tessera-learn 0.2.3 → 0.3.0

package/src/runtime/adapters/index.ts

@@ -1,23 +1,25 @@
 import type { CourseConfig } from '../types.js';
+import type { Manifest } from '../../plugin/manifest.js';
 import type { PersistenceAdapter } from '../persistence.js';
 import { WebAdapter } from './web.js';
 import { SCORM12Adapter } from './scorm12.js';
 import { SCORM2004Adapter } from './scorm2004.js';
 import { CMI5Adapter } from './cmi5.js';
+import { XAPIAdapter } from './xapi.js';
 import {
   findSCORM12API,
   findSCORM2004API,
   hasCMI5LaunchParams,
+  hasXAPILaunchParams,
 } from './discovery.js';
+import {
+  LMSAdapterError,
+  lmsWarnLabel,
+  missingApiError,
+  type LMSStandard,
+} from './lms-error.js';
 
-export class LMSAdapterError extends Error {
-  standard: 'scorm12' | 'scorm2004' | 'cmi5';
-  constructor(standard: 'scorm12' | 'scorm2004' | 'cmi5', message: string) {
-    super(message);
-    this.name = 'LMSAdapterError';
-    this.standard = standard;
-  }
-}
+export { LMSAdapterError, missingApiError };
 
 export interface CreateAdapterOptions {
   /**
@@ -26,59 +28,24 @@ export interface CreateAdapterOptions {
    * so dev builds stay forgiving and production builds fail loud.
    */
   allowFallback?: boolean;
+  /** Course manifest — lets the WebAdapter fingerprint its page structure into the storage key. */
+  manifest?: Manifest;
 }
 
-type LMSStandard = 'scorm12' | 'scorm2004' | 'cmi5';
-
-/** Per-standard LMS wiring: `detect` returns an adapter when the LMS runtime is reachable, else null. Labels are the single source for the dev warning and production error. */
-const LMS_ADAPTERS: Record<
-  LMSStandard,
-  {
-    detect: () => PersistenceAdapter | null;
-    warnLabel: string;
-    name: string;
-    missingDetail: string;
-  }
-> = {
-  scorm12: {
-    detect: () => {
-      const api = findSCORM12API();
-      return api ? new SCORM12Adapter(api) : null;
-    },
-    warnLabel: 'SCORM 1.2 API',
-    name: 'SCORM 1.2',
-    missingDetail:
-      'No SCORM 1.2 API object found in the window.parent or window.opener chain.',
-  },
-  scorm2004: {
-    detect: () => {
-      const api = findSCORM2004API();
-      return api ? new SCORM2004Adapter(api) : null;
-    },
-    warnLabel: 'SCORM 2004 API',
-    name: 'SCORM 2004',
-    missingDetail:
-      'No SCORM 2004 API object found in the window.parent or window.opener chain.',
+/** Per-standard LMS wiring: `detect` returns an adapter when the LMS runtime is reachable, else null. Labels and the fail-loud error live in `./lms-error.js`. */
+const LMS_ADAPTERS: Record<LMSStandard, () => PersistenceAdapter | null> = {
+  scorm12: () => {
+    const api = findSCORM12API();
+    return api ? new SCORM12Adapter(api) : null;
   },
-  cmi5: {
-    detect: () => (hasCMI5LaunchParams() ? new CMI5Adapter() : null),
-    warnLabel: 'cmi5 launch parameters',
-    name: 'cmi5',
-    missingDetail:
-      'No cmi5 launch parameters (fetch / endpoint / activityId / actor) on the URL.',
+  scorm2004: () => {
+    const api = findSCORM2004API();
+    return api ? new SCORM2004Adapter(api) : null;
   },
+  cmi5: () => (hasCMI5LaunchParams() ? new CMI5Adapter() : null),
+  xapi: () => (hasXAPILaunchParams() ? new XAPIAdapter() : null),
 };
 
-function missingApiError(standard: LMSStandard): LMSAdapterError {
-  const { name, missingDetail } = LMS_ADAPTERS[standard];
-  return new LMSAdapterError(
-    standard,
-    `Tessera: this course is configured for ${name} but ${missingDetail} ` +
-      `The course must be launched from an LMS that provides the ${name} runtime. ` +
-      `If you are testing locally, run \`npm run dev\` instead, or set export.standard to "web".`,
-  );
-}
-
 /**
  * Select the appropriate persistence adapter based on course config.
  *
@@ -99,15 +66,15 @@ export function createAdapter(
   if (
     standard === 'scorm12' ||
     standard === 'scorm2004' ||
-    standard === 'cmi5'
+    standard === 'cmi5' ||
+    standard === 'xapi'
   ) {
-    const entry = LMS_ADAPTERS[standard];
-    const adapter = entry.detect();
+    const adapter = LMS_ADAPTERS[standard]();
     if (adapter) return adapter;
     if (!allowFallback) throw missingApiError(standard);
     console.warn(
-      `Tessera (dev): ${entry.warnLabel} not found — falling back to localStorage`,
+      `Tessera (dev): ${lmsWarnLabel(standard)} not found — falling back to localStorage`,
     );
   }
-  return new WebAdapter(config);
+  return new WebAdapter(config, options.manifest);
 }

package/src/runtime/adapters/lms-error.ts

@@ -0,0 +1,61 @@
+/**
+ * Per-standard LMS labels and the missing-API error, kept free of any adapter
+ * imports so both the runtime selector (`createAdapter`) and the build-time
+ * generated single-adapter modules can share one source of truth without
+ * pulling every adapter into a production bundle.
+ */
+
+export type LMSStandard = 'scorm12' | 'scorm2004' | 'cmi5' | 'xapi';
+
+export class LMSAdapterError extends Error {
+  standard: LMSStandard;
+  constructor(standard: LMSStandard, message: string) {
+    super(message);
+    this.name = 'LMSAdapterError';
+    this.standard = standard;
+  }
+}
+
+const STANDARD_INFO: Record<
+  LMSStandard,
+  { name: string; warnLabel: string; missingDetail: string }
+> = {
+  scorm12: {
+    name: 'SCORM 1.2',
+    warnLabel: 'SCORM 1.2 API',
+    missingDetail:
+      'No SCORM 1.2 API object found in the window.parent or window.opener chain.',
+  },
+  scorm2004: {
+    name: 'SCORM 2004',
+    warnLabel: 'SCORM 2004 API',
+    missingDetail:
+      'No SCORM 2004 API object found in the window.parent or window.opener chain.',
+  },
+  cmi5: {
+    name: 'cmi5',
+    warnLabel: 'cmi5 launch parameters',
+    missingDetail:
+      'No cmi5 launch parameters (fetch / endpoint / activityId / actor) on the URL.',
+  },
+  xapi: {
+    name: 'xAPI 1.0.3',
+    warnLabel: 'xAPI launch parameters',
+    missingDetail:
+      'No xAPI launch parameters (endpoint / auth / actor / activity_id) on the URL.',
+  },
+};
+
+export function lmsWarnLabel(standard: LMSStandard): string {
+  return STANDARD_INFO[standard].warnLabel;
+}
+
+export function missingApiError(standard: LMSStandard): LMSAdapterError {
+  const { name, missingDetail } = STANDARD_INFO[standard];
+  return new LMSAdapterError(
+    standard,
+    `Tessera: this course is configured for ${name} but ${missingDetail} ` +
+      `The course must be launched from an LMS that provides the ${name} runtime. ` +
+      `If you are testing locally, run \`npm run dev\` instead, or set export.standard to "web".`,
+  );
+}

package/src/runtime/adapters/scorm2004.ts

@@ -1,4 +1,5 @@
 import { SCORM2004_INTERACTION_FORMAT } from '../interaction-format.js';
+import type { Interaction } from '../interaction.js';
 import type { SavedState } from '../persistence.js';
 import { BaseScormAdapter, type ScormDialect } from './scorm-base.js';
 import {
@@ -113,7 +114,7 @@ export class SCORM2004Adapter extends BaseScormAdapter<SCORM2004API> {
 
   reportInteraction(
     questionId: string,
-    interaction: import('../interaction.js').Interaction,
+    interaction: Interaction,
     correct: boolean | null,
   ): void {
     if (!this.#canWrite) return;

package/src/runtime/adapters/web.ts

@@ -1,7 +1,21 @@
 import type { PersistenceAdapter, SavedState } from '../persistence.js';
 import type { CourseConfig } from '../types.js';
+import { courseIdentity } from '../types.js';
 import type { Interaction } from '../interaction.js';
-import { slugify } from '../slugify.js';
+import type { Manifest } from '../../plugin/manifest.js';
+
+// FNV-1a over the ordered page slugs. SavedState is keyed by page index, so a
+// structure change must change the key — else stale state restores onto the
+// wrong pages. Slugs can't contain a NUL, so it's a collision-proof delimiter.
+function structureFingerprint(manifest: Manifest): string {
+  const slugs = manifest.pages.map((p) => p.slug).join('\0');
+  let h = 0x811c9dc5;
+  for (let i = 0; i < slugs.length; i++) {
+    h ^= slugs.charCodeAt(i);
+    h = Math.imul(h, 0x01000193);
+  }
+  return (h >>> 0).toString(36);
+}
 
 /**
  * Web persistence adapter — stores course state in localStorage.
@@ -11,9 +25,10 @@ export class WebAdapter implements PersistenceAdapter {
   #storageKey: string;
   #state: SavedState | null = null;
 
-  constructor(config: CourseConfig) {
-    const courseId = slugify(config.title || '') || 'tessera-course';
-    this.#storageKey = `tessera-${courseId}`;
+  constructor(config: CourseConfig, manifest?: Manifest) {
+    const base = courseIdentity(config) || 'tessera-course';
+    const fp = manifest ? structureFingerprint(manifest) : '';
+    this.#storageKey = `tessera-${base}${fp ? `-${fp}` : ''}`;
   }
 
   async init(): Promise<void> {

package/src/runtime/adapters/xapi-launch-base.ts

@@ -0,0 +1,346 @@
+import type { PersistenceAdapter, SavedState } from '../persistence.js';
+import type { Interaction } from '../interaction.js';
+import {
+  formatResponse,
+  formatCorrectPattern,
+  XAPI_INTERACTION_FORMAT,
+} from '../interaction-format.js';
+import { formatISO8601Duration } from './format.js';
+import { XAPIPublisher } from '../xapi/publisher.js';
+import type { XAPIAgent, PartialStatement } from '../xapi/types.js';
+
+export const VERBS = {
+  initialized: 'http://adlnet.gov/expapi/verbs/initialized',
+  answered: 'http://adlnet.gov/expapi/verbs/answered',
+  completed: 'http://adlnet.gov/expapi/verbs/completed',
+  passed: 'http://adlnet.gov/expapi/verbs/passed',
+  failed: 'http://adlnet.gov/expapi/verbs/failed',
+  terminated: 'http://adlnet.gov/expapi/verbs/terminated',
+} as const;
+
+const CMI_INTERACTION_TYPE =
+  'http://adlnet.gov/expapi/activities/cmi.interaction';
+
+/**
+ * Version-neutral xAPI launch lifecycle shared by the cmi5 and plain-xAPI
+ * adapters. Subclasses set the protected fields in init() and may override
+ * buildContext()/isDefinedStatementAllowed()/scoreForSuccess() to layer
+ * profile rules on top.
+ */
+export abstract class BaseXAPILaunchAdapter implements PersistenceAdapter {
+  protected publisher: XAPIPublisher | null = null;
+  protected endpoint = '';
+  protected activityId = '';
+  protected actor: XAPIAgent | null = null;
+  protected registration: string | undefined;
+  protected authToken = '';
+  protected version = '1.0.3';
+  /** Prefix for this adapter's console warnings (e.g. "cmi5", "xAPI"). */
+  protected logName = 'xAPI';
+
+  protected score: number | null = null;
+  protected durationSeconds = 0;
+  protected state: SavedState | null = null;
+  protected completedEmitted = false;
+  protected lastSuccessEmitted: 'unknown' | 'passed' | 'failed' = 'unknown';
+  protected terminated = false;
+  protected returnURL: string | undefined;
+
+  abstract init(): Promise<void>;
+
+  /** Profile context for a Defined Statement. Plain xAPI adds nothing — the publisher injects context.registration on its own. */
+  protected buildContext(
+    _opts: { moveOn?: boolean; mastery?: boolean } = {},
+  ): Record<string, unknown> | undefined {
+    return undefined;
+  }
+
+  /** cmi5 Browse/Review gating hook. Plain xAPI always allows. */
+  protected isDefinedStatementAllowed(): boolean {
+    return true;
+  }
+
+  /** Scaled score to attach to Passed/Failed, or null to omit. cmi5 overrides for masteryScore gating. */
+  protected scoreForSuccess(_status: 'passed' | 'failed'): number | null {
+    return this.score !== null ? this.score / 100 : null;
+  }
+
+  getPublisher(): XAPIPublisher | null {
+    return this.publisher;
+  }
+
+  getState(): SavedState | null {
+    return this.state;
+  }
+
+  saveState(state: SavedState): void {
+    this.state = state;
+    if (!this.publisher) return;
+    void this.publisher.chainTask(async () => {
+      try {
+        const resp = await this.xapiFetch(this.buildStateUrl(), {
+          method: 'PUT',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(state),
+        });
+        if (!resp.ok) {
+          console.warn(
+            `Tessera ${this.logName}: State API PUT returned ${resp.status}; learner progress did not persist.`,
+          );
+        }
+      } catch (err) {
+        console.warn(`Tessera ${this.logName}: Failed to save state`, err);
+      }
+    });
+  }
+
+  setScore(score: number): void {
+    if (!Number.isFinite(score)) {
+      this.score = null;
+      return;
+    }
+    this.score = Math.max(0, Math.min(100, score));
+  }
+
+  setDuration(seconds: number): void {
+    this.durationSeconds = seconds;
+  }
+
+  setExit(_mode: 'suspend' | 'normal'): void {
+    // No cmi.exit analogue in xAPI; suspend is implicit. No-op.
+  }
+
+  commit(): void {
+    // Statements are sent individually. No-op.
+  }
+
+  seedLifecycle(
+    completion: 'incomplete' | 'complete',
+    success: 'unknown' | 'passed' | 'failed',
+  ): void {
+    if (completion === 'complete') this.completedEmitted = true;
+    if (success === 'passed' || success === 'failed') {
+      this.lastSuccessEmitted = success;
+    }
+  }
+
+  setCompletionStatus(status: 'incomplete' | 'complete'): void {
+    if (status !== 'complete' || this.completedEmitted || !this.publisher)
+      return;
+    if (!this.isDefinedStatementAllowed()) return;
+    this.completedEmitted = true;
+    const result: Record<string, unknown> = {
+      completion: true,
+      duration: formatISO8601Duration(this.durationSeconds),
+    };
+    this.dispatch('Completed', {
+      verb: { id: VERBS.completed, display: { 'en-US': 'completed' } },
+      result,
+      context: this.buildContext({ moveOn: true }),
+    });
+  }
+
+  setSuccessStatus(status: 'passed' | 'failed' | 'unknown'): void {
+    if (status === 'unknown' || !this.publisher) return;
+    if (status === this.lastSuccessEmitted) return;
+    if (!this.isDefinedStatementAllowed()) return;
+    this.lastSuccessEmitted = status;
+
+    const verb = status === 'passed' ? VERBS.passed : VERBS.failed;
+    const verbName = status === 'passed' ? 'passed' : 'failed';
+    const result: Record<string, unknown> = {
+      success: status === 'passed',
+      duration: formatISO8601Duration(this.durationSeconds),
+    };
+    const scaled = this.scoreForSuccess(status);
+    if (scaled !== null) result.score = { scaled };
+    this.dispatch(status === 'passed' ? 'Passed' : 'Failed', {
+      verb: { id: verb, display: { 'en-US': verbName } },
+      result,
+      context: this.buildContext({ moveOn: true, mastery: true }),
+    });
+  }
+
+  reportInteraction(
+    questionId: string,
+    interaction: Interaction,
+    correct: boolean | null,
+  ): void {
+    if (!this.publisher) return;
+    const response = formatResponse(interaction, XAPI_INTERACTION_FORMAT);
+    const pattern = formatCorrectPattern(interaction, XAPI_INTERACTION_FORMAT);
+    const definition: Record<string, unknown> = {
+      type: CMI_INTERACTION_TYPE,
+      interactionType: interaction.type,
+    };
+    if (pattern !== null) {
+      definition.correctResponsesPattern = [pattern];
+    }
+    const result: Record<string, unknown> = { response };
+    if (correct !== null) {
+      result.success = correct;
+    }
+    this.dispatch('Answered', {
+      verb: { id: VERBS.answered, display: { 'en-US': 'answered' } },
+      object: {
+        id: `${this.activityId}#${questionId}`,
+        objectType: 'Activity',
+        definition,
+      },
+      result,
+    });
+  }
+
+  terminate(): void {
+    if (this.terminated) return;
+    this.terminated = true;
+    if (!this.publisher) return;
+    this.publisher.markUnloading();
+    const duration = formatISO8601Duration(this.durationSeconds);
+    this.dispatch('Terminated', {
+      verb: { id: VERBS.terminated, display: { 'en-US': 'terminated' } },
+      result: { duration },
+      context: this.buildContext(),
+    });
+  }
+
+  async exit(): Promise<void> {
+    this.terminate();
+    if (this.publisher) {
+      try {
+        await this.publisher.chainTask(async () => {});
+      } catch {
+        // never rejects today; don't block redirect.
+      }
+    }
+    if (this.returnURL && typeof window !== 'undefined') {
+      window.location.assign(this.returnURL);
+    }
+  }
+
+  /** Parse the launch `actor` param into an Identified Agent, failing loud on malformed JSON. */
+  protected parseActorParam(raw: string): void {
+    try {
+      const parsed = JSON.parse(raw);
+      if (!parsed || typeof parsed !== 'object') {
+        throw new Error('actor must be an object');
+      }
+      this.actor = parsed as XAPIAgent;
+    } catch (err) {
+      throw new Error(
+        `Tessera ${this.logName}: launch parameter 'actor' is malformed (${err instanceof Error ? err.message : String(err)}). The LMS did not send a valid Identified Agent JSON.`,
+        { cause: err },
+      );
+    }
+  }
+
+  /** Construct the publisher from the resolved launch fields plus per-profile options. */
+  protected createPublisher(opts: {
+    sessionId?: string;
+    cmi5Mode?: boolean;
+  }): XAPIPublisher {
+    if (!this.actor) {
+      throw new Error(
+        `Tessera ${this.logName}: cannot create publisher before the launch actor is resolved.`,
+      );
+    }
+    this.publisher = new XAPIPublisher({
+      endpoint: this.endpoint,
+      auth: this.authToken,
+      actor: this.actor,
+      activityId: this.activityId,
+      registration: this.registration,
+      version: this.version,
+      ...opts,
+    });
+    return this.publisher;
+  }
+
+  /** Fire-and-forget Initialized statement (the first Defined Statement of the session). */
+  protected sendInitialized(): void {
+    this.dispatch('Initialized', {
+      verb: { id: VERBS.initialized, display: { 'en-US': 'initialized' } },
+      context: this.buildContext(),
+    });
+  }
+
+  /** Enqueue a lifecycle statement fire-and-forget. `label` names it in both the LRS-reject and send-failure warnings. */
+  protected dispatch(label: string, partial: PartialStatement): void {
+    if (!this.publisher) return;
+    this.publisher
+      .sendStatement(partial)
+      .then(this.warnOnLRSReject(label))
+      .catch((err) => {
+        console.warn(
+          `Tessera ${this.logName}: failed to send ${label} statement`,
+          err,
+        );
+      });
+  }
+
+  /** `.then` handler that warns on LRS non-2xx. The publisher resolves successfully on 4xx/5xx (failure is in the destination outcome), so `.catch` alone misses them. */
+  protected warnOnLRSReject(
+    label: string,
+  ): (res: {
+    destinations?: Array<{ ok?: boolean; status?: number; error?: Error }>;
+  }) => void {
+    const logName = this.logName;
+    return (res) => {
+      const dest = res.destinations?.[0];
+      if (dest && !dest.ok) {
+        console.warn(
+          `Tessera ${logName}: ${label} statement rejected by LRS (${dest.status ?? 'network error'})`,
+          dest.error,
+        );
+      }
+    };
+  }
+
+  protected buildStateUrl(stateId: string = 'tessera-state'): string {
+    const params = new URLSearchParams({
+      activityId: this.activityId,
+      agent: JSON.stringify(this.actor),
+      stateId,
+    });
+    if (this.registration) params.set('registration', this.registration);
+    return `${this.endpoint}activities/state?${params.toString()}`;
+  }
+
+  protected async xapiFetch(
+    url: string,
+    options: RequestInit = {},
+  ): Promise<Response> {
+    const headers = new Headers(options.headers);
+    if (this.authToken) {
+      headers.set('Authorization', `Basic ${this.authToken}`);
+    }
+    headers.set('X-Experience-API-Version', this.version);
+    const keepalive = this.publisher?.isUnloading() ?? false;
+    return fetch(url, {
+      ...options,
+      headers,
+      ...(keepalive ? { keepalive: true } : {}),
+    });
+  }
+
+  /** Shared resume GET — call from a subclass init() after the publisher exists. */
+  protected async loadResumeState(): Promise<void> {
+    try {
+      const resp = await this.xapiFetch(this.buildStateUrl(), {
+        method: 'GET',
+      });
+      if (resp.ok) {
+        this.state = await resp.json();
+      } else if (resp.status !== 404) {
+        console.warn(
+          `Tessera ${this.logName}: State API GET returned ${resp.status}; resume disabled for this launch.`,
+        );
+      }
+    } catch (err) {
+      console.warn(
+        `Tessera ${this.logName}: State API GET failed (${err instanceof Error ? err.message : String(err)}); resume disabled for this launch.`,
+      );
+      this.state = null;
+    }
+  }
+}

package/src/runtime/adapters/xapi.ts

@@ -0,0 +1,26 @@
+import { BaseXAPILaunchAdapter } from './xapi-launch-base.js';
+
+/**
+ * Plain xAPI ("Tin Can") launch adapter. Reads launch params straight off the
+ * URL — no cmi5 fetch-token, no LMS.LaunchData, no cmi5 context.
+ */
+export class XAPIAdapter extends BaseXAPILaunchAdapter {
+  async init(): Promise<void> {
+    const params = new URLSearchParams(window.location.search);
+    this.endpoint = (params.get('endpoint') || '').replace(/\/?$/, '/');
+    // Tin Can uses snake_case `activity_id` (NOT cmi5's camelCase `activityId`).
+    this.activityId = params.get('activity_id') || '';
+    const reg = params.get('registration') || '';
+    this.registration = reg ? reg : undefined;
+    // Tin Can launch passes `auth` as the full "Basic <base64>" header value;
+    // strip the scheme so we don't double-prefix it when sending.
+    this.authToken = (params.get('auth') || '').replace(/^Basic\s+/i, '');
+    this.parseActorParam(params.get('actor') || '');
+
+    const publisher = this.createPublisher({});
+    await publisher.init();
+
+    this.sendInitialized();
+    await this.loadResumeState();
+  }
+}

package/src/runtime/types.ts

@@ -9,6 +9,15 @@ import type { XAPIAgent } from './xapi/types.js';
 export const FEEDBACK_MODES = ['review', 'immediate', 'never'] as const;
 export const RETRY_MODES = ['full', 'incorrect-only'] as const;
 
+/**
+ * Trimmed course identity, or '' when absent. Single source of truth for the
+ * "is there a usable id?" check shared by the web storage key, the cmi5/xAPI
+ * id derivation, and the config validator.
+ */
+export function courseIdentity(config: { id?: unknown }): string {
+  return (typeof config.id === 'string' && config.id.trim()) || '';
+}
+
 /**
  * Per-page quiz configuration. Single source of truth — the build plugin
  * extracts this from `pageConfig.quiz` and embeds it in the manifest;
@@ -24,6 +33,10 @@ export interface QuizConfig {
 
 export interface CourseConfig {
   title: string;
+  /** Stable, unique course identity (e.g. 'urn:uuid:…'). Seeds the web
+   * localStorage key and the cmi5/xAPI LRS activity id; scaffolders generate one.
+   * Absent → both fall back to a fixed value, colliding across courses. */
+  id?: string;
   description?: string;
   author?: string;
   version?: string;
@@ -46,7 +59,12 @@ export interface CourseConfig {
     passingScore: number;
   };
   export: {
-    standard: 'web' | 'scorm12' | 'scorm2004' | 'cmi5';
+    standard: 'web' | 'scorm12' | 'scorm2004' | 'cmi5' | 'xapi';
+    /** Web export only: extend the baseline Content-Security-Policy. Each key is
+     * a directive; its sources are appended (unioned) onto the baseline. `false`
+     * drops the CSP meta entirely (for deployments that set a CSP header).
+     * Ignored unless `standard` is 'web'. */
+    csp?: false | Record<string, string[]>;
   };
   /**
    * Optional xAPI destination(s) for custom statement publishing via

package/src/runtime/xapi/publisher.ts

@@ -46,6 +46,8 @@ export interface XAPIPublisherOptions {
    * Set by the cmi5 adapter and by 'lms'-inherited destinations under cmi5.
    */
   cmi5Mode?: boolean;
+  /** xAPI version for the X-Experience-API-Version header. Defaults to X_API_VERSION (1.0.3). */
+  version?: string;
   /** When set, every send method rejects with the returned Error without hitting the network. */
   unavailableReason?: () => Error;
 }
@@ -94,6 +96,7 @@ export class XAPIPublisher {
   readonly #registration?: string;
   readonly #sessionId: string;
   readonly #cmi5Mode: boolean;
+  readonly #version: string;
 
   // When set, every send method short-circuits with a rejected promise.
   readonly #unavailableReason: (() => Error) | null;
@@ -138,6 +141,7 @@ export class XAPIPublisher {
     this.#activityId = opts.activityId;
     this.#registration = opts.registration;
     this.#cmi5Mode = !!opts.cmi5Mode;
+    this.#version = opts.version ?? X_API_VERSION;
     this.#authValue = opts.auth;
     this.#actorValue = opts.actor;
     this.#sessionId = opts.sessionId ?? uuidv4();
@@ -485,7 +489,7 @@ export class XAPIPublisher {
   #buildHeaders(token: string): Headers {
     const headers = new Headers();
     if (token) headers.set('Authorization', `Basic ${token}`);
-    headers.set('X-Experience-API-Version', X_API_VERSION);
+    headers.set('X-Experience-API-Version', this.#version);
     headers.set('Content-Type', 'application/json');
     return headers;
   }