openlearn-next 0.4.2 → 0.7.3

package/dist/cli-migrator.cjs

@@ -0,0 +1,310 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// packages/core/db/migrator.ts
+var migrator_exports = {};
+__export(migrator_exports, {
+  executeSqlStatements: () => executeSqlStatements,
+  getDefaultMigrationsDir: () => getDefaultMigrationsDir,
+  loadMigrationsFromDirectory: () => loadMigrationsFromDirectory,
+  parseMigrationSql: () => parseMigrationSql,
+  rollbackMigration: () => rollbackMigration,
+  runMigrations: () => runMigrations,
+  simpleChecksum: () => simpleChecksum,
+  splitSqlStatements: () => splitSqlStatements,
+  sqlMigration: () => sqlMigration
+});
+module.exports = __toCommonJS(migrator_exports);
+var import_fs = __toESM(require("fs"), 1);
+var import_path = __toESM(require("path"), 1);
+var import_url = require("url");
+
+// packages/core/db/backup-manager.ts
+var import_node_fs2 = __toESM(require("node:fs"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_better_sqlite3 = __toESM(require("better-sqlite3"), 1);
+
+// packages/core/db/secure-files.ts
+var import_node_fs = __toESM(require("node:fs"), 1);
+var SECURE_FILE_MODE = 384;
+var SECURE_DIR_MODE = 448;
+var GROUP_OTHER_BITS = 63;
+function currentMode(filePath) {
+  try {
+    return import_node_fs.default.statSync(filePath).mode & 511;
+  } catch {
+    return null;
+  }
+}
+function hardenFile(filePath) {
+  const mode = currentMode(filePath);
+  if (mode === null || (mode & GROUP_OTHER_BITS) === 0) return false;
+  try {
+    import_node_fs.default.chmodSync(filePath, SECURE_FILE_MODE);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hardenDir(dirPath) {
+  const mode = currentMode(dirPath);
+  if (mode === null || (mode & GROUP_OTHER_BITS) === 0) return false;
+  try {
+    import_node_fs.default.chmodSync(dirPath, SECURE_DIR_MODE);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function ensureSecureDir(dirPath) {
+  try {
+    import_node_fs.default.mkdirSync(dirPath, { recursive: true, mode: SECURE_DIR_MODE });
+  } catch {
+  }
+  hardenDir(dirPath);
+}
+
+// packages/core/db/backup-manager.ts
+function getDefaultBackupDir() {
+  if (process.env.BACKUP_DIR) {
+    return import_node_path.default.resolve(process.cwd(), process.env.BACKUP_DIR);
+  }
+  return import_node_path.default.resolve(process.cwd(), "backups");
+}
+function pruneByPrefix(backupDir, prefix, keepCount) {
+  if (keepCount <= 0 || !import_node_fs2.default.existsSync(backupDir)) return 0;
+  const files = import_node_fs2.default.readdirSync(backupDir).filter((f) => f.startsWith(prefix) && f.endsWith(".db")).sort().reverse();
+  if (files.length <= keepCount) return 0;
+  let pruned = 0;
+  for (const file of files.slice(keepCount)) {
+    try {
+      import_node_fs2.default.unlinkSync(import_node_path.default.join(backupDir, file));
+      pruned++;
+    } catch {
+    }
+  }
+  return pruned;
+}
+function resolvePreMigrationKeep() {
+  const n = Number(process.env.PRE_MIGRATION_KEEP ?? 5);
+  const keep = Number.isFinite(n) ? Math.floor(n) : 5;
+  return Math.max(1, keep);
+}
+function pruneMigratorSnapshots(backupDir = getDefaultBackupDir(), keepCount) {
+  return pruneByPrefix(backupDir, "pre_migration_", Math.max(1, keepCount ?? resolvePreMigrationKeep()));
+}
+
+// packages/core/db/migrator.ts
+var import_meta = {};
+function splitSqlStatements(sql) {
+  return sql.split(";").map((s) => s.trim()).filter((s) => {
+    const content = s.replace(/--.*$/gm, "").trim();
+    return content.length > 0;
+  });
+}
+function parseMigrationSql(name, content) {
+  const upMatch = content.match(/--\s*UP([\s\S]*?)(?=--\s*DOWN|$)/i);
+  const downMatch = content.match(/--\s*DOWN([\s\S]*)$/i);
+  const up = upMatch ? upMatch[1].trim() : downMatch ? content.slice(0, downMatch.index).trim() : content.trim();
+  const down = downMatch ? downMatch[1].trim() : "";
+  return { name, up, down };
+}
+function loadMigrationsFromDirectory(dirPath) {
+  if (!import_fs.default.existsSync(dirPath)) {
+    return [];
+  }
+  const files = import_fs.default.readdirSync(dirPath).filter((f) => f.endsWith(".sql")).sort((a, b) => a.localeCompare(b, void 0, { numeric: true, sensitivity: "base" }));
+  return files.map((file) => {
+    const fullPath = import_path.default.join(dirPath, file);
+    const content = import_fs.default.readFileSync(fullPath, "utf8");
+    const name = import_path.default.basename(file, ".sql");
+    return parseMigrationSql(name, content);
+  });
+}
+function executeSqlStatements(db, sql) {
+  const statements = splitSqlStatements(sql);
+  for (const stmt of statements) {
+    try {
+      db.exec(stmt);
+    } catch (err) {
+      if (err?.message && err.message.includes("duplicate column name")) {
+        continue;
+      }
+      throw err;
+    }
+  }
+}
+function simpleChecksum(text) {
+  let hash = 0;
+  for (let i = 0; i < text.length; i++) {
+    const char = text.charCodeAt(i);
+    hash = (hash << 5) - hash + char;
+    hash |= 0;
+  }
+  return hash.toString(16);
+}
+function runMigrations(db, migrations) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS _migrations (
+      name TEXT PRIMARY KEY,
+      applied_at INTEGER NOT NULL,
+      checksum TEXT NOT NULL
+    );
+  `);
+  const appliedRows = db.prepare("SELECT name, checksum FROM _migrations").all();
+  const applied = new Map(appliedRows.map((r) => [r.name, r.checksum]));
+  const byName = new Map(migrations.map((m) => [m.name, m]));
+  const drift = [];
+  for (const [name, stored] of applied) {
+    const migration = byName.get(name);
+    if (!migration) continue;
+    const actual = simpleChecksum(migration.up);
+    if (actual !== stored) {
+      drift.push({ name, stored, actual });
+    }
+  }
+  if (drift.length > 0) {
+    const detail = drift.map((d) => `  - ${d.name}: \u8BB0\u5F55 ${d.stored} \u2192 \u5F53\u524D\u6587\u4EF6 ${d.actual}`).join("\n");
+    const msg = `[Migration] \u5DF2\u6267\u884C\u8FC1\u79FB\u7684 UP \u811A\u672C\u5728\u5E94\u7528\u540E\u88AB\u4FEE\u6539\u8FC7\uFF1A
+${detail}
+  \u8FD9\u4E0D\u4F1A\u81EA\u52A8\u4FEE\u590D\u6570\u636E\u5E93 \u2014\u2014 \u5DF2\u6267\u884C\u7684\u90E8\u5206\u65E0\u6CD5\u56DE\u9000\u3002\u8BF7\u786E\u8BA4\u662F\u6709\u610F\u4FEE\u6539\uFF0C\u6216\u8865\u4E00\u6761\u65B0\u7684\u8FC1\u79FB\u6765\u4FEE\u6B63\u3002`;
+    if (process.env.MIGRATION_CHECKSUM_STRICT === "true") {
+      throw new Error(msg);
+    }
+    console.error(msg);
+  }
+  const pending = migrations.filter((m) => !applied.has(m.name));
+  if (pending.length > 0 && db.name && db.name !== ":memory:" && (process.env.FORCE_MIGRATION_SNAPSHOT === "true" || !process.env.VITEST)) {
+    try {
+      const backupDir = process.env.BACKUP_DIR || import_path.default.join(import_path.default.dirname(db.name), "backups");
+      ensureSecureDir(backupDir);
+      const now = /* @__PURE__ */ new Date();
+      const pad = (n) => String(n).padStart(2, "0");
+      const timestamp = `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}_${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
+      const backupFile = import_path.default.join(backupDir, `pre_migration_${timestamp}.db`);
+      const escaped = backupFile.replace(/'/g, "''");
+      db.exec(`VACUUM INTO '${escaped}'`);
+      hardenFile(backupFile);
+      try {
+        const pruned = pruneMigratorSnapshots(backupDir);
+        if (pruned > 0) console.log(`[Migration] Pruned ${pruned} old pre-migration snapshot(s)`);
+      } catch (pErr) {
+        console.warn("[Migration] Warning: failed to prune old pre-migration snapshots:", pErr);
+      }
+      console.log(`[Migration] Safety snapshot created before applying ${pending.length} migration(s): ${backupFile}`);
+    } catch (bErr) {
+      const message = bErr instanceof Error ? bErr.message : String(bErr);
+      if (!process.env.VITEST) {
+        throw new Error(`[Migration] \u8FC1\u79FB\u524D\u5FEB\u7167\u5931\u8D25\uFF0C\u5DF2\u4E2D\u6B62\u4E14\u672A\u5E94\u7528\u4EFB\u4F55\u5F85\u6267\u884C SQL: ${message}`, { cause: bErr });
+      }
+      console.warn("[Migration] Warning: Could not create pre-migration snapshot:", message);
+    }
+  }
+  for (const migration of migrations) {
+    if (applied.has(migration.name)) continue;
+    const applyOne = db.transaction(() => {
+      executeSqlStatements(db, migration.up);
+      db.prepare("INSERT INTO _migrations (name, applied_at, checksum) VALUES (?, ?, ?)").run(
+        migration.name,
+        Date.now(),
+        simpleChecksum(migration.up)
+      );
+    });
+    try {
+      applyOne();
+    } catch (err) {
+      console.error(`[Migration] FAILED: ${migration.name}`, err);
+      throw err;
+    }
+  }
+  return drift;
+}
+function rollbackMigration(db, migration) {
+  if (!migration.down || migration.down.trim() === "") {
+    throw new Error(`Migration ${migration.name} does not provide a DOWN rollback script.`);
+  }
+  executeSqlStatements(db, migration.down);
+  db.prepare("DELETE FROM _migrations WHERE name = ?").run(migration.name);
+}
+function sqlMigration(name, up, down = "") {
+  return { name, up, down };
+}
+function getDefaultMigrationsDir(options = {}) {
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const hasSql = (dir) => {
+    try {
+      return import_fs.default.existsSync(dir) && import_fs.default.readdirSync(dir).some((f) => f.endsWith(".sql"));
+    } catch {
+      return false;
+    }
+  };
+  const override = env.OPENLEARN_MIGRATIONS_DIR;
+  if (override && hasSql(override)) return import_path.default.resolve(override);
+  const starts = options.startDirs ? [...options.startDirs] : [];
+  if (!options.startDirs && typeof __dirname !== "undefined") starts.push(__dirname);
+  try {
+    if (!options.startDirs && typeof import_meta !== "undefined" && import_meta.url) {
+      starts.push(import_path.default.dirname((0, import_url.fileURLToPath)(import_meta.url)));
+    }
+  } catch {
+  }
+  for (const start of starts) {
+    let dir = import_path.default.resolve(start);
+    for (; ; ) {
+      const pkgPath = import_path.default.join(dir, "package.json");
+      if (import_fs.default.existsSync(pkgPath)) {
+        try {
+          const pkg = JSON.parse(import_fs.default.readFileSync(pkgPath, "utf-8"));
+          if (pkg.name === "openlearn-next") {
+            const candidate = import_path.default.join(dir, "migrations");
+            if (hasSql(candidate)) return candidate;
+          }
+        } catch {
+        }
+      }
+      const parent = import_path.default.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return import_path.default.resolve(cwd, "migrations");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  executeSqlStatements,
+  getDefaultMigrationsDir,
+  loadMigrationsFromDirectory,
+  parseMigrationSql,
+  rollbackMigration,
+  runMigrations,
+  simpleChecksum,
+  splitSqlStatements,
+  sqlMigration
+});

package/dist/env-validation.cjs

@@ -0,0 +1,351 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// server/security/env-validation.ts
+var env_validation_exports = {};
+__export(env_validation_exports, {
+  assertStartupEnv: () => assertStartupEnv,
+  formatEnvIssues: () => formatEnvIssues,
+  validateStartupEnv: () => validateStartupEnv
+});
+module.exports = __toCommonJS(env_validation_exports);
+var import_node_net = __toESM(require("node:net"), 1);
+var NODE_ENVS = ["development", "production", "test"];
+var ISOLATE_KINDS = ["thread", "process"];
+var PERMISSION_POLICIES = ["rw", "ro", "off"];
+var LIVENESS_VALUES = ["on", "off"];
+var TELEMETRY_VALUES = ["on", "off"];
+var QUOTA_INT_KEYS = [
+  "OPENLEARN_PLUGIN_MAX_RSS_MB",
+  "OPENLEARN_PLUGIN_CPU_QUOTA_MS",
+  "OPENLEARN_PLUGIN_CPU_WINDOW_MS"
+];
+var QUOTA_SWITCH_KEYS = ["OPENLEARN_PLUGIN_QUOTA"];
+var LIVENESS_INT_KEYS = ["OPENLEARN_WORKER_LIVENESS_INTERVAL_MS", "OPENLEARN_WORKER_LIVENESS_GRACE_MS"];
+var HEX_64 = /^[0-9a-fA-F]{64}$/;
+function trimmed(env, key) {
+  const raw = env[key];
+  if (raw === void 0 || raw === null) return void 0;
+  const value = String(raw).trim();
+  return value === "" ? void 0 : value;
+}
+function unquote(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1).trim();
+  }
+  return value;
+}
+function isValidTrustProxyToken(token) {
+  const value = token.trim();
+  if (value === "") return false;
+  if (/^\d+$/.test(value)) return Number(value) >= 0;
+  if (value === "true" || value === "false") return true;
+  if (value === "loopback" || value === "linklocal" || value === "uniquelocal") return true;
+  if (import_node_net.default.isIP(value) !== 0) return true;
+  const cidr = /^(.+)\/(\d+)$/.exec(value);
+  if (cidr && import_node_net.default.isIP(cidr[1]) !== 0) {
+    const prefix = Number(cidr[2]);
+    const maxPrefix = import_node_net.default.isIPv6(cidr[1]) ? 128 : 32;
+    return prefix >= 0 && prefix <= maxPrefix;
+  }
+  return false;
+}
+function isValidOriginPattern(entry) {
+  const value = entry.trim();
+  if (value === "") return false;
+  if (value === "*") return true;
+  let parsed;
+  try {
+    parsed = new URL(value.replace(":*", ":0"));
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+  if (!parsed.hostname) return false;
+  return true;
+}
+function splitList(value) {
+  if (!value) return [];
+  return value.split(",").map((part) => part.trim()).filter(Boolean);
+}
+function validateStartupEnv(env = process.env) {
+  const errors = [];
+  const warnings = [];
+  const isProduction = env.NODE_ENV === "production";
+  const nodeEnv = trimmed(env, "NODE_ENV");
+  if (nodeEnv && !NODE_ENVS.includes(nodeEnv)) {
+    errors.push({
+      key: "NODE_ENV",
+      severity: "error",
+      message: `NODE_ENV \u5FC5\u987B\u662F ${NODE_ENVS.join(" / ")} \u4E4B\u4E00\uFF0C\u5B9E\u9645\u4E3A "${nodeEnv}"\u3002`
+    });
+  }
+  const port = trimmed(env, "PORT");
+  if (port && !/^\d+$/.test(port)) {
+    errors.push({ key: "PORT", severity: "error", message: `PORT \u5FC5\u987B\u662F\u6574\u6570\uFF0C\u5B9E\u9645\u4E3A "${port}"\u3002` });
+  } else if (port) {
+    const parsedPort = Number(port);
+    if (parsedPort < 1 || parsedPort > 65535) {
+      errors.push({
+        key: "PORT",
+        severity: "error",
+        message: `PORT \u5FC5\u987B\u5728 1-65535 \u4E4B\u95F4\uFF0C\u5B9E\u9645\u4E3A ${parsedPort}\u3002`
+      });
+    }
+  }
+  const trustProxy = trimmed(env, "TRUST_PROXY");
+  if (trustProxy) {
+    const tokens = splitList(trustProxy);
+    const invalid = tokens.filter((token) => !isValidTrustProxyToken(token));
+    if (tokens.length === 0 || invalid.length > 0) {
+      errors.push({
+        key: "TRUST_PROXY",
+        severity: "error",
+        message: `TRUST_PROXY \u542B\u65E0\u6CD5\u8BC6\u522B\u7684\u53D6\u503C ${invalid.length ? invalid.map((t) => `"${t}"`).join(", ") : `"${trustProxy}"`}\u3002 \u5141\u8BB8\uFF1A0/false\u30011/true\u3001\u975E\u8D1F\u6574\u6570\u3001loopback/linklocal/uniquelocal\u3001\u5177\u4F53 IP\u3001\u9017\u53F7\u5206\u9694\u7EC4\u5408\u3002`
+      });
+    }
+    if (isProduction && tokens.some((token) => token === "true" || token === "1")) {
+      warnings.push({
+        key: "TRUST_PROXY",
+        severity: "warning",
+        message: "\u751F\u4EA7\u73AF\u5883\u4FE1\u4EFB\u6240\u6709\u4E0A\u6E38\u4EE3\u7406\uFF08TRUST_PROXY=1/true\uFF09\u3002\u82E5\u670D\u52A1\u53EF\u88AB\u516C\u7F51\u76F4\u8FDE\uFF0C\u5BA2\u6237\u7AEF\u53EF\u4F2A\u9020 X-Forwarded-For \u7ED5\u8FC7\u9650\u6D41\u3002"
+      });
+    }
+  }
+  const encryptionKey = trimmed(env, "ENCRYPTION_KEY");
+  if (encryptionKey) {
+    const value = unquote(encryptionKey);
+    if (!HEX_64.test(value)) {
+      errors.push({
+        key: "ENCRYPTION_KEY",
+        severity: "error",
+        message: "ENCRYPTION_KEY \u5FC5\u987B\u662F 64 \u4F4D\u5341\u516D\u8FDB\u5236\uFF0832 \u5B57\u8282\uFF09\u3002\u4E0D\u8981\u4F7F\u7528\u77ED\u5BC6\u94A5\u6216\u5360\u4F4D\u7B26\u3002"
+      });
+    }
+  } else if (isProduction) {
+    warnings.push({
+      key: "ENCRYPTION_KEY",
+      severity: "warning",
+      message: "\u672A\u8BBE\u7F6E ENCRYPTION_KEY\uFF0C\u5C06\u4F7F\u7528/\u751F\u6210 storage/encryption-key\u3002\u751F\u4EA7\u73AF\u5883\u5EFA\u8BAE\u663E\u5F0F\u8BBE\u7F6E\u5E76\u79BB\u7EBF\u5907\u4EFD\uFF0C\u5426\u5219\u4E22\u5931\u8BE5\u6587\u4EF6\u5C06\u65E0\u6CD5\u89E3\u5BC6 AI Key \u4E0E\u73ED\u7EA7\u53E3\u4EE4\u3002"
+    });
+  }
+  const isolate = trimmed(env, "OPENLEARN_WORKER_ISOLATE");
+  if (isolate && !ISOLATE_KINDS.includes(isolate.toLowerCase())) {
+    errors.push({
+      key: "OPENLEARN_WORKER_ISOLATE",
+      severity: "error",
+      message: `OPENLEARN_WORKER_ISOLATE \u5FC5\u987B\u662F ${ISOLATE_KINDS.join(" / ")}\uFF0C\u5B9E\u9645\u4E3A "${isolate}"\u3002`
+    });
+  }
+  const permission = trimmed(env, "OPENLEARN_PLUGIN_PERMISSION");
+  if (permission && !PERMISSION_POLICIES.includes(permission.toLowerCase())) {
+    errors.push({
+      key: "OPENLEARN_PLUGIN_PERMISSION",
+      severity: "error",
+      message: `OPENLEARN_PLUGIN_PERMISSION \u5FC5\u987B\u662F ${PERMISSION_POLICIES.join(" / ")}\uFF0C\u5B9E\u9645\u4E3A "${permission}"\u3002 \u62FC\u9519\u4F1A\u9759\u9ED8\u56DE\u843D\u9ED8\u8BA4\u7B56\u7565\uFF0C\u56E0\u6B64\u62D2\u7EDD\u542F\u52A8\u800C\u4E0D\u662F\u7EE7\u7EED\u3002`
+    });
+  }
+  const heap = trimmed(env, "OPENLEARN_PLUGIN_MAX_HEAP_MB");
+  if (heap) {
+    const lower = heap.toLowerCase();
+    if (lower !== "off" && lower !== "none" && lower !== "0") {
+      const match = /^(\d+)$/.exec(heap);
+      const mb = match ? Number(match[1]) : NaN;
+      if (!match || mb < 32) {
+        errors.push({
+          key: "OPENLEARN_PLUGIN_MAX_HEAP_MB",
+          severity: "error",
+          message: `OPENLEARN_PLUGIN_MAX_HEAP_MB \u5FC5\u987B\u662F "off"/"none"/"0" \u6216 >= 32 \u7684\u6574\u6570 MB\uFF0C\u5B9E\u9645\u4E3A "${heap}"\u3002 \u5E26\u5355\u4F4D\uFF08\u5982 128MB\uFF09\u6216\u4F4E\u4E8E\u4E0B\u9650\u4F1A\u9759\u9ED8\u56DE\u843D\u9ED8\u8BA4\u503C\uFF0C\u56E0\u6B64\u62D2\u7EDD\u542F\u52A8\u800C\u4E0D\u662F\u7EE7\u7EED\u3002`
+        });
+      }
+    }
+  }
+  const liveness = trimmed(env, "OPENLEARN_WORKER_LIVENESS");
+  if (liveness && !LIVENESS_VALUES.includes(liveness.toLowerCase())) {
+    errors.push({
+      key: "OPENLEARN_WORKER_LIVENESS",
+      severity: "error",
+      message: `OPENLEARN_WORKER_LIVENESS \u53EA\u80FD\u662F on / off\uFF0C\u5B9E\u9645\u4E3A "${liveness}"\u3002`
+    });
+  }
+  const enforce = trimmed(env, "OPENLEARN_ENFORCE_PLUGIN_ISOLATION");
+  if (enforce && !["1", "0"].includes(enforce)) {
+    errors.push({
+      key: "OPENLEARN_ENFORCE_PLUGIN_ISOLATION",
+      severity: "error",
+      message: `OPENLEARN_ENFORCE_PLUGIN_ISOLATION \u53EA\u80FD\u662F "1" \u6216 "0"\uFF0C\u5B9E\u9645\u4E3A "${enforce}"\u3002 \u5224\u5B9A\u5904\u662F \`!== '1'\` \u2014\u2014 \u5199\u6210 true/yes \u4F1A\u88AB\u9759\u9ED8\u5F53\u6210"\u672A\u5F00\u542F"\uFF0C\u56E0\u6B64\u62D2\u7EDD\u542F\u52A8\u800C\u4E0D\u662F\u7EE7\u7EED\u3002`
+    });
+  }
+  const trustedInline = trimmed(env, "OPENLEARN_TRUSTED_INLINE_PLUGINS");
+  if (trustedInline) {
+    const ids = splitList(trustedInline);
+    if (ids.length === 0) {
+      warnings.push({
+        key: "OPENLEARN_TRUSTED_INLINE_PLUGINS",
+        severity: "warning",
+        message: "OPENLEARN_TRUSTED_INLINE_PLUGINS \u53EA\u542B\u7A7A\u767D/\u9017\u53F7\uFF0C\u7B49\u540C\u4E8E\u672A\u914D\u7F6E\u3002"
+      });
+    } else if (isProduction) {
+      warnings.push({
+        key: "OPENLEARN_TRUSTED_INLINE_PLUGINS",
+        severity: "warning",
+        message: `\u751F\u4EA7\u73AF\u5883\u4FE1\u4EFB\u4E86 ${ids.length} \u4E2A\u63D2\u4EF6\u5728**\u8FDB\u7A0B\u5185**\u8FD0\u884C\uFF1A${ids.join(", ")}\u3002 \u5B83\u4EEC\u4E0E\u5BBF\u4E3B\u5171\u4EAB\u73AF\u5883\u53D8\u91CF\u4E0E\u7F51\u7EDC\u6808\uFF0C\u51FA\u7AD9\u7F51\u7EDC\u62E6\u622A\u5BF9\u5B83\u4EEC\u4E0D\u751F\u6548\u3002 \u786E\u8BA4\u8FD9\u662F\u6709\u610F\u4E3A\u4E4B\uFF1B\u5426\u5219\u6E05\u7A7A\u8BE5\u53D8\u91CF\u8BA9\u5B83\u4EEC\u56DE\u5230 process \u5B50\u8FDB\u7A0B\u9694\u79BB\u3002`
+      });
+    }
+  }
+  for (const key of QUOTA_SWITCH_KEYS) {
+    const value = trimmed(env, key);
+    if (value && !LIVENESS_VALUES.includes(value.toLowerCase())) {
+      errors.push({
+        key,
+        severity: "error",
+        message: `${key} \u53EA\u80FD\u662F on / off\uFF0C\u5B9E\u9645\u4E3A "${value}"\u3002\u5199\u9519\u4F1A\u9759\u9ED8\u4FDD\u6301\u914D\u989D\u751F\u6548\uFF0C\u770B\u8D77\u6765\u50CF"\u5173\u6389\u4E86\u4F46\u6CA1\u7528"\u3002`
+      });
+    }
+  }
+  for (const key of QUOTA_INT_KEYS) {
+    const value = trimmed(env, key);
+    if (!value) continue;
+    const lower = value.toLowerCase();
+    if (lower === "off" || lower === "none" || lower === "0") continue;
+    if (!/^\d+$/.test(value) || Number(value) <= 0) {
+      errors.push({
+        key,
+        severity: "error",
+        message: `${key} \u5FC5\u987B\u662F "off"/"none"/"0" \u6216\u6B63\u6574\u6570\uFF08\u6BEB\u79D2 / MB\uFF09\uFF0C\u5B9E\u9645\u4E3A "${value}"\u3002 \u5E26\u5355\u4F4D\uFF08\u5982 20s\u3001512MB\uFF09\u4F1A\u9759\u9ED8\u56DE\u843D\u9ED8\u8BA4\u503C\uFF0C\u56E0\u6B64\u62D2\u7EDD\u542F\u52A8\u800C\u4E0D\u662F\u7EE7\u7EED\u3002`
+      });
+    } else if (key.endsWith("_WINDOW_MS") && Number(value) < 1e3) {
+      warnings.push({
+        key,
+        severity: "warning",
+        message: `${key}=${value} \u5C0F\u4E8E 1 \u79D2\uFF0C\u91C7\u6837\u7A97\u53E3\u8FC7\u77ED\u4F1A\u8BA9 CPU \u914D\u989D\u5224\u5B9A\u6296\u52A8\uFF08\u91C7\u6837\u672C\u8EAB\u662F 1s \u4E00\u6B21\uFF09\u3002`
+      });
+    }
+  }
+  for (const key of LIVENESS_INT_KEYS) {
+    const value = trimmed(env, key);
+    if (!value) continue;
+    if (!/^\d+$/.test(value) || Number(value) <= 0) {
+      errors.push({
+        key,
+        severity: "error",
+        message: `${key} \u5FC5\u987B\u662F\u6B63\u6574\u6570\uFF08\u6BEB\u79D2\uFF09\uFF0C\u5B9E\u9645\u4E3A "${value}"\u3002\u975E\u6CD5\u503C\u4F1A\u9759\u9ED8\u56DE\u843D\u9ED8\u8BA4\u63A2\u6D3B\u8282\u594F\u3002`
+      });
+    }
+  }
+  const telemetry = trimmed(env, "BRIDGE_HOOK_TELEMETRY");
+  if (telemetry && !TELEMETRY_VALUES.includes(telemetry.toLowerCase())) {
+    errors.push({
+      key: "BRIDGE_HOOK_TELEMETRY",
+      severity: "error",
+      message: `BRIDGE_HOOK_TELEMETRY \u53EA\u80FD\u662F on / off\uFF0C\u5B9E\u9645\u4E3A "${telemetry}"\u3002`
+    });
+  }
+  const allowedOrigins = trimmed(env, "ALLOWED_ORIGINS");
+  if (allowedOrigins) {
+    const origins = splitList(allowedOrigins);
+    const invalid = origins.filter((origin) => !isValidOriginPattern(origin));
+    if (invalid.length > 0) {
+      errors.push({
+        key: "ALLOWED_ORIGINS",
+        severity: "error",
+        message: `ALLOWED_ORIGINS \u542B\u975E\u6CD5 origin\uFF1A${invalid.map((o) => `"${o}"`).join(", ")}\u3002`
+      });
+    }
+    if (origins.includes("*")) {
+      warnings.push({
+        key: "ALLOWED_ORIGINS",
+        severity: "warning",
+        message: 'ALLOWED_ORIGINS \u542B "*"\uFF0C\u5C06\u5173\u95ED\u51ED\u8BC1\u652F\u6301\u3002\u751F\u4EA7\u73AF\u5883\u5EFA\u8BAE\u6539\u4E3A\u663E\u5F0F\u6765\u6E90\u767D\u540D\u5355\u3002'
+      });
+    }
+  }
+  for (const key of ["ALLOWED_FRAME_ORIGINS", "LTI_ALLOWED_LMS_ORIGINS"]) {
+    const raw = trimmed(env, key);
+    if (!raw) continue;
+    const invalid = splitList(raw).filter((origin) => !isValidOriginPattern(origin));
+    if (invalid.length > 0) {
+      warnings.push({
+        key,
+        severity: "warning",
+        message: `${key} \u542B\u65E0\u6CD5\u89E3\u6790\u7684 origin\uFF1A${invalid.map((o) => `"${o}"`).join(", ")}\uFF0C\u5C06\u65E0\u6CD5\u5339\u914D\u4EFB\u4F55\u6765\u6E90\u3002`
+      });
+    }
+  }
+  if (isProduction) {
+    const adminPassword = trimmed(env, "OPENLEARN_ADMIN_PASSWORD");
+    if (adminPassword && adminPassword.toLowerCase() === "admin") {
+      errors.push({
+        key: "OPENLEARN_ADMIN_PASSWORD",
+        severity: "error",
+        message: '\u751F\u4EA7\u73AF\u5883\u7981\u6B62\u628A OPENLEARN_ADMIN_PASSWORD \u8BBE\u4E3A\u7528\u6237\u540D "admin"\u3002\u8BF7\u8BBE\u7F6E\u5F3A\u53E3\u4EE4\u3002'
+      });
+    }
+    const teacherPassword = trimmed(env, "OPENLEARN_TEACHER_PASSWORD");
+    if (teacherPassword && teacherPassword.toLowerCase() === "teacher") {
+      errors.push({
+        key: "OPENLEARN_TEACHER_PASSWORD",
+        severity: "error",
+        message: '\u751F\u4EA7\u73AF\u5883\u7981\u6B62\u628A OPENLEARN_TEACHER_PASSWORD \u8BBE\u4E3A\u7528\u6237\u540D "teacher"\u3002\u8BF7\u8BBE\u7F6E\u5F3A\u53E3\u4EE4\u3002'
+      });
+    }
+  }
+  const metricsToken = trimmed(env, "METRICS_TOKEN");
+  if (metricsToken && metricsToken.length < 16) {
+    warnings.push({
+      key: "METRICS_TOKEN",
+      severity: "warning",
+      message: "METRICS_TOKEN \u77ED\u4E8E 16 \u4E2A\u5B57\u7B26\uFF0C\u5BB9\u6613\u88AB\u66B4\u529B\u731C\u6D4B\uFF0C\u5EFA\u8BAE\u52A0\u957F\u3002"
+    });
+  }
+  return { errors, warnings };
+}
+function formatEnvIssues(issues) {
+  return issues.map((issue) => `  [${issue.severity.toUpperCase()}] ${issue.key}: ${issue.message}`).join("\n");
+}
+function assertStartupEnv(env = process.env) {
+  const { errors, warnings } = validateStartupEnv(env);
+  if (warnings.length > 0) {
+    console.warn(`[Security] \u542F\u52A8\u671F\u73AF\u5883\u53D8\u91CF\u544A\u8B66\uFF1A
+${formatEnvIssues(warnings)}`);
+  }
+  if (errors.length > 0) {
+    const message = `[Security] FATAL: \u542F\u52A8\u671F\u73AF\u5883\u53D8\u91CF\u6821\u9A8C\u5931\u8D25\uFF0C\u62D2\u7EDD\u542F\u52A8\uFF08${errors.length} \u9879\uFF09\uFF1A
+` + formatEnvIssues(errors);
+    const error = new Error(message);
+    error.name = "StartupEnvValidationError";
+    throw error;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  assertStartupEnv,
+  formatEnvIssues,
+  validateStartupEnv
+});