openlearn-next 0.7.3 → 0.7.4

package/dist/server.cjs

@@ -1188,12 +1188,12 @@ var init_manifest_schema = __esm({
 // packages/core/di/api-key-crypto.ts
 function resolveEncryptionKeyStorageDir(env = process.env, cwd = process.cwd()) {
   if (env.OPENLEARN_DATA_DIR?.trim()) {
-    return import_node_path3.default.join(import_node_path3.default.resolve(env.OPENLEARN_DATA_DIR.trim()), "storage");
+    return import_node_path4.default.join(import_node_path4.default.resolve(env.OPENLEARN_DATA_DIR.trim()), "storage");
   }
   if (env.OPENLEARN_DB_PATH?.trim()) {
-    return import_node_path3.default.join(import_node_path3.default.dirname(import_node_path3.default.resolve(env.OPENLEARN_DB_PATH.trim())), "storage");
+    return import_node_path4.default.join(import_node_path4.default.dirname(import_node_path4.default.resolve(env.OPENLEARN_DB_PATH.trim())), "storage");
   }
-  return import_node_path3.default.join(cwd, "storage");
+  return import_node_path4.default.join(cwd, "storage");
 }
 function normalizeKeyHex(raw) {
   let value = raw.trim();
@@ -1214,11 +1214,11 @@ function readProcessEnvKey(env) {
   return normalizeKeyHex(raw);
 }
 function readDotEnvKey(cwd) {
-  const envPath = import_node_path3.default.resolve(cwd, ".env");
-  if (!import_node_fs3.default.existsSync(envPath)) return null;
+  const envPath = import_node_path4.default.resolve(cwd, ".env");
+  if (!import_node_fs4.default.existsSync(envPath)) return null;
   let content = "";
   try {
-    content = import_node_fs3.default.readFileSync(envPath, "utf8");
+    content = import_node_fs4.default.readFileSync(envPath, "utf8");
   } catch {
     return null;
   }
@@ -1227,11 +1227,11 @@ function readDotEnvKey(cwd) {
   return normalizeKeyHex(match[1] ?? "");
 }
 function keyFilePath(storageDir) {
-  return import_node_path3.default.join(storageDir, ENCRYPTION_KEY_FILE_NAME);
+  return import_node_path4.default.join(storageDir, ENCRYPTION_KEY_FILE_NAME);
 }
 function chmodKeyFile(filePath) {
   try {
-    import_node_fs3.default.chmodSync(filePath, 384);
+    import_node_fs4.default.chmodSync(filePath, 384);
   } catch (err) {
     throw new Error(
       `\u65E0\u6CD5\u5C06 ${filePath} \u7684\u6743\u9650\u8BBE\u4E3A 0600\uFF08${err instanceof Error ? err.message : err}\uFF09\u3002\u5DF2\u62D2\u7EDD\u7EE7\u7EED\u4F7F\u7528\u8BE5\u5BC6\u94A5\u6587\u4EF6\u3002`
@@ -1239,8 +1239,8 @@ function chmodKeyFile(filePath) {
   }
 }
 function readKeyFile(filePath) {
-  if (!import_node_fs3.default.existsSync(filePath)) return null;
-  const normalized = normalizeKeyHex(import_node_fs3.default.readFileSync(filePath, "utf8"));
+  if (!import_node_fs4.default.existsSync(filePath)) return null;
+  const normalized = normalizeKeyHex(import_node_fs4.default.readFileSync(filePath, "utf8"));
   if (!normalized) {
     throw new EncryptionKeyInvalidError(
       `\u5BC6\u94A5\u6587\u4EF6 ${filePath} \u662F\u7A7A\u7684\u3002\u8BF7\u5220\u6389\u5B83\uFF0C\u6216\u5199\u5165\u539F\u6765\u7684 64 \u4F4D hex\u3002\u4E0D\u8981\u8BA9\u7CFB\u7EDF\u53E6\u9020\u4E00\u628A\u94A5\u5319\u3002`
@@ -1253,9 +1253,9 @@ function keysEqual(left, right) {
   return import_node_crypto.default.timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
 }
 function persistGeneratedKey(filePath, generated) {
-  import_node_fs3.default.mkdirSync(import_node_path3.default.dirname(filePath), { recursive: true });
+  import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(filePath), { recursive: true });
   try {
-    import_node_fs3.default.writeFileSync(filePath, `${generated}
+    import_node_fs4.default.writeFileSync(filePath, `${generated}
 `, { mode: 384, flag: "wx" });
   } catch (err) {
     const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
@@ -1291,7 +1291,7 @@ function resolveEncryptionKey(options = {}) {
   const fromDotEnv = fromProcess ? null : readDotEnvKey(cwd);
   const configured = fromProcess ?? fromDotEnv;
   const configuredSource = fromProcess ? "env" : fromDotEnv ? "env-file" : null;
-  const fileKey = import_node_fs3.default.existsSync(filePath) ? readKeyFile(filePath) : null;
+  const fileKey = import_node_fs4.default.existsSync(filePath) ? readKeyFile(filePath) : null;
   if (configured && fileKey && !keysEqual(configured, fileKey)) {
     throw new EncryptionKeyMismatchError(filePath);
   }
@@ -1400,13 +1400,13 @@ function encryptStoredPlaintextApiKeys(db2) {
   }
   return { updated, skipped };
 }
-var import_node_crypto, import_node_fs3, import_node_path3, ENCRYPTION_KEY_FILE_NAME, AUTO_GENERATED_KEY_WARNING, HEX_64, EncryptionKeyInvalidError, EncryptionKeyMismatchError, cached;
+var import_node_crypto, import_node_fs4, import_node_path4, ENCRYPTION_KEY_FILE_NAME, AUTO_GENERATED_KEY_WARNING, HEX_64, EncryptionKeyInvalidError, EncryptionKeyMismatchError, cached;
 var init_api_key_crypto = __esm({
   "packages/core/di/api-key-crypto.ts"() {
     "use strict";
     import_node_crypto = __toESM(require("node:crypto"), 1);
-    import_node_fs3 = __toESM(require("node:fs"), 1);
-    import_node_path3 = __toESM(require("node:path"), 1);
+    import_node_fs4 = __toESM(require("node:fs"), 1);
+    import_node_path4 = __toESM(require("node:path"), 1);
     ENCRYPTION_KEY_FILE_NAME = "encryption-key";
     AUTO_GENERATED_KEY_WARNING = "\u6B63\u5728\u4F7F\u7528\u81EA\u52A8\u751F\u6210\u7684\u52A0\u5BC6\u5BC6\u94A5\uFF08storage/encryption-key\uFF0C\u4E0E bootstrap-credentials.txt \u540C\u76EE\u5F55\uFF0C\u6743\u9650 600\uFF09\u3002\u5EFA\u8BAE\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF ENCRYPTION_KEY \u4E3A\u8BE5\u6587\u4EF6\u4E2D\u7684 64 \u4F4D hex\uFF0C\u5E76\u79BB\u7EBF\u5907\u4EFD\u8BE5\u6587\u4EF6\u3002site-backup \u4E0D\u5305\u542B\u6B64\u6587\u4EF6\u3002\u4E22\u5931\u540E\u65E0\u6CD5\u89E3\u5BC6 AI Provider API Key \u4E0E\u73ED\u7EA7\u4E34\u65F6\u53E3\u4EE4\u3002";
     HEX_64 = /^[0-9a-fA-F]{64}$/;
@@ -1921,49 +1921,49 @@ function getMaxUncompressedSize() {
 }
 function isInsideRoot(root, target) {
   if (!root || !target) return false;
-  const rel = path7.relative(path7.resolve(root), path7.resolve(target));
+  const rel = path8.relative(path8.resolve(root), path8.resolve(target));
   if (rel === "") return false;
-  if (path7.isAbsolute(rel)) return false;
-  return rel !== ".." && !rel.startsWith(".." + path7.sep);
+  if (path8.isAbsolute(rel)) return false;
+  return rel !== ".." && !rel.startsWith(".." + path8.sep);
 }
 function realPathOrNull(target) {
   try {
-    return fs6.realpathSync(target);
+    return fs7.realpathSync(target);
   } catch {
     return null;
   }
 }
 function realPathOrSelf(target) {
-  return realPathOrNull(target) ?? path7.resolve(target);
+  return realPathOrNull(target) ?? path8.resolve(target);
 }
 function getMaxUploadBodyBytes() {
   return getMaxUncompressedSize();
 }
 function readZipBufferFromPath(zipPath) {
-  if (!fs6.existsSync(zipPath)) {
+  if (!fs7.existsSync(zipPath)) {
     throw new Error(`[install-utils] ZIP \u6587\u4EF6\u4E0D\u5B58\u5728: ${zipPath}`);
   }
-  return fs6.readFileSync(zipPath);
+  return fs7.readFileSync(zipPath);
 }
 function writeBufferToTempZip(buffer, prefix = "plugin-upload-") {
   if (!Buffer.isBuffer(buffer) || buffer.length === 0) {
     throw new Error("[install-utils] \u7A7A\u7684 ZIP Buffer");
   }
-  const zipPath = path7.join(os2.tmpdir(), `${prefix}${(0, import_uuid6.v7)()}.zip`);
-  fs6.writeFileSync(zipPath, buffer);
+  const zipPath = path8.join(os2.tmpdir(), `${prefix}${(0, import_uuid6.v7)()}.zip`);
+  fs7.writeFileSync(zipPath, buffer);
   return zipPath;
 }
 function removeTempZip(zipPath) {
   if (!zipPath) return;
   try {
-    fs6.rmSync(zipPath, { force: true });
+    fs7.rmSync(zipPath, { force: true });
   } catch {
   }
 }
 function removeTempFile(filePath) {
   if (!filePath) return;
   try {
-    fs6.rmSync(filePath, { force: true });
+    fs7.rmSync(filePath, { force: true });
   } catch {
   }
 }
@@ -2209,13 +2209,13 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
   const esbuild = await import("esbuild");
   const allowedRoots = [];
   const allowRoot = (dir) => {
-    const lexical = path7.resolve(dir);
+    const lexical = path8.resolve(dir);
     if (allowedRoots.some((r) => r.lexical === lexical)) return;
     allowedRoots.push({ lexical, real: realPathOrSelf(lexical) });
   };
   allowRoot(resolveDir);
   const isPermittedPath = (target) => {
-    const resolved = path7.resolve(target);
+    const resolved = path8.resolve(target);
     if (allowedRoots.some((r) => isInsideRoot(r.lexical, resolved))) return true;
     const real = realPathOrNull(resolved);
     if (!real) return false;
@@ -2242,14 +2242,14 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
         setup(build) {
           build.onResolve({ filter: /.*/ }, (args) => {
             if (args.path.includes("core/di/interfaces")) {
-              const tsPath = path7.resolve(process.cwd(), "packages/core/di/interfaces.ts");
-              if (fs6.existsSync(tsPath)) {
-                allowRoot(path7.dirname(tsPath));
+              const tsPath = path8.resolve(process.cwd(), "packages/core/di/interfaces.ts");
+              if (fs7.existsSync(tsPath)) {
+                allowRoot(path8.dirname(tsPath));
                 return { path: tsPath };
               }
-              const jsPath = path7.resolve(process.cwd(), "packages/core/di/interfaces.js");
-              if (fs6.existsSync(jsPath)) {
-                allowRoot(path7.dirname(jsPath));
+              const jsPath = path8.resolve(process.cwd(), "packages/core/di/interfaces.js");
+              if (fs7.existsSync(jsPath)) {
+                allowRoot(path8.dirname(jsPath));
                 return { path: jsPath };
               }
             }
@@ -2263,8 +2263,8 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
               };
             }
             if (args.path.startsWith(".")) {
-              const importerDir = args.resolveDir || path7.resolve(resolveDir);
-              const candidate = path7.resolve(importerDir, args.path);
+              const importerDir = args.resolveDir || path8.resolve(resolveDir);
+              const candidate = path8.resolve(importerDir, args.path);
               if (!isPermittedPath(candidate)) {
                 return {
                   errors: [
@@ -2302,7 +2302,7 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
     ]
   });
   if (outfile !== void 0) {
-    assertPluginCodeSafe(fs6.readFileSync(outfile, "utf-8"));
+    assertPluginCodeSafe(fs7.readFileSync(outfile, "utf-8"));
     return void 0;
   }
   const bundled = result.outputFiles?.[0]?.text;
@@ -2316,8 +2316,8 @@ async function extractZipEntries(zip, destDir, maxTotalBytes) {
   let totalBytes = 0;
   for (const [name, file] of Object.entries(zip.files)) {
     if (file.dir) continue;
-    const filePath = path7.join(destDir, name);
-    fs6.mkdirSync(path7.dirname(filePath), { recursive: true });
+    const filePath = path8.join(destDir, name);
+    fs7.mkdirSync(path8.dirname(filePath), { recursive: true });
     const content = await file.async("nodebuffer");
     totalBytes += content.length;
     if (totalBytes > maxTotalBytes) {
@@ -2325,7 +2325,7 @@ async function extractZipEntries(zip, destDir, maxTotalBytes) {
         `ZIP bomb prevention: actual uncompressed size ${totalBytes} bytes exceeds limit of ${maxTotalBytes} bytes`
       );
     }
-    fs6.writeFileSync(filePath, content);
+    fs7.writeFileSync(filePath, content);
   }
 }
 async function validateAndBundleZip(zipPath) {
@@ -2373,16 +2373,16 @@ async function validateAndBundleZip(zipPath) {
     throw new Error(`Entry file "${manifest.main}" specified in manifest not found in ZIP package`);
   }
   const entryCode = await entryFile.async("string");
-  const tmpDir = path7.join(os2.tmpdir(), `plugin-build-${(0, import_uuid6.v7)()}`);
+  const tmpDir = path8.join(os2.tmpdir(), `plugin-build-${(0, import_uuid6.v7)()}`);
   try {
-    fs6.mkdirSync(tmpDir, { recursive: true });
+    fs7.mkdirSync(tmpDir, { recursive: true });
     await extractZipEntries(zip, tmpDir, getMaxUncompressedSize());
-    const bundledPath = path7.join(os2.tmpdir(), `plugin-bundle-${(0, import_uuid6.v7)()}.mjs`);
+    const bundledPath = path8.join(os2.tmpdir(), `plugin-bundle-${(0, import_uuid6.v7)()}.mjs`);
     await bundlePlugin(entryCode, tmpDir, bundledPath);
     return { manifest, bundledPath, entryFileName: resolvedMain, package: zip };
   } finally {
     try {
-      fs6.rmSync(tmpDir, { recursive: true, force: true });
+      fs7.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -2390,14 +2390,14 @@ async function validateAndBundleZip(zipPath) {
 async function extractManifestFromBundle(_bundledCode) {
   throw new Error("extractManifestFromBundle is not yet implemented");
 }
-var import_jszip, fs6, os2, path7, import_uuid6, PluginCodeSecurityError, LEX_SCAN_LIMIT;
+var import_jszip, fs7, os2, path8, import_uuid6, PluginCodeSecurityError, LEX_SCAN_LIMIT;
 var init_install_utils = __esm({
   "packages/core/esm-loader/install-utils.ts"() {
     "use strict";
     import_jszip = __toESM(require("jszip"), 1);
-    fs6 = __toESM(require("fs"), 1);
+    fs7 = __toESM(require("fs"), 1);
     os2 = __toESM(require("os"), 1);
-    path7 = __toESM(require("path"), 1);
+    path8 = __toESM(require("path"), 1);
     import_uuid6 = require("uuid");
     init_manifest_schema();
     PluginCodeSecurityError = class extends Error {
@@ -2472,7 +2472,7 @@ var init_redaction = __esm({
 // packages/core/observability/rotating-file-stream.ts
 function removeIfExists(filePath) {
   try {
-    import_node_fs4.default.unlinkSync(filePath);
+    import_node_fs5.default.unlinkSync(filePath);
   } catch {
   }
 }
@@ -2491,7 +2491,7 @@ function unregisterStream(stream) {
 function safeRename(from, to) {
   try {
     removeIfExists(to);
-    import_node_fs4.default.renameSync(from, to);
+    import_node_fs5.default.renameSync(from, to);
     return true;
   } catch {
     return false;
@@ -2516,12 +2516,12 @@ function resolveAuditRotationConfig(env = process.env) {
   const maxFiles = Math.floor(readPositiveInt(env.AUDIT_LOG_MAX_FILES, 20, "AUDIT_LOG_MAX_FILES"));
   return { maxBytes: Math.floor(maxSizeMb * 1024 * 1024), maxFiles };
 }
-var import_node_fs4, import_node_path4, import_node_stream, activeStreams, exitHookInstalled, RotatingFileStream;
+var import_node_fs5, import_node_path5, import_node_stream, activeStreams, exitHookInstalled, RotatingFileStream;
 var init_rotating_file_stream = __esm({
   "packages/core/observability/rotating-file-stream.ts"() {
     "use strict";
-    import_node_fs4 = __toESM(require("node:fs"), 1);
-    import_node_path4 = __toESM(require("node:path"), 1);
+    import_node_fs5 = __toESM(require("node:fs"), 1);
+    import_node_path5 = __toESM(require("node:path"), 1);
     import_node_stream = require("node:stream");
     activeStreams = /* @__PURE__ */ new Set();
     exitHookInstalled = false;
@@ -2535,7 +2535,7 @@ var init_rotating_file_stream = __esm({
         this.filePath = options.filePath;
         this.maxBytes = options.maxBytes;
         this.maxFiles = options.maxFiles;
-        this.dir = import_node_path4.default.dirname(this.filePath);
+        this.dir = import_node_path5.default.dirname(this.filePath);
       }
       /** 当前活动文件路径（测试与排障用） */
       get activeFilePath() {
@@ -2556,7 +2556,7 @@ var init_rotating_file_stream = __esm({
           if (this.currentSize > 0 && this.currentSize + buf.length > this.maxBytes) {
             this.rotate();
           }
-          const written = import_node_fs4.default.writeSync(this.fd, buf, 0, buf.length, null);
+          const written = import_node_fs5.default.writeSync(this.fd, buf, 0, buf.length, null);
           this.currentSize += written;
           callback();
         } catch (err) {
@@ -2576,7 +2576,7 @@ var init_rotating_file_stream = __esm({
       closeFd() {
         if (this.fd !== null) {
           try {
-            import_node_fs4.default.closeSync(this.fd);
+            import_node_fs5.default.closeSync(this.fd);
           } catch {
           }
           this.fd = null;
@@ -2585,11 +2585,11 @@ var init_rotating_file_stream = __esm({
       }
       ensureOpen() {
         if (this.fd !== null) return;
-        import_node_fs4.default.mkdirSync(this.dir, { recursive: true });
-        this.fd = import_node_fs4.default.openSync(this.filePath, "a");
+        import_node_fs5.default.mkdirSync(this.dir, { recursive: true });
+        this.fd = import_node_fs5.default.openSync(this.filePath, "a");
         registerStream(this);
         try {
-          this.currentSize = import_node_fs4.default.statSync(this.filePath).size;
+          this.currentSize = import_node_fs5.default.statSync(this.filePath).size;
         } catch {
           this.currentSize = 0;
         }
@@ -2603,13 +2603,13 @@ var init_rotating_file_stream = __esm({
         this.closeFd();
         for (let i = this.maxFiles - 1; i >= 1; i -= 1) {
           const from = this.historyFilePath(i);
-          if (import_node_fs4.default.existsSync(from)) {
+          if (import_node_fs5.default.existsSync(from)) {
             safeRename(from, this.historyFilePath(i + 1));
           }
         }
         safeRename(this.filePath, this.historyFilePath(1));
         this.currentSize = 0;
-        this.fd = import_node_fs4.default.openSync(this.filePath, "a");
+        this.fd = import_node_fs5.default.openSync(this.filePath, "a");
       }
     };
   }
@@ -2640,28 +2640,28 @@ function consoleStream() {
 function createLogger(component) {
   return logger.child({ component });
 }
-var import_pino, import_node_fs5, import_node_path5, defaultLevel, consoleLevel, fileLevel, rootLevel, logDir, logFile, streams, fileLogging, logger;
+var import_pino, import_node_fs6, import_node_path6, defaultLevel, consoleLevel, fileLevel, rootLevel, logDir, logFile, streams, fileLogging, logger;
 var init_logger = __esm({
   "packages/core/observability/logger.ts"() {
     "use strict";
     import_pino = __toESM(require("pino"), 1);
-    import_node_fs5 = __toESM(require("node:fs"), 1);
-    import_node_path5 = __toESM(require("node:path"), 1);
+    import_node_fs6 = __toESM(require("node:fs"), 1);
+    import_node_path6 = __toESM(require("node:path"), 1);
     init_redaction();
     init_rotating_file_stream();
     defaultLevel = process.env.LOG_LEVEL || (process.env.HTTP_ACCESS_LOG === "all" ? "debug" : process.env.NODE_ENV === "production" ? "info" : "debug");
     consoleLevel = process.env.LOG_CONSOLE_LEVEL || defaultLevel;
     fileLevel = defaultLevel;
     rootLevel = minPinoLevel(consoleLevel, fileLevel);
-    logDir = import_node_path5.default.resolve(process.env.LOG_DIR || import_node_path5.default.join(process.cwd(), "logs"));
-    logFile = import_node_path5.default.join(logDir, "openlearn.log");
+    logDir = import_node_path6.default.resolve(process.env.LOG_DIR || import_node_path6.default.join(process.cwd(), "logs"));
+    logFile = import_node_path6.default.join(logDir, "openlearn.log");
     streams = [
       { level: consoleLevel, stream: consoleStream() }
     ];
     fileLogging = false;
     try {
-      if (!import_node_fs5.default.existsSync(logDir)) import_node_fs5.default.mkdirSync(logDir, { recursive: true });
-      import_node_fs5.default.accessSync(logDir, import_node_fs5.default.constants.W_OK);
+      if (!import_node_fs6.default.existsSync(logDir)) import_node_fs6.default.mkdirSync(logDir, { recursive: true });
+      import_node_fs6.default.accessSync(logDir, import_node_fs6.default.constants.W_OK);
       fileLogging = true;
     } catch (err) {
       console.warn(`[logger] \u65E0\u6CD5\u5199\u5165\u65E5\u5FD7\u76EE\u5F55 ${logDir}\uFF0C\u4EC5\u8F93\u51FA\u5230 stdout\u3002`, err instanceof Error ? err.message : err);
@@ -2787,15 +2787,15 @@ function buildAuditLogger() {
   if (process.env.NODE_ENV === "test" || process.env.VITEST) {
     return (0, import_pino2.default)({ level: "silent" }, import_pino2.default.destination(1));
   }
-  const logDir2 = import_node_path6.default.resolve(process.env.LOG_DIR || import_node_path6.default.join(process.cwd(), "logs"));
+  const logDir2 = import_node_path7.default.resolve(process.env.LOG_DIR || import_node_path7.default.join(process.cwd(), "logs"));
   try {
-    if (!import_node_fs6.default.existsSync(logDir2)) import_node_fs6.default.mkdirSync(logDir2, { recursive: true });
-    import_node_fs6.default.accessSync(logDir2, import_node_fs6.default.constants.W_OK);
+    if (!import_node_fs7.default.existsSync(logDir2)) import_node_fs7.default.mkdirSync(logDir2, { recursive: true });
+    import_node_fs7.default.accessSync(logDir2, import_node_fs7.default.constants.W_OK);
     const rotation = resolveAuditRotationConfig();
     streams2.push({
       level: "info",
       stream: new RotatingFileStream({
-        filePath: import_node_path6.default.join(logDir2, "audit.log"),
+        filePath: import_node_path7.default.join(logDir2, "audit.log"),
         maxBytes: rotation.maxBytes,
         maxFiles: rotation.maxFiles
       })
@@ -2820,12 +2820,12 @@ function recordSecurityAudit(event, fields = {}) {
   }
   return record;
 }
-var import_node_fs6, import_node_path6, import_pino2, testSink, auditLogger;
+var import_node_fs7, import_node_path7, import_pino2, testSink, auditLogger;
 var init_audit_log = __esm({
   "packages/core/observability/audit-log.ts"() {
     "use strict";
-    import_node_fs6 = __toESM(require("node:fs"), 1);
-    import_node_path6 = __toESM(require("node:path"), 1);
+    import_node_fs7 = __toESM(require("node:fs"), 1);
+    import_node_path7 = __toESM(require("node:path"), 1);
     import_pino2 = __toESM(require("pino"), 1);
     init_logger();
     init_request_context();
@@ -3875,9 +3875,9 @@ var init_http_router = __esm({
       /**
        * 注册指定动词与路径的 Handler
        */
-      route(method, path45, handler, options = {}) {
+      route(method, path46, handler, options = {}) {
         const upperMethod = method.toUpperCase();
-        const normalized = path45.startsWith("/") ? path45 : "/" + path45;
+        const normalized = path46.startsWith("/") ? path46 : "/" + path46;
         const { regex, paramNames } = compileRoutePattern(normalized);
         this.warnIfUnscoped(upperMethod, normalized, options);
         this.routes.push({
@@ -3890,20 +3890,20 @@ var init_http_router = __esm({
           scope: options.scope
         });
       }
-      get(path45, handler, options) {
-        this.route("GET", path45, handler, options);
+      get(path46, handler, options) {
+        this.route("GET", path46, handler, options);
       }
-      post(path45, handler, options) {
-        this.route("POST", path45, handler, options);
+      post(path46, handler, options) {
+        this.route("POST", path46, handler, options);
       }
-      put(path45, handler, options) {
-        this.route("PUT", path45, handler, options);
+      put(path46, handler, options) {
+        this.route("PUT", path46, handler, options);
       }
-      patch(path45, handler, options) {
-        this.route("PATCH", path45, handler, options);
+      patch(path46, handler, options) {
+        this.route("PATCH", path46, handler, options);
       }
-      delete(path45, handler, options) {
-        this.route("DELETE", path45, handler, options);
+      delete(path46, handler, options) {
+        this.route("DELETE", path46, handler, options);
       }
       warnIfUnscoped(method, pattern, options) {
         if (options.scope) return;
@@ -3918,19 +3918,19 @@ var init_http_router = __esm({
       }
       stream(methodOrPath, pathOrHandler, maybeHandler) {
         if (typeof pathOrHandler === "function") {
-          const path45 = methodOrPath;
+          const path46 = methodOrPath;
           const handler = pathOrHandler;
-          this.registerStream("GET", path45, handler);
-          this.registerStream("POST", path45, handler);
+          this.registerStream("GET", path46, handler);
+          this.registerStream("POST", path46, handler);
         } else {
           const method = methodOrPath.toUpperCase();
-          const path45 = pathOrHandler;
+          const path46 = pathOrHandler;
           const handler = maybeHandler;
-          this.registerStream(method, path45, handler);
+          this.registerStream(method, path46, handler);
         }
       }
-      registerStream(method, path45, handler) {
-        const normalized = path45.startsWith("/") ? path45 : "/" + path45;
+      registerStream(method, path46, handler) {
+        const normalized = path46.startsWith("/") ? path46 : "/" + path46;
         const { regex, paramNames } = compileRoutePattern(normalized);
         this.routes.push({
           method: method.toUpperCase(),
@@ -3944,9 +3944,9 @@ var init_http_router = __esm({
       /**
        * 检查指定动词与路径是否为流式路由
        */
-      isStream(method, path45) {
+      isStream(method, path46) {
         const upperMethod = method.toUpperCase();
-        const normalized = path45.startsWith("/") ? path45 : "/" + path45;
+        const normalized = path46.startsWith("/") ? path46 : "/" + path46;
         for (const entry of this.routes) {
           if (entry.method !== upperMethod) continue;
           if (entry.regex.test(normalized)) {
@@ -3958,9 +3958,9 @@ var init_http_router = __esm({
       /**
        * 匹配路由并提取路由参数
        */
-      match(method, path45) {
+      match(method, path46) {
         const upperMethod = method.toUpperCase();
-        const normalized = path45.startsWith("/") ? path45 : "/" + path45;
+        const normalized = path46.startsWith("/") ? path46 : "/" + path46;
         for (const entry of this.routes) {
           if (entry.method !== upperMethod) continue;
           const match = normalized.match(entry.regex);
@@ -4103,13 +4103,13 @@ function checkMethodPolicy(input) {
   if (tokens.frontendApi && token === tokens.frontendApi) {
     if (isReadOnlyMethod(method)) return null;
     if (method === "request" && !Array.isArray(args)) return null;
-    const path45 = extractPathArg(args);
-    const isHighRisk = HIGH_RISK_PATH_PREFIXES.some((p) => path45 === p || path45.startsWith(`${p}/`));
-    const isIrreversible = IRREVERSIBLE_PATH_SUFFIXES.some((s) => path45.endsWith(s));
-    const isEntityDelete = method === "del" && ENTITY_DELETE_RE.test(path45);
+    const path46 = extractPathArg(args);
+    const isHighRisk = HIGH_RISK_PATH_PREFIXES.some((p) => path46 === p || path46.startsWith(`${p}/`));
+    const isIrreversible = IRREVERSIBLE_PATH_SUFFIXES.some((s) => path46.endsWith(s));
+    const isEntityDelete = method === "del" && ENTITY_DELETE_RE.test(path46);
     if (isHighRisk || isIrreversible || isEntityDelete) {
       if (hasCapability(caps, CAP_API_ADMIN)) return null;
-      const why = isIrreversible ? `\u4E0D\u53EF\u9006\u64CD\u4F5C '${path45}'` : isEntityDelete ? `\u5B9E\u4F53\u7EA7\u5220\u9664 '${path45}'` : `\u5199\u5165\u9AD8\u5371\u8DEF\u5F84 '${path45 || "<\u672A\u63D0\u4F9B\u8DEF\u5F84>"}'`;
+      const why = isIrreversible ? `\u4E0D\u53EF\u9006\u64CD\u4F5C '${path46}'` : isEntityDelete ? `\u5B9E\u4F53\u7EA7\u5220\u9664 '${path46}'` : `\u5199\u5165\u9AD8\u5371\u8DEF\u5F84 '${path46 || "<\u672A\u63D0\u4F9B\u8DEF\u5F84>"}'`;
       return `${why} \u9700\u8981 manifest \u58F0\u660E '${CAP_API_ADMIN}' \u80FD\u529B`;
     }
     return hasCapability(caps, CAP_API_WRITE) ? null : `\u5199\u64CD\u4F5C\uFF08${method}\uFF09\u9700\u8981 manifest \u58F0\u660E '${CAP_API_WRITE}' \u80FD\u529B\uFF08\u666E\u901A\u53EA\u8BFB\u8C03\u7528\u8BF7\u7528 get\uFF09`;
@@ -5714,7 +5714,7 @@ function spawnPluginChild(opts) {
   });
   const removeBootstrapFile = () => {
     try {
-      import_node_fs8.default.unlinkSync(bootstrapFile);
+      import_node_fs9.default.unlinkSync(bootstrapFile);
     } catch {
     }
   };
@@ -5740,25 +5740,25 @@ function isPidAlive(pid) {
   }
 }
 function writeBootstrapTempFile(code) {
-  const file = import_node_path9.default.join(
+  const file = import_node_path10.default.join(
     import_node_os.default.tmpdir(),
     `${BOOTSTRAP_PREFIX}${process.pid}-${import_node_crypto7.default.randomBytes(8).toString("hex")}${BOOTSTRAP_SUFFIX}`
   );
-  import_node_fs8.default.writeFileSync(file, code, { encoding: "utf8", mode: 384 });
+  import_node_fs9.default.writeFileSync(file, code, { encoding: "utf8", mode: 384 });
   return file;
 }
 function cleanupStaleBootstrapFiles(now = Date.now()) {
   try {
     const tmpDir = import_node_os.default.tmpdir();
-    const files = import_node_fs8.default.readdirSync(tmpDir);
+    const files = import_node_fs9.default.readdirSync(tmpDir);
     let cleaned = 0;
     for (const file of files) {
       if (!file.startsWith(BOOTSTRAP_PREFIX) || !file.endsWith(BOOTSTRAP_SUFFIX)) continue;
-      const full = import_node_path9.default.join(tmpDir, file);
+      const full = import_node_path10.default.join(tmpDir, file);
       const ownerPid = bootstrapOwnerPid(file);
       if (ownerPid === null) {
         try {
-          if (now - import_node_fs8.default.statSync(full).mtimeMs < LEGACY_BOOTSTRAP_STALE_MS) continue;
+          if (now - import_node_fs9.default.statSync(full).mtimeMs < LEGACY_BOOTSTRAP_STALE_MS) continue;
         } catch {
           continue;
         }
@@ -5766,7 +5766,7 @@ function cleanupStaleBootstrapFiles(now = Date.now()) {
         continue;
       }
       try {
-        import_node_fs8.default.unlinkSync(full);
+        import_node_fs9.default.unlinkSync(full);
         cleaned++;
       } catch {
       }
@@ -5781,7 +5781,7 @@ function defaultNetPreloadStartDirs() {
   try {
     const url = import_meta5.url;
     if (typeof url === "string" && url.startsWith("file:")) {
-      dirs.push(import_node_path9.default.dirname((0, import_node_url3.fileURLToPath)(url)));
+      dirs.push(import_node_path10.default.dirname((0, import_node_url3.fileURLToPath)(url)));
     }
   } catch {
   }
@@ -5793,27 +5793,27 @@ function defaultNetPreloadStartDirs() {
 function resolveNetPreloadPath(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const candidates = [
-    import_node_path9.default.resolve(cwd, "packages/core/worker-runtime/plugin-net-preload.cjs"),
-    import_node_path9.default.resolve(cwd, "dist/plugin-net-preload.cjs")
+    import_node_path10.default.resolve(cwd, "packages/core/worker-runtime/plugin-net-preload.cjs"),
+    import_node_path10.default.resolve(cwd, "dist/plugin-net-preload.cjs")
   ];
   for (const dir of options.startDirs ?? defaultNetPreloadStartDirs()) {
-    candidates.unshift(import_node_path9.default.join(dir, "plugin-net-preload.cjs"));
+    candidates.unshift(import_node_path10.default.join(dir, "plugin-net-preload.cjs"));
   }
-  const found = candidates.find((candidate) => import_node_fs8.default.existsSync(candidate));
+  const found = candidates.find((candidate) => import_node_fs9.default.existsSync(candidate));
   if (!found) {
     throw new Error(`[PluginNet] preload script not found. Looked in: ${candidates.join(", ")}`);
   }
   return found;
 }
-var import_node_child_process, import_node_crypto7, import_node_fs8, import_node_os, import_node_path9, import_node_url3, import_meta5, ENV_ALLOWLIST, ENV_DENYLIST, WORKER_DATA_ENV, BOOTSTRAP_PREFIX, BOOTSTRAP_SUFFIX, LEGACY_BOOTSTRAP_STALE_MS;
+var import_node_child_process, import_node_crypto7, import_node_fs9, import_node_os, import_node_path10, import_node_url3, import_meta5, ENV_ALLOWLIST, ENV_DENYLIST, WORKER_DATA_ENV, BOOTSTRAP_PREFIX, BOOTSTRAP_SUFFIX, LEGACY_BOOTSTRAP_STALE_MS;
 var init_child_spawn = __esm({
   "packages/core/worker-runtime/child-spawn.ts"() {
     "use strict";
     import_node_child_process = require("node:child_process");
     import_node_crypto7 = __toESM(require("node:crypto"), 1);
-    import_node_fs8 = __toESM(require("node:fs"), 1);
+    import_node_fs9 = __toESM(require("node:fs"), 1);
     import_node_os = __toESM(require("node:os"), 1);
-    import_node_path9 = __toESM(require("node:path"), 1);
+    import_node_path10 = __toESM(require("node:path"), 1);
     import_node_url3 = require("node:url");
     init_child_transport();
     init_child_isolate();
@@ -5869,12 +5869,12 @@ function quotaExceeded(input) {
 }
 function readProcSample(pid) {
   try {
-    const stat = import_node_fs9.default.readFileSync(`/proc/${pid}/stat`, "utf8");
+    const stat = import_node_fs10.default.readFileSync(`/proc/${pid}/stat`, "utf8");
     const rest = stat.slice(stat.lastIndexOf(")") + 2).trim().split(/\s+/);
     const utime = Number(rest[11]);
     const stime = Number(rest[12]);
     if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
-    const status = import_node_fs9.default.readFileSync(`/proc/${pid}/status`, "utf8");
+    const status = import_node_fs10.default.readFileSync(`/proc/${pid}/status`, "utf8");
     const rss = /^VmRSS:\s+(\d+)\s+kB/m.exec(status);
     return { cpuMs: (utime + stime) / 100 * 1e3, rssKb: rss ? Number(rss[1]) : 0 };
   } catch {
@@ -5917,11 +5917,11 @@ function startProcessQuota(pid, onBreach, env = process.env) {
     }
   };
 }
-var import_node_fs9, DEFAULT_MAX_RSS_MB, DEFAULT_CPU_QUOTA_MS, DEFAULT_CPU_WINDOW_MS;
+var import_node_fs10, DEFAULT_MAX_RSS_MB, DEFAULT_CPU_QUOTA_MS, DEFAULT_CPU_WINDOW_MS;
 var init_plugin_quota = __esm({
   "packages/core/worker-runtime/plugin-quota.ts"() {
     "use strict";
-    import_node_fs9 = __toESM(require("node:fs"), 1);
+    import_node_fs10 = __toESM(require("node:fs"), 1);
     DEFAULT_MAX_RSS_MB = 512;
     DEFAULT_CPU_QUOTA_MS = 8e3;
     DEFAULT_CPU_WINDOW_MS = 1e4;
@@ -8923,9 +8923,9 @@ __export(worker_manager_exports, {
 function collectSharedReadPaths(pluginDir) {
   if (!pluginDir) return [];
   const paths = /* @__PURE__ */ new Set();
-  const nodeModulesDir = import_node_path10.default.join(import_node_path10.default.dirname(pluginDir), "node_modules");
+  const nodeModulesDir = import_node_path11.default.join(import_node_path11.default.dirname(pluginDir), "node_modules");
   paths.add(nodeModulesDir);
-  const sdkLink = import_node_path10.default.join(nodeModulesDir, "@openlearn", "plugin-sdk");
+  const sdkLink = import_node_path11.default.join(nodeModulesDir, "@openlearn", "plugin-sdk");
   try {
     if (import_fs7.default.existsSync(sdkLink)) paths.add(import_fs7.default.realpathSync(sdkLink));
   } catch {
@@ -8964,7 +8964,7 @@ function generateBootstrapCode() {
   const rootPath = process.cwd().replace(/\\/g, "/");
   return composeBootstrapCode(`${rootPath}/package.json`);
 }
-var import_node_worker_threads, import_fs7, import_node_path10, import_uuid12, BASE_WORKER_SERVICE_TOKENS, ALL_SERVICE_TOKENS, POINTS_SERVICE_TOKENS, MAX_WORKERS, ACTIVATE_TIMEOUT_MS, ACTIVATE_PROGRESS_SLIDE_MS, WorkerRegistry, WorkerManager;
+var import_node_worker_threads, import_fs7, import_node_path11, import_uuid12, BASE_WORKER_SERVICE_TOKENS, ALL_SERVICE_TOKENS, POINTS_SERVICE_TOKENS, MAX_WORKERS, ACTIVATE_TIMEOUT_MS, ACTIVATE_PROGRESS_SLIDE_MS, WorkerRegistry, WorkerManager;
 var init_worker_manager = __esm({
   "packages/core/worker-runtime/worker-manager.ts"() {
     "use strict";
@@ -8978,7 +8978,7 @@ var init_worker_manager = __esm({
     init_plugin_limits();
     init_thread_isolate();
     import_fs7 = __toESM(require("fs"), 1);
-    import_node_path10 = __toESM(require("node:path"), 1);
+    import_node_path11 = __toESM(require("node:path"), 1);
     init_transport();
     init_plugin_net_proxy();
     init_service_host();
@@ -9383,7 +9383,7 @@ var init_worker_manager = __esm({
         const encodedBootstrap = Buffer.from(bootstrapCode, "utf-8").toString("base64");
         const bootstrapDataUrl = `data:text/javascript;base64,${encodedBootstrap}`;
         const allowedTokens = computeAllowedWorkerTokens(manifest, serviceTokens);
-        const resolvedPluginDir = pluginDir && import_fs7.default.existsSync(import_node_path10.default.join(pluginDir, "index.js")) ? pluginDir : void 0;
+        const resolvedPluginDir = pluginDir && import_fs7.default.existsSync(import_node_path11.default.join(pluginDir, "index.js")) ? pluginDir : void 0;
         let approvedNetHosts = [];
         try {
           approvedNetHosts = listApprovedNetHosts(this.db, [pluginId, manifest.id]);
@@ -11027,7 +11027,7 @@ function simpleChecksum(text) {
   }
   return hash.toString(16);
 }
-function runMigrations(db2, migrations) {
+function runMigrations(db2, migrations, options = {}) {
   db2.exec(`
     CREATE TABLE IF NOT EXISTS _migrations (
       name TEXT PRIMARY KEY,
@@ -11038,6 +11038,23 @@ function runMigrations(db2, migrations) {
   const appliedRows = db2.prepare("SELECT name, checksum FROM _migrations").all();
   const applied = new Map(appliedRows.map((r) => [r.name, r.checksum]));
   const byName = new Map(migrations.map((m) => [m.name, m]));
+  const unknown = [...applied.keys()].filter((name) => !byName.has(name));
+  if (unknown.length > 0) {
+    const detail = unknown.map((n) => `  - ${n}`).join("\n");
+    const msg = `[Migration] \u53F0\u8D26\u91CC\u6709 ${unknown.length} \u4E2A\u672C\u6B21\u8FC1\u79FB\u5217\u8868\u672A\u5305\u542B\u7684\u6761\u76EE\uFF1A
+${detail}
+` + (options.strictLedger ? `  \u542F\u52A8\u94FE\u8DEF\u5224\u5B9A\u4E3A FATAL\uFF1A
+  \u6210\u56E0\u4E00\uFF1A\u7528\u66F4\u65B0\u7248\u672C\u7684\u5907\u4EFD\u6062\u590D\u4E86\u65E7\u4EE3\u7801\uFF08\u4EE3\u7801\u964D\u7EA7\uFF09\u2014\u2014\u8BF7\u5148\u5347\u7EA7\u4EE3\u7801\u518D\u542F\u52A8\uFF1B
+  \u6210\u56E0\u4E8C\uFF1A\u5DF2\u5E94\u7528\u7684\u8FC1\u79FB\u6587\u4EF6\u88AB\u6539\u540D\u6216\u5220\u9664\u2014\u2014\u8FC1\u79FB\u4E00\u65E6\u5E94\u7528\u4E0D\u53EF\u6539\u540D\uFF0C\u8BF7\u6062\u590D\u6587\u4EF6\u6216\u8865\u4E00\u6761\u65B0\u8FC1\u79FB\u3002
+  \u786E\u5C5E\u6709\u610F\u7684\u964D\u7EA7\u8FD0\u7EF4\uFF1A\u8BBE\u7F6E MIGRATION_ALLOW_UNKNOWN_LEDGER=true \u653E\u884C\uFF08\u4E0D\u63A8\u8350\uFF09\u3002` : `  \uFF08\u975E\u4E25\u683C\u53E3\u5F84\uFF1A\u8FC1\u79FB\u5B50\u96C6\u8C03\u7528\u5C5E\u5408\u6CD5\u7528\u6CD5\uFF0C\u4EC5\u63D0\u793A\uFF09`);
+    if (process.env.MIGRATION_ALLOW_UNKNOWN_LEDGER === "true") {
+      console.warn("[Migration] WARNING: \u672A\u77E5\u53F0\u8D26\u6761\u76EE\u5DF2\u6309 MIGRATION_ALLOW_UNKNOWN_LEDGER \u653E\u884C\uFF1A\n" + msg);
+    } else if (options.strictLedger) {
+      throw new Error(msg);
+    } else {
+      console.warn("[Migration] " + msg);
+    }
+  }
   const drift = [];
   for (const [name, stored] of applied) {
     const migration = byName.get(name);
@@ -11145,6 +11162,68 @@ function getDefaultMigrationsDir(options = {}) {
   return import_path.default.resolve(cwd, "migrations");
 }
 
+// packages/core/db/schema-golden.ts
+var import_node_fs3 = __toESM(require("node:fs"), 1);
+var import_node_path3 = __toESM(require("node:path"), 1);
+var SCHEMA_GOLDEN_FILENAME = "schema-golden.json";
+function extractSchemaSnapshot(db2) {
+  const tables = db2.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name").all();
+  const snapshot = {};
+  for (const { name } of tables) {
+    const columns = db2.prepare(`PRAGMA table_info(${JSON.stringify(name)})`).all().map(
+      (c) => c.name
+    );
+    snapshot[name] = columns.sort();
+  }
+  return snapshot;
+}
+function verifySchemaAgainstGolden(db2, golden) {
+  const actual = extractSchemaSnapshot(db2);
+  const drifts = [];
+  for (const [table, expectedColumns] of Object.entries(golden.tables)) {
+    const actualColumns = actual[table];
+    if (!actualColumns) {
+      drifts.push({ table, missingColumns: expectedColumns, tableMissing: true });
+      continue;
+    }
+    const actualSet = new Set(actualColumns);
+    const missing = expectedColumns.filter((c) => !actualSet.has(c));
+    if (missing.length > 0) {
+      drifts.push({ table, missingColumns: missing, tableMissing: false });
+    }
+  }
+  return drifts;
+}
+function formatSchemaGoldenDrifts(drifts) {
+  return drifts.map(
+    (d) => d.tableMissing ? `  - \u8868 ${d.table} \u6574\u8868\u7F3A\u5931\uFF08\u671F\u671B\u5217\uFF1A${d.missingColumns.join(", ")}\uFF09` : `  - \u8868 ${d.table} \u7F3A\u5217\uFF1A${d.missingColumns.join(", ")}`
+  ).join("\n");
+}
+function loadSchemaGolden(migrationsDir) {
+  const filePath = import_node_path3.default.join(migrationsDir, SCHEMA_GOLDEN_FILENAME);
+  if (!import_node_fs3.default.existsSync(filePath)) {
+    throw new Error(
+      `[SchemaGolden] FATAL: ${filePath} \u4E0D\u5B58\u5728\u3002\u91D1\u6837\u4E0E\u8FC1\u79FB\u6587\u4EF6\u540C\u76EE\u5F55\u53D1\u5E03\uFF0C\u7F3A\u5931\u8BF4\u660E\u5B89\u88C5\u5305\u4E0D\u5B8C\u6574\uFF1B\u6E90\u7801\u4ED3\u5E93\u91CC\u8BF7\u8FD0\u884C pnpm db:gen-golden \u751F\u6210\u3002`
+    );
+  }
+  try {
+    return JSON.parse(import_node_fs3.default.readFileSync(filePath, "utf8"));
+  } catch (err) {
+    throw new Error(`[SchemaGolden] FATAL: \u91D1\u6837\u6587\u4EF6\u89E3\u6790\u5931\u8D25\uFF08${filePath}\uFF09\uFF1A${String(err)}`, { cause: err });
+  }
+}
+function assertSchemaMatchesGolden(db2, migrationsDir) {
+  const golden = loadSchemaGolden(migrationsDir);
+  const drifts = verifySchemaAgainstGolden(db2, golden);
+  if (drifts.length > 0) {
+    throw new Error(
+      `[SchemaGolden] FATAL: \u6570\u636E\u5E93\u7ED3\u6784\u4F4E\u4E8E\u4EE3\u7801\u671F\u671B\uFF08${drifts.length} \u5904\u7F3A\u5931\uFF09\u2014\u2014\u8FC1\u79FB\u53F0\u8D26\u867D\u5DF2\u8FFD\u5E73\uFF0C\u4F46\u5E93\u88AB\u5916\u90E8\u4FEE\u6539\u8FC7\u6216\u4ECE\u65E7\u5907\u4EFD\u505A\u4E86\u90E8\u5206\u6062\u590D\u3002\u7F3A\u5931\u660E\u7EC6\uFF1A
+${formatSchemaGoldenDrifts(drifts)}
+  \u6062\u590D\u624B\u6BB5\uFF1A\u7528 backups/ \u91CC\u6700\u65B0\u7684 pre_migration_*.db \u5FEB\u7167\u6062\u590D\uFF0C\u6216\u6838\u5BF9\u6700\u8FD1\u4E00\u6B21\u6062\u590D\u64CD\u4F5C\u7684\u6765\u6E90\u3002`
+    );
+  }
+}
+
 // packages/core/db/class-passcode-crypto.ts
 var import_node_crypto2 = __toESM(require("node:crypto"), 1);
 init_api_key_crypto();
@@ -11802,7 +11881,16 @@ function initializeDatabase(instance) {
     if (migrations.length === 0) {
       throw new Error(`[DB SSOT] FATAL: \u8FC1\u79FB\u76EE\u5F55 ${migrationsDir} \u91CC\u6CA1\u6709 .sql \u6587\u4EF6\u3002\u62D2\u7EDD\u5728\u6CA1\u6709 schema \u7684\u5E93\u4E0A\u542F\u52A8\u3002`);
     }
-    runMigrations(instance, migrations);
+    runMigrations(instance, migrations, { strictLedger: true });
+    if (process.env.VITEST) {
+      try {
+        assertSchemaMatchesGolden(instance, migrationsDir);
+      } catch (err) {
+        console.warn("[SchemaGolden] \u6D4B\u8BD5\u73AF\u5883\u7ED3\u6784\u7EC8\u68C0\u672A\u901A\u8FC7\uFF08\u5FFD\u7565\uFF09\uFF1A", err instanceof Error ? err.message : err);
+      }
+    } else {
+      assertSchemaMatchesGolden(instance, migrationsDir);
+    }
     applyStartupDataMigrations(instance);
     const apiKeyMigration = encryptStoredPlaintextApiKeys(instance);
     if (apiKeyMigration.updated > 0) {
@@ -14061,10 +14149,10 @@ function parseScoreFields(fields) {
   if (typeof fields !== "string" || !fields.trim()) return [];
   return fields.split(/[\n\r,，;；|]+/).map((f) => f.trim()).filter(Boolean);
 }
-function getNested(raw, path45) {
+function getNested(raw, path46) {
   if (raw === null || raw === void 0) return void 0;
-  if (!path45) return void 0;
-  const parts = String(path45).split(".").map((p) => p.trim()).filter(Boolean);
+  if (!path46) return void 0;
+  const parts = String(path46).split(".").map((p) => p.trim()).filter(Boolean);
   let cursor = raw;
   for (let i = 0; i < parts.length; i += 1) {
     if (cursor === null || cursor === void 0) return void 0;
@@ -18655,7 +18743,7 @@ var import_semver2 = __toESM(require("semver"), 1);
 init_types();
 
 // packages/core/plugin-host/execution-policy.ts
-var import_node_path7 = __toESM(require("node:path"), 1);
+var import_node_path8 = __toESM(require("node:path"), 1);
 var import_node_url2 = require("node:url");
 init_types();
 var import_meta4 = {};
@@ -18668,21 +18756,21 @@ function builtinPluginsDir() {
   try {
     const url = import_meta4.url;
     if (typeof url === "string" && url.startsWith("file:")) {
-      return import_node_path7.default.resolve(import_node_path7.default.dirname((0, import_node_url2.fileURLToPath)(url)), "../../plugins");
+      return import_node_path8.default.resolve(import_node_path8.default.dirname((0, import_node_url2.fileURLToPath)(url)), "../../plugins");
     }
   } catch {
   }
   if (typeof __dirname !== "undefined") {
-    return import_node_path7.default.resolve(__dirname, "../packages/plugins");
+    return import_node_path8.default.resolve(__dirname, "../packages/plugins");
   }
-  return import_node_path7.default.resolve(process.cwd(), "packages/plugins");
+  return import_node_path8.default.resolve(process.cwd(), "packages/plugins");
 }
 function isInsideBuiltinPluginsDir(sourcePath, builtinDir = builtinPluginsDir()) {
   if (!sourcePath) return false;
-  const root = import_node_path7.default.resolve(builtinDir);
-  const resolved = import_node_path7.default.resolve(sourcePath);
-  const relative2 = import_node_path7.default.relative(root, resolved);
-  return relative2 === "" || !relative2.startsWith("..") && !import_node_path7.default.isAbsolute(relative2);
+  const root = import_node_path8.default.resolve(builtinDir);
+  const resolved = import_node_path8.default.resolve(sourcePath);
+  const relative2 = import_node_path8.default.relative(root, resolved);
+  return relative2 === "" || !relative2.startsWith("..") && !import_node_path8.default.isAbsolute(relative2);
 }
 function isTrustedInProcessPlugin(manifestId, env = process.env, sourcePath) {
   if (isInsideBuiltinPluginsDir(sourcePath)) return true;
@@ -19742,7 +19830,7 @@ var PluginHostHttp = class extends PluginHostCore {
   /**
    * 判断指定插件的某个请求路径是否为流式路由 (SSE)
    */
-  isStreamRoute(pluginIdOrManifestId, method, path45) {
+  isStreamRoute(pluginIdOrManifestId, method, path46) {
     const upperMethod = method.toUpperCase();
     const resolvedId = this.resolvePluginUuid(pluginIdOrManifestId);
     const instance = this.pluginInstances.get(resolvedId) ?? this.pluginInstances.get(pluginIdOrManifestId);
@@ -19751,7 +19839,7 @@ var PluginHostHttp = class extends PluginHostCore {
       for (const r of manifest.api.routes) {
         if (r.method.toUpperCase() === upperMethod && r.streaming === true) {
           const compiled = compileRoutePattern(r.path);
-          if (compiled.regex.test(path45)) {
+          if (compiled.regex.test(path46)) {
             return true;
           }
         }
@@ -19759,14 +19847,14 @@ var PluginHostHttp = class extends PluginHostCore {
     }
     if (!instance) return false;
     if (instance.context?.http) {
-      return instance.context.http.isStream(upperMethod, path45);
+      return instance.context.http.isStream(upperMethod, path46);
     }
     if (instance.workerRef) {
       const routes = instance.workerRef.serviceHost.getRegisteredRoutes();
       for (const r of routes) {
         if (r.method === upperMethod && r.isStream) {
           const compiled = compileRoutePattern(r.pattern);
-          if (compiled.regex.test(path45)) {
+          if (compiled.regex.test(path46)) {
             return true;
           }
         }
@@ -19839,8 +19927,8 @@ init_manifest_schema();
 init_context_builder();
 
 // packages/core/plugin-host/declarative-migrator.ts
-var import_node_fs7 = __toESM(require("node:fs"), 1);
-var import_node_path8 = __toESM(require("node:path"), 1);
+var import_node_fs8 = __toESM(require("node:fs"), 1);
+var import_node_path9 = __toESM(require("node:path"), 1);
 init_errors2();
 init_plugin_tables();
 function ensurePluginDeclaredMigrationsTable(db2) {
@@ -19856,7 +19944,7 @@ function ensurePluginDeclaredMigrationsTable(db2) {
   `);
 }
 function parseMigrationFileName(fileName) {
-  const baseName = import_node_path8.default.basename(fileName, ".sql");
+  const baseName = import_node_path9.default.basename(fileName, ".sql");
   const match = baseName.match(/^(\d+)[_-]?(.*)$/);
   if (match) {
     const version = parseInt(match[1], 10);
@@ -19865,22 +19953,22 @@ function parseMigrationFileName(fileName) {
   return { version: 0, baseName };
 }
 function loadPluginMigrations(migrationsDir) {
-  if (!import_node_fs7.default.existsSync(migrationsDir)) {
+  if (!import_node_fs8.default.existsSync(migrationsDir)) {
     return [];
   }
-  const stat = import_node_fs7.default.statSync(migrationsDir);
+  const stat = import_node_fs8.default.statSync(migrationsDir);
   if (!stat.isDirectory()) {
     return [];
   }
-  const files = import_node_fs7.default.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort((a, b) => {
+  const files = import_node_fs8.default.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort((a, b) => {
     const vA = parseMigrationFileName(a).version;
     const vB = parseMigrationFileName(b).version;
     if (vA !== vB) return vA - vB;
     return a.localeCompare(b, void 0, { numeric: true, sensitivity: "base" });
   });
   return files.map((file) => {
-    const fullPath = import_node_path8.default.join(migrationsDir, file);
-    const content = import_node_fs7.default.readFileSync(fullPath, "utf8");
+    const fullPath = import_node_path9.default.join(migrationsDir, file);
+    const content = import_node_fs8.default.readFileSync(fullPath, "utf8");
     const { version, baseName } = parseMigrationFileName(file);
     const parsed = parseMigrationSql(baseName, content);
     return {
@@ -20636,27 +20724,27 @@ var import_path8 = __toESM(require("path"), 1);
 var import_semver3 = __toESM(require("semver"), 1);
 
 // packages/core/version.ts
-var import_node_fs10 = __toESM(require("node:fs"), 1);
-var import_node_path11 = __toESM(require("node:path"), 1);
+var import_node_fs11 = __toESM(require("node:fs"), 1);
+var import_node_path12 = __toESM(require("node:path"), 1);
 var import_node_url5 = require("node:url");
 var import_meta6 = {};
-var FALLBACK_VERSION = "0.7.2";
+var FALLBACK_VERSION = "0.7.4";
 function readPlatformVersion() {
   const bases = [];
   if (typeof __dirname !== "undefined") bases.push(__dirname);
   try {
-    bases.push(import_node_path11.default.dirname((0, import_node_url5.fileURLToPath)(import_meta6.url)));
+    bases.push(import_node_path12.default.dirname((0, import_node_url5.fileURLToPath)(import_meta6.url)));
   } catch {
   }
   for (const base of bases) {
     let dir = base;
     for (; ; ) {
       try {
-        const pkg = JSON.parse(import_node_fs10.default.readFileSync(import_node_path11.default.join(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(import_node_fs11.default.readFileSync(import_node_path12.default.join(dir, "package.json"), "utf-8"));
         if (pkg.name === "openlearn-next" && typeof pkg.version === "string") return pkg.version;
       } catch {
       }
-      const parent = import_node_path11.default.dirname(dir);
+      const parent = import_node_path12.default.dirname(dir);
       if (parent === dir) break;
       dir = parent;
     }
@@ -21375,8 +21463,8 @@ init_audit_log();
 
 // packages/core/plugin-host/dependency-install.ts
 var import_node_child_process2 = require("node:child_process");
-var import_node_fs11 = __toESM(require("node:fs"), 1);
-var import_node_path12 = __toESM(require("node:path"), 1);
+var import_node_fs12 = __toESM(require("node:fs"), 1);
+var import_node_path13 = __toESM(require("node:path"), 1);
 var DependencyInstallError = class extends Error {
   constructor(message, pluginId, cause) {
     super(message);
@@ -21411,8 +21499,8 @@ function resolveRegistry() {
 function assertDependenciesResolved(pluginDir, dependencies, pluginId) {
   const names = dependencyNames(dependencies);
   if (names.length === 0) return;
-  const lockPath = import_node_path12.default.join(pluginDir, "package-lock.json");
-  if (!import_node_fs11.default.existsSync(lockPath)) {
+  const lockPath = import_node_path13.default.join(pluginDir, "package-lock.json");
+  if (!import_node_fs12.default.existsSync(lockPath)) {
     throw new DependencyInstallError(
       `\u4F9D\u8D56\u5B89\u88C5\u672A\u4EA7\u51FA package-lock.json \u2014\u2014 \u65E0\u6CD5\u786E\u8BA4\u4F9D\u8D56\u5DF2\u843D\u76D8\u3002pluginId=${pluginId}\uFF0C\u58F0\u660E\u4F9D\u8D56\uFF1A${names.join(", ")}`,
       pluginId
@@ -21420,7 +21508,7 @@ function assertDependenciesResolved(pluginDir, dependencies, pluginId) {
   }
   let lock;
   try {
-    lock = JSON.parse(import_node_fs11.default.readFileSync(lockPath, "utf-8"));
+    lock = JSON.parse(import_node_fs12.default.readFileSync(lockPath, "utf-8"));
   } catch (err) {
     throw new DependencyInstallError(
       `package-lock.json \u4E0D\u662F\u5408\u6CD5 JSON \u2014\u2014 \u4F9D\u8D56\u5B89\u88C5\u7ED3\u679C\u4E0D\u53EF\u4FE1\u3002pluginId=${pluginId}`,
@@ -21493,8 +21581,8 @@ function installPluginDependencies(pluginDir, opts, runNpm = import_node_child_p
   const { pluginId, dependencies, operation = "install" } = opts;
   const depMap = toNpmDependencyMap(dependencies);
   if (Object.keys(depMap).length === 0) return;
-  const pkgJsonPath = import_node_path12.default.join(pluginDir, "package.json");
-  import_node_fs11.default.writeFileSync(
+  const pkgJsonPath = import_node_path13.default.join(pluginDir, "package.json");
+  import_node_fs12.default.writeFileSync(
     pkgJsonPath,
     JSON.stringify({ name: pluginId, version: "0.0.0", dependencies: depMap }, null, 2),
     "utf-8"
@@ -22763,20 +22851,20 @@ init_install_utils();
 
 // packages/core/security/plugin-signature.ts
 var import_node_crypto9 = __toESM(require("node:crypto"), 1);
-var import_node_fs12 = __toESM(require("node:fs"), 1);
+var import_node_fs13 = __toESM(require("node:fs"), 1);
 function computeSha256(input) {
   const hash = import_node_crypto9.default.createHash("sha256");
   if (typeof input === "string") {
-    if (import_node_fs12.default.existsSync(input)) {
-      const fd = import_node_fs12.default.openSync(input, "r");
+    if (import_node_fs13.default.existsSync(input)) {
+      const fd = import_node_fs13.default.openSync(input, "r");
       const buf = Buffer.alloc(64 * 1024);
       let bytesRead = 0;
       try {
-        while ((bytesRead = import_node_fs12.default.readSync(fd, buf, 0, buf.length, null)) > 0) {
+        while ((bytesRead = import_node_fs13.default.readSync(fd, buf, 0, buf.length, null)) > 0) {
           hash.update(buf.subarray(0, bytesRead));
         }
       } finally {
-        import_node_fs12.default.closeSync(fd);
+        import_node_fs13.default.closeSync(fd);
       }
       const digest4 = hash.digest();
       return { hex: digest4.toString("hex"), base64: digest4.toString("base64") };
@@ -22845,8 +22933,8 @@ async function extractEmbeddedSignature(zipPathOrBuffer) {
     const JSZip5 = (await import("jszip")).default;
     let buffer;
     if (typeof zipPathOrBuffer === "string") {
-      if (!import_node_fs12.default.existsSync(zipPathOrBuffer)) return null;
-      buffer = import_node_fs12.default.readFileSync(zipPathOrBuffer);
+      if (!import_node_fs13.default.existsSync(zipPathOrBuffer)) return null;
+      buffer = import_node_fs13.default.readFileSync(zipPathOrBuffer);
     } else {
       buffer = zipPathOrBuffer;
     }
@@ -22891,9 +22979,9 @@ function resolveTrustedPublicKeys(explicitKeys, env = process.env) {
     for (const part of remaining.split(/[,;\n]/)) {
       const p = part.trim();
       if (!p) continue;
-      if (import_node_fs12.default.existsSync(p)) {
+      if (import_node_fs13.default.existsSync(p)) {
         try {
-          const fileContent = import_node_fs12.default.readFileSync(p, "utf8").trim();
+          const fileContent = import_node_fs13.default.readFileSync(p, "utf8").trim();
           const filePems = fileContent.match(/-----BEGIN [A-Z0-9 ]+-----[\s\S]+?-----END [A-Z0-9 ]+-----/g);
           if (filePems) {
             for (const fpem of filePems) {
@@ -22946,7 +23034,7 @@ async function verifyPluginPackage(options) {
       const JSZip5 = (await import("jszip")).default;
       let buffer;
       if (typeof packageSource === "string") {
-        buffer = import_node_fs12.default.readFileSync(packageSource);
+        buffer = import_node_fs13.default.readFileSync(packageSource);
       } else {
         buffer = packageSource;
       }
@@ -23152,11 +23240,11 @@ var PluginDistributionManager = class {
       return;
     }
     const filePath = this.pluginHost.getPluginFilePath(this.pluginHost.resolvePluginUuid(pluginId));
-    const fs39 = await import("node:fs");
-    if (!fs39.existsSync(filePath)) {
+    const fs40 = await import("node:fs");
+    if (!fs40.existsSync(filePath)) {
       throw new Error(`Cannot reload plugin "${pluginId}": source file missing at ${filePath}`);
     }
-    const code = fs39.readFileSync(filePath, "utf-8");
+    const code = fs40.readFileSync(filePath, "utf-8");
     await this.pluginHost.reloadPlugin(pluginId, code);
   }
   async updateFromZip(zipPath, options = {}) {
@@ -23345,8 +23433,8 @@ var HotReloadController = class {
     const timer = setTimeout(async () => {
       this.debounceTimers.delete(pluginId);
       try {
-        const fs39 = await import("fs/promises");
-        const newSourceCode = await fs39.readFile(filePath, "utf-8");
+        const fs40 = await import("fs/promises");
+        const newSourceCode = await fs40.readFile(filePath, "utf-8");
         console.log(`[HotReload] File changed: ${filePath} \u2192 triggering reload for "${pluginId}"`);
         await this.pluginHost.reloadPlugin(pluginId, newSourceCode);
       } catch (err) {
@@ -32579,24 +32667,24 @@ ${formatEnvIssues(warnings)}`);
 }
 
 // server/security/file-permissions.ts
-var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path13 = __toESM(require("node:path"), 1);
+var import_node_fs14 = __toESM(require("node:fs"), 1);
+var import_node_path14 = __toESM(require("node:path"), 1);
 var FILE_PERMISSION_BASELINE_DOC = "\u4FEE\u590D\uFF1Achmod 600 <file>\uFF08\u76EE\u5F55 chmod 700\uFF09\uFF1B\u8BE6\u89C1 docs/administrator-guide/admin-manual.md \u6587\u4EF6\u6743\u9650\u57FA\u7EBF\u4E00\u8282\u3002";
 function modeOf(p) {
   try {
-    return import_node_fs13.default.statSync(p).mode & 511;
+    return import_node_fs14.default.statSync(p).mode & 511;
   } catch {
     return null;
   }
 }
 function defaultPaths() {
-  const dbPath2 = process.env.OPENLEARN_DB_PATH ? import_node_path13.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH) : import_node_path13.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
-  const backupDir = process.env.BACKUP_DIR ? import_node_path13.default.resolve(process.cwd(), process.env.BACKUP_DIR) : import_node_path13.default.join(import_node_path13.default.dirname(dbPath2), "backups");
+  const dbPath2 = process.env.OPENLEARN_DB_PATH ? import_node_path14.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH) : import_node_path14.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
+  const backupDir = process.env.BACKUP_DIR ? import_node_path14.default.resolve(process.cwd(), process.env.BACKUP_DIR) : import_node_path14.default.join(import_node_path14.default.dirname(dbPath2), "backups");
   return {
-    envPath: import_node_path13.default.resolve(process.cwd(), ".env"),
+    envPath: import_node_path14.default.resolve(process.cwd(), ".env"),
     dbPath: dbPath2,
     backupDir,
-    encryptionKeyPath: import_node_path13.default.resolve(process.cwd(), "storage", "encryption-key")
+    encryptionKeyPath: import_node_path14.default.resolve(process.cwd(), "storage", "encryption-key")
   };
 }
 function checkSensitiveFilePermissions(options = {}) {
@@ -32627,11 +32715,11 @@ function checkSensitiveFilePermissions(options = {}) {
   }
   if (dirMode !== null) {
     let scanned = 0;
-    for (const entry of import_node_fs13.default.readdirSync(backupDir)) {
+    for (const entry of import_node_fs14.default.readdirSync(backupDir)) {
       if (scanned >= maxBackupFiles) break;
       if (!entry.endsWith(".db")) continue;
       scanned++;
-      checkFile(import_node_path13.default.join(backupDir, entry), "600", "backup-file");
+      checkFile(import_node_path14.default.join(backupDir, entry), "600", "backup-file");
     }
   }
   return issues;
@@ -33531,8 +33619,8 @@ var runOpenAIAgentChat = async (provider, request) => {
 };
 
 // server/backup-scheduler.ts
-var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_fs15 = __toESM(require("node:fs"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
 var HOUR_MS = 60 * 60 * 1e3;
 var DAY_MS2 = 24 * HOUR_MS;
 var WAL_FULL_THRESHOLD_BYTES = 50 * 1024 * 1024;
@@ -33549,8 +33637,8 @@ function shouldFullCheckpoint(walBytes, threshold = WAL_FULL_THRESHOLD_BYTES) {
 }
 function resolveDbPath(explicit) {
   if (explicit) return explicit;
-  if (process.env.OPENLEARN_DB_PATH) return import_node_path14.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH);
-  return import_node_path14.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
+  if (process.env.OPENLEARN_DB_PATH) return import_node_path15.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH);
+  return import_node_path15.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
 }
 function startBackupScheduler(deps) {
   const noop = { stop: () => {
@@ -33578,7 +33666,7 @@ function startBackupScheduler(deps) {
     try {
       let walBytes = 0;
       try {
-        walBytes = import_node_fs14.default.statSync(dbPath2 + "-wal").size;
+        walBytes = import_node_fs15.default.statSync(dbPath2 + "-wal").size;
       } catch {
         walBytes = 0;
       }
@@ -33669,9 +33757,9 @@ function isWhitelisted(route, whitelist) {
     (entry) => entry.method.toUpperCase() === route.method && normalizePath2(entry.path) === normalizePath2(route.path)
   );
 }
-function normalizePath2(path45) {
-  if (!path45) return "/";
-  return path45.endsWith("/") && path45.length > 1 ? path45.slice(0, -1) : path45;
+function normalizePath2(path46) {
+  if (!path46) return "/";
+  return path46.endsWith("/") && path46.length > 1 ? path46.slice(0, -1) : path46;
 }
 function auditRouteScopes(app, whitelist = []) {
   const declared = [];
@@ -33849,11 +33937,11 @@ function enforcePasswordChanged(req, res, next) {
   if (isPasswordChangeGateSkipped()) {
     return next();
   }
-  const path45 = req.path || "";
-  if (!path45.startsWith("/api/")) {
+  const path46 = req.path || "";
+  if (!path46.startsWith("/api/")) {
     return next();
   }
-  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path45)) {
+  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path46)) {
     return next();
   }
   const token = getCookieToken(req);
@@ -33928,8 +34016,8 @@ function csrfGuard(req, res, next) {
       next();
       return;
     }
-    const path46 = req.path;
-    if (EXEMPT_PREFIXES.some((p) => path46 === p || path46.startsWith(p))) {
+    const path47 = req.path;
+    if (EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
       next();
       return;
     }
@@ -33939,10 +34027,10 @@ function csrfGuard(req, res, next) {
   const origin = req.headers.origin;
   const referer = req.headers.referer;
   const host = req.headers.host;
-  const path45 = req.path;
+  const path46 = req.path;
   if (typeof origin === "string" && origin !== "") {
     if (origin === "null") {
-      if (!EXEMPT_PREFIXES.some((p) => path45 === p || path45.startsWith(p))) {
+      if (!EXEMPT_PREFIXES.some((p) => path46 === p || path46.startsWith(p))) {
         res.status(403).json({ success: false, code: "FORBIDDEN_CROSS_SITE", error: "Opaque origin write request blocked" });
         return;
       }
@@ -33950,7 +34038,7 @@ function csrfGuard(req, res, next) {
       try {
         const originHost = new URL(origin).host;
         if (host && originHost.toLowerCase() !== host.toLowerCase()) {
-          if (!EXEMPT_PREFIXES.some((p) => path45 === p || path45.startsWith(p))) {
+          if (!EXEMPT_PREFIXES.some((p) => path46 === p || path46.startsWith(p))) {
             res.status(403).json({
               success: false,
               code: "FORBIDDEN_CROSS_SITE",
@@ -33968,7 +34056,7 @@ function csrfGuard(req, res, next) {
     try {
       const refererHost = new URL(referer).host;
       if (host && refererHost.toLowerCase() !== host.toLowerCase()) {
-        if (!EXEMPT_PREFIXES.some((p) => path45 === p || path45.startsWith(p))) {
+        if (!EXEMPT_PREFIXES.some((p) => path46 === p || path46.startsWith(p))) {
           res.status(403).json({
             success: false,
             code: "FORBIDDEN_CROSS_SITE",
@@ -34021,8 +34109,8 @@ function parseSentryDsn(dsn) {
     const projectId = url.pathname.split("/").filter(Boolean).pop();
     if (!projectId || !/^\d+$/.test(projectId)) return null;
     const prefix = url.pathname.split("/").filter(Boolean).slice(0, -1).join("/");
-    const path45 = prefix ? `/${prefix}` : "";
-    const envelopeUrl = `${url.protocol}//${url.host}${path45}/api/${projectId}/envelope/`;
+    const path46 = prefix ? `/${prefix}` : "";
+    const envelopeUrl = `${url.protocol}//${url.host}${path46}/api/${projectId}/envelope/`;
     return { envelopeUrl, publicKey };
   } catch {
     return null;
@@ -34462,23 +34550,23 @@ function createSocketIoCors(options) {
 }
 
 // server/routes/health.ts
-var import_node_fs16 = __toESM(require("node:fs"), 1);
-var import_node_path16 = __toESM(require("node:path"), 1);
+var import_node_fs17 = __toESM(require("node:fs"), 1);
+var import_node_path17 = __toESM(require("node:path"), 1);
 
 // packages/core/observability/health.ts
-var import_node_fs15 = __toESM(require("node:fs"), 1);
-var import_node_path15 = __toESM(require("node:path"), 1);
+var import_node_fs16 = __toESM(require("node:fs"), 1);
+var import_node_path16 = __toESM(require("node:path"), 1);
 var import_node_crypto13 = require("node:crypto");
 function probeStorageWritable(dir) {
-  const probe = import_node_path15.default.join(dir, `.ready-${process.pid}-${(0, import_node_crypto13.randomBytes)(4).toString("hex")}`);
+  const probe = import_node_path16.default.join(dir, `.ready-${process.pid}-${(0, import_node_crypto13.randomBytes)(4).toString("hex")}`);
   try {
-    import_node_fs15.default.mkdirSync(dir, { recursive: true });
-    import_node_fs15.default.writeFileSync(probe, "ok", { flag: "w" });
-    import_node_fs15.default.unlinkSync(probe);
+    import_node_fs16.default.mkdirSync(dir, { recursive: true });
+    import_node_fs16.default.writeFileSync(probe, "ok", { flag: "w" });
+    import_node_fs16.default.unlinkSync(probe);
     return true;
   } catch {
     try {
-      import_node_fs15.default.unlinkSync(probe);
+      import_node_fs16.default.unlinkSync(probe);
     } catch {
     }
     return false;
@@ -34486,15 +34574,15 @@ function probeStorageWritable(dir) {
 }
 function listMigrationNames(migrationsDir) {
   try {
-    if (!import_node_fs15.default.existsSync(migrationsDir)) return null;
-    const names = import_node_fs15.default.readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).map((file) => import_node_path15.default.basename(file, ".sql"));
+    if (!import_node_fs16.default.existsSync(migrationsDir)) return null;
+    const names = import_node_fs16.default.readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).map((file) => import_node_path16.default.basename(file, ".sql"));
     return names.length > 0 ? names : null;
   } catch {
     return null;
   }
 }
 function migrationRecordName(name) {
-  return import_node_path15.default.basename(name.replace(/\r/g, "").trim(), ".sql");
+  return import_node_path16.default.basename(name.replace(/\r/g, "").trim(), ".sql");
 }
 function migrationsComplete(expected, applied) {
   if (!expected) return { ok: false, reason: "migrations" };
@@ -34586,15 +34674,15 @@ function countPendingMigrations(migrationsDir, appliedMigrations) {
 function newestBackupAgeSeconds(backupDir, now) {
   let names;
   try {
-    if (!import_node_fs16.default.existsSync(backupDir)) return OPERATIONAL_GAUGE_UNKNOWN;
-    names = import_node_fs16.default.readdirSync(backupDir);
+    if (!import_node_fs17.default.existsSync(backupDir)) return OPERATIONAL_GAUGE_UNKNOWN;
+    names = import_node_fs17.default.readdirSync(backupDir);
   } catch {
     return OPERATIONAL_GAUGE_UNKNOWN;
   }
   let newestMs = Number.NEGATIVE_INFINITY;
   for (const name of names) {
     try {
-      const stat = import_node_fs16.default.statSync(import_node_path16.default.join(backupDir, name));
+      const stat = import_node_fs17.default.statSync(import_node_path17.default.join(backupDir, name));
       if (!stat.isFile()) continue;
       if (stat.mtimeMs > newestMs) newestMs = stat.mtimeMs;
     } catch {
@@ -34626,7 +34714,7 @@ function defaultCountEvents() {
 function registerHealthRoutes(app, options) {
   const startTime = options?.startTime ?? Date.now();
   const platformVersion = options?.platformVersion ?? PLATFORM_VERSION;
-  const migrationsDir = options?.migrationsDir ?? import_node_path16.default.join(process.cwd(), "migrations");
+  const migrationsDir = options?.migrationsDir ?? import_node_path17.default.join(process.cwd(), "migrations");
   const storageDir = options?.storageDir ?? getStorageDir();
   const backupDir = options?.backupDir ?? getBackupsDir();
   const countEvents = options?.countEvents ?? defaultCountEvents;
@@ -34746,8 +34834,8 @@ var import_express2 = __toESM(require("express"), 1);
 var import_zod2 = require("zod");
 
 // server/services/course-package-assets.ts
-var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_path17 = __toESM(require("node:path"), 1);
+var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_path18 = __toESM(require("node:path"), 1);
 var import_node_crypto14 = __toESM(require("node:crypto"), 1);
 var import_jszip3 = __toESM(require("jszip"), 1);
 var import_jspdf = require("jspdf");
@@ -34991,8 +35079,8 @@ async function materializePackageAssets(assets) {
   const result = /* @__PURE__ */ new Map();
   if (assets.length === 0) return result;
   const uploadsDir = getUploadsDir();
-  if (!import_node_fs17.default.existsSync(uploadsDir)) {
-    import_node_fs17.default.mkdirSync(uploadsDir, { recursive: true });
+  if (!import_node_fs18.default.existsSync(uploadsDir)) {
+    import_node_fs18.default.mkdirSync(uploadsDir, { recursive: true });
   }
   const writtenPaths = [];
   try {
@@ -35014,8 +35102,8 @@ async function materializePackageAssets(assets) {
         throw new Error(`\u8BFE\u7A0B\u5305\u8D44\u4EA7 "${asset.id}" \u58F0\u660E\u4E3A ${asset.contentType} \u4F46\u5185\u5BB9\u662F\u4E8C\u8FDB\u5236`);
       }
       const uniqueName = `${Date.now()}-${import_node_crypto14.default.randomBytes(4).toString("hex")}${ext}`;
-      const filePath = import_node_path17.default.join(uploadsDir, uniqueName);
-      import_node_fs17.default.writeFileSync(filePath, buffer);
+      const filePath = import_node_path18.default.join(uploadsDir, uniqueName);
+      import_node_fs18.default.writeFileSync(filePath, buffer);
       writtenPaths.push(filePath);
       const slideCount = isEmbeddableAssetType(asset.contentType) ? asset.contentType === "pdf" ? countPdfPages(buffer) : await countPptxSlides(buffer) : 0;
       result.set(asset.id, {
@@ -35029,7 +35117,7 @@ async function materializePackageAssets(assets) {
   } catch (err) {
     for (const filePath of writtenPaths) {
       try {
-        import_node_fs17.default.unlinkSync(filePath);
+        import_node_fs18.default.unlinkSync(filePath);
       } catch (cleanupErr) {
         console.warn("[course-package] \u9644\u4EF6\u8865\u507F\u6E05\u7406\u5931\u8D25:", cleanupErr.message);
       }
@@ -40031,7 +40119,7 @@ ${runtimeScripts}` : BRIDGE_SDK_CODE;
 }
 
 // server/routes/lessons.ts
-var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_fs19 = __toESM(require("node:fs"), 1);
 
 // server/services/diagnostic-service.ts
 var import_crypto12 = require("crypto");
@@ -41943,8 +42031,8 @@ function registerLessonsRoutes(ctx) {
       passed += 1;
       try {
         const dir = getUploadsDir();
-        import_node_fs18.default.mkdirSync(dir, { recursive: true });
-        import_node_fs18.default.accessSync(dir, import_node_fs18.default.constants.W_OK);
+        import_node_fs19.default.mkdirSync(dir, { recursive: true });
+        import_node_fs19.default.accessSync(dir, import_node_fs19.default.constants.W_OK);
         checks.staticResources = { status: "passed", message: "\u8BFE\u4EF6\u5B58\u50A8\u76EE\u5F55\u53EF\u5199" };
         passed += 1;
       } catch (err) {
@@ -41977,8 +42065,8 @@ function registerLessonsRoutes(ctx) {
 }
 
 // server/services/course-package-import.ts
-var import_node_fs19 = __toESM(require("node:fs"), 1);
-var import_node_path18 = __toESM(require("node:path"), 1);
+var import_node_fs20 = __toESM(require("node:fs"), 1);
+var import_node_path19 = __toESM(require("node:path"), 1);
 var import_uuid18 = require("uuid");
 
 // server/services/course-package-identity.ts
@@ -42253,11 +42341,11 @@ function findReferencedAsset(rawData, assets) {
 function cleanupMaterializedAssets(materialized) {
   const uploadsDir = getUploadsDir();
   for (const asset of materialized.values()) {
-    const fileName = import_node_path18.default.basename(asset.fileUrl);
-    const target = import_node_path18.default.join(uploadsDir, fileName);
+    const fileName = import_node_path19.default.basename(asset.fileUrl);
+    const target = import_node_path19.default.join(uploadsDir, fileName);
     try {
-      if (import_node_fs19.default.existsSync(target)) {
-        import_node_fs19.default.unlinkSync(target);
+      if (import_node_fs20.default.existsSync(target)) {
+        import_node_fs20.default.unlinkSync(target);
       }
     } catch (err) {
       console.warn(`[course-package] \u6E05\u7406\u5B64\u513F\u9644\u4EF6\u5931\u8D25\uFF1A${target}`, err.message);
@@ -48334,7 +48422,7 @@ async function checkVersion(source, installedVersion) {
 init_audit_log();
 
 // server/routes/plugin-api-gateway.ts
-var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_path20 = __toESM(require("node:path"), 1);
 init_http_router();
 init_interfaces();
 var RESERVED_ACTIONS = /* @__PURE__ */ new Set([
@@ -48508,7 +48596,7 @@ async function pluginApiGatewayMiddleware(req, res, next) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
   }
-  const normalizedSubPath = import_node_path19.default.posix.normalize("/" + rawSubPath);
+  const normalizedSubPath = import_node_path20.default.posix.normalize("/" + rawSubPath);
   if (normalizedSubPath.includes("..")) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
@@ -48945,8 +49033,8 @@ init_fetch_with_retry();
 
 // server/services/community-registry.ts
 var import_semver7 = __toESM(require("semver"), 1);
-var import_node_fs20 = __toESM(require("node:fs"), 1);
-var import_node_path20 = __toESM(require("node:path"), 1);
+var import_node_fs21 = __toESM(require("node:fs"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
 var import_node_os3 = __toESM(require("node:os"), 1);
 var import_node_crypto16 = require("node:crypto");
 var COMMUNITY_REGISTRY_ENV = "PLUGIN_COMMUNITY_REGISTRY_URL";
@@ -49168,8 +49256,8 @@ async function downloadPluginPackage(downloadUrl, options = {}) {
   if (!response.body) {
     throw new Error("\u4E0B\u8F7D\u63D2\u4EF6\u5305\u5931\u8D25: \u54CD\u5E94\u4F53\u4E3A\u7A7A");
   }
-  const zipPath = import_node_path20.default.join(import_node_os3.default.tmpdir(), `plugin-download-${(0, import_node_crypto16.randomUUID)()}.zip`);
-  const out = import_node_fs20.default.createWriteStream(zipPath);
+  const zipPath = import_node_path21.default.join(import_node_os3.default.tmpdir(), `plugin-download-${(0, import_node_crypto16.randomUUID)()}.zip`);
+  const out = import_node_fs21.default.createWriteStream(zipPath);
   let received = 0;
   try {
     for await (const chunk of response.body) {
@@ -49191,13 +49279,13 @@ async function downloadPluginPackage(downloadUrl, options = {}) {
   } catch (err) {
     out.destroy();
     try {
-      import_node_fs20.default.rmSync(zipPath, { force: true });
+      import_node_fs21.default.rmSync(zipPath, { force: true });
     } catch {
     }
     throw err;
   }
   if (received === 0) {
-    import_node_fs20.default.rmSync(zipPath, { force: true });
+    import_node_fs21.default.rmSync(zipPath, { force: true });
     throw new Error("\u63D2\u4EF6\u5305\u4E3A\u7A7A");
   }
   return { zipPath, filename: resolveFilename(response, downloadUrl), bytes: received };
@@ -57121,8 +57209,10 @@ async function startServer() {
     if (migrations.length === 0) {
       throw new Error(`[Migration] FATAL: ${migrationsDir} \u4E2D\u6CA1\u6709\u8FC1\u79FB\u6587\u4EF6\uFF0C\u62D2\u7EDD\u542F\u52A8\u3002`);
     }
-    runMigrations(kernelContainer.db, migrations);
+    runMigrations(kernelContainer.db, migrations, { strictLedger: true });
     console.log(`[Migration] \u542F\u52A8\u590D\u67E5\u5B8C\u6210\uFF1A${migrationsDir}\uFF08${migrations.length} \u4E2A\u6587\u4EF6\uFF09`);
+    assertSchemaMatchesGolden(kernelContainer.db, migrationsDir);
+    console.log("[SchemaGolden] \u542F\u52A8\u7EC8\u68C0\u901A\u8FC7\uFF1A\u6570\u636E\u5E93\u7ED3\u6784\u8986\u76D6\u4EE3\u7801\u671F\u671B\u7684\u5168\u90E8\u8868\u4E0E\u5217\u3002");
   } catch (err) {
     console.error("[Migration] FATAL: \u6570\u636E\u5E93\u8FC1\u79FB\u5931\u8D25\uFF0C\u62D2\u7EDD\u5728\u672A\u5B8C\u6210\u8FC1\u79FB\u7684\u5E93\u4E0A\u63D0\u4F9B\u670D\u52A1\u3002");
     console.error(err);