@aipt/idp-deploy 0.1.2

package/src/config.mjs

@@ -0,0 +1,903 @@
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { IdpError, invariant } from './errors.mjs';
+import {
+  assertDisjointRoots,
+  assertMode,
+  assertOutsideRepositories,
+  assertSafeDirectory,
+  assertSafeRegularFile,
+  atomicWrite,
+  canonicalPlannedDirectory,
+  canonicalExisting,
+  createExclusiveFile,
+  parseEnv,
+  resolveContained,
+} from './security.mjs';
+import { hashFile, sha256, stableJson } from './hash.mjs';
+import { readImageLock, REQUIRED_IMAGE_PLATFORMS } from './image-lock.mjs';
+import { resolveProfile } from './profiles.mjs';
+import { validateBenchSnapshot, validateDyytoSnapshot } from './source-contracts.mjs';
+
+export const COMPONENTS = ['tech', 'dyyto', 'bench', 'forge', 'flow', 'portal', 'smartgo'];
+
+function rootEnv() {
+  const processUid = typeof process.getuid === 'function' ? process.getuid() : 1000;
+  const processGid = typeof process.getgid === 'function' ? process.getgid() : 1000;
+  const uid = processUid > 0 ? processUid : 1000;
+  const gid = processGid > 0 ? processGid : 1000;
+  const runtimePlatform = os.arch() === 'arm64' ? 'linux/arm64' : 'linux/amd64';
+  return `# IDP宿主机非敏感配置；Secret只能通过*_FILE引用。
+IDP_CONFIG_SCHEMA_VERSION=1
+IDP_INSTANCE_ID=company-idp-mac-01
+IDP_ENVIRONMENT=private
+IDP_DATA_DIR=/Users/Shared/company/idp/data
+IDP_BACKUP_DIR=/Users/Shared/company/idp/backups
+IDP_LOG_DIR=/Users/Shared/company/idp/logs
+IDP_RUNTIME_DIR=/Users/Shared/company/idp/runtime
+IDP_RESTORE_DIR=/Users/Shared/company/idp/restore
+IDP_CONTAINER_UID=${uid}
+IDP_CONTAINER_GID=${gid}
+IDP_RUNTIME_PLATFORM=${runtimePlatform}
+IDP_HTTP_ENABLED=true
+IDP_HTTP_BIND=127.0.0.1
+IDP_HTTP_PORT=8080
+IDP_SMARTGO_GOTOLOGY_PORT=13000
+IDP_SMARTGO_OPERATIONS_PORT=13101
+IDP_SMARTGO_STUDIO_PORT=13002
+IDP_TLS_ENABLED=false
+IDP_HTTPS_BIND=127.0.0.1
+IDP_HTTPS_PORT=8443
+IDP_PUBLIC_HOST=127.0.0.1
+IDP_NETWORK_POLICY_MODE=loopback-only
+IDP_ALLOWED_CIDR=127.0.0.0/8
+IDP_HOST_FIREWALL_EVIDENCE_FILE=trust/host-firewall-policy.txt
+IDP_REGISTRY_BIND=127.0.0.1
+IDP_REGISTRY_PORT=4873
+IDP_REGISTRY_PRIVATE_SCOPES=@aipt,@bench
+IDP_OCI_REPOSITORY_ROOT=UNCONFIGURED
+IDP_OCI_LAYOUT_ORAS_FALLBACK_ENABLED=false
+IDP_OCI_LAYOUT_BUILDER=UNCONFIGURED
+IDP_ORAS_BINARY_PATH=tools/oras/oras
+IDP_ORAS_VERSION=UNCONFIGURED
+IDP_ORAS_SHA256=UNCONFIGURED
+IDP_ALLOW_NON_GIT_SMARTGO_SOURCE=true
+IDP_IDENTITY_MODE=anonymous-private
+IDP_OIDC_ENABLED=false
+IDP_OIDC_ISSUER=
+IDP_OIDC_CLIENT_ID=
+IDP_OIDC_GROUP_CLAIM=groups
+IDP_OIDC_GROUP_MAPPING_FILE=bindings/identity/group-mapping.json
+IDP_OIDC_CLIENT_SECRET_FILE=secrets/infrastructure/identity/oidc-client-secret
+IDP_TLS_CERT_FILE=certs/tls-certificate.pem
+IDP_TLS_KEY_FILE=secrets/infrastructure/edge/tls-private-key.pem
+IDP_POSTGRES_SUPERUSER_PASSWORD_FILE=secrets/infrastructure/postgresql/superuser-password
+IDP_POSTGRES_TECH_PASSWORD_FILE=secrets/infrastructure/postgresql/tech-password
+IDP_POSTGRES_PORTAL_PASSWORD_FILE=secrets/infrastructure/postgresql/portal-password
+IDP_POSTGRES_SMARTGO_PASSWORD_FILE=components/smartgo/secrets/postgresql-password
+IDP_REGISTRY_HTPASSWD_FILE=secrets/infrastructure/registry/htpasswd
+IDP_REGISTRY_ACCEPTANCE_NPMRC_FILE=secrets/infrastructure/registry/acceptance-npmrc
+IDP_POSTGRES_IMAGE=UNCONFIGURED
+IDP_CADDY_IMAGE=UNCONFIGURED
+IDP_REGISTRY_IMAGE=UNCONFIGURED
+IDP_TECH_IMAGE=UNCONFIGURED
+IDP_PORTAL_IMAGE=UNCONFIGURED
+IDP_FLOW_IMAGE=UNCONFIGURED
+IDP_SMARTGO_IMAGE=UNCONFIGURED
+IDP_SMARTGO_OBJECT_STORE_IMAGE=UNCONFIGURED
+IDP_SMARTGO_OBJECT_STORE_CLIENT_IMAGE=UNCONFIGURED
+`;
+}
+
+const COMPONENT_ENVS = {
+  tech: `# Tech知识控制面；Secret路径均相对本组件Config Dir。\nTECH_DATABASE_URL_FILE=secrets/database-url\nTECH_OPERATOR_TOKEN_FILE=secrets/operator-token\nTECH_SOURCE_CREDENTIALS_MANIFEST_FILE=config/source-credentials.json\nTECH_AUTH_MODE=anonymous-private\nTECH_BIND_HOST=0.0.0.0\nTECH_PORT=3698\nTECH_OPERATOR_LOOPBACK_ONLY=false\nTECH_EMBEDDING_ENABLED=false\nOPENAI_BASE_URL_FILE=secrets/openai-base-url\nOPENAI_API_KEY_FILE=secrets/openai-api-key\nOPENAI_EMBED_MODEL=text-embedding-3-small\nTECH_OBJECT_STORAGE_MODE=none\nTECH_POLICY_REVISION=policy-v1\n`,
+  dyyto: `DYYTO_NPMRC_FILE=secrets/npmrc\nDYYTO_PACKAGE_CATALOG_DIRS_FILE=catalog/package-catalog-dirs\n`,
+  bench: `# Bench 直接消费IDP_CONFIG_DIR/bindings并将确定性投影写入IDP_CONFIG_DIR/snapshots。\nBENCH_NPMRC_FILE=secrets/npmrc\n`,
+  forge: `FORGE_NPMRC_FILE=secrets/npmrc\n`,
+  flow: `FLOW_MODE=snapshot\nFLOW_BIND_HOST=0.0.0.0\nFLOW_PORT=3710\nFLOW_HTTP_TIMEOUT_MS=5000\nFLOW_WRITE_MODE=disabled\nFLOW_OPERATOR_TOKEN_FILE=secrets/operator-token\nFLOW_TECH_REQUIRED=true\nFLOW_TECH_URL=http://tech:3698\nFLOW_TECH_CONTEXT_FILE=snapshots/tech-context-bundle.json\nFLOW_DYYTO_CATALOG_FILE=snapshots/dyyto-package-release-catalog.json\nFLOW_BENCH_SNAPSHOT_FILE=snapshots/bench-environment-snapshot.json\nFLOW_PROPOSAL_URL=\n`,
+  portal: `PORTAL_PUBLIC_URL=http://127.0.0.1:8080\nPORTAL_DATABASE_URL_FILE=secrets/database-url\nPORTAL_TECH_URL=http://tech:3698\nPORTAL_FLOW_URL=http://flow:3710\nPORTAL_DYYTO_CATALOG_FILE=snapshots/dyyto-package-release-catalog.json\nPORTAL_BENCH_SNAPSHOT_FILE=snapshots/bench-environment-snapshot.json\nPORTAL_DEVELOPER_WORKSPACE_FILE=config/developer-workspace.json\nPORTAL_FOUNDATION_DIRECTORY_FILE=snapshots/foundation-directory.json\nPORTAL_FOUNDATION_PROBE_TIMEOUT_MS=1500\nPORTAL_UPSTREAM_TIMEOUT_MS=1500\nPORTAL_FIXTURE_FALLBACK=false\n`,
+  smartgo: `# SmartGo受管业务Profile；Secret只能使用相对此组件目录的*_FILE引用。
+NODE_ENV=development
+SMARTGO_DEPLOYMENT_MODE=idp-managed
+SMARTGO_AUTH_MODE=local-open
+SMARTGO_BIND_HOST=127.0.0.1
+SMARTGO_STUDIO_STATE_MODE=ephemeral-fixture
+SMARTGO_STUDIO_DATA_DIRECTORY=/run/smartgo/studio
+MEDIA_ASSET_REPOSITORY=minio
+GOTOLOGY_PUBLIC_URL=http://127.0.0.1:13000/
+OPERATIONS_PUBLIC_URL=http://127.0.0.1:13101/
+STUDIO_PUBLIC_URL=http://127.0.0.1:13002/
+SMARTGO_ARTIFACT_STORE_PROVIDER=s3
+SMARTGO_MINIO_BUCKET=smartgo-artifacts
+SMARTGO_MINIO_INTERNAL_ENDPOINT=http://smartgo-object-store:9000
+SMARTGO_MINIO_PUBLIC_ENDPOINT=http://127.0.0.1:8080
+SIGNED_OBJECT_URL_TTL_SECONDS=900
+
+DATABASE_URL_FILE=secrets/database-url
+DIRECT_DATABASE_URL_FILE=secrets/direct-database-url
+SMARTGO_OPERATOR_TOKEN_FILE=secrets/operator-token
+PLATFORM_IDENTITY_SERVICE_TOKEN_FILE=secrets/platform-identity-service-token
+PLATFORM_IDENTITY_ACTIVATION_TOKEN_FILE=secrets/platform-identity-activation-token
+PLATFORM_IDENTITY_CLIENT_SECRET_FILE=secrets/platform-identity-client-secret
+ARTIFACT_RENDERER_CALLBACK_TOKEN_FILE=secrets/artifact-renderer-callback-token
+ALIYUN_OSS_ACCESS_KEY_ID_FILE=secrets/aliyun-oss-access-key-id
+ALIYUN_OSS_ACCESS_KEY_SECRET_FILE=secrets/aliyun-oss-access-key-secret
+ARTIFACT_DELIVERY_S3_ACCESS_KEY_ID_FILE=secrets/artifact-delivery-s3-access-key-id
+ARTIFACT_DELIVERY_S3_ACCESS_KEY_SECRET_FILE=secrets/artifact-delivery-s3-access-key-secret
+WORKER_ARTIFACT_S3_ACCESS_KEY_ID_FILE=secrets/worker-artifact-s3-access-key-id
+WORKER_ARTIFACT_S3_ACCESS_KEY_SECRET_FILE=secrets/worker-artifact-s3-access-key-secret
+SMARTGO_MINIO_ROOT_USER_FILE=secrets/minio-root-user
+SMARTGO_MINIO_ROOT_PASSWORD_FILE=secrets/minio-root-password
+SMARTGO_NPMRC_FILE=secrets/npmrc
+`,
+};
+
+const REFERENCE_KEYS_BY_SCOPE = Object.freeze({
+  root: ['IDP_HOST_FIREWALL_EVIDENCE_FILE', 'IDP_TLS_CERT_FILE', 'IDP_TLS_KEY_FILE', 'IDP_POSTGRES_SUPERUSER_PASSWORD_FILE', 'IDP_POSTGRES_TECH_PASSWORD_FILE', 'IDP_POSTGRES_PORTAL_PASSWORD_FILE', 'IDP_POSTGRES_SMARTGO_PASSWORD_FILE', 'IDP_REGISTRY_HTPASSWD_FILE', 'IDP_REGISTRY_ACCEPTANCE_NPMRC_FILE', 'IDP_OIDC_CLIENT_SECRET_FILE', 'IDP_OIDC_GROUP_MAPPING_FILE'],
+  tech: ['TECH_DATABASE_URL_FILE', 'TECH_OPERATOR_TOKEN_FILE', 'TECH_SOURCE_CREDENTIALS_MANIFEST_FILE', 'OPENAI_BASE_URL_FILE', 'OPENAI_API_KEY_FILE'],
+  dyyto: ['DYYTO_NPMRC_FILE', 'DYYTO_PACKAGE_CATALOG_DIRS_FILE'],
+  bench: ['BENCH_NPMRC_FILE'],
+  forge: ['FORGE_NPMRC_FILE'],
+  flow: ['FLOW_OPERATOR_TOKEN_FILE', 'FLOW_TECH_CONTEXT_FILE', 'FLOW_DYYTO_CATALOG_FILE', 'FLOW_BENCH_SNAPSHOT_FILE'],
+  portal: ['PORTAL_DATABASE_URL_FILE', 'PORTAL_DYYTO_CATALOG_FILE', 'PORTAL_BENCH_SNAPSHOT_FILE', 'PORTAL_DEVELOPER_WORKSPACE_FILE', 'PORTAL_FOUNDATION_DIRECTORY_FILE'],
+  smartgo: [
+    'DATABASE_URL_FILE', 'DIRECT_DATABASE_URL_FILE', 'SMARTGO_OPERATOR_TOKEN_FILE',
+    'PLATFORM_IDENTITY_SERVICE_TOKEN_FILE', 'PLATFORM_IDENTITY_ACTIVATION_TOKEN_FILE',
+    'PLATFORM_IDENTITY_CLIENT_SECRET_FILE', 'ARTIFACT_RENDERER_CALLBACK_TOKEN_FILE',
+    'ALIYUN_OSS_ACCESS_KEY_ID_FILE', 'ALIYUN_OSS_ACCESS_KEY_SECRET_FILE',
+    'ARTIFACT_DELIVERY_S3_ACCESS_KEY_ID_FILE', 'ARTIFACT_DELIVERY_S3_ACCESS_KEY_SECRET_FILE',
+    'WORKER_ARTIFACT_S3_ACCESS_KEY_ID_FILE', 'WORKER_ARTIFACT_S3_ACCESS_KEY_SECRET_FILE',
+    'SMARTGO_MINIO_ROOT_USER_FILE', 'SMARTGO_MINIO_ROOT_PASSWORD_FILE', 'SMARTGO_NPMRC_FILE',
+  ],
+});
+
+const REQUIRED_DIRECTORIES = [
+  'components', 'infrastructure', 'bindings', 'secrets/infrastructure',
+  'certs', 'trust', 'tools', 'tools/oras', 'releases', 'snapshots', 'snapshots/history', 'imports', 'generated', 'bindings/identity',
+];
+
+function ensureDirectory(candidate, mode = 0o700) {
+  if (!fs.existsSync(candidate)) fs.mkdirSync(candidate, { recursive: true, mode });
+  const stat = fs.lstatSync(candidate);
+  invariant(stat.isDirectory() && !stat.isSymbolicLink(), 'IDP_DIRECTORY_INVALID', `必须是普通目录：${candidate}`);
+  fs.chmodSync(candidate, mode);
+}
+
+function ensureFile(candidate, content, mode = 0o600) {
+  if (!fs.existsSync(candidate)) createExclusiveFile(candidate, content, mode);
+  assertSafeRegularFile(candidate, mode, { allowEmpty: true, role: '配置文件' });
+}
+
+function ensureEnvFile(candidate, template, configRoot, scope, { knownDefaultMigrations = {} } = {}) {
+  if (!fs.existsSync(candidate)) {
+    createExclusiveFile(candidate, template, 0o600);
+    return [];
+  }
+  assertSafeRegularFile(candidate, 0o600, { allowEmpty: false, role: `${scope} .env` });
+  const before = fs.readFileSync(candidate, 'utf8');
+  const current = parseEnv(before, candidate);
+  const defaults = parseEnv(template, `${scope}默认.env`);
+  const missing = Object.entries(defaults).filter(([key]) => !(key in current));
+  const replacements = Object.entries(knownDefaultMigrations).filter(([key, migration]) => (
+    key in current && migration.from.includes(current[key]) && current[key] !== migration.to
+  ));
+  if (missing.length === 0 && replacements.length === 0) return [];
+  const preimageDirectory = path.join(configRoot, 'snapshots', 'config-preimages');
+  ensureDirectory(preimageDirectory, 0o700);
+  const stamp = new Date().toISOString().replace(/[:.]/gu, '-');
+  const preimage = path.join(preimageDirectory, `${stamp}-${scope}-${crypto.randomUUID()}.env.preimage`);
+  createExclusiveFile(preimage, before, 0o600);
+  let after = before;
+  for (const [key, migration] of replacements) {
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+    after = after.replace(new RegExp(`^${escaped}=.*$`, 'mu'), `${key}=${migration.to}`);
+  }
+  if (missing.length > 0) {
+    const additions = missing.map(([key, value]) => `${key}=${value}`).join('\n');
+    after = `${after.trimEnd()}\n# 由config init补齐的新配置键；已有值未覆盖。\n${additions}\n`;
+  }
+  atomicWrite(candidate, after, 0o600);
+  return [...replacements.map(([key]) => key), ...missing.map(([key]) => key)];
+}
+
+const SMARTGO_KNOWN_DEFAULT_MIGRATIONS = Object.freeze({
+  GOTOLOGY_PUBLIC_URL: { from: ['http://127.0.0.1:8080/smartgo/gotology', 'http://127.0.0.1:8080/smartgo/gotology/'], to: 'http://127.0.0.1:13000/' },
+  OPERATIONS_PUBLIC_URL: { from: ['http://127.0.0.1:3101', 'http://127.0.0.1:3101/', 'http://127.0.0.1:8080/smartgo/operations', 'http://127.0.0.1:8080/smartgo/operations/'], to: 'http://127.0.0.1:13101/' },
+  STUDIO_PUBLIC_URL: { from: ['http://127.0.0.1:3002', 'http://127.0.0.1:3002/', 'http://127.0.0.1:8080/smartgo/studio', 'http://127.0.0.1:8080/smartgo/studio/'], to: 'http://127.0.0.1:13002/' },
+  SMARTGO_MINIO_PUBLIC_ENDPOINT: { from: ['http://127.0.0.1:8080/smartgo/objects', 'http://127.0.0.1:8080/smartgo/objects/'], to: 'http://127.0.0.1:8080' },
+});
+
+export function referencedFiles(root) {
+  const refs = [];
+  const envFiles = [
+    { scope: 'root', envFile: path.join(root, '.env') },
+    ...COMPONENTS.map((scope) => ({ scope, envFile: path.join(root, 'components', scope, '.env') })),
+  ];
+  for (const { scope, envFile } of envFiles) {
+    if (!fs.existsSync(envFile)) continue;
+    const values = parseEnv(fs.readFileSync(envFile, 'utf8'), envFile);
+    for (const [key, value] of Object.entries(values)) {
+      if (!key.endsWith('_FILE') || !value) continue;
+      const base = scope === 'root' ? root : path.join(root, 'components', scope);
+      refs.push({ scope, key, reference: value, absolute: resolveContained(base, value, key) });
+    }
+  }
+  return refs;
+}
+
+function readSingleLineReference(candidate, role) {
+  if (!fs.existsSync(candidate) || fs.statSync(candidate).size === 0) return null;
+  const value = fs.readFileSync(candidate, 'utf8').replace(/[\r\n]+$/u, '');
+  invariant(value.length > 0 && !/[\r\n]/u.test(value), 'IDP_DATABASE_CREDENTIAL_INVALID', `${role}必须是单行非空值`);
+  return value;
+}
+
+function validateDatabaseCredentialConsistency(root, active) {
+  const refs = new Map(referencedFiles(root).map((ref) => [`${ref.scope}.${ref.key}`, ref.absolute]));
+  const contracts = [
+    {
+      enabled: active.has('tech'), role: 'tech', database: 'tech',
+      password: refs.get('root.IDP_POSTGRES_TECH_PASSWORD_FILE'),
+      url: refs.get('tech.TECH_DATABASE_URL_FILE'),
+    },
+    {
+      enabled: active.has('portal'), role: 'portal', database: 'backstage',
+      password: refs.get('root.IDP_POSTGRES_PORTAL_PASSWORD_FILE'),
+      url: refs.get('portal.PORTAL_DATABASE_URL_FILE'),
+    },
+    {
+      enabled: active.has('smartgo'), role: 'smartgo', database: 'smartgo',
+      password: refs.get('root.IDP_POSTGRES_SMARTGO_PASSWORD_FILE'),
+      url: refs.get('smartgo.DATABASE_URL_FILE'),
+    },
+    {
+      enabled: active.has('smartgo'), role: 'smartgo', database: 'smartgo',
+      password: refs.get('root.IDP_POSTGRES_SMARTGO_PASSWORD_FILE'),
+      url: refs.get('smartgo.DIRECT_DATABASE_URL_FILE'),
+    },
+  ];
+  for (const contract of contracts) {
+    if (!contract.enabled || !contract.password || !contract.url) continue;
+    const password = readSingleLineReference(contract.password, `${contract.role}数据库密码`);
+    const rawUrl = readSingleLineReference(contract.url, `${contract.role}数据库URL`);
+    if (password === null || rawUrl === null) continue;
+    let parsed;
+    try { parsed = new URL(rawUrl); }
+    catch { invariant(false, 'IDP_DATABASE_URL_INVALID', `${contract.role}数据库URL不是有效URL`); }
+    let decodedPassword;
+    try { decodedPassword = decodeURIComponent(parsed.password); }
+    catch { invariant(false, 'IDP_DATABASE_URL_INVALID', `${contract.role}数据库URL密码编码无效`); }
+    invariant(
+      parsed.protocol === 'postgresql:' && parsed.username === contract.role && decodedPassword === password &&
+      parsed.hostname === 'postgresql' && parsed.port === '5432' && parsed.pathname === `/${contract.database}` &&
+      parsed.searchParams.get('schema') === 'public',
+      'IDP_DATABASE_CREDENTIAL_MISMATCH', `${contract.role}数据库密码与连接URL不一致；必须在切换前原子更新两者`,
+    );
+  }
+}
+
+function validateSmartGoCredentialConsistency(root, active) {
+  if (!active.has('smartgo')) return;
+  const refs = new Map(referencedFiles(root).filter((ref) => ref.scope === 'smartgo').map((ref) => [ref.key, ref.absolute]));
+  const read = (key) => readSingleLineReference(refs.get(key), key);
+  const minioUser = read('SMARTGO_MINIO_ROOT_USER_FILE');
+  const minioPassword = read('SMARTGO_MINIO_ROOT_PASSWORD_FILE');
+  const deliveryUser = read('ARTIFACT_DELIVERY_S3_ACCESS_KEY_ID_FILE');
+  const deliveryPassword = read('ARTIFACT_DELIVERY_S3_ACCESS_KEY_SECRET_FILE');
+  const workerUser = read('WORKER_ARTIFACT_S3_ACCESS_KEY_ID_FILE');
+  const workerPassword = read('WORKER_ARTIFACT_S3_ACCESS_KEY_SECRET_FILE');
+  if ([minioUser, deliveryUser, workerUser].every((value) => value !== null)) {
+    invariant(minioUser === deliveryUser && minioUser === workerUser, 'IDP_SMARTGO_OBJECT_ACCESS_KEY_MISMATCH', 'SmartGo应用与受管MinIO Access Key ID不一致');
+  }
+  if ([minioPassword, deliveryPassword, workerPassword].every((value) => value !== null)) {
+    invariant(minioPassword === deliveryPassword && minioPassword === workerPassword, 'IDP_SMARTGO_OBJECT_SECRET_MISMATCH', 'SmartGo应用与受管MinIO Access Key Secret不一致');
+  }
+}
+
+function booleanValue(env, key) {
+  invariant(['true', 'false'].includes(env[key]), 'IDP_BOOLEAN_INVALID', `${key}只能是true或false`);
+  return env[key] === 'true';
+}
+
+const ORAS_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)$/u;
+const SHA256_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+const BUILDX_BUILDER_PATTERN = /^[a-z0-9][a-z0-9_.-]{0,63}$/u;
+
+export function resolveConfiguredOrasTool(root, env) {
+  const enabled = booleanValue(env, 'IDP_OCI_LAYOUT_ORAS_FALLBACK_ENABLED');
+  const builder = env.IDP_OCI_LAYOUT_BUILDER;
+  invariant(
+    builder === 'UNCONFIGURED' || BUILDX_BUILDER_PATTERN.test(builder ?? ''),
+    'IDP_RELEASE_OCI_BUILDER_NAME_INVALID',
+    'IDP_OCI_LAYOUT_BUILDER必须是安全的Buildx Builder名称或UNCONFIGURED',
+  );
+  const reference = env.IDP_ORAS_BINARY_PATH;
+  invariant(typeof reference === 'string' && reference.length > 0, 'IDP_RELEASE_ORAS_PATH_INVALID', 'IDP_ORAS_BINARY_PATH必须是Config Dir内的相对路径');
+  let binary;
+  try { binary = resolveContained(root, reference, 'IDP_ORAS_BINARY_PATH'); }
+  catch { throw new IdpError('IDP_RELEASE_ORAS_PATH_INVALID', 'IDP_ORAS_BINARY_PATH必须是Config Dir内无链接的相对路径'); }
+  const version = env.IDP_ORAS_VERSION;
+  const digest = env.IDP_ORAS_SHA256;
+  invariant(version === 'UNCONFIGURED' || ORAS_VERSION_PATTERN.test(version ?? ''), 'IDP_RELEASE_ORAS_VERSION_INVALID', 'IDP_ORAS_VERSION必须是精确三段SemVer或UNCONFIGURED');
+  invariant(digest === 'UNCONFIGURED' || SHA256_DIGEST_PATTERN.test(digest ?? ''), 'IDP_RELEASE_ORAS_DIGEST_INVALID', 'IDP_ORAS_SHA256必须是sha256摘要或UNCONFIGURED');
+  if (!enabled) return null;
+  invariant(builder !== 'UNCONFIGURED', 'IDP_RELEASE_OCI_BUILDER_REQUIRED', '启用OCI Layout回退时必须固定IDP_OCI_LAYOUT_BUILDER');
+  invariant(version !== 'UNCONFIGURED', 'IDP_RELEASE_ORAS_VERSION_REQUIRED', '启用OCI Layout回退时必须固定IDP_ORAS_VERSION');
+  invariant(digest !== 'UNCONFIGURED', 'IDP_RELEASE_ORAS_DIGEST_REQUIRED', '启用OCI Layout回退时必须固定IDP_ORAS_SHA256');
+  invariant(fs.existsSync(binary), 'IDP_RELEASE_ORAS_BINARY_MISSING', '启用OCI Layout回退时Config Dir内缺少ORAS工具');
+  let stat;
+  try { stat = fs.lstatSync(binary); }
+  catch { throw new IdpError('IDP_RELEASE_ORAS_BINARY_INVALID', 'Config Dir中的ORAS工具无法安全读取'); }
+  invariant(stat.isFile() && !stat.isSymbolicLink(), 'IDP_RELEASE_ORAS_BINARY_INVALID', 'Config Dir中的ORAS工具必须是无链接普通文件');
+  invariant(stat.nlink === 1, 'IDP_RELEASE_ORAS_BINARY_INVALID', 'Config Dir中的ORAS工具必须只有一个硬链接');
+  if (typeof process.getuid === 'function') invariant(stat.uid === process.getuid(), 'IDP_RELEASE_ORAS_OWNER_INVALID', 'ORAS工具必须由当前部署用户拥有');
+  invariant((stat.mode & 0o500) === 0o500 && (stat.mode & 0o077) === 0, 'IDP_RELEASE_ORAS_MODE_INVALID', 'ORAS工具必须仅允许owner读取和执行');
+  invariant(stat.size > 0 && stat.size <= 128 * 1024 * 1024, 'IDP_RELEASE_ORAS_SIZE_INVALID', 'ORAS工具必须非空且不能超过128 MiB');
+  let observedDigest;
+  try { observedDigest = hashFile(binary); }
+  catch { throw new IdpError('IDP_RELEASE_ORAS_BINARY_INVALID', 'Config Dir中的ORAS工具无法安全读取'); }
+  invariant(observedDigest === digest, 'IDP_RELEASE_ORAS_DIGEST_MISMATCH', 'ORAS工具SHA-256与IDP_ORAS_SHA256不一致');
+  return Object.freeze({ binary, version, digest, builder });
+}
+
+function portValue(env, key) {
+  invariant(/^\d{1,5}$/u.test(env[key] ?? ''), 'IDP_PORT_INVALID', `${key}必须是1到65535之间的端口`);
+  const value = Number(env[key]);
+  invariant(value >= 1 && value <= 65535, 'IDP_PORT_INVALID', `${key}必须是1到65535之间的端口`);
+  return value;
+}
+
+function isLoopback(address) {
+  return address === '::1' || (net.isIPv4(address) && address.startsWith('127.'));
+}
+
+function validateNetworkConfiguration(env, active) {
+  const httpEnabled = booleanValue(env, 'IDP_HTTP_ENABLED');
+  const tlsEnabled = booleanValue(env, 'IDP_TLS_ENABLED');
+  invariant(httpEnabled || tlsEnabled, 'IDP_EDGE_DISABLED', 'HTTP与TLS不能同时关闭');
+  for (const key of ['IDP_HTTP_BIND', 'IDP_HTTPS_BIND', 'IDP_REGISTRY_BIND']) {
+    invariant(net.isIP(env[key] ?? '') !== 0, 'IDP_BIND_INVALID', `${key}必须是明确的IPv4或IPv6地址`);
+  }
+  for (const key of ['IDP_HTTP_PORT', 'IDP_HTTPS_PORT', 'IDP_REGISTRY_PORT', 'IDP_SMARTGO_GOTOLOGY_PORT', 'IDP_SMARTGO_OPERATIONS_PORT', 'IDP_SMARTGO_STUDIO_PORT']) portValue(env, key);
+  if (active.has('smartgo')) {
+    const smartgoPorts = ['IDP_HTTP_PORT', 'IDP_SMARTGO_GOTOLOGY_PORT', 'IDP_SMARTGO_OPERATIONS_PORT', 'IDP_SMARTGO_STUDIO_PORT'].map((key) => env[key]);
+    invariant(new Set(smartgoPorts).size === smartgoPorts.length, 'IDP_SMARTGO_PORT_COLLISION', 'SmartGo三站点与主Edge端口不能重复');
+  }
+  invariant(/^(?:[a-zA-Z0-9.-]+|\[[0-9a-fA-F:]+\])$/u.test(env.IDP_PUBLIC_HOST ?? ''), 'IDP_PUBLIC_HOST_INVALID', 'IDP_PUBLIC_HOST只能是主机名或IP地址，不能包含协议、路径或端口');
+  for (const cidr of (env.IDP_ALLOWED_CIDR ?? '').split(',').map((value) => value.trim()).filter(Boolean)) {
+    const [address, prefix, extra] = cidr.split('/');
+    const family = net.isIP(address);
+    const numericPrefix = Number(prefix);
+    invariant(!extra && family && /^\d+$/u.test(prefix ?? '') && numericPrefix >= 0 && numericPrefix <= (family === 4 ? 32 : 128), 'IDP_CIDR_INVALID', `IDP_ALLOWED_CIDR包含无效网段：${cidr}`);
+  }
+  invariant(Boolean(env.IDP_ALLOWED_CIDR), 'IDP_CIDR_EMPTY', 'IDP_ALLOWED_CIDR不能为空');
+  const mode = env.IDP_NETWORK_POLICY_MODE;
+  invariant(['loopback-only', 'host-firewall'].includes(mode), 'IDP_NETWORK_POLICY_INVALID', 'IDP_NETWORK_POLICY_MODE只能是loopback-only或host-firewall');
+  const exposedBinds = [];
+  if (active.has('edge') && httpEnabled) exposedBinds.push(['IDP_HTTP_BIND', env.IDP_HTTP_BIND]);
+  if (active.has('edge') && tlsEnabled) exposedBinds.push(['IDP_HTTPS_BIND', env.IDP_HTTPS_BIND]);
+  if (active.has('registry')) exposedBinds.push(['IDP_REGISTRY_BIND', env.IDP_REGISTRY_BIND]);
+  if (mode === 'loopback-only') {
+    for (const [key, address] of exposedBinds) invariant(isLoopback(address), 'IDP_NON_LOOPBACK_BIND_FORBIDDEN', `${key}在loopback-only模式下必须绑定回环地址`);
+  } else {
+    const cidrs = env.IDP_ALLOWED_CIDR.split(',').map((value) => value.trim());
+    invariant(!cidrs.includes('0.0.0.0/0') && !cidrs.includes('::/0'), 'IDP_FIREWALL_CIDR_TOO_BROAD', 'host-firewall模式不允许全网CIDR');
+    const nonLoopbackBinds = exposedBinds.filter(([, address]) => !isLoopback(address));
+    if (nonLoopbackBinds.length > 0) {
+      invariant(tlsEnabled, 'IDP_NON_LOOPBACK_TLS_REQUIRED', '扩大Web监听范围时必须同时启用TLS');
+      invariant(!nonLoopbackBinds.some(([key]) => key === 'IDP_REGISTRY_BIND'), 'IDP_REGISTRY_NON_LOOPBACK_FORBIDDEN', 'Registry当前只提供HTTP直连，必须保持回环监听；需要内网访问时应通过TLS反向代理');
+      if (nonLoopbackBinds.some(([key]) => key === 'IDP_HTTP_BIND')) {
+        invariant(!isLoopback(env.IDP_HTTPS_BIND), 'IDP_HTTPS_BIND_REQUIRED', 'HTTP扩大监听仅用于跳转时，HTTPS也必须监听企业内网地址');
+      }
+      const publicHost = (env.IDP_PUBLIC_HOST ?? '').replace(/^\[|\]$/gu, '');
+      invariant(!net.isIP(publicHost) || !isLoopback(publicHost), 'IDP_PUBLIC_HOST_LOOPBACK_FORBIDDEN', '扩大Web监听范围时IDP_PUBLIC_HOST不能仍是回环地址');
+    }
+  }
+  return { httpEnabled, tlsEnabled, policyMode: mode, exposedBinds: exposedBinds.map(([key, address]) => ({ key, address })) };
+}
+
+function validateIdentityConfiguration(env) {
+  invariant(env.IDP_IDENTITY_MODE === 'anonymous-private', 'IDP_IDENTITY_MODE_INVALID', '当前轻量部署只支持IDP_IDENTITY_MODE=anonymous-private');
+  const oidcEnabled = booleanValue(env, 'IDP_OIDC_ENABLED');
+  invariant(!oidcEnabled, 'IDP_OIDC_NOT_IMPLEMENTED', '当前版本只保留标准OIDC升级合同，尚未接入身份执行面；不得把OIDC标记为已启用');
+  if (env.IDP_OIDC_ISSUER) validateHttpUrl(env.IDP_OIDC_ISSUER, 'IDP_OIDC_ISSUER');
+  invariant(/^[A-Za-z][A-Za-z0-9_.:-]{0,127}$/u.test(env.IDP_OIDC_GROUP_CLAIM ?? ''), 'IDP_OIDC_GROUP_CLAIM_INVALID', 'IDP_OIDC_GROUP_CLAIM格式无效');
+}
+
+export function registryPrivateScopes(env) {
+  const scopes = String(env.IDP_REGISTRY_PRIVATE_SCOPES ?? '').split(',').map((value) => value.trim()).filter(Boolean);
+  invariant(scopes.length > 0, 'IDP_REGISTRY_SCOPES_EMPTY', 'IDP_REGISTRY_PRIVATE_SCOPES至少要声明一个私有Scope');
+  invariant(scopes.includes('@aipt') && scopes.includes('@bench'), 'IDP_REGISTRY_REQUIRED_SCOPE_MISSING', '私有Scope至少必须包含@aipt与@bench');
+  invariant(new Set(scopes).size === scopes.length, 'IDP_REGISTRY_SCOPE_DUPLICATE', 'IDP_REGISTRY_PRIVATE_SCOPES不能重复');
+  for (const scope of scopes) invariant(/^@[a-z0-9][a-z0-9._-]{0,63}$/u.test(scope), 'IDP_REGISTRY_SCOPE_INVALID', `Registry私有Scope格式无效：${scope}`);
+  return scopes;
+}
+
+function validateEnvSafety(values, source) {
+  for (const key of Object.keys(values)) {
+    const sensitive = /(PASSWORD|PASSPHRASE|SECRET|TOKEN|API_KEY|PRIVATE_KEY|ACCESS_KEY|DATABASE_URL|CONNECTION_STRING|NPMRC|AUTHORIZATION|(?:^|_)CREDENTIALS?(?:_|$)|(?:^|_)DSN(?:_|$))/u.test(key);
+    invariant(!sensitive || key.endsWith('_FILE'), 'IDP_INLINE_SECRET_FORBIDDEN', `${source}中的${key}疑似敏感值，必须改成*_FILE引用`);
+  }
+}
+
+function validateHttpUrl(value, key, { required = true } = {}) {
+  if (!value && !required) return;
+  invariant(Boolean(value), 'IDP_URL_REQUIRED', `${key}不能为空`);
+  let parsed;
+  try { parsed = new URL(value); } catch { invariant(false, 'IDP_URL_INVALID', `${key}必须是绝对HTTP(S) URL`); }
+  invariant(['http:', 'https:'].includes(parsed.protocol) && !parsed.username && !parsed.password && !parsed.hash, 'IDP_URL_INVALID', `${key}必须是不含凭据和片段的绝对HTTP(S) URL`);
+}
+
+function positiveInteger(values, key, maximum = 300_000) {
+  invariant(/^\d+$/u.test(values[key] ?? ''), 'IDP_NUMBER_INVALID', `${key}必须是正整数`);
+  const value = Number(values[key]);
+  invariant(value > 0 && value <= maximum, 'IDP_NUMBER_INVALID', `${key}必须在1到${maximum}之间`);
+}
+
+function validateComponentConfiguration(active, rootEnvValues, componentValues) {
+  if (active.has('tech')) {
+    const tech = componentValues.tech;
+    invariant(tech.TECH_AUTH_MODE === 'anonymous-private', 'IDP_TECH_AUTH_MODE_INVALID', '当前无OIDC轻量部署只支持TECH_AUTH_MODE=anonymous-private');
+    invariant(tech.TECH_BIND_HOST === '0.0.0.0', 'IDP_TECH_BIND_INVALID', '容器内TECH_BIND_HOST必须固定为0.0.0.0，由宿主Edge控制暴露边界');
+    invariant(tech.TECH_PORT === '3698', 'IDP_TECH_PORT_INVALID', 'TECH_PORT必须与Compose和Edge合同固定为3698');
+    booleanValue(tech, 'TECH_OPERATOR_LOOPBACK_ONLY');
+    invariant(tech.TECH_OPERATOR_LOOPBACK_ONLY === 'false', 'IDP_TECH_OPERATOR_EDGE_MODE_REQUIRED', 'Tech只通过Edge暴露，TECH_OPERATOR_LOOPBACK_ONLY必须为false并使用Bearer Operator Token鉴权');
+    booleanValue(tech, 'TECH_EMBEDDING_ENABLED');
+    invariant(/^[a-z0-9][a-z0-9._-]{0,127}$/u.test(tech.TECH_POLICY_REVISION ?? ''), 'IDP_TECH_POLICY_REVISION_INVALID', 'TECH_POLICY_REVISION格式无效');
+    if (tech.TECH_EMBEDDING_ENABLED === 'true') {
+      invariant(Boolean(tech.OPENAI_EMBED_MODEL), 'IDP_TECH_EMBED_MODEL_REQUIRED', '启用Embedding时必须配置OPENAI_EMBED_MODEL');
+    }
+    invariant(tech.TECH_SOURCE_CREDENTIALS_MANIFEST_FILE === 'config/source-credentials.json', 'IDP_TECH_SOURCE_CREDENTIALS_PATH_INVALID', 'TECH_SOURCE_CREDENTIALS_MANIFEST_FILE必须固定为config/source-credentials.json');
+    invariant(tech.TECH_OBJECT_STORAGE_MODE === 'none', 'IDP_TECH_OBJECT_STORAGE_UNSUPPORTED', '当前Tech P0尚未实现对象正文/附件存储，TECH_OBJECT_STORAGE_MODE必须为none');
+  }
+  if (active.has('flow')) {
+    const flow = componentValues.flow;
+    invariant(['snapshot', 'http'].includes(flow.FLOW_MODE), 'IDP_FLOW_MODE_INVALID', 'FLOW_MODE只能是snapshot或http');
+    invariant(['disabled', 'operator'].includes(flow.FLOW_WRITE_MODE), 'IDP_FLOW_WRITE_MODE_INVALID', 'FLOW_WRITE_MODE只能是disabled或operator');
+    invariant(flow.FLOW_BIND_HOST === '0.0.0.0', 'IDP_FLOW_BIND_INVALID', '容器内FLOW_BIND_HOST必须固定为0.0.0.0，由宿主Edge控制暴露边界');
+    portValue(flow, 'FLOW_PORT');
+    invariant(flow.FLOW_PORT === '3710', 'IDP_FLOW_PORT_INVALID', 'FLOW_PORT必须与Compose和Edge合同固定为3710');
+    positiveInteger(flow, 'FLOW_HTTP_TIMEOUT_MS');
+    booleanValue(flow, 'FLOW_TECH_REQUIRED');
+    if (flow.FLOW_TECH_REQUIRED === 'true') validateHttpUrl(flow.FLOW_TECH_URL, 'FLOW_TECH_URL');
+    else validateHttpUrl(flow.FLOW_TECH_URL, 'FLOW_TECH_URL', { required: false });
+    if (flow.FLOW_MODE === 'http') {
+      validateHttpUrl(flow.FLOW_DYYTO_URL, 'FLOW_DYYTO_URL');
+      validateHttpUrl(flow.FLOW_BENCH_URL, 'FLOW_BENCH_URL');
+    }
+    if (flow.FLOW_WRITE_MODE === 'operator') validateHttpUrl(flow.FLOW_PROPOSAL_URL, 'FLOW_PROPOSAL_URL');
+    else invariant(!flow.FLOW_PROPOSAL_URL, 'IDP_FLOW_WRITE_DISABLED', 'FLOW_WRITE_MODE=disabled时FLOW_PROPOSAL_URL必须为空');
+  }
+  if (active.has('portal')) {
+    const portal = componentValues.portal;
+    validateHttpUrl(portal.PORTAL_PUBLIC_URL, 'PORTAL_PUBLIC_URL');
+    const externalScheme = rootEnvValues.IDP_TLS_ENABLED === 'true' ? 'https' : 'http';
+    const externalPort = rootEnvValues.IDP_TLS_ENABLED === 'true' ? rootEnvValues.IDP_HTTPS_PORT : rootEnvValues.IDP_HTTP_PORT;
+    const expectedOrigin = new URL(`${externalScheme}://${rootEnvValues.IDP_PUBLIC_HOST}:${externalPort}`).origin;
+    invariant(new URL(portal.PORTAL_PUBLIC_URL).origin === expectedOrigin, 'IDP_PORTAL_PUBLIC_URL_MISMATCH', `PORTAL_PUBLIC_URL必须与Edge外部Origin一致：${expectedOrigin}`);
+    validateHttpUrl(portal.PORTAL_TECH_URL, 'PORTAL_TECH_URL', { required: false });
+    validateHttpUrl(portal.PORTAL_FLOW_URL, 'PORTAL_FLOW_URL', { required: false });
+    positiveInteger(portal, 'PORTAL_FOUNDATION_PROBE_TIMEOUT_MS');
+    positiveInteger(portal, 'PORTAL_UPSTREAM_TIMEOUT_MS');
+    booleanValue(portal, 'PORTAL_FIXTURE_FALLBACK');
+    invariant(portal.PORTAL_FIXTURE_FALLBACK !== 'true' || rootEnvValues.IDP_ENVIRONMENT === 'development', 'IDP_PORTAL_FIXTURE_FORBIDDEN', 'PORTAL_FIXTURE_FALLBACK只允许development环境显式启用');
+  }
+  if (active.has('smartgo')) {
+    const smartgo = componentValues.smartgo;
+    invariant(smartgo.NODE_ENV === 'development', 'IDP_SMARTGO_NODE_ENV_INVALID', 'SmartGo local-open受管Profile当前只允许NODE_ENV=development');
+    invariant(smartgo.SMARTGO_DEPLOYMENT_MODE === 'idp-managed', 'IDP_SMARTGO_DEPLOYMENT_MODE_INVALID', 'SmartGo受管Profile必须使用SMARTGO_DEPLOYMENT_MODE=idp-managed');
+    invariant(smartgo.SMARTGO_AUTH_MODE === 'local-open', 'IDP_SMARTGO_AUTH_MODE_INVALID', 'SmartGo当前只支持SMARTGO_AUTH_MODE=local-open');
+    invariant(smartgo.SMARTGO_STUDIO_STATE_MODE === 'ephemeral-fixture', 'IDP_SMARTGO_STUDIO_STATE_MODE_INVALID', 'SmartGo local-open必须且只能使用SMARTGO_STUDIO_STATE_MODE=ephemeral-fixture');
+    invariant(smartgo.SMARTGO_STUDIO_DATA_DIRECTORY === '/run/smartgo/studio', 'IDP_SMARTGO_STUDIO_DATA_DIRECTORY_INVALID', 'SmartGo local-open Studio数据目录必须固定为绝对路径/run/smartgo/studio');
+    invariant(isLoopback(smartgo.SMARTGO_BIND_HOST), 'IDP_SMARTGO_BIND_INVALID', 'SmartGo local-open宿主发布边界必须是明确回环地址');
+    invariant(smartgo.SMARTGO_BIND_HOST === rootEnvValues.IDP_HTTP_BIND && smartgo.SMARTGO_BIND_HOST === rootEnvValues.IDP_PUBLIC_HOST, 'IDP_SMARTGO_BIND_MISMATCH', 'SmartGo回环Bind、Edge HTTP Bind与Public Host必须一致');
+    invariant(rootEnvValues.IDP_HTTP_ENABLED === 'true' && rootEnvValues.IDP_TLS_ENABLED === 'false', 'IDP_SMARTGO_LOCAL_OPEN_HTTP_REQUIRED', 'SmartGo local-open受管Profile当前只支持回环HTTP，不得伪装成OIDC/TLS生产模式');
+    invariant(smartgo.MEDIA_ASSET_REPOSITORY === 'minio' && smartgo.SMARTGO_ARTIFACT_STORE_PROVIDER === 's3', 'IDP_SMARTGO_OBJECT_STORE_INVALID', 'business-smartgo必须使用idp-deploy受管MinIO/S3对象存储');
+    invariant(smartgo.SMARTGO_MINIO_BUCKET === 'smartgo-artifacts', 'IDP_SMARTGO_BUCKET_INVALID', 'P0受管MinIO Bucket必须固定为smartgo-artifacts');
+    positiveInteger(smartgo, 'SIGNED_OBJECT_URL_TTL_SECONDS', 86_400);
+    validateHttpUrl(smartgo.GOTOLOGY_PUBLIC_URL, 'GOTOLOGY_PUBLIC_URL');
+    validateHttpUrl(smartgo.OPERATIONS_PUBLIC_URL, 'OPERATIONS_PUBLIC_URL');
+    validateHttpUrl(smartgo.STUDIO_PUBLIC_URL, 'STUDIO_PUBLIC_URL');
+    validateHttpUrl(smartgo.SMARTGO_MINIO_INTERNAL_ENDPOINT, 'SMARTGO_MINIO_INTERNAL_ENDPOINT');
+    validateHttpUrl(smartgo.SMARTGO_MINIO_PUBLIC_ENDPOINT, 'SMARTGO_MINIO_PUBLIC_ENDPOINT');
+    invariant(new URL(smartgo.SMARTGO_MINIO_INTERNAL_ENDPOINT).origin === 'http://smartgo-object-store:9000', 'IDP_SMARTGO_MINIO_ENDPOINT_INVALID', '受管MinIO内部Endpoint必须指向http://smartgo-object-store:9000');
+    invariant(new URL(smartgo.SMARTGO_MINIO_PUBLIC_ENDPOINT).origin === `http://${smartgo.SMARTGO_BIND_HOST}:${rootEnvValues.IDP_HTTP_PORT}` && new URL(smartgo.SMARTGO_MINIO_PUBLIC_ENDPOINT).pathname === '/', 'IDP_SMARTGO_MINIO_PUBLIC_ENDPOINT_INVALID', '受管MinIO Public Endpoint必须是主Edge无路径Origin');
+    const expectedOrigins = {
+      GOTOLOGY_PUBLIC_URL: `http://${smartgo.SMARTGO_BIND_HOST}:${rootEnvValues.IDP_SMARTGO_GOTOLOGY_PORT}`,
+      OPERATIONS_PUBLIC_URL: `http://${smartgo.SMARTGO_BIND_HOST}:${rootEnvValues.IDP_SMARTGO_OPERATIONS_PORT}`,
+      STUDIO_PUBLIC_URL: `http://${smartgo.SMARTGO_BIND_HOST}:${rootEnvValues.IDP_SMARTGO_STUDIO_PORT}`,
+    };
+    for (const [key, expected] of Object.entries(expectedOrigins)) {
+      invariant(new URL(smartgo[key]).origin === expected && new URL(smartgo[key]).pathname === '/', 'IDP_SMARTGO_PUBLIC_URL_MISMATCH', `${key}必须是无路径前缀的独立回环Origin：${expected}/`);
+    }
+  }
+}
+
+function isReferenceRequired(ref, active, rootEnvValues, componentValues) {
+  if (['IDP_TLS_CERT_FILE', 'IDP_TLS_KEY_FILE'].includes(ref.key)) return rootEnvValues.IDP_TLS_ENABLED === 'true' && active.has('edge');
+  if (ref.key === 'IDP_HOST_FIREWALL_EVIDENCE_FILE') return rootEnvValues.IDP_NETWORK_POLICY_MODE === 'host-firewall' && (active.has('edge') || active.has('registry'));
+  if (ref.key === 'IDP_POSTGRES_SUPERUSER_PASSWORD_FILE') return active.has('postgresql');
+  if (['IDP_POSTGRES_TECH_PASSWORD_FILE', 'IDP_POSTGRES_PORTAL_PASSWORD_FILE'].includes(ref.key)) return active.has('postgresql');
+  if (ref.key === 'IDP_POSTGRES_SMARTGO_PASSWORD_FILE') return active.has('smartgo');
+  if (ref.key === 'IDP_REGISTRY_HTPASSWD_FILE') return false;
+  if (ref.key === 'IDP_REGISTRY_ACCEPTANCE_NPMRC_FILE') return false;
+  if (['IDP_OIDC_CLIENT_SECRET_FILE', 'IDP_OIDC_GROUP_MAPPING_FILE'].includes(ref.key)) return rootEnvValues.IDP_OIDC_ENABLED === 'true';
+  if (['DYYTO_NPMRC_FILE', 'DYYTO_PACKAGE_CATALOG_DIRS_FILE', 'BENCH_NPMRC_FILE', 'FORGE_NPMRC_FILE'].includes(ref.key)) return false;
+  if (ref.key === 'FLOW_OPERATOR_TOKEN_FILE') return active.has('flow') && componentValues.flow?.FLOW_WRITE_MODE === 'operator';
+  if (ref.key === 'FLOW_TECH_CONTEXT_FILE') return active.has('flow') && componentValues.flow?.FLOW_TECH_REQUIRED === 'false';
+  if (['FLOW_DYYTO_CATALOG_FILE', 'FLOW_BENCH_SNAPSHOT_FILE'].includes(ref.key)) return active.has('flow') && componentValues.flow?.FLOW_MODE === 'snapshot';
+  if (['PORTAL_DYYTO_CATALOG_FILE', 'PORTAL_BENCH_SNAPSHOT_FILE'].includes(ref.key)) return active.has('portal') && componentValues.portal?.PORTAL_FIXTURE_FALLBACK !== 'true';
+  if (ref.key === 'PORTAL_FOUNDATION_DIRECTORY_FILE') return false;
+  if (ref.scope === 'smartgo') {
+    if (!active.has('smartgo')) return false;
+    if (['ALIYUN_OSS_ACCESS_KEY_ID_FILE', 'ALIYUN_OSS_ACCESS_KEY_SECRET_FILE', 'SMARTGO_NPMRC_FILE'].includes(ref.key)) return false;
+    return true;
+  }
+  if (['OPENAI_BASE_URL_FILE', 'OPENAI_API_KEY_FILE'].includes(ref.key)) return active.has('tech') && componentValues.tech?.TECH_EMBEDDING_ENABLED === 'true';
+  if (ref.scope === 'root') return true;
+  return active.has(ref.scope);
+}
+
+function assertRequiredReferenceDeclarations(active, rootEnvValues, componentValues) {
+  for (const [scope, keys] of Object.entries(REFERENCE_KEYS_BY_SCOPE)) {
+    const values = scope === 'root' ? rootEnvValues : componentValues[scope];
+    for (const key of keys) {
+      const ref = { scope, key };
+      if (isReferenceRequired(ref, active, rootEnvValues, componentValues)) {
+        invariant(typeof values[key] === 'string' && values[key].length > 0, 'IDP_REFERENCE_PATH_REQUIRED', `${scope}.${key}必须声明非空的Config Dir相对文件路径`);
+      }
+    }
+  }
+}
+
+function validateSourceReference(ref, stat) {
+  if (ref.key === 'OPENAI_BASE_URL_FILE') {
+    invariant(stat.size <= 4096, 'IDP_TECH_OPENAI_URL_INVALID', 'OPENAI_BASE_URL_FILE不能超过4 KiB');
+    const value = fs.readFileSync(ref.absolute, 'utf8').replace(/[\r\n]+$/u, '');
+    invariant(value.length > 0 && !/[\r\n]/u.test(value), 'IDP_TECH_OPENAI_URL_INVALID', 'OPENAI_BASE_URL_FILE必须是单行URL');
+    validateHttpUrl(value, 'OPENAI_BASE_URL_FILE');
+    const parsed = new URL(value);
+    const local = parsed.hostname === 'localhost' || isLoopback(parsed.hostname);
+    invariant(parsed.protocol === 'https:' || local, 'IDP_TECH_OPENAI_TLS_REQUIRED', '非本机Embedding Provider必须使用HTTPS');
+    return;
+  }
+  const validators = {
+    FLOW_DYYTO_CATALOG_FILE: validateDyytoSnapshot,
+    PORTAL_DYYTO_CATALOG_FILE: validateDyytoSnapshot,
+    FLOW_BENCH_SNAPSHOT_FILE: validateBenchSnapshot,
+    PORTAL_BENCH_SNAPSHOT_FILE: validateBenchSnapshot,
+  };
+  const validator = validators[ref.key];
+  if (!validator) return;
+  invariant(stat.size <= 16 * 1024 * 1024, 'IDP_SOURCE_SIZE_INVALID', `${ref.key}不能超过16 MiB`);
+  let document;
+  try { document = JSON.parse(fs.readFileSync(ref.absolute, 'utf8')); }
+  catch { invariant(false, 'IDP_SOURCE_JSON_INVALID', `${ref.key}不是有效JSON`); }
+  validator(document);
+}
+
+function parseTechSourceCredentialsManifest(candidate) {
+  const stat = assertSafeRegularFile(candidate, 0o600, { allowEmpty: false, role: 'Tech来源凭据清单' });
+  invariant(stat.size <= 64 * 1024, 'IDP_TECH_SOURCE_CREDENTIALS_MANIFEST_TOO_LARGE', 'Tech来源凭据清单不能超过64 KiB');
+  let document;
+  try { document = JSON.parse(fs.readFileSync(candidate, 'utf8')); }
+  catch { invariant(false, 'IDP_TECH_SOURCE_CREDENTIALS_MANIFEST_JSON_INVALID', 'Tech来源凭据清单不是有效JSON'); }
+  invariant(document && typeof document === 'object' && !Array.isArray(document), 'IDP_TECH_SOURCE_CREDENTIALS_MANIFEST_SCHEMA_INVALID', 'Tech来源凭据清单必须是JSON对象');
+  const keys = Object.keys(document).sort();
+  invariant(keys.length === 2 && keys[0] === 'files' && keys[1] === 'schemaVersion', 'IDP_TECH_SOURCE_CREDENTIALS_MANIFEST_SCHEMA_INVALID', 'Tech来源凭据清单只能包含schemaVersion与files');
+  invariant(document.schemaVersion === 1 && Array.isArray(document.files), 'IDP_TECH_SOURCE_CREDENTIALS_MANIFEST_SCHEMA_INVALID', 'Tech来源凭据清单必须符合v1合同');
+  invariant(document.files.length <= 200, 'IDP_TECH_SOURCE_CREDENTIALS_LIMIT_EXCEEDED', 'Tech来源凭据清单最多允许200个文件');
+  const reserved = new Set(['database-url', 'operator-token', 'openai-api-key', 'openai-base-url', 'source-credentials.json']);
+  let previous;
+  for (const filename of document.files) {
+    invariant(typeof filename === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/u.test(filename), 'IDP_TECH_SOURCE_CREDENTIAL_FILENAME_INVALID', 'Tech来源凭据文件名必须是1到200字符的安全basename');
+    invariant(!reserved.has(filename), 'IDP_TECH_SOURCE_CREDENTIAL_FILENAME_RESERVED', `Tech来源凭据不得使用固定Secret保留名：${filename}`);
+    invariant(previous === undefined || previous < filename, 'IDP_TECH_SOURCE_CREDENTIALS_ORDER_INVALID', 'Tech来源凭据文件名必须唯一并按字典序严格升序排列');
+    previous = filename;
+  }
+  return document.files;
+}
+
+function validateTechSourceCredentials(root, tech, { requireConfigured }) {
+  const manifestReference = tech.TECH_SOURCE_CREDENTIALS_MANIFEST_FILE;
+  const componentRoot = resolveContained(root, 'components/tech', 'Tech组件配置目录');
+  const credentialsRoot = resolveContained(componentRoot, 'secrets/source-credentials', 'Tech来源凭据专属目录');
+  assertSafeDirectory(credentialsRoot, 0o700, { role: 'Tech来源凭据专属目录' });
+  const manifestPath = resolveContained(componentRoot, manifestReference, 'Tech来源凭据清单引用');
+  if (!fs.existsSync(manifestPath) || fs.statSync(manifestPath).size === 0) return { manifestReference, manifestPath, files: [] };
+  const filenames = parseTechSourceCredentialsManifest(manifestPath);
+  const files = filenames.map((filename) => {
+    const reference = `secrets/source-credentials/${filename}`;
+    const absolute = resolveContained(componentRoot, reference, `Tech来源凭据${filename}`);
+    if (fs.existsSync(absolute)) {
+      assertSafeRegularFile(absolute, 0o600, { allowEmpty: !requireConfigured, role: `Tech来源凭据${filename}` });
+    } else if (requireConfigured) {
+      invariant(false, 'IDP_TECH_SOURCE_CREDENTIAL_MISSING', `Tech来源凭据文件不存在：${filename}`);
+    }
+    return { filename, reference, absolute };
+  });
+  return { manifestReference, manifestPath, files };
+}
+
+function requiredImages(active) {
+  const result = [];
+  if (active.has('postgresql')) result.push('IDP_POSTGRES_IMAGE');
+  if (active.has('registry')) result.push('IDP_REGISTRY_IMAGE');
+  if (active.has('tech')) result.push('IDP_TECH_IMAGE');
+  if (active.has('portal')) result.push('IDP_PORTAL_IMAGE');
+  if (active.has('flow')) result.push('IDP_FLOW_IMAGE');
+  if (active.has('smartgo')) result.push('IDP_SMARTGO_IMAGE', 'IDP_SMARTGO_OBJECT_STORE_IMAGE', 'IDP_SMARTGO_OBJECT_STORE_CLIENT_IMAGE');
+  if (active.has('edge')) result.push('IDP_CADDY_IMAGE');
+  return result;
+}
+
+function configurationValues(root) {
+  const componentsRoot = resolveContained(root, 'components', '组件配置根');
+  assertSafeDirectory(componentsRoot, 0o700, { role: '组件配置根' });
+  const rootEnvPath = path.join(root, '.env');
+  assertSafeRegularFile(rootEnvPath, 0o600, { allowEmpty: false, role: '根.env' });
+  const env = parseEnv(fs.readFileSync(rootEnvPath, 'utf8'), rootEnvPath);
+  validateEnvSafety(env, rootEnvPath);
+  const components = Object.create(null);
+  for (const component of COMPONENTS) {
+    const componentRoot = resolveContained(root, `components/${component}`, `${component}配置目录`);
+    assertSafeDirectory(componentRoot, 0o700, { role: `${component}配置目录` });
+    const candidate = resolveContained(root, `components/${component}/.env`, `${component} .env`);
+    assertSafeRegularFile(candidate, 0o600, { allowEmpty: false, role: `${component} .env` });
+    components[component] = parseEnv(fs.readFileSync(candidate, 'utf8'), candidate);
+    validateEnvSafety(components[component], candidate);
+    const scopeConflicts = Object.keys(components[component]).filter((key) => key in env);
+    invariant(scopeConflicts.length === 0, 'IDP_ENV_SCOPE_CONFLICT', `${component} .env不能重复定义根配置键：${scopeConflicts.join(',')}`);
+  }
+  return { env, components };
+}
+
+function materializeReferences(root) {
+  const created = [];
+  for (const ref of referencedFiles(root)) {
+    if (ref.key === 'PORTAL_FOUNDATION_DIRECTORY_FILE' && !fs.existsSync(ref.absolute)) continue;
+    ensureDirectory(path.dirname(ref.absolute));
+    if (!fs.existsSync(ref.absolute)) {
+      const initialContent = ref.key === 'TECH_SOURCE_CREDENTIALS_MANIFEST_FILE'
+        ? `${JSON.stringify({ schemaVersion: 1, files: [] }, null, 2)}\n`
+        : ref.key === 'PORTAL_DEVELOPER_WORKSPACE_FILE'
+          ? `${JSON.stringify({
+              schemaVersion: 'portal.developer-workspace/v1',
+              generatedAt: new Date().toISOString(),
+              workspaces: [],
+              environments: [],
+            }, null, 2)}\n`
+          : '';
+      ensureFile(ref.absolute, initialContent, ref.key.includes('CERT') && !ref.key.includes('KEY') ? 0o644 : 0o600);
+      created.push(ref.reference);
+    } else {
+      assertSafeRegularFile(ref.absolute, ref.key.includes('CERT') && !ref.key.includes('KEY') ? 0o644 : 0o600, { allowEmpty: true, role: ref.key });
+    }
+  }
+  return created;
+}
+
+export function initializeConfig(configRoot) {
+  invariant(path.isAbsolute(configRoot), 'IDP_CONFIG_NOT_ABSOLUTE', 'IDP_CONFIG_DIR必须是绝对路径');
+  assertOutsideRepositories(configRoot, 'IDP_CONFIG_DIR');
+  ensureDirectory(configRoot, 0o700);
+  const canonicalRoot = canonicalExisting(configRoot, 'IDP_CONFIG_DIR');
+  assertOutsideRepositories(canonicalRoot, 'IDP_CONFIG_DIR');
+  for (const relative of REQUIRED_DIRECTORIES) ensureDirectory(path.join(canonicalRoot, relative));
+  for (const component of COMPONENTS) {
+    ensureDirectory(path.join(canonicalRoot, 'components', component));
+    ensureDirectory(path.join(canonicalRoot, 'components', component, 'config'));
+    if (component === 'tech') ensureDirectory(path.join(canonicalRoot, 'components', component, 'secrets', 'source-credentials'));
+    ensureEnvFile(
+      path.join(canonicalRoot, 'components', component, '.env'),
+      COMPONENT_ENVS[component],
+      canonicalRoot,
+      `component-${component}`,
+      component === 'smartgo' ? { knownDefaultMigrations: SMARTGO_KNOWN_DEFAULT_MIGRATIONS } : undefined,
+    );
+  }
+  for (const infrastructure of ['edge', 'postgresql', 'registry', 'identity']) {
+    ensureDirectory(path.join(canonicalRoot, 'infrastructure', infrastructure));
+    ensureDirectory(path.join(canonicalRoot, 'secrets', 'infrastructure', infrastructure));
+  }
+  ensureEnvFile(path.join(canonicalRoot, '.env'), rootEnv(), canonicalRoot, 'root');
+  ensureFile(path.join(canonicalRoot, 'host.json'), `${JSON.stringify({ schemaVersion: 1, hostname: os.hostname(), platform: os.platform(), arch: os.arch(), createdAt: new Date().toISOString() }, null, 2)}\n`);
+  materializeReferences(canonicalRoot);
+  return doctorConfig(canonicalRoot, { requireConfigured: false });
+}
+
+export function generateSecrets(configRoot) {
+  const { root } = doctorConfig(configRoot, { requireConfigured: false });
+  materializeReferences(root);
+  const refs = new Map(referencedFiles(root).map((ref) => [ref.key, ref]));
+  const generated = [];
+  const generate = (key, bytes = 32) => {
+    const ref = refs.get(key);
+    invariant(ref, 'IDP_SECRET_REFERENCE_MISSING', `${key}未配置*_FILE路径`);
+    assertSafeRegularFile(ref.absolute, 0o600, { allowEmpty: true, role: key });
+    if (fs.statSync(ref.absolute).size > 0) {
+      const value = fs.readFileSync(ref.absolute, 'utf8').replace(/[\r\n]+$/u, '');
+      invariant(value.length > 0 && !/[\r\n]/u.test(value), 'IDP_SECRET_FORMAT_INVALID', `${key}必须是单行非空Secret`);
+      return value;
+    }
+    const value = crypto.randomBytes(bytes).toString('base64url');
+    atomicWrite(ref.absolute, `${value}\n`, 0o600);
+    generated.push(key);
+    return value;
+  };
+  generate('IDP_POSTGRES_SUPERUSER_PASSWORD_FILE');
+  const techPassword = generate('IDP_POSTGRES_TECH_PASSWORD_FILE');
+  const portalPassword = generate('IDP_POSTGRES_PORTAL_PASSWORD_FILE');
+  const smartgoPassword = generate('IDP_POSTGRES_SMARTGO_PASSWORD_FILE');
+  const operatorRef = refs.get('TECH_OPERATOR_TOKEN_FILE');
+  invariant(operatorRef, 'IDP_SECRET_REFERENCE_MISSING', 'TECH_OPERATOR_TOKEN_FILE未配置*_FILE路径');
+  assertSafeRegularFile(operatorRef.absolute, 0o600, { allowEmpty: true, role: 'TECH_OPERATOR_TOKEN_FILE' });
+  if (fs.statSync(operatorRef.absolute).size === 0) {
+    atomicWrite(operatorRef.absolute, `op0_${crypto.randomBytes(32).toString('base64url')}\n`, 0o600);
+    generated.push('TECH_OPERATOR_TOKEN_FILE');
+  } else {
+    const value = fs.readFileSync(operatorRef.absolute, 'utf8').replace(/[\r\n]+$/u, '');
+    invariant(value.length >= 32 && value.length <= 256 && /[A-Za-z]/u.test(value) && /[0-9]/u.test(value) && /^[A-Za-z0-9._~-]+$/u.test(value), 'IDP_TECH_OPERATOR_TOKEN_INVALID', 'TECH_OPERATOR_TOKEN_FILE必须是32到256位且同时包含字母和数字的安全单行Token');
+  }
+
+  const urls = [
+    ['TECH_DATABASE_URL_FILE', `postgresql://tech:${encodeURIComponent(techPassword)}@postgresql:5432/tech?schema=public`],
+    ['PORTAL_DATABASE_URL_FILE', `postgresql://portal:${encodeURIComponent(portalPassword)}@postgresql:5432/backstage?schema=public`],
+    ['DATABASE_URL_FILE', `postgresql://smartgo:${encodeURIComponent(smartgoPassword)}@postgresql:5432/smartgo?schema=public`],
+    ['DIRECT_DATABASE_URL_FILE', `postgresql://smartgo:${encodeURIComponent(smartgoPassword)}@postgresql:5432/smartgo?schema=public`],
+  ];
+  for (const [key, value] of urls) {
+    const ref = refs.get(key);
+    invariant(ref, 'IDP_SECRET_REFERENCE_MISSING', `${key}未配置*_FILE路径`);
+    assertSafeRegularFile(ref.absolute, 0o600, { allowEmpty: true, role: key });
+    if (fs.statSync(ref.absolute).size === 0) {
+      atomicWrite(ref.absolute, `${value}\n`, 0o600);
+      generated.push(key);
+    }
+  }
+  for (const key of [
+    'SMARTGO_OPERATOR_TOKEN_FILE', 'PLATFORM_IDENTITY_SERVICE_TOKEN_FILE',
+    'PLATFORM_IDENTITY_ACTIVATION_TOKEN_FILE', 'PLATFORM_IDENTITY_CLIENT_SECRET_FILE',
+    'ARTIFACT_RENDERER_CALLBACK_TOKEN_FILE',
+  ]) generate(key);
+  const minioUserRef = refs.get('SMARTGO_MINIO_ROOT_USER_FILE');
+  invariant(minioUserRef, 'IDP_SECRET_REFERENCE_MISSING', 'SMARTGO_MINIO_ROOT_USER_FILE未配置*_FILE路径');
+  assertSafeRegularFile(minioUserRef.absolute, 0o600, { allowEmpty: true, role: 'SMARTGO_MINIO_ROOT_USER_FILE' });
+  let minioUser = readSingleLineReference(minioUserRef.absolute, 'SMARTGO_MINIO_ROOT_USER_FILE');
+  if (minioUser === null) {
+    minioUser = `smartgo_${crypto.randomBytes(12).toString('hex')}`;
+    atomicWrite(minioUserRef.absolute, `${minioUser}\n`, 0o600);
+    generated.push('SMARTGO_MINIO_ROOT_USER_FILE');
+  }
+  const minioPassword = generate('SMARTGO_MINIO_ROOT_PASSWORD_FILE');
+  const mirrorSecret = (key, value) => {
+    const ref = refs.get(key);
+    invariant(ref, 'IDP_SECRET_REFERENCE_MISSING', `${key}未配置*_FILE路径`);
+    assertSafeRegularFile(ref.absolute, 0o600, { allowEmpty: true, role: key });
+    const current = readSingleLineReference(ref.absolute, key);
+    if (current === null) {
+      atomicWrite(ref.absolute, `${value}\n`, 0o600);
+      generated.push(key);
+    } else invariant(current === value, 'IDP_SMARTGO_OBJECT_CREDENTIAL_MISMATCH', `${key}与受管MinIO凭据不一致`);
+  };
+  mirrorSecret('ARTIFACT_DELIVERY_S3_ACCESS_KEY_ID_FILE', minioUser);
+  mirrorSecret('WORKER_ARTIFACT_S3_ACCESS_KEY_ID_FILE', minioUser);
+  mirrorSecret('ARTIFACT_DELIVERY_S3_ACCESS_KEY_SECRET_FILE', minioPassword);
+  mirrorSecret('WORKER_ARTIFACT_S3_ACCESS_KEY_SECRET_FILE', minioPassword);
+  return { generated, report: doctorConfig(root, { requireConfigured: false }).report };
+}
+
+export function doctorConfig(configRoot, { requireConfigured = false, profile = 'full', allowLegacyImageLock = false } = {}) {
+  const root = canonicalExisting(configRoot, 'IDP_CONFIG_DIR');
+  assertOutsideRepositories(root, 'IDP_CONFIG_DIR');
+  assertMode(root, 0o700, 'IDP_CONFIG_DIR');
+  const { env, components } = configurationValues(root);
+  invariant(env.IDP_CONFIG_SCHEMA_VERSION === '1', 'IDP_CONFIG_SCHEMA_UNSUPPORTED', '只支持IDP_CONFIG_SCHEMA_VERSION=1');
+  if (env.IDP_OCI_REPOSITORY_ROOT && env.IDP_OCI_REPOSITORY_ROOT !== 'UNCONFIGURED') {
+    invariant(
+      /^[a-z0-9]+(?:[._-][a-z0-9]+)*(?::[1-9][0-9]{0,4})?(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)+$/u.test(env.IDP_OCI_REPOSITORY_ROOT),
+      'IDP_OCI_REPOSITORY_ROOT_INVALID',
+      'IDP_OCI_REPOSITORY_ROOT必须是不含协议、凭据、tag或digest的小写OCI仓库路径',
+    );
+  }
+  resolveConfiguredOrasTool(root, env);
+  invariant(/^[a-z0-9][a-z0-9-]{2,62}$/u.test(env.IDP_INSTANCE_ID ?? ''), 'IDP_INSTANCE_INVALID', 'IDP_INSTANCE_ID必须是3到63位小写字母、数字或连字符');
+  invariant(['private', 'production', 'development'].includes(env.IDP_ENVIRONMENT), 'IDP_ENVIRONMENT_INVALID', 'IDP_ENVIRONMENT只能是private、production或development');
+  booleanValue(env, 'IDP_ALLOW_NON_GIT_SMARTGO_SOURCE');
+  for (const key of ['IDP_CONTAINER_UID', 'IDP_CONTAINER_GID']) {
+    invariant(/^[1-9][0-9]{0,9}$/u.test(env[key] ?? '') && Number(env[key]) <= 2_147_483_647, 'IDP_CONTAINER_ID_INVALID', `${key}必须是非零的十进制UID/GID`);
+  }
+  invariant(['linux/amd64', 'linux/arm64'].includes(env.IDP_RUNTIME_PLATFORM), 'IDP_RUNTIME_PLATFORM_INVALID', 'IDP_RUNTIME_PLATFORM只能是linux/amd64或linux/arm64');
+  if (typeof process.getuid === 'function' && typeof process.getgid === 'function') {
+    invariant(process.getuid() !== 0, 'IDP_ROOT_OPERATOR_FORBIDDEN', '不能使用root账号运行部署工具；0400运行时投影必须由非root部署用户创建');
+    invariant(Number(env.IDP_CONTAINER_UID) === process.getuid() && Number(env.IDP_CONTAINER_GID) === process.getgid(), 'IDP_CONTAINER_OWNER_MISMATCH', 'IDP_CONTAINER_UID/GID必须与当前部署用户一致，确保Linux容器可读取0400投影');
+  }
+  const active = new Set(resolveProfile(profile));
+  invariant(env.IDP_ENVIRONMENT !== 'production' || !active.has('smartgo') || env.IDP_ALLOW_NON_GIT_SMARTGO_SOURCE === 'false', 'IDP_NON_GIT_SOURCE_PRODUCTION_FORBIDDEN', '生产环境禁止非Git SmartGo源码发布；必须使用可追溯Git revision');
+  const network = validateNetworkConfiguration(env, active);
+  validateIdentityConfiguration(env);
+  if (active.has('registry')) registryPrivateScopes(env);
+  validateComponentConfiguration(active, env, components);
+  assertRequiredReferenceDeclarations(active, env, components);
+  const roots = ['IDP_DATA_DIR', 'IDP_BACKUP_DIR', 'IDP_LOG_DIR', 'IDP_RUNTIME_DIR', 'IDP_RESTORE_DIR'].map((key) => {
+    invariant(path.isAbsolute(env[key] ?? ''), 'IDP_RUNTIME_ROOT_INVALID', `${key}必须是绝对路径`);
+    const value = canonicalPlannedDirectory(env[key], key);
+    invariant(!['/', os.homedir(), '/Users', '/Users/Shared'].includes(value), 'IDP_RUNTIME_ROOT_TOO_BROAD', `${key}不能指向系统或用户根目录`);
+    env[key] = value;
+    return [key, value];
+  });
+  assertDisjointRoots([['IDP_CONFIG_DIR', root], ...roots]);
+  for (const [, candidate] of roots) assertOutsideRepositories(candidate, '运行数据根目录');
+  const unconfigured = [];
+  const optionalUnconfigured = [];
+  const techSourceCredentials = active.has('tech')
+    ? validateTechSourceCredentials(root, components.tech, { requireConfigured })
+    : { manifestReference: null, manifestPath: null, files: [] };
+  let imageLock;
+  for (const ref of referencedFiles(root)) {
+    const required = isReferenceRequired(ref, active, env, components);
+    const targetList = required ? unconfigured : optionalUnconfigured;
+    if (!fs.existsSync(ref.absolute)) targetList.push({ key: ref.key, reason: 'missing' });
+    else {
+      const stat = assertSafeRegularFile(ref.absolute, ref.key.includes('CERT') && !ref.key.includes('KEY') ? 0o644 : 0o600, { allowEmpty: true, role: ref.key });
+      if (stat.size === 0) targetList.push({ key: ref.key, reason: 'empty' });
+      else if (required) validateSourceReference(ref, stat);
+    }
+    if (requireConfigured && required) {
+      invariant(fs.existsSync(ref.absolute), 'IDP_REFERENCE_MISSING', `${ref.key}引用的文件不存在`);
+      assertSafeRegularFile(ref.absolute, ref.key.includes('CERT') && !ref.key.includes('KEY') ? 0o644 : 0o600, { allowEmpty: false, role: ref.key });
+    }
+  }
+  if (active.has('tech')) {
+    for (const file of techSourceCredentials.files) {
+      if (!fs.existsSync(file.absolute)) unconfigured.push({ key: `TECH_SOURCE_CREDENTIAL:${file.filename}`, reason: 'missing' });
+      else if (fs.statSync(file.absolute).size === 0) unconfigured.push({ key: `TECH_SOURCE_CREDENTIAL:${file.filename}`, reason: 'empty' });
+    }
+  }
+  validateDatabaseCredentialConsistency(root, active);
+  validateSmartGoCredentialConsistency(root, active);
+  if (requireConfigured) {
+    const imageKeys = requiredImages(active);
+    for (const key of imageKeys) {
+      invariant(/^.+@sha256:[0-9a-f]{64}$/u.test(env[key] ?? ''), 'IDP_IMAGE_NOT_PINNED', `${key}必须使用OCI digest锁定`);
+    }
+    imageLock = readImageLock(root, {
+      env,
+      requiredPlatforms: REQUIRED_IMAGE_PLATFORMS,
+      requiredKeys: imageKeys,
+      allowLegacy: allowLegacyImageLock,
+    }).document;
+  }
+  const imagePlaceholders = requiredImages(active).filter((key) => !/^.+@sha256:[0-9a-f]{64}$/u.test(env[key] ?? ''));
+  const report = {
+    schemaVersion: 1,
+    status: unconfigured.length || imagePlaceholders.length ? 'unconfigured' : 'valid',
+    configRoot: root,
+    environment: env.IDP_ENVIRONMENT,
+    instanceId: env.IDP_INSTANCE_ID,
+    profile,
+    host: { platform: os.platform(), arch: os.arch(), containerPlatform: env.IDP_RUNTIME_PLATFORM, appleSilicon: os.platform() === 'darwin' && os.arch() === 'arm64' },
+    edge: { ...network, publicHost: env.IDP_PUBLIC_HOST, allowedCidr: env.IDP_ALLOWED_CIDR },
+    unconfigured,
+    optionalUnconfigured,
+    imagePlaceholders,
+    imageLockDigest: imageLock?.digest ?? null,
+    digest: sha256(stableJson({
+      env,
+      components,
+      profile,
+      techSourceCredentialFiles: techSourceCredentials.files.map(({ filename }) => filename),
+      refs: referencedFiles(root)
+        .map(({ scope, key, reference }) => ({ scope, key, reference }))
+        .sort((left, right) => {
+          const leftKey = `${left.scope}\0${left.key}\0${left.reference}`;
+          const rightKey = `${right.scope}\0${right.key}\0${right.reference}`;
+          return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+        }),
+    })),
+  };
+  return { root, env, components, report, techSourceCredentials };
+}