openlearn-next 0.7.3 → 0.7.5

package/dist/server.cjs

@@ -944,6 +944,9 @@ var init_manifest_schema = __esm({
       "stage.display.overlay": import_zod.z.array(frontendSlotEntrySchema).optional(),
       "stage.display.action": import_zod.z.array(frontendSlotEntrySchema).optional(),
       "assignment.submission.preview": import_zod.z.array(frontendSlotEntrySchema).optional(),
+      // 作业**附件**预览：插件声明自己能处理的文件类型（extensions / mimeTypes），
+      // 宿主在预览对话框里按类型匹配后给出入口。数据型贡献（远程插件可用）。
+      "assignment.file.preview": import_zod.z.array(frontendSlotEntrySchema).optional(),
       "student.classroom.overlay": import_zod.z.array(frontendSlotEntrySchema).optional(),
       "student.profile.tab": import_zod.z.array(frontendSlotEntrySchema).optional(),
       "whiteboard.renderer": import_zod.z.array(frontendSlotEntrySchema).optional(),
@@ -1188,12 +1191,12 @@ var init_manifest_schema = __esm({
 // packages/core/di/api-key-crypto.ts
 function resolveEncryptionKeyStorageDir(env = process.env, cwd = process.cwd()) {
   if (env.OPENLEARN_DATA_DIR?.trim()) {
-    return import_node_path3.default.join(import_node_path3.default.resolve(env.OPENLEARN_DATA_DIR.trim()), "storage");
+    return import_node_path5.default.join(import_node_path5.default.resolve(env.OPENLEARN_DATA_DIR.trim()), "storage");
   }
   if (env.OPENLEARN_DB_PATH?.trim()) {
-    return import_node_path3.default.join(import_node_path3.default.dirname(import_node_path3.default.resolve(env.OPENLEARN_DB_PATH.trim())), "storage");
+    return import_node_path5.default.join(import_node_path5.default.dirname(import_node_path5.default.resolve(env.OPENLEARN_DB_PATH.trim())), "storage");
   }
-  return import_node_path3.default.join(cwd, "storage");
+  return import_node_path5.default.join(cwd, "storage");
 }
 function normalizeKeyHex(raw) {
   let value = raw.trim();
@@ -1214,11 +1217,11 @@ function readProcessEnvKey(env) {
   return normalizeKeyHex(raw);
 }
 function readDotEnvKey(cwd) {
-  const envPath = import_node_path3.default.resolve(cwd, ".env");
-  if (!import_node_fs3.default.existsSync(envPath)) return null;
+  const envPath = import_node_path5.default.resolve(cwd, ".env");
+  if (!import_node_fs4.default.existsSync(envPath)) return null;
   let content = "";
   try {
-    content = import_node_fs3.default.readFileSync(envPath, "utf8");
+    content = import_node_fs4.default.readFileSync(envPath, "utf8");
   } catch {
     return null;
   }
@@ -1227,11 +1230,11 @@ function readDotEnvKey(cwd) {
   return normalizeKeyHex(match[1] ?? "");
 }
 function keyFilePath(storageDir) {
-  return import_node_path3.default.join(storageDir, ENCRYPTION_KEY_FILE_NAME);
+  return import_node_path5.default.join(storageDir, ENCRYPTION_KEY_FILE_NAME);
 }
 function chmodKeyFile(filePath) {
   try {
-    import_node_fs3.default.chmodSync(filePath, 384);
+    import_node_fs4.default.chmodSync(filePath, 384);
   } catch (err) {
     throw new Error(
       `\u65E0\u6CD5\u5C06 ${filePath} \u7684\u6743\u9650\u8BBE\u4E3A 0600\uFF08${err instanceof Error ? err.message : err}\uFF09\u3002\u5DF2\u62D2\u7EDD\u7EE7\u7EED\u4F7F\u7528\u8BE5\u5BC6\u94A5\u6587\u4EF6\u3002`
@@ -1239,8 +1242,8 @@ function chmodKeyFile(filePath) {
   }
 }
 function readKeyFile(filePath) {
-  if (!import_node_fs3.default.existsSync(filePath)) return null;
-  const normalized = normalizeKeyHex(import_node_fs3.default.readFileSync(filePath, "utf8"));
+  if (!import_node_fs4.default.existsSync(filePath)) return null;
+  const normalized = normalizeKeyHex(import_node_fs4.default.readFileSync(filePath, "utf8"));
   if (!normalized) {
     throw new EncryptionKeyInvalidError(
       `\u5BC6\u94A5\u6587\u4EF6 ${filePath} \u662F\u7A7A\u7684\u3002\u8BF7\u5220\u6389\u5B83\uFF0C\u6216\u5199\u5165\u539F\u6765\u7684 64 \u4F4D hex\u3002\u4E0D\u8981\u8BA9\u7CFB\u7EDF\u53E6\u9020\u4E00\u628A\u94A5\u5319\u3002`
@@ -1253,9 +1256,9 @@ function keysEqual(left, right) {
   return import_node_crypto.default.timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
 }
 function persistGeneratedKey(filePath, generated) {
-  import_node_fs3.default.mkdirSync(import_node_path3.default.dirname(filePath), { recursive: true });
+  import_node_fs4.default.mkdirSync(import_node_path5.default.dirname(filePath), { recursive: true });
   try {
-    import_node_fs3.default.writeFileSync(filePath, `${generated}
+    import_node_fs4.default.writeFileSync(filePath, `${generated}
 `, { mode: 384, flag: "wx" });
   } catch (err) {
     const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
@@ -1291,7 +1294,7 @@ function resolveEncryptionKey(options = {}) {
   const fromDotEnv = fromProcess ? null : readDotEnvKey(cwd);
   const configured = fromProcess ?? fromDotEnv;
   const configuredSource = fromProcess ? "env" : fromDotEnv ? "env-file" : null;
-  const fileKey = import_node_fs3.default.existsSync(filePath) ? readKeyFile(filePath) : null;
+  const fileKey = import_node_fs4.default.existsSync(filePath) ? readKeyFile(filePath) : null;
   if (configured && fileKey && !keysEqual(configured, fileKey)) {
     throw new EncryptionKeyMismatchError(filePath);
   }
@@ -1400,13 +1403,13 @@ function encryptStoredPlaintextApiKeys(db2) {
   }
   return { updated, skipped };
 }
-var import_node_crypto, import_node_fs3, import_node_path3, ENCRYPTION_KEY_FILE_NAME, AUTO_GENERATED_KEY_WARNING, HEX_64, EncryptionKeyInvalidError, EncryptionKeyMismatchError, cached;
+var import_node_crypto, import_node_fs4, import_node_path5, ENCRYPTION_KEY_FILE_NAME, AUTO_GENERATED_KEY_WARNING, HEX_64, EncryptionKeyInvalidError, EncryptionKeyMismatchError, cached;
 var init_api_key_crypto = __esm({
   "packages/core/di/api-key-crypto.ts"() {
     "use strict";
     import_node_crypto = __toESM(require("node:crypto"), 1);
-    import_node_fs3 = __toESM(require("node:fs"), 1);
-    import_node_path3 = __toESM(require("node:path"), 1);
+    import_node_fs4 = __toESM(require("node:fs"), 1);
+    import_node_path5 = __toESM(require("node:path"), 1);
     ENCRYPTION_KEY_FILE_NAME = "encryption-key";
     AUTO_GENERATED_KEY_WARNING = "\u6B63\u5728\u4F7F\u7528\u81EA\u52A8\u751F\u6210\u7684\u52A0\u5BC6\u5BC6\u94A5\uFF08storage/encryption-key\uFF0C\u4E0E bootstrap-credentials.txt \u540C\u76EE\u5F55\uFF0C\u6743\u9650 600\uFF09\u3002\u5EFA\u8BAE\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF ENCRYPTION_KEY \u4E3A\u8BE5\u6587\u4EF6\u4E2D\u7684 64 \u4F4D hex\uFF0C\u5E76\u79BB\u7EBF\u5907\u4EFD\u8BE5\u6587\u4EF6\u3002site-backup \u4E0D\u5305\u542B\u6B64\u6587\u4EF6\u3002\u4E22\u5931\u540E\u65E0\u6CD5\u89E3\u5BC6 AI Provider API Key \u4E0E\u73ED\u7EA7\u4E34\u65F6\u53E3\u4EE4\u3002";
     HEX_64 = /^[0-9a-fA-F]{64}$/;
@@ -1921,49 +1924,49 @@ function getMaxUncompressedSize() {
 }
 function isInsideRoot(root, target) {
   if (!root || !target) return false;
-  const rel = path7.relative(path7.resolve(root), path7.resolve(target));
+  const rel = path9.relative(path9.resolve(root), path9.resolve(target));
   if (rel === "") return false;
-  if (path7.isAbsolute(rel)) return false;
-  return rel !== ".." && !rel.startsWith(".." + path7.sep);
+  if (path9.isAbsolute(rel)) return false;
+  return rel !== ".." && !rel.startsWith(".." + path9.sep);
 }
 function realPathOrNull(target) {
   try {
-    return fs6.realpathSync(target);
+    return fs7.realpathSync(target);
   } catch {
     return null;
   }
 }
 function realPathOrSelf(target) {
-  return realPathOrNull(target) ?? path7.resolve(target);
+  return realPathOrNull(target) ?? path9.resolve(target);
 }
 function getMaxUploadBodyBytes() {
   return getMaxUncompressedSize();
 }
 function readZipBufferFromPath(zipPath) {
-  if (!fs6.existsSync(zipPath)) {
+  if (!fs7.existsSync(zipPath)) {
     throw new Error(`[install-utils] ZIP \u6587\u4EF6\u4E0D\u5B58\u5728: ${zipPath}`);
   }
-  return fs6.readFileSync(zipPath);
+  return fs7.readFileSync(zipPath);
 }
 function writeBufferToTempZip(buffer, prefix = "plugin-upload-") {
   if (!Buffer.isBuffer(buffer) || buffer.length === 0) {
     throw new Error("[install-utils] \u7A7A\u7684 ZIP Buffer");
   }
-  const zipPath = path7.join(os2.tmpdir(), `${prefix}${(0, import_uuid6.v7)()}.zip`);
-  fs6.writeFileSync(zipPath, buffer);
+  const zipPath = path9.join(os2.tmpdir(), `${prefix}${(0, import_uuid6.v7)()}.zip`);
+  fs7.writeFileSync(zipPath, buffer);
   return zipPath;
 }
 function removeTempZip(zipPath) {
   if (!zipPath) return;
   try {
-    fs6.rmSync(zipPath, { force: true });
+    fs7.rmSync(zipPath, { force: true });
   } catch {
   }
 }
 function removeTempFile(filePath) {
   if (!filePath) return;
   try {
-    fs6.rmSync(filePath, { force: true });
+    fs7.rmSync(filePath, { force: true });
   } catch {
   }
 }
@@ -2209,13 +2212,13 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
   const esbuild = await import("esbuild");
   const allowedRoots = [];
   const allowRoot = (dir) => {
-    const lexical = path7.resolve(dir);
+    const lexical = path9.resolve(dir);
     if (allowedRoots.some((r) => r.lexical === lexical)) return;
     allowedRoots.push({ lexical, real: realPathOrSelf(lexical) });
   };
   allowRoot(resolveDir);
   const isPermittedPath = (target) => {
-    const resolved = path7.resolve(target);
+    const resolved = path9.resolve(target);
     if (allowedRoots.some((r) => isInsideRoot(r.lexical, resolved))) return true;
     const real = realPathOrNull(resolved);
     if (!real) return false;
@@ -2242,14 +2245,14 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
         setup(build) {
           build.onResolve({ filter: /.*/ }, (args) => {
             if (args.path.includes("core/di/interfaces")) {
-              const tsPath = path7.resolve(process.cwd(), "packages/core/di/interfaces.ts");
-              if (fs6.existsSync(tsPath)) {
-                allowRoot(path7.dirname(tsPath));
+              const tsPath = path9.resolve(process.cwd(), "packages/core/di/interfaces.ts");
+              if (fs7.existsSync(tsPath)) {
+                allowRoot(path9.dirname(tsPath));
                 return { path: tsPath };
               }
-              const jsPath = path7.resolve(process.cwd(), "packages/core/di/interfaces.js");
-              if (fs6.existsSync(jsPath)) {
-                allowRoot(path7.dirname(jsPath));
+              const jsPath = path9.resolve(process.cwd(), "packages/core/di/interfaces.js");
+              if (fs7.existsSync(jsPath)) {
+                allowRoot(path9.dirname(jsPath));
                 return { path: jsPath };
               }
             }
@@ -2263,8 +2266,8 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
               };
             }
             if (args.path.startsWith(".")) {
-              const importerDir = args.resolveDir || path7.resolve(resolveDir);
-              const candidate = path7.resolve(importerDir, args.path);
+              const importerDir = args.resolveDir || path9.resolve(resolveDir);
+              const candidate = path9.resolve(importerDir, args.path);
               if (!isPermittedPath(candidate)) {
                 return {
                   errors: [
@@ -2302,7 +2305,7 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
     ]
   });
   if (outfile !== void 0) {
-    assertPluginCodeSafe(fs6.readFileSync(outfile, "utf-8"));
+    assertPluginCodeSafe(fs7.readFileSync(outfile, "utf-8"));
     return void 0;
   }
   const bundled = result.outputFiles?.[0]?.text;
@@ -2316,8 +2319,8 @@ async function extractZipEntries(zip, destDir, maxTotalBytes) {
   let totalBytes = 0;
   for (const [name, file] of Object.entries(zip.files)) {
     if (file.dir) continue;
-    const filePath = path7.join(destDir, name);
-    fs6.mkdirSync(path7.dirname(filePath), { recursive: true });
+    const filePath = path9.join(destDir, name);
+    fs7.mkdirSync(path9.dirname(filePath), { recursive: true });
     const content = await file.async("nodebuffer");
     totalBytes += content.length;
     if (totalBytes > maxTotalBytes) {
@@ -2325,7 +2328,7 @@ async function extractZipEntries(zip, destDir, maxTotalBytes) {
         `ZIP bomb prevention: actual uncompressed size ${totalBytes} bytes exceeds limit of ${maxTotalBytes} bytes`
       );
     }
-    fs6.writeFileSync(filePath, content);
+    fs7.writeFileSync(filePath, content);
   }
 }
 async function validateAndBundleZip(zipPath) {
@@ -2373,16 +2376,16 @@ async function validateAndBundleZip(zipPath) {
     throw new Error(`Entry file "${manifest.main}" specified in manifest not found in ZIP package`);
   }
   const entryCode = await entryFile.async("string");
-  const tmpDir = path7.join(os2.tmpdir(), `plugin-build-${(0, import_uuid6.v7)()}`);
+  const tmpDir = path9.join(os2.tmpdir(), `plugin-build-${(0, import_uuid6.v7)()}`);
   try {
-    fs6.mkdirSync(tmpDir, { recursive: true });
+    fs7.mkdirSync(tmpDir, { recursive: true });
     await extractZipEntries(zip, tmpDir, getMaxUncompressedSize());
-    const bundledPath = path7.join(os2.tmpdir(), `plugin-bundle-${(0, import_uuid6.v7)()}.mjs`);
+    const bundledPath = path9.join(os2.tmpdir(), `plugin-bundle-${(0, import_uuid6.v7)()}.mjs`);
     await bundlePlugin(entryCode, tmpDir, bundledPath);
     return { manifest, bundledPath, entryFileName: resolvedMain, package: zip };
   } finally {
     try {
-      fs6.rmSync(tmpDir, { recursive: true, force: true });
+      fs7.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -2390,14 +2393,14 @@ async function validateAndBundleZip(zipPath) {
 async function extractManifestFromBundle(_bundledCode) {
   throw new Error("extractManifestFromBundle is not yet implemented");
 }
-var import_jszip, fs6, os2, path7, import_uuid6, PluginCodeSecurityError, LEX_SCAN_LIMIT;
+var import_jszip, fs7, os2, path9, import_uuid6, PluginCodeSecurityError, LEX_SCAN_LIMIT;
 var init_install_utils = __esm({
   "packages/core/esm-loader/install-utils.ts"() {
     "use strict";
     import_jszip = __toESM(require("jszip"), 1);
-    fs6 = __toESM(require("fs"), 1);
+    fs7 = __toESM(require("fs"), 1);
     os2 = __toESM(require("os"), 1);
-    path7 = __toESM(require("path"), 1);
+    path9 = __toESM(require("path"), 1);
     import_uuid6 = require("uuid");
     init_manifest_schema();
     PluginCodeSecurityError = class extends Error {
@@ -2472,7 +2475,7 @@ var init_redaction = __esm({
 // packages/core/observability/rotating-file-stream.ts
 function removeIfExists(filePath) {
   try {
-    import_node_fs4.default.unlinkSync(filePath);
+    import_node_fs5.default.unlinkSync(filePath);
   } catch {
   }
 }
@@ -2491,7 +2494,7 @@ function unregisterStream(stream) {
 function safeRename(from, to) {
   try {
     removeIfExists(to);
-    import_node_fs4.default.renameSync(from, to);
+    import_node_fs5.default.renameSync(from, to);
     return true;
   } catch {
     return false;
@@ -2516,12 +2519,12 @@ function resolveAuditRotationConfig(env = process.env) {
   const maxFiles = Math.floor(readPositiveInt(env.AUDIT_LOG_MAX_FILES, 20, "AUDIT_LOG_MAX_FILES"));
   return { maxBytes: Math.floor(maxSizeMb * 1024 * 1024), maxFiles };
 }
-var import_node_fs4, import_node_path4, import_node_stream, activeStreams, exitHookInstalled, RotatingFileStream;
+var import_node_fs5, import_node_path6, import_node_stream, activeStreams, exitHookInstalled, RotatingFileStream;
 var init_rotating_file_stream = __esm({
   "packages/core/observability/rotating-file-stream.ts"() {
     "use strict";
-    import_node_fs4 = __toESM(require("node:fs"), 1);
-    import_node_path4 = __toESM(require("node:path"), 1);
+    import_node_fs5 = __toESM(require("node:fs"), 1);
+    import_node_path6 = __toESM(require("node:path"), 1);
     import_node_stream = require("node:stream");
     activeStreams = /* @__PURE__ */ new Set();
     exitHookInstalled = false;
@@ -2535,7 +2538,7 @@ var init_rotating_file_stream = __esm({
         this.filePath = options.filePath;
         this.maxBytes = options.maxBytes;
         this.maxFiles = options.maxFiles;
-        this.dir = import_node_path4.default.dirname(this.filePath);
+        this.dir = import_node_path6.default.dirname(this.filePath);
       }
       /** 当前活动文件路径（测试与排障用） */
       get activeFilePath() {
@@ -2556,7 +2559,7 @@ var init_rotating_file_stream = __esm({
           if (this.currentSize > 0 && this.currentSize + buf.length > this.maxBytes) {
             this.rotate();
           }
-          const written = import_node_fs4.default.writeSync(this.fd, buf, 0, buf.length, null);
+          const written = import_node_fs5.default.writeSync(this.fd, buf, 0, buf.length, null);
           this.currentSize += written;
           callback();
         } catch (err) {
@@ -2576,7 +2579,7 @@ var init_rotating_file_stream = __esm({
       closeFd() {
         if (this.fd !== null) {
           try {
-            import_node_fs4.default.closeSync(this.fd);
+            import_node_fs5.default.closeSync(this.fd);
           } catch {
           }
           this.fd = null;
@@ -2585,11 +2588,11 @@ var init_rotating_file_stream = __esm({
       }
       ensureOpen() {
         if (this.fd !== null) return;
-        import_node_fs4.default.mkdirSync(this.dir, { recursive: true });
-        this.fd = import_node_fs4.default.openSync(this.filePath, "a");
+        import_node_fs5.default.mkdirSync(this.dir, { recursive: true });
+        this.fd = import_node_fs5.default.openSync(this.filePath, "a");
         registerStream(this);
         try {
-          this.currentSize = import_node_fs4.default.statSync(this.filePath).size;
+          this.currentSize = import_node_fs5.default.statSync(this.filePath).size;
         } catch {
           this.currentSize = 0;
         }
@@ -2603,13 +2606,13 @@ var init_rotating_file_stream = __esm({
         this.closeFd();
         for (let i = this.maxFiles - 1; i >= 1; i -= 1) {
           const from = this.historyFilePath(i);
-          if (import_node_fs4.default.existsSync(from)) {
+          if (import_node_fs5.default.existsSync(from)) {
             safeRename(from, this.historyFilePath(i + 1));
           }
         }
         safeRename(this.filePath, this.historyFilePath(1));
         this.currentSize = 0;
-        this.fd = import_node_fs4.default.openSync(this.filePath, "a");
+        this.fd = import_node_fs5.default.openSync(this.filePath, "a");
       }
     };
   }
@@ -2640,28 +2643,28 @@ function consoleStream() {
 function createLogger(component) {
   return logger.child({ component });
 }
-var import_pino, import_node_fs5, import_node_path5, defaultLevel, consoleLevel, fileLevel, rootLevel, logDir, logFile, streams, fileLogging, logger;
+var import_pino, import_node_fs6, import_node_path7, defaultLevel, consoleLevel, fileLevel, rootLevel, logDir, logFile, streams, fileLogging, logger;
 var init_logger = __esm({
   "packages/core/observability/logger.ts"() {
     "use strict";
     import_pino = __toESM(require("pino"), 1);
-    import_node_fs5 = __toESM(require("node:fs"), 1);
-    import_node_path5 = __toESM(require("node:path"), 1);
+    import_node_fs6 = __toESM(require("node:fs"), 1);
+    import_node_path7 = __toESM(require("node:path"), 1);
     init_redaction();
     init_rotating_file_stream();
     defaultLevel = process.env.LOG_LEVEL || (process.env.HTTP_ACCESS_LOG === "all" ? "debug" : process.env.NODE_ENV === "production" ? "info" : "debug");
     consoleLevel = process.env.LOG_CONSOLE_LEVEL || defaultLevel;
     fileLevel = defaultLevel;
     rootLevel = minPinoLevel(consoleLevel, fileLevel);
-    logDir = import_node_path5.default.resolve(process.env.LOG_DIR || import_node_path5.default.join(process.cwd(), "logs"));
-    logFile = import_node_path5.default.join(logDir, "openlearn.log");
+    logDir = import_node_path7.default.resolve(process.env.LOG_DIR || import_node_path7.default.join(process.cwd(), "logs"));
+    logFile = import_node_path7.default.join(logDir, "openlearn.log");
     streams = [
       { level: consoleLevel, stream: consoleStream() }
     ];
     fileLogging = false;
     try {
-      if (!import_node_fs5.default.existsSync(logDir)) import_node_fs5.default.mkdirSync(logDir, { recursive: true });
-      import_node_fs5.default.accessSync(logDir, import_node_fs5.default.constants.W_OK);
+      if (!import_node_fs6.default.existsSync(logDir)) import_node_fs6.default.mkdirSync(logDir, { recursive: true });
+      import_node_fs6.default.accessSync(logDir, import_node_fs6.default.constants.W_OK);
       fileLogging = true;
     } catch (err) {
       console.warn(`[logger] \u65E0\u6CD5\u5199\u5165\u65E5\u5FD7\u76EE\u5F55 ${logDir}\uFF0C\u4EC5\u8F93\u51FA\u5230 stdout\u3002`, err instanceof Error ? err.message : err);
@@ -2787,15 +2790,15 @@ function buildAuditLogger() {
   if (process.env.NODE_ENV === "test" || process.env.VITEST) {
     return (0, import_pino2.default)({ level: "silent" }, import_pino2.default.destination(1));
   }
-  const logDir2 = import_node_path6.default.resolve(process.env.LOG_DIR || import_node_path6.default.join(process.cwd(), "logs"));
+  const logDir2 = import_node_path8.default.resolve(process.env.LOG_DIR || import_node_path8.default.join(process.cwd(), "logs"));
   try {
-    if (!import_node_fs6.default.existsSync(logDir2)) import_node_fs6.default.mkdirSync(logDir2, { recursive: true });
-    import_node_fs6.default.accessSync(logDir2, import_node_fs6.default.constants.W_OK);
+    if (!import_node_fs7.default.existsSync(logDir2)) import_node_fs7.default.mkdirSync(logDir2, { recursive: true });
+    import_node_fs7.default.accessSync(logDir2, import_node_fs7.default.constants.W_OK);
     const rotation = resolveAuditRotationConfig();
     streams2.push({
       level: "info",
       stream: new RotatingFileStream({
-        filePath: import_node_path6.default.join(logDir2, "audit.log"),
+        filePath: import_node_path8.default.join(logDir2, "audit.log"),
         maxBytes: rotation.maxBytes,
         maxFiles: rotation.maxFiles
       })
@@ -2820,12 +2823,12 @@ function recordSecurityAudit(event, fields = {}) {
   }
   return record;
 }
-var import_node_fs6, import_node_path6, import_pino2, testSink, auditLogger;
+var import_node_fs7, import_node_path8, import_pino2, testSink, auditLogger;
 var init_audit_log = __esm({
   "packages/core/observability/audit-log.ts"() {
     "use strict";
-    import_node_fs6 = __toESM(require("node:fs"), 1);
-    import_node_path6 = __toESM(require("node:path"), 1);
+    import_node_fs7 = __toESM(require("node:fs"), 1);
+    import_node_path8 = __toESM(require("node:path"), 1);
     import_pino2 = __toESM(require("pino"), 1);
     init_logger();
     init_request_context();
@@ -3875,9 +3878,9 @@ var init_http_router = __esm({
       /**
        * 注册指定动词与路径的 Handler
        */
-      route(method, path45, handler, options = {}) {
+      route(method, path47, handler, options = {}) {
         const upperMethod = method.toUpperCase();
-        const normalized = path45.startsWith("/") ? path45 : "/" + path45;
+        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
         const { regex, paramNames } = compileRoutePattern(normalized);
         this.warnIfUnscoped(upperMethod, normalized, options);
         this.routes.push({
@@ -3890,20 +3893,20 @@ var init_http_router = __esm({
           scope: options.scope
         });
       }
-      get(path45, handler, options) {
-        this.route("GET", path45, handler, options);
+      get(path47, handler, options) {
+        this.route("GET", path47, handler, options);
       }
-      post(path45, handler, options) {
-        this.route("POST", path45, handler, options);
+      post(path47, handler, options) {
+        this.route("POST", path47, handler, options);
       }
-      put(path45, handler, options) {
-        this.route("PUT", path45, handler, options);
+      put(path47, handler, options) {
+        this.route("PUT", path47, handler, options);
       }
-      patch(path45, handler, options) {
-        this.route("PATCH", path45, handler, options);
+      patch(path47, handler, options) {
+        this.route("PATCH", path47, handler, options);
       }
-      delete(path45, handler, options) {
-        this.route("DELETE", path45, handler, options);
+      delete(path47, handler, options) {
+        this.route("DELETE", path47, handler, options);
       }
       warnIfUnscoped(method, pattern, options) {
         if (options.scope) return;
@@ -3918,19 +3921,19 @@ var init_http_router = __esm({
       }
       stream(methodOrPath, pathOrHandler, maybeHandler) {
         if (typeof pathOrHandler === "function") {
-          const path45 = methodOrPath;
+          const path47 = methodOrPath;
           const handler = pathOrHandler;
-          this.registerStream("GET", path45, handler);
-          this.registerStream("POST", path45, handler);
+          this.registerStream("GET", path47, handler);
+          this.registerStream("POST", path47, handler);
         } else {
           const method = methodOrPath.toUpperCase();
-          const path45 = pathOrHandler;
+          const path47 = pathOrHandler;
           const handler = maybeHandler;
-          this.registerStream(method, path45, handler);
+          this.registerStream(method, path47, handler);
         }
       }
-      registerStream(method, path45, handler) {
-        const normalized = path45.startsWith("/") ? path45 : "/" + path45;
+      registerStream(method, path47, handler) {
+        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
         const { regex, paramNames } = compileRoutePattern(normalized);
         this.routes.push({
           method: method.toUpperCase(),
@@ -3944,9 +3947,9 @@ var init_http_router = __esm({
       /**
        * 检查指定动词与路径是否为流式路由
        */
-      isStream(method, path45) {
+      isStream(method, path47) {
         const upperMethod = method.toUpperCase();
-        const normalized = path45.startsWith("/") ? path45 : "/" + path45;
+        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
         for (const entry of this.routes) {
           if (entry.method !== upperMethod) continue;
           if (entry.regex.test(normalized)) {
@@ -3958,9 +3961,9 @@ var init_http_router = __esm({
       /**
        * 匹配路由并提取路由参数
        */
-      match(method, path45) {
+      match(method, path47) {
         const upperMethod = method.toUpperCase();
-        const normalized = path45.startsWith("/") ? path45 : "/" + path45;
+        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
         for (const entry of this.routes) {
           if (entry.method !== upperMethod) continue;
           const match = normalized.match(entry.regex);
@@ -4103,13 +4106,13 @@ function checkMethodPolicy(input) {
   if (tokens.frontendApi && token === tokens.frontendApi) {
     if (isReadOnlyMethod(method)) return null;
     if (method === "request" && !Array.isArray(args)) return null;
-    const path45 = extractPathArg(args);
-    const isHighRisk = HIGH_RISK_PATH_PREFIXES.some((p) => path45 === p || path45.startsWith(`${p}/`));
-    const isIrreversible = IRREVERSIBLE_PATH_SUFFIXES.some((s) => path45.endsWith(s));
-    const isEntityDelete = method === "del" && ENTITY_DELETE_RE.test(path45);
+    const path47 = extractPathArg(args);
+    const isHighRisk = HIGH_RISK_PATH_PREFIXES.some((p) => path47 === p || path47.startsWith(`${p}/`));
+    const isIrreversible = IRREVERSIBLE_PATH_SUFFIXES.some((s) => path47.endsWith(s));
+    const isEntityDelete = method === "del" && ENTITY_DELETE_RE.test(path47);
     if (isHighRisk || isIrreversible || isEntityDelete) {
       if (hasCapability(caps, CAP_API_ADMIN)) return null;
-      const why = isIrreversible ? `\u4E0D\u53EF\u9006\u64CD\u4F5C '${path45}'` : isEntityDelete ? `\u5B9E\u4F53\u7EA7\u5220\u9664 '${path45}'` : `\u5199\u5165\u9AD8\u5371\u8DEF\u5F84 '${path45 || "<\u672A\u63D0\u4F9B\u8DEF\u5F84>"}'`;
+      const why = isIrreversible ? `\u4E0D\u53EF\u9006\u64CD\u4F5C '${path47}'` : isEntityDelete ? `\u5B9E\u4F53\u7EA7\u5220\u9664 '${path47}'` : `\u5199\u5165\u9AD8\u5371\u8DEF\u5F84 '${path47 || "<\u672A\u63D0\u4F9B\u8DEF\u5F84>"}'`;
       return `${why} \u9700\u8981 manifest \u58F0\u660E '${CAP_API_ADMIN}' \u80FD\u529B`;
     }
     return hasCapability(caps, CAP_API_WRITE) ? null : `\u5199\u64CD\u4F5C\uFF08${method}\uFF09\u9700\u8981 manifest \u58F0\u660E '${CAP_API_WRITE}' \u80FD\u529B\uFF08\u666E\u901A\u53EA\u8BFB\u8C03\u7528\u8BF7\u7528 get\uFF09`;
@@ -4609,6 +4612,53 @@ function wrapPointsDimensionRegistry(registry4, tracker, pluginId) {
     })
   };
 }
+function wrapClassroomLifecycleService(service, tracker, pluginId) {
+  return {
+    getStage: createSafeFunction((lessonId) => service.getStage(lessonId)),
+    transitionStage: createSafeFunction(
+      (lessonId, toStage, actorId, classId) => service.transitionStage(lessonId, toStage, actorId, classId)
+    ),
+    registerStageGuard: createSafeFunction((owner, guard) => {
+      service.registerStageGuard(owner, guard);
+      tracker.track(pluginId, {
+        dispose: () => {
+          service.unregisterStageGuard(owner);
+        }
+      });
+    }),
+    unregisterStageGuard: createSafeFunction((owner) => {
+      service.unregisterStageGuard(owner);
+    })
+  };
+}
+function wrapInteractionRuntimeService(service, tracker, pluginId) {
+  return {
+    registerActivityProvider: createSafeFunction((owner, descriptor) => {
+      service.registerActivityProvider(owner, descriptor);
+      const providerId = descriptor?.id;
+      if (providerId) {
+        tracker.track(pluginId, {
+          dispose: () => {
+            service.unregisterActivityProvider(owner, providerId);
+          }
+        });
+      }
+    }),
+    unregisterActivityProvider: createSafeFunction((owner, id) => {
+      service.unregisterActivityProvider(owner, id);
+    }),
+    listActivityProviders: createSafeFunction(() => service.listActivityProviders())
+  };
+}
+function wrapPluginRuntimeService(raw, tokenName, tracker, pluginId) {
+  if (tokenName === IClassroomLifecycleServiceToken.name) {
+    return wrapClassroomLifecycleService(raw, tracker, pluginId);
+  }
+  if (tokenName === IInteractionRuntimeServiceToken.name) {
+    return wrapInteractionRuntimeService(raw, tracker, pluginId);
+  }
+  return raw;
+}
 function wrapPointsLedgerService(service, pluginId, capabilities) {
   const auditAccess = (studentId, method, operation, requiredCap) => {
     const hasCap = hasCapability(capabilities ?? [], requiredCap);
@@ -4903,9 +4953,9 @@ async function buildContext(serviceRegistry, tracker, pluginId, manifest, db2, s
             `[PluginHost] Plugin "${manifest.id}" cannot resolve "${token}" by name. Use the Token object imported from @openlearn/plugin-sdk, or one of the SDK-exported Token names.`
           );
         }
-        return serviceRegistry.resolveByName(token);
+        return serviceRegistry.resolveByName(token).then((raw) => wrapPluginRuntimeService(raw, token, tracker, pluginId));
       }
-      return serviceRegistry.resolve(token);
+      return serviceRegistry.resolve(token).then((raw) => wrapPluginRuntimeService(raw, token.name, tracker, pluginId));
     },
     // V3.2: 插件向 DI 容器提供服务（对应 manifest.provides）
     provide: async (token, instance) => {
@@ -5714,7 +5764,7 @@ function spawnPluginChild(opts) {
   });
   const removeBootstrapFile = () => {
     try {
-      import_node_fs8.default.unlinkSync(bootstrapFile);
+      import_node_fs9.default.unlinkSync(bootstrapFile);
     } catch {
     }
   };
@@ -5740,25 +5790,25 @@ function isPidAlive(pid) {
   }
 }
 function writeBootstrapTempFile(code) {
-  const file = import_node_path9.default.join(
+  const file = import_node_path11.default.join(
     import_node_os.default.tmpdir(),
     `${BOOTSTRAP_PREFIX}${process.pid}-${import_node_crypto7.default.randomBytes(8).toString("hex")}${BOOTSTRAP_SUFFIX}`
   );
-  import_node_fs8.default.writeFileSync(file, code, { encoding: "utf8", mode: 384 });
+  import_node_fs9.default.writeFileSync(file, code, { encoding: "utf8", mode: 384 });
   return file;
 }
 function cleanupStaleBootstrapFiles(now = Date.now()) {
   try {
     const tmpDir = import_node_os.default.tmpdir();
-    const files = import_node_fs8.default.readdirSync(tmpDir);
+    const files = import_node_fs9.default.readdirSync(tmpDir);
     let cleaned = 0;
     for (const file of files) {
       if (!file.startsWith(BOOTSTRAP_PREFIX) || !file.endsWith(BOOTSTRAP_SUFFIX)) continue;
-      const full = import_node_path9.default.join(tmpDir, file);
+      const full = import_node_path11.default.join(tmpDir, file);
       const ownerPid = bootstrapOwnerPid(file);
       if (ownerPid === null) {
         try {
-          if (now - import_node_fs8.default.statSync(full).mtimeMs < LEGACY_BOOTSTRAP_STALE_MS) continue;
+          if (now - import_node_fs9.default.statSync(full).mtimeMs < LEGACY_BOOTSTRAP_STALE_MS) continue;
         } catch {
           continue;
         }
@@ -5766,7 +5816,7 @@ function cleanupStaleBootstrapFiles(now = Date.now()) {
         continue;
       }
       try {
-        import_node_fs8.default.unlinkSync(full);
+        import_node_fs9.default.unlinkSync(full);
         cleaned++;
       } catch {
       }
@@ -5779,9 +5829,9 @@ function cleanupStaleBootstrapFiles(now = Date.now()) {
 function defaultNetPreloadStartDirs() {
   const dirs = [];
   try {
-    const url = import_meta5.url;
+    const url = import_meta6.url;
     if (typeof url === "string" && url.startsWith("file:")) {
-      dirs.push(import_node_path9.default.dirname((0, import_node_url3.fileURLToPath)(url)));
+      dirs.push(import_node_path11.default.dirname((0, import_node_url3.fileURLToPath)(url)));
     }
   } catch {
   }
@@ -5793,33 +5843,33 @@ function defaultNetPreloadStartDirs() {
 function resolveNetPreloadPath(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const candidates = [
-    import_node_path9.default.resolve(cwd, "packages/core/worker-runtime/plugin-net-preload.cjs"),
-    import_node_path9.default.resolve(cwd, "dist/plugin-net-preload.cjs")
+    import_node_path11.default.resolve(cwd, "packages/core/worker-runtime/plugin-net-preload.cjs"),
+    import_node_path11.default.resolve(cwd, "dist/plugin-net-preload.cjs")
   ];
   for (const dir of options.startDirs ?? defaultNetPreloadStartDirs()) {
-    candidates.unshift(import_node_path9.default.join(dir, "plugin-net-preload.cjs"));
+    candidates.unshift(import_node_path11.default.join(dir, "plugin-net-preload.cjs"));
   }
-  const found = candidates.find((candidate) => import_node_fs8.default.existsSync(candidate));
+  const found = candidates.find((candidate) => import_node_fs9.default.existsSync(candidate));
   if (!found) {
     throw new Error(`[PluginNet] preload script not found. Looked in: ${candidates.join(", ")}`);
   }
   return found;
 }
-var import_node_child_process, import_node_crypto7, import_node_fs8, import_node_os, import_node_path9, import_node_url3, import_meta5, ENV_ALLOWLIST, ENV_DENYLIST, WORKER_DATA_ENV, BOOTSTRAP_PREFIX, BOOTSTRAP_SUFFIX, LEGACY_BOOTSTRAP_STALE_MS;
+var import_node_child_process, import_node_crypto7, import_node_fs9, import_node_os, import_node_path11, import_node_url3, import_meta6, ENV_ALLOWLIST, ENV_DENYLIST, WORKER_DATA_ENV, BOOTSTRAP_PREFIX, BOOTSTRAP_SUFFIX, LEGACY_BOOTSTRAP_STALE_MS;
 var init_child_spawn = __esm({
   "packages/core/worker-runtime/child-spawn.ts"() {
     "use strict";
     import_node_child_process = require("node:child_process");
     import_node_crypto7 = __toESM(require("node:crypto"), 1);
-    import_node_fs8 = __toESM(require("node:fs"), 1);
+    import_node_fs9 = __toESM(require("node:fs"), 1);
     import_node_os = __toESM(require("node:os"), 1);
-    import_node_path9 = __toESM(require("node:path"), 1);
+    import_node_path11 = __toESM(require("node:path"), 1);
     import_node_url3 = require("node:url");
     init_child_transport();
     init_child_isolate();
     init_plugin_permission();
     init_plugin_limits();
-    import_meta5 = {};
+    import_meta6 = {};
     ENV_ALLOWLIST = [
       "PATH",
       "LANG",
@@ -5869,12 +5919,12 @@ function quotaExceeded(input) {
 }
 function readProcSample(pid) {
   try {
-    const stat = import_node_fs9.default.readFileSync(`/proc/${pid}/stat`, "utf8");
+    const stat = import_node_fs10.default.readFileSync(`/proc/${pid}/stat`, "utf8");
     const rest = stat.slice(stat.lastIndexOf(")") + 2).trim().split(/\s+/);
     const utime = Number(rest[11]);
     const stime = Number(rest[12]);
     if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
-    const status = import_node_fs9.default.readFileSync(`/proc/${pid}/status`, "utf8");
+    const status = import_node_fs10.default.readFileSync(`/proc/${pid}/status`, "utf8");
     const rss = /^VmRSS:\s+(\d+)\s+kB/m.exec(status);
     return { cpuMs: (utime + stime) / 100 * 1e3, rssKb: rss ? Number(rss[1]) : 0 };
   } catch {
@@ -5917,11 +5967,11 @@ function startProcessQuota(pid, onBreach, env = process.env) {
     }
   };
 }
-var import_node_fs9, DEFAULT_MAX_RSS_MB, DEFAULT_CPU_QUOTA_MS, DEFAULT_CPU_WINDOW_MS;
+var import_node_fs10, DEFAULT_MAX_RSS_MB, DEFAULT_CPU_QUOTA_MS, DEFAULT_CPU_WINDOW_MS;
 var init_plugin_quota = __esm({
   "packages/core/worker-runtime/plugin-quota.ts"() {
     "use strict";
-    import_node_fs9 = __toESM(require("node:fs"), 1);
+    import_node_fs10 = __toESM(require("node:fs"), 1);
     DEFAULT_MAX_RSS_MB = 512;
     DEFAULT_CPU_QUOTA_MS = 8e3;
     DEFAULT_CPU_WINDOW_MS = 1e4;
@@ -8923,9 +8973,9 @@ __export(worker_manager_exports, {
 function collectSharedReadPaths(pluginDir) {
   if (!pluginDir) return [];
   const paths = /* @__PURE__ */ new Set();
-  const nodeModulesDir = import_node_path10.default.join(import_node_path10.default.dirname(pluginDir), "node_modules");
+  const nodeModulesDir = import_node_path12.default.join(import_node_path12.default.dirname(pluginDir), "node_modules");
   paths.add(nodeModulesDir);
-  const sdkLink = import_node_path10.default.join(nodeModulesDir, "@openlearn", "plugin-sdk");
+  const sdkLink = import_node_path12.default.join(nodeModulesDir, "@openlearn", "plugin-sdk");
   try {
     if (import_fs7.default.existsSync(sdkLink)) paths.add(import_fs7.default.realpathSync(sdkLink));
   } catch {
@@ -8964,7 +9014,7 @@ function generateBootstrapCode() {
   const rootPath = process.cwd().replace(/\\/g, "/");
   return composeBootstrapCode(`${rootPath}/package.json`);
 }
-var import_node_worker_threads, import_fs7, import_node_path10, import_uuid12, BASE_WORKER_SERVICE_TOKENS, ALL_SERVICE_TOKENS, POINTS_SERVICE_TOKENS, MAX_WORKERS, ACTIVATE_TIMEOUT_MS, ACTIVATE_PROGRESS_SLIDE_MS, WorkerRegistry, WorkerManager;
+var import_node_worker_threads, import_fs7, import_node_path12, import_uuid12, BASE_WORKER_SERVICE_TOKENS, ALL_SERVICE_TOKENS, POINTS_SERVICE_TOKENS, MAX_WORKERS, ACTIVATE_TIMEOUT_MS, ACTIVATE_PROGRESS_SLIDE_MS, WorkerRegistry, WorkerManager;
 var init_worker_manager = __esm({
   "packages/core/worker-runtime/worker-manager.ts"() {
     "use strict";
@@ -8978,7 +9028,7 @@ var init_worker_manager = __esm({
     init_plugin_limits();
     init_thread_isolate();
     import_fs7 = __toESM(require("fs"), 1);
-    import_node_path10 = __toESM(require("node:path"), 1);
+    import_node_path12 = __toESM(require("node:path"), 1);
     init_transport();
     init_plugin_net_proxy();
     init_service_host();
@@ -9383,7 +9433,7 @@ var init_worker_manager = __esm({
         const encodedBootstrap = Buffer.from(bootstrapCode, "utf-8").toString("base64");
         const bootstrapDataUrl = `data:text/javascript;base64,${encodedBootstrap}`;
         const allowedTokens = computeAllowedWorkerTokens(manifest, serviceTokens);
-        const resolvedPluginDir = pluginDir && import_fs7.default.existsSync(import_node_path10.default.join(pluginDir, "index.js")) ? pluginDir : void 0;
+        const resolvedPluginDir = pluginDir && import_fs7.default.existsSync(import_node_path12.default.join(pluginDir, "index.js")) ? pluginDir : void 0;
         let approvedNetHosts = [];
         try {
           approvedNetHosts = listApprovedNetHosts(this.db, [pluginId, manifest.id]);
@@ -9755,6 +9805,193 @@ __export(server_exports, {
   startServer: () => startServer
 });
 module.exports = __toCommonJS(server_exports);
+
+// server/security/runtime-check.ts
+var import_node_path = __toESM(require("node:path"), 1);
+var import_node_module = require("node:module");
+
+// scripts/assert-node-runtime.mjs
+var SUPPORTED_NODE_MAJORS = Object.freeze([20, 22, 24]);
+var SUPPORTED_NODE_TEXT = "Node.js 20.x / 22.x / 24.x";
+var PINNED_NODE_MAJOR = 22;
+function parseNodeMajor(version) {
+  if (typeof version !== "string") return null;
+  const matched = /^v?(\d+)\./.exec(version.trim());
+  if (!matched) return null;
+  const major = Number(matched[1]);
+  return Number.isFinite(major) ? major : null;
+}
+function checkNodeVersion(version, supported = SUPPORTED_NODE_MAJORS) {
+  const major = parseNodeMajor(version);
+  if (major === null) {
+    return {
+      ok: false,
+      code: "unparseable",
+      major: null,
+      message: `\u65E0\u6CD5\u89E3\u6790 Node \u7248\u672C\u300C${version}\u300D\u3002`
+    };
+  }
+  if (supported.includes(major)) {
+    return { ok: true, code: "supported", major, message: "" };
+  }
+  return {
+    ok: false,
+    code: "unsupported",
+    major,
+    message: `\u5F53\u524D Node \u7248\u672C v${major}.x \u4E0D\u53D7\u652F\u6301\uFF08\u652F\u6301\u8303\u56F4\uFF1A${SUPPORTED_NODE_TEXT}\uFF09\u3002\u672C\u9879\u76EE\u7684\u539F\u751F\u4F9D\u8D56\uFF08better-sqlite3\uFF09\u6309 Node ABI \u7F16\u8BD1\uFF0C\u590D\u7528\u65E7 node_modules \u4F1A\u5728\u8FD0\u884C\u671F\u62A5 ERR_DLOPEN_FAILED / NODE_MODULE_VERSION \u4E0D\u4E00\u81F4\u3002`
+  };
+}
+function buildFixGuidance(major) {
+  const pinned = PINNED_NODE_MAJOR;
+  const lines = [
+    "\u600E\u4E48\u4FEE\uFF08\u4EFB\u9009\u5176\u4E00\uFF09\uFF1A",
+    `  1) \u5207\u5230\u53D7\u652F\u6301\u7684 Node \u7248\u672C\uFF08\u672C\u9879\u76EE\u5B9E\u6D4B ${SUPPORTED_NODE_MAJORS.join(" / ")}\uFF09\uFF1A`,
+    `       nvm install ${pinned} && nvm use ${pinned}`,
+    `       fnm install ${pinned} && fnm use ${pinned}`,
+    `       asdf install nodejs ${pinned}.16.0 && asdf local nodejs ${pinned}.16.0`,
+    "     \u4ED3\u5E93\u6839\u7684 .nvmrc / .node-version \u5DF2\u9489\u4F4F " + pinned + "\uFF0Cnvm / fnm \u4F1A\u81EA\u52A8\u91C7\u7528\u3002",
+    "  2) \u7528\u5B98\u65B9\u5BB9\u5668\u955C\u50CF\uFF08\u5185\u542B Node " + pinned + "\uFF0C\u5BBF\u4E3B\u673A\u65E0\u9700\u88C5 Node\uFF09\uFF1A",
+    "       docker compose up -d",
+    "  3) \u786E\u5B9E\u8981\u7528\u522B\u7684 Node \u7248\u672C\uFF1A\u5FC5\u987B\u8BA9\u539F\u751F\u6A21\u5757\u6309\u65B0 ABI \u91CD\u65B0\u7F16\u8BD1 \u2014\u2014",
+    "     \u4FDD\u7559\u65E7 node_modules \u53EA\u4F1A\u7EE7\u7EED\u590D\u7528 ABI \u4E0D\u5339\u914D\u7684\u4E8C\u8FDB\u5236\uFF1A",
+    "       rm -rf node_modules && pnpm install"
+  ];
+  if (major !== null && major === 21) {
+    lines.push(
+      "     \u6CE8\uFF1ANode 21 \u4E0D\u662F LTS\uFF0C\u4E14 better-sqlite3 \u5B98\u65B9\u4E0D\u63D0\u4F9B 21.x \u9884\u7F16\u8BD1\u4EA7\u7269\uFF0C",
+      "     \u91CD\u88C5\u540E\u4ECD\u9700\u8981\u672C\u5730\u7F16\u8BD1\u5DE5\u5177\u94FE\uFF08python3 + make + g++\uFF09\uFF0C\u4E0D\u5EFA\u8BAE\u7528\u4E8E\u751F\u4EA7\u3002"
+    );
+  }
+  return lines.join("\n");
+}
+function formatUnsupportedMessage(version, check = checkNodeVersion(version)) {
+  if (check.ok) return "";
+  const head = `[NodeRuntime] FATAL: ${check.message}`;
+  return `${head}
+
+${buildFixGuidance(check.major)}
+`;
+}
+function runCliGuard() {
+  const result = checkNodeVersion(process.version);
+  if (result.ok) return;
+  console.error(formatUnsupportedMessage(process.version, result));
+  process.exit(1);
+}
+var invokedDirectly = process.argv[1] && (process.argv[1].endsWith("assert-node-runtime.mjs") || process.argv[1].endsWith("assert-node-runtime") || process.argv[1].includes("assert-node-runtime"));
+if (invokedDirectly) {
+  runCliGuard();
+}
+
+// server/security/runtime-check.ts
+var import_meta = {};
+var ABI_PATTERN = /NODE_MODULE_VERSION\s+(\d+)/i;
+var MISSING_BINDINGS_MARKERS = ["Could not locate the bindings file", "bindings file"];
+function detectNativeModuleFailure(error) {
+  const runtimeAbi = Number(process.versions.modules);
+  const message = error instanceof Error ? error.message : String(error);
+  const abiMatch = ABI_PATTERN.exec(message);
+  if (abiMatch) {
+    return {
+      kind: "abi-mismatch",
+      // better-sqlite3 的报错里第一个 NODE_MODULE_VERSION 是「模块编译时的 ABI」，
+      // 第二个是「当前运行时要求的 ABI」。
+      moduleAbi: Number(abiMatch[1]),
+      runtimeAbi,
+      detail: message
+    };
+  }
+  if (MISSING_BINDINGS_MARKERS.some((marker) => message.includes(marker))) {
+    return { kind: "missing-bindings", moduleAbi: null, runtimeAbi, detail: message };
+  }
+  return { kind: "unknown", moduleAbi: null, runtimeAbi, detail: message };
+}
+function resolveRequire() {
+  if (typeof import_meta !== "undefined" && import_meta.url) {
+    return (0, import_node_module.createRequire)(import_meta.url);
+  }
+  if (typeof __filename !== "undefined") {
+    return (0, import_node_module.createRequire)(__filename);
+  }
+  return (0, import_node_module.createRequire)(import_node_path.default.join(process.cwd(), "package.json"));
+}
+function loadBetterSqlite3Binding(loadModule) {
+  const load = loadModule ?? resolveRequire();
+  const Database3 = load("better-sqlite3");
+  const probe = new Database3(":memory:");
+  probe.close();
+}
+function checkNativeModule(load = loadBetterSqlite3Binding) {
+  try {
+    load();
+    return null;
+  } catch (error) {
+    const failure = detectNativeModuleFailure(error);
+    if (failure.kind === "abi-mismatch") {
+      return {
+        key: "native-module-abi",
+        severity: "error",
+        message: `\u539F\u751F\u6A21\u5757 better-sqlite3 \u4E0E\u5F53\u524D Node \u8FD0\u884C\u65F6\u4E0D\u517C\u5BB9\uFF1A\u4E8C\u8FDB\u5236\u662F\u6309 ABI ${failure.moduleAbi} \u7F16\u8BD1\u7684\uFF0C\u5F53\u524D\u8FD0\u884C\u65F6\uFF08Node ${process.versions.node}\uFF09\u8981\u6C42 ABI ${failure.runtimeAbi}\u3002
+  \u5E38\u89C1\u539F\u56E0\uFF1Anode_modules \u662F\u5728\u53E6\u4E00\u4E2A Node \u7248\u672C\u4E0B\u5B89\u88C5/\u62F7\u8D1D\u7684\u3002
+  \u4FEE\u590D\uFF1Arm -rf node_modules && pnpm install\uFF08\u6309\u5F53\u524D Node \u91CD\u65B0\u7F16\u8BD1\u539F\u751F\u6A21\u5757\uFF09\uFF0C
+        \u6216\u5207\u56DE\u53D7\u652F\u6301\u7684 Node \u7248\u672C\uFF08${SUPPORTED_NODE_TEXT}\uFF09\u3002`
+      };
+    }
+    if (failure.kind === "missing-bindings") {
+      return {
+        key: "native-module-missing",
+        severity: "error",
+        message: `\u539F\u751F\u6A21\u5757 better-sqlite3 \u7684\u4E8C\u8FDB\u5236\u4E0D\u5B58\u5728\uFF08\u672A\u7F16\u8BD1\u6216\u4F9D\u8D56\u88AB\u88C1\u526A\uFF09\u3002
+  \u4FEE\u590D\uFF1Arm -rf node_modules && pnpm install\uFF08pnpm \u9700\u8981 allowBuilds \u653E\u884C better-sqlite3 \u7684\u6784\u5EFA\u811A\u672C\uFF09\uFF0C
+        \u6216\u6539\u7528\u5B98\u65B9\u5BB9\u5668\u955C\u50CF\uFF08\u5DF2\u5185\u7F6E\u7F16\u8BD1\u597D\u7684\u4E8C\u8FDB\u5236\uFF09\u3002`
+      };
+    }
+    return {
+      key: "native-module-load",
+      severity: "error",
+      message: `\u539F\u751F\u6A21\u5757 better-sqlite3 \u52A0\u8F7D\u5931\u8D25\uFF1A${failure.detail}`
+    };
+  }
+}
+function checkRuntimeEnvironment(input = {}) {
+  const errors = [];
+  const warnings = [];
+  const nodeVersion = input.nodeVersion ?? process.version;
+  const nodeCheck = checkNodeVersion(nodeVersion);
+  if (!nodeCheck.ok) {
+    errors.push({
+      key: "node-version",
+      severity: "error",
+      message: `${nodeCheck.message}
+${buildFixGuidance(nodeCheck.major)}`
+    });
+    return { errors, warnings };
+  }
+  const nativeIssue = checkNativeModule(input.loadNativeModule);
+  if (nativeIssue) {
+    errors.push(nativeIssue);
+  }
+  return { errors, warnings };
+}
+function assertRuntimeEnvironment() {
+  const { errors, warnings } = checkRuntimeEnvironment();
+  for (const warning of warnings) {
+    console.warn(`[NodeRuntime] WARN: ${warning.message}`);
+  }
+  if (errors.length === 0) return;
+  console.error("[NodeRuntime] FATAL: \u8FD0\u884C\u65F6\u73AF\u5883\u4E0D\u6EE1\u8DB3\u8981\u6C42\uFF0C\u62D2\u7EDD\u542F\u52A8\u3002");
+  for (const issue of errors) {
+    console.error(`
+[NodeRuntime] ${issue.key}
+${issue.message}`);
+  }
+  process.exit(1);
+}
+
+// server/security/runtime-preflight.ts
+assertRuntimeEnvironment();
+
+// server.ts
 var import_express4 = __toESM(require("express"), 1);
 var import_path23 = __toESM(require("path"), 1);
 var import_dotenv = __toESM(require("dotenv"), 1);
@@ -10786,12 +11023,12 @@ var import_url = require("url");
 
 // packages/core/db/backup-manager.ts
 var import_node_fs2 = __toESM(require("node:fs"), 1);
-var import_node_path2 = __toESM(require("node:path"), 1);
+var import_node_path3 = __toESM(require("node:path"), 1);
 var import_better_sqlite3 = __toESM(require("better-sqlite3"), 1);
 
 // packages/core/db/secure-files.ts
 var import_node_fs = __toESM(require("node:fs"), 1);
-var import_node_path = __toESM(require("node:path"), 1);
+var import_node_path2 = __toESM(require("node:path"), 1);
 var SECURE_FILE_MODE = 384;
 var SECURE_DIR_MODE = 448;
 var GROUP_OTHER_BITS = 63;
@@ -10835,7 +11072,7 @@ function ensureSecureFile(filePath) {
       hardenFile(filePath);
       return;
     }
-    import_node_fs.default.mkdirSync(import_node_path.default.dirname(filePath), { recursive: true });
+    import_node_fs.default.mkdirSync(import_node_path2.default.dirname(filePath), { recursive: true });
     const fd = import_node_fs.default.openSync(filePath, "a", SECURE_FILE_MODE);
     import_node_fs.default.closeSync(fd);
   } catch {
@@ -10853,15 +11090,15 @@ function secureDatabaseFiles(dbPath2) {
 // packages/core/db/backup-manager.ts
 function getDefaultDbPath() {
   if (process.env.OPENLEARN_DB_PATH) {
-    return import_node_path2.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH);
+    return import_node_path3.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH);
   }
-  return import_node_path2.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
+  return import_node_path3.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
 }
 function getDefaultBackupDir() {
   if (process.env.BACKUP_DIR) {
-    return import_node_path2.default.resolve(process.cwd(), process.env.BACKUP_DIR);
+    return import_node_path3.default.resolve(process.cwd(), process.env.BACKUP_DIR);
   }
-  return import_node_path2.default.resolve(process.cwd(), "backups");
+  return import_node_path3.default.resolve(process.cwd(), "backups");
 }
 function validateBackup(filePath) {
   if (!import_node_fs2.default.existsSync(filePath)) {
@@ -10915,7 +11152,7 @@ function pruneByPrefix(backupDir, prefix, keepCount) {
   let pruned = 0;
   for (const file of files.slice(keepCount)) {
     try {
-      import_node_fs2.default.unlinkSync(import_node_path2.default.join(backupDir, file));
+      import_node_fs2.default.unlinkSync(import_node_path3.default.join(backupDir, file));
       pruned++;
     } catch {
     }
@@ -10934,15 +11171,15 @@ function pruneMigratorSnapshots(backupDir = getDefaultBackupDir(), keepCount) {
   return pruneByPrefix(backupDir, "pre_migration_", Math.max(1, keepCount ?? resolvePreMigrationKeep()));
 }
 function performBackup(options = {}) {
-  const dbPath2 = options.dbPath ? import_node_path2.default.resolve(options.dbPath) : getDefaultDbPath();
-  const backupDir = options.backupDir ? import_node_path2.default.resolve(options.backupDir) : getDefaultBackupDir();
+  const dbPath2 = options.dbPath ? import_node_path3.default.resolve(options.dbPath) : getDefaultDbPath();
+  const backupDir = options.backupDir ? import_node_path3.default.resolve(options.backupDir) : getDefaultBackupDir();
   const keep = typeof options.keep === "number" ? options.keep : 10;
   if (!import_node_fs2.default.existsSync(backupDir)) {
     ensureSecureDir(backupDir);
   }
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const filename = options.customName || `backup_${timestamp}.db`;
-  const backupPath = import_node_path2.default.join(backupDir, filename);
+  const backupPath = import_node_path3.default.join(backupDir, filename);
   if (import_node_fs2.default.existsSync(backupPath)) {
     import_node_fs2.default.unlinkSync(backupPath);
   }
@@ -10979,7 +11216,7 @@ function performBackup(options = {}) {
 }
 
 // packages/core/db/migrator.ts
-var import_meta = {};
+var import_meta2 = {};
 function splitSqlStatements(sql) {
   return sql.split(";").map((s) => s.trim()).filter((s) => {
     const content = s.replace(/--.*$/gm, "").trim();
@@ -11027,7 +11264,7 @@ function simpleChecksum(text) {
   }
   return hash.toString(16);
 }
-function runMigrations(db2, migrations) {
+function runMigrations(db2, migrations, options = {}) {
   db2.exec(`
     CREATE TABLE IF NOT EXISTS _migrations (
       name TEXT PRIMARY KEY,
@@ -11038,6 +11275,23 @@ function runMigrations(db2, migrations) {
   const appliedRows = db2.prepare("SELECT name, checksum FROM _migrations").all();
   const applied = new Map(appliedRows.map((r) => [r.name, r.checksum]));
   const byName = new Map(migrations.map((m) => [m.name, m]));
+  const unknown = [...applied.keys()].filter((name) => !byName.has(name));
+  if (unknown.length > 0) {
+    const detail = unknown.map((n) => `  - ${n}`).join("\n");
+    const msg = `[Migration] \u53F0\u8D26\u91CC\u6709 ${unknown.length} \u4E2A\u672C\u6B21\u8FC1\u79FB\u5217\u8868\u672A\u5305\u542B\u7684\u6761\u76EE\uFF1A
+${detail}
+` + (options.strictLedger ? `  \u542F\u52A8\u94FE\u8DEF\u5224\u5B9A\u4E3A FATAL\uFF1A
+  \u6210\u56E0\u4E00\uFF1A\u7528\u66F4\u65B0\u7248\u672C\u7684\u5907\u4EFD\u6062\u590D\u4E86\u65E7\u4EE3\u7801\uFF08\u4EE3\u7801\u964D\u7EA7\uFF09\u2014\u2014\u8BF7\u5148\u5347\u7EA7\u4EE3\u7801\u518D\u542F\u52A8\uFF1B
+  \u6210\u56E0\u4E8C\uFF1A\u5DF2\u5E94\u7528\u7684\u8FC1\u79FB\u6587\u4EF6\u88AB\u6539\u540D\u6216\u5220\u9664\u2014\u2014\u8FC1\u79FB\u4E00\u65E6\u5E94\u7528\u4E0D\u53EF\u6539\u540D\uFF0C\u8BF7\u6062\u590D\u6587\u4EF6\u6216\u8865\u4E00\u6761\u65B0\u8FC1\u79FB\u3002
+  \u786E\u5C5E\u6709\u610F\u7684\u964D\u7EA7\u8FD0\u7EF4\uFF1A\u8BBE\u7F6E MIGRATION_ALLOW_UNKNOWN_LEDGER=true \u653E\u884C\uFF08\u4E0D\u63A8\u8350\uFF09\u3002` : `  \uFF08\u975E\u4E25\u683C\u53E3\u5F84\uFF1A\u8FC1\u79FB\u5B50\u96C6\u8C03\u7528\u5C5E\u5408\u6CD5\u7528\u6CD5\uFF0C\u4EC5\u63D0\u793A\uFF09`);
+    if (process.env.MIGRATION_ALLOW_UNKNOWN_LEDGER === "true") {
+      console.warn("[Migration] WARNING: \u672A\u77E5\u53F0\u8D26\u6761\u76EE\u5DF2\u6309 MIGRATION_ALLOW_UNKNOWN_LEDGER \u653E\u884C\uFF1A\n" + msg);
+    } else if (options.strictLedger) {
+      throw new Error(msg);
+    } else {
+      console.warn("[Migration] " + msg);
+    }
+  }
   const drift = [];
   for (const [name, stored] of applied) {
     const migration = byName.get(name);
@@ -11118,8 +11372,8 @@ function getDefaultMigrationsDir(options = {}) {
   const starts = options.startDirs ? [...options.startDirs] : [];
   if (!options.startDirs && typeof __dirname !== "undefined") starts.push(__dirname);
   try {
-    if (!options.startDirs && typeof import_meta !== "undefined" && import_meta.url) {
-      starts.push(import_path.default.dirname((0, import_url.fileURLToPath)(import_meta.url)));
+    if (!options.startDirs && typeof import_meta2 !== "undefined" && import_meta2.url) {
+      starts.push(import_path.default.dirname((0, import_url.fileURLToPath)(import_meta2.url)));
     }
   } catch {
   }
@@ -11145,6 +11399,68 @@ function getDefaultMigrationsDir(options = {}) {
   return import_path.default.resolve(cwd, "migrations");
 }
 
+// packages/core/db/schema-golden.ts
+var import_node_fs3 = __toESM(require("node:fs"), 1);
+var import_node_path4 = __toESM(require("node:path"), 1);
+var SCHEMA_GOLDEN_FILENAME = "schema-golden.json";
+function extractSchemaSnapshot(db2) {
+  const tables = db2.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name").all();
+  const snapshot = {};
+  for (const { name } of tables) {
+    const columns = db2.prepare(`PRAGMA table_info(${JSON.stringify(name)})`).all().map(
+      (c) => c.name
+    );
+    snapshot[name] = columns.sort();
+  }
+  return snapshot;
+}
+function verifySchemaAgainstGolden(db2, golden) {
+  const actual = extractSchemaSnapshot(db2);
+  const drifts = [];
+  for (const [table, expectedColumns] of Object.entries(golden.tables)) {
+    const actualColumns = actual[table];
+    if (!actualColumns) {
+      drifts.push({ table, missingColumns: expectedColumns, tableMissing: true });
+      continue;
+    }
+    const actualSet = new Set(actualColumns);
+    const missing = expectedColumns.filter((c) => !actualSet.has(c));
+    if (missing.length > 0) {
+      drifts.push({ table, missingColumns: missing, tableMissing: false });
+    }
+  }
+  return drifts;
+}
+function formatSchemaGoldenDrifts(drifts) {
+  return drifts.map(
+    (d) => d.tableMissing ? `  - \u8868 ${d.table} \u6574\u8868\u7F3A\u5931\uFF08\u671F\u671B\u5217\uFF1A${d.missingColumns.join(", ")}\uFF09` : `  - \u8868 ${d.table} \u7F3A\u5217\uFF1A${d.missingColumns.join(", ")}`
+  ).join("\n");
+}
+function loadSchemaGolden(migrationsDir) {
+  const filePath = import_node_path4.default.join(migrationsDir, SCHEMA_GOLDEN_FILENAME);
+  if (!import_node_fs3.default.existsSync(filePath)) {
+    throw new Error(
+      `[SchemaGolden] FATAL: ${filePath} \u4E0D\u5B58\u5728\u3002\u91D1\u6837\u4E0E\u8FC1\u79FB\u6587\u4EF6\u540C\u76EE\u5F55\u53D1\u5E03\uFF0C\u7F3A\u5931\u8BF4\u660E\u5B89\u88C5\u5305\u4E0D\u5B8C\u6574\uFF1B\u6E90\u7801\u4ED3\u5E93\u91CC\u8BF7\u8FD0\u884C pnpm db:gen-golden \u751F\u6210\u3002`
+    );
+  }
+  try {
+    return JSON.parse(import_node_fs3.default.readFileSync(filePath, "utf8"));
+  } catch (err) {
+    throw new Error(`[SchemaGolden] FATAL: \u91D1\u6837\u6587\u4EF6\u89E3\u6790\u5931\u8D25\uFF08${filePath}\uFF09\uFF1A${String(err)}`, { cause: err });
+  }
+}
+function assertSchemaMatchesGolden(db2, migrationsDir) {
+  const golden = loadSchemaGolden(migrationsDir);
+  const drifts = verifySchemaAgainstGolden(db2, golden);
+  if (drifts.length > 0) {
+    throw new Error(
+      `[SchemaGolden] FATAL: \u6570\u636E\u5E93\u7ED3\u6784\u4F4E\u4E8E\u4EE3\u7801\u671F\u671B\uFF08${drifts.length} \u5904\u7F3A\u5931\uFF09\u2014\u2014\u8FC1\u79FB\u53F0\u8D26\u867D\u5DF2\u8FFD\u5E73\uFF0C\u4F46\u5E93\u88AB\u5916\u90E8\u4FEE\u6539\u8FC7\u6216\u4ECE\u65E7\u5907\u4EFD\u505A\u4E86\u90E8\u5206\u6062\u590D\u3002\u7F3A\u5931\u660E\u7EC6\uFF1A
+${formatSchemaGoldenDrifts(drifts)}
+  \u6062\u590D\u624B\u6BB5\uFF1A\u7528 backups/ \u91CC\u6700\u65B0\u7684 pre_migration_*.db \u5FEB\u7167\u6062\u590D\uFF0C\u6216\u6838\u5BF9\u6700\u8FD1\u4E00\u6B21\u6062\u590D\u64CD\u4F5C\u7684\u6765\u6E90\u3002`
+    );
+  }
+}
+
 // packages/core/db/class-passcode-crypto.ts
 var import_node_crypto2 = __toESM(require("node:crypto"), 1);
 init_api_key_crypto();
@@ -11666,7 +11982,7 @@ function purgeAllExpiredData(db2, options) {
 
 // packages/core/db/index.ts
 init_api_key_crypto();
-var import_meta2 = {};
+var import_meta3 = {};
 var BCRYPT_ROUNDS = 10;
 function hashPassword(pwd) {
   return import_bcryptjs.default.hashSync(pwd, BCRYPT_ROUNDS);
@@ -11741,8 +12057,8 @@ if (process.env.VITEST) {
     dbPath = import_path2.default.join(__dirname, "educational_os.db");
   } else {
     try {
-      if (typeof import_meta2 !== "undefined" && import_meta2.url) {
-        const __filename2 = (0, import_url2.fileURLToPath)(import_meta2.url);
+      if (typeof import_meta3 !== "undefined" && import_meta3.url) {
+        const __filename2 = (0, import_url2.fileURLToPath)(import_meta3.url);
         const __dir = import_path2.default.dirname(__filename2);
         dbPath = import_path2.default.join(__dir, "educational_os.db");
       } else {
@@ -11802,7 +12118,16 @@ function initializeDatabase(instance) {
     if (migrations.length === 0) {
       throw new Error(`[DB SSOT] FATAL: \u8FC1\u79FB\u76EE\u5F55 ${migrationsDir} \u91CC\u6CA1\u6709 .sql \u6587\u4EF6\u3002\u62D2\u7EDD\u5728\u6CA1\u6709 schema \u7684\u5E93\u4E0A\u542F\u52A8\u3002`);
     }
-    runMigrations(instance, migrations);
+    runMigrations(instance, migrations, { strictLedger: true });
+    if (process.env.VITEST) {
+      try {
+        assertSchemaMatchesGolden(instance, migrationsDir);
+      } catch (err) {
+        console.warn("[SchemaGolden] \u6D4B\u8BD5\u73AF\u5883\u7ED3\u6784\u7EC8\u68C0\u672A\u901A\u8FC7\uFF08\u5FFD\u7565\uFF09\uFF1A", err instanceof Error ? err.message : err);
+      }
+    } else {
+      assertSchemaMatchesGolden(instance, migrationsDir);
+    }
     applyStartupDataMigrations(instance);
     const apiKeyMigration = encryptStoredPlaintextApiKeys(instance);
     if (apiKeyMigration.updated > 0) {
@@ -14061,10 +14386,10 @@ function parseScoreFields(fields) {
   if (typeof fields !== "string" || !fields.trim()) return [];
   return fields.split(/[\n\r,，;；|]+/).map((f) => f.trim()).filter(Boolean);
 }
-function getNested(raw, path45) {
+function getNested(raw, path47) {
   if (raw === null || raw === void 0) return void 0;
-  if (!path45) return void 0;
-  const parts = String(path45).split(".").map((p) => p.trim()).filter(Boolean);
+  if (!path47) return void 0;
+  const parts = String(path47).split(".").map((p) => p.trim()).filter(Boolean);
   let cursor = raw;
   for (let i = 0; i < parts.length; i += 1) {
     if (cursor === null || cursor === void 0) return void 0;
@@ -18064,7 +18389,7 @@ var import_path11 = __toESM(require("path"), 1);
 // packages/core/plugin-host/base.ts
 var import_path5 = __toESM(require("path"), 1);
 var import_express = __toESM(require("express"), 1);
-var import_node_module = require("node:module");
+var import_node_module2 = require("node:module");
 var import_node_url = require("node:url");
 
 // packages/core/plugin-host/resource-tracker.ts
@@ -18350,7 +18675,7 @@ var ContributionRegistry = class {
 // packages/core/plugin-host/base.ts
 init_types();
 init_errors2();
-var import_meta3 = {};
+var import_meta4 = {};
 var VALID_TRANSITIONS = {
   ["installed" /* INSTALLED */]: ["activating" /* ACTIVATING */, "uninstalled" /* UNINSTALLED */],
   ["activating" /* ACTIVATING */]: ["active" /* ACTIVE */, "error" /* ERROR */],
@@ -18385,12 +18710,12 @@ function resolveHostSdkDir() {
   const bases = [];
   if (typeof __dirname !== "undefined") bases.push(__dirname);
   try {
-    bases.push(import_path5.default.dirname((0, import_node_url.fileURLToPath)(import_meta3.url)));
+    bases.push(import_path5.default.dirname((0, import_node_url.fileURLToPath)(import_meta4.url)));
   } catch {
   }
   for (const base of bases) {
     try {
-      const req = (0, import_node_module.createRequire)(import_path5.default.join(base, "__openlearn_resolve__.js"));
+      const req = (0, import_node_module2.createRequire)(import_path5.default.join(base, "__openlearn_resolve__.js"));
       return import_path5.default.dirname(req.resolve("@openlearn/plugin-sdk/package.json"));
     } catch {
     }
@@ -18655,10 +18980,10 @@ var import_semver2 = __toESM(require("semver"), 1);
 init_types();
 
 // packages/core/plugin-host/execution-policy.ts
-var import_node_path7 = __toESM(require("node:path"), 1);
+var import_node_path9 = __toESM(require("node:path"), 1);
 var import_node_url2 = require("node:url");
 init_types();
-var import_meta4 = {};
+var import_meta5 = {};
 function trustedInlineAllowlist(env = process.env) {
   return new Set(
     (env.OPENLEARN_TRUSTED_INLINE_PLUGINS ?? "").split(",").map((item) => item.trim()).filter((item) => item.length > 0)
@@ -18666,23 +18991,23 @@ function trustedInlineAllowlist(env = process.env) {
 }
 function builtinPluginsDir() {
   try {
-    const url = import_meta4.url;
+    const url = import_meta5.url;
     if (typeof url === "string" && url.startsWith("file:")) {
-      return import_node_path7.default.resolve(import_node_path7.default.dirname((0, import_node_url2.fileURLToPath)(url)), "../../plugins");
+      return import_node_path9.default.resolve(import_node_path9.default.dirname((0, import_node_url2.fileURLToPath)(url)), "../../plugins");
     }
   } catch {
   }
   if (typeof __dirname !== "undefined") {
-    return import_node_path7.default.resolve(__dirname, "../packages/plugins");
+    return import_node_path9.default.resolve(__dirname, "../packages/plugins");
   }
-  return import_node_path7.default.resolve(process.cwd(), "packages/plugins");
+  return import_node_path9.default.resolve(process.cwd(), "packages/plugins");
 }
 function isInsideBuiltinPluginsDir(sourcePath, builtinDir = builtinPluginsDir()) {
   if (!sourcePath) return false;
-  const root = import_node_path7.default.resolve(builtinDir);
-  const resolved = import_node_path7.default.resolve(sourcePath);
-  const relative2 = import_node_path7.default.relative(root, resolved);
-  return relative2 === "" || !relative2.startsWith("..") && !import_node_path7.default.isAbsolute(relative2);
+  const root = import_node_path9.default.resolve(builtinDir);
+  const resolved = import_node_path9.default.resolve(sourcePath);
+  const relative2 = import_node_path9.default.relative(root, resolved);
+  return relative2 === "" || !relative2.startsWith("..") && !import_node_path9.default.isAbsolute(relative2);
 }
 function isTrustedInProcessPlugin(manifestId, env = process.env, sourcePath) {
   if (isInsideBuiltinPluginsDir(sourcePath)) return true;
@@ -19645,6 +19970,37 @@ var PluginHostCore = class _PluginHostCore extends PluginHostBase {
       console.warn(`[PluginHost] Failed to revoke stage guards for "${pluginId}":`, e);
     }
   }
+  /**
+   * 回收该插件注册的服务端题型（Issue #320）。
+   *
+   * 题型注册表（`IAssessmentGraderRegistry`）是插件用 `ctx.resolve(token)` 直取的
+   * **裸注册表**，不像 `ctx.services.*` 那样经过 `ResourceTracker` 包装 —— 所以
+   * `disposeAll()` 拿它没办法。不清理的后果已验证为真：
+   *
+   * 1. 停用插件后题型仍留在注册表里 —— 教师继续能出题、继续按旧闭包判分（“幽灵题型”），
+   *    `GET /api/assessment-question-types` 也继续把它列给前端；
+   * 2. 重装/升级插件时 `registerQuestionType` 抛 `duplicate question type`，
+   *    表现为「升级后插件激活失败」，必须重启宿主才能恢复。
+   *
+   * 与 `revokePluginStageGuards` 同构：注册方可能传安装行 UUID，也可能传
+   * manifest.id（文档约定的就是后者），两侧都清一遍（幂等）。
+   */
+  async revokePluginQuestionTypes(pluginId, manifestId) {
+    try {
+      const registry4 = await this.serviceRegistry.tryResolve(IAssessmentGraderRegistryToken);
+      if (!registry4 || typeof registry4.clearOwnedQuestionTypes !== "function") return;
+      let removed = 0;
+      for (const owner of /* @__PURE__ */ new Set([pluginId, manifestId])) {
+        if (!owner) continue;
+        removed += registry4.clearOwnedQuestionTypes(owner) ?? 0;
+      }
+      if (removed > 0) {
+        console.log(`[PluginHost] Revoked ${removed} question type(s) for plugin "${pluginId}"`);
+      }
+    } catch (e) {
+      console.warn(`[PluginHost] Failed to revoke question types for "${pluginId}":`, e);
+    }
+  }
   setPluginState(pluginId, state, opts = {}) {
     this.pluginStates.set(pluginId, state);
     if (!opts.persistDb) return;
@@ -19742,7 +20098,7 @@ var PluginHostHttp = class extends PluginHostCore {
   /**
    * 判断指定插件的某个请求路径是否为流式路由 (SSE)
    */
-  isStreamRoute(pluginIdOrManifestId, method, path45) {
+  isStreamRoute(pluginIdOrManifestId, method, path47) {
     const upperMethod = method.toUpperCase();
     const resolvedId = this.resolvePluginUuid(pluginIdOrManifestId);
     const instance = this.pluginInstances.get(resolvedId) ?? this.pluginInstances.get(pluginIdOrManifestId);
@@ -19751,7 +20107,7 @@ var PluginHostHttp = class extends PluginHostCore {
       for (const r of manifest.api.routes) {
         if (r.method.toUpperCase() === upperMethod && r.streaming === true) {
           const compiled = compileRoutePattern(r.path);
-          if (compiled.regex.test(path45)) {
+          if (compiled.regex.test(path47)) {
             return true;
           }
         }
@@ -19759,14 +20115,14 @@ var PluginHostHttp = class extends PluginHostCore {
     }
     if (!instance) return false;
     if (instance.context?.http) {
-      return instance.context.http.isStream(upperMethod, path45);
+      return instance.context.http.isStream(upperMethod, path47);
     }
     if (instance.workerRef) {
       const routes = instance.workerRef.serviceHost.getRegisteredRoutes();
       for (const r of routes) {
         if (r.method === upperMethod && r.isStream) {
           const compiled = compileRoutePattern(r.pattern);
-          if (compiled.regex.test(path45)) {
+          if (compiled.regex.test(path47)) {
             return true;
           }
         }
@@ -19839,8 +20195,8 @@ init_manifest_schema();
 init_context_builder();
 
 // packages/core/plugin-host/declarative-migrator.ts
-var import_node_fs7 = __toESM(require("node:fs"), 1);
-var import_node_path8 = __toESM(require("node:path"), 1);
+var import_node_fs8 = __toESM(require("node:fs"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
 init_errors2();
 init_plugin_tables();
 function ensurePluginDeclaredMigrationsTable(db2) {
@@ -19856,7 +20212,7 @@ function ensurePluginDeclaredMigrationsTable(db2) {
   `);
 }
 function parseMigrationFileName(fileName) {
-  const baseName = import_node_path8.default.basename(fileName, ".sql");
+  const baseName = import_node_path10.default.basename(fileName, ".sql");
   const match = baseName.match(/^(\d+)[_-]?(.*)$/);
   if (match) {
     const version = parseInt(match[1], 10);
@@ -19865,22 +20221,22 @@ function parseMigrationFileName(fileName) {
   return { version: 0, baseName };
 }
 function loadPluginMigrations(migrationsDir) {
-  if (!import_node_fs7.default.existsSync(migrationsDir)) {
+  if (!import_node_fs8.default.existsSync(migrationsDir)) {
     return [];
   }
-  const stat = import_node_fs7.default.statSync(migrationsDir);
+  const stat = import_node_fs8.default.statSync(migrationsDir);
   if (!stat.isDirectory()) {
     return [];
   }
-  const files = import_node_fs7.default.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort((a, b) => {
+  const files = import_node_fs8.default.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort((a, b) => {
     const vA = parseMigrationFileName(a).version;
     const vB = parseMigrationFileName(b).version;
     if (vA !== vB) return vA - vB;
     return a.localeCompare(b, void 0, { numeric: true, sensitivity: "base" });
   });
   return files.map((file) => {
-    const fullPath = import_node_path8.default.join(migrationsDir, file);
-    const content = import_node_fs7.default.readFileSync(fullPath, "utf8");
+    const fullPath = import_node_path10.default.join(migrationsDir, file);
+    const content = import_node_fs8.default.readFileSync(fullPath, "utf8");
     const { version, baseName } = parseMigrationFileName(file);
     const parsed = parseMigrationSql(baseName, content);
     return {
@@ -20521,6 +20877,7 @@ var PluginHostLifecycle = class extends PluginHostHttp {
           this.resourceTracker.disposeAll(pluginId);
           this.pluginInstances.delete(pluginId);
           this.revokePluginContributions(pluginId);
+          await this.revokePluginQuestionTypes(pluginId, deactManifest.id);
           this.setPluginState(pluginId, "inactive" /* INACTIVE */, { persistDb: true });
           if (this._hotReloadController) {
             this._hotReloadController.unregisterPlugin(pluginId);
@@ -20539,6 +20896,7 @@ var PluginHostLifecycle = class extends PluginHostHttp {
       this.resourceTracker.disposeAll(pluginId);
       this.pluginInstances.delete(pluginId);
       this.revokePluginContributions(pluginId);
+      await this.revokePluginQuestionTypes(pluginId, deactManifest.id);
       this.setPluginState(pluginId, "inactive" /* INACTIVE */, { persistDb: true });
       if (actorId) {
         await this.revokeCapabilities(actorId);
@@ -20574,6 +20932,7 @@ var PluginHostLifecycle = class extends PluginHostHttp {
       this.resourceTracker.disposeAll(pluginId);
       this.pluginInstances.delete(pluginId);
       this.revokePluginContributions(pluginId);
+      await this.revokePluginQuestionTypes(pluginId, instance?.manifest?.id ?? pluginId);
       this.setPluginState(pluginId, "inactive" /* INACTIVE */, { persistDb: true });
       if (actorId) {
         await this.revokeCapabilities(actorId);
@@ -20636,27 +20995,27 @@ var import_path8 = __toESM(require("path"), 1);
 var import_semver3 = __toESM(require("semver"), 1);
 
 // packages/core/version.ts
-var import_node_fs10 = __toESM(require("node:fs"), 1);
-var import_node_path11 = __toESM(require("node:path"), 1);
+var import_node_fs11 = __toESM(require("node:fs"), 1);
+var import_node_path13 = __toESM(require("node:path"), 1);
 var import_node_url5 = require("node:url");
-var import_meta6 = {};
-var FALLBACK_VERSION = "0.7.2";
+var import_meta7 = {};
+var FALLBACK_VERSION = "0.7.5";
 function readPlatformVersion() {
   const bases = [];
   if (typeof __dirname !== "undefined") bases.push(__dirname);
   try {
-    bases.push(import_node_path11.default.dirname((0, import_node_url5.fileURLToPath)(import_meta6.url)));
+    bases.push(import_node_path13.default.dirname((0, import_node_url5.fileURLToPath)(import_meta7.url)));
   } catch {
   }
   for (const base of bases) {
     let dir = base;
     for (; ; ) {
       try {
-        const pkg = JSON.parse(import_node_fs10.default.readFileSync(import_node_path11.default.join(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(import_node_fs11.default.readFileSync(import_node_path13.default.join(dir, "package.json"), "utf-8"));
         if (pkg.name === "openlearn-next" && typeof pkg.version === "string") return pkg.version;
       } catch {
       }
-      const parent = import_node_path11.default.dirname(dir);
+      const parent = import_node_path13.default.dirname(dir);
       if (parent === dir) break;
       dir = parent;
     }
@@ -21375,8 +21734,8 @@ init_audit_log();
 
 // packages/core/plugin-host/dependency-install.ts
 var import_node_child_process2 = require("node:child_process");
-var import_node_fs11 = __toESM(require("node:fs"), 1);
-var import_node_path12 = __toESM(require("node:path"), 1);
+var import_node_fs12 = __toESM(require("node:fs"), 1);
+var import_node_path14 = __toESM(require("node:path"), 1);
 var DependencyInstallError = class extends Error {
   constructor(message, pluginId, cause) {
     super(message);
@@ -21411,8 +21770,8 @@ function resolveRegistry() {
 function assertDependenciesResolved(pluginDir, dependencies, pluginId) {
   const names = dependencyNames(dependencies);
   if (names.length === 0) return;
-  const lockPath = import_node_path12.default.join(pluginDir, "package-lock.json");
-  if (!import_node_fs11.default.existsSync(lockPath)) {
+  const lockPath = import_node_path14.default.join(pluginDir, "package-lock.json");
+  if (!import_node_fs12.default.existsSync(lockPath)) {
     throw new DependencyInstallError(
       `\u4F9D\u8D56\u5B89\u88C5\u672A\u4EA7\u51FA package-lock.json \u2014\u2014 \u65E0\u6CD5\u786E\u8BA4\u4F9D\u8D56\u5DF2\u843D\u76D8\u3002pluginId=${pluginId}\uFF0C\u58F0\u660E\u4F9D\u8D56\uFF1A${names.join(", ")}`,
       pluginId
@@ -21420,7 +21779,7 @@ function assertDependenciesResolved(pluginDir, dependencies, pluginId) {
   }
   let lock;
   try {
-    lock = JSON.parse(import_node_fs11.default.readFileSync(lockPath, "utf-8"));
+    lock = JSON.parse(import_node_fs12.default.readFileSync(lockPath, "utf-8"));
   } catch (err) {
     throw new DependencyInstallError(
       `package-lock.json \u4E0D\u662F\u5408\u6CD5 JSON \u2014\u2014 \u4F9D\u8D56\u5B89\u88C5\u7ED3\u679C\u4E0D\u53EF\u4FE1\u3002pluginId=${pluginId}`,
@@ -21493,8 +21852,8 @@ function installPluginDependencies(pluginDir, opts, runNpm = import_node_child_p
   const { pluginId, dependencies, operation = "install" } = opts;
   const depMap = toNpmDependencyMap(dependencies);
   if (Object.keys(depMap).length === 0) return;
-  const pkgJsonPath = import_node_path12.default.join(pluginDir, "package.json");
-  import_node_fs11.default.writeFileSync(
+  const pkgJsonPath = import_node_path14.default.join(pluginDir, "package.json");
+  import_node_fs12.default.writeFileSync(
     pkgJsonPath,
     JSON.stringify({ name: pluginId, version: "0.0.0", dependencies: depMap }, null, 2),
     "utf-8"
@@ -22323,6 +22682,7 @@ var PluginHostUninstall = class extends PluginHostInstall {
         return pluginId;
       }
     })();
+    await this.revokePluginQuestionTypes(pluginId, manifestId);
     if (state === "uninstalled" /* UNINSTALLED */ && !row) {
       this.pluginStates.delete(pluginId);
       return {
@@ -22763,20 +23123,20 @@ init_install_utils();
 
 // packages/core/security/plugin-signature.ts
 var import_node_crypto9 = __toESM(require("node:crypto"), 1);
-var import_node_fs12 = __toESM(require("node:fs"), 1);
+var import_node_fs13 = __toESM(require("node:fs"), 1);
 function computeSha256(input) {
   const hash = import_node_crypto9.default.createHash("sha256");
   if (typeof input === "string") {
-    if (import_node_fs12.default.existsSync(input)) {
-      const fd = import_node_fs12.default.openSync(input, "r");
+    if (import_node_fs13.default.existsSync(input)) {
+      const fd = import_node_fs13.default.openSync(input, "r");
       const buf = Buffer.alloc(64 * 1024);
       let bytesRead = 0;
       try {
-        while ((bytesRead = import_node_fs12.default.readSync(fd, buf, 0, buf.length, null)) > 0) {
+        while ((bytesRead = import_node_fs13.default.readSync(fd, buf, 0, buf.length, null)) > 0) {
           hash.update(buf.subarray(0, bytesRead));
         }
       } finally {
-        import_node_fs12.default.closeSync(fd);
+        import_node_fs13.default.closeSync(fd);
       }
       const digest4 = hash.digest();
       return { hex: digest4.toString("hex"), base64: digest4.toString("base64") };
@@ -22845,8 +23205,8 @@ async function extractEmbeddedSignature(zipPathOrBuffer) {
     const JSZip5 = (await import("jszip")).default;
     let buffer;
     if (typeof zipPathOrBuffer === "string") {
-      if (!import_node_fs12.default.existsSync(zipPathOrBuffer)) return null;
-      buffer = import_node_fs12.default.readFileSync(zipPathOrBuffer);
+      if (!import_node_fs13.default.existsSync(zipPathOrBuffer)) return null;
+      buffer = import_node_fs13.default.readFileSync(zipPathOrBuffer);
     } else {
       buffer = zipPathOrBuffer;
     }
@@ -22891,9 +23251,9 @@ function resolveTrustedPublicKeys(explicitKeys, env = process.env) {
     for (const part of remaining.split(/[,;\n]/)) {
       const p = part.trim();
       if (!p) continue;
-      if (import_node_fs12.default.existsSync(p)) {
+      if (import_node_fs13.default.existsSync(p)) {
         try {
-          const fileContent = import_node_fs12.default.readFileSync(p, "utf8").trim();
+          const fileContent = import_node_fs13.default.readFileSync(p, "utf8").trim();
           const filePems = fileContent.match(/-----BEGIN [A-Z0-9 ]+-----[\s\S]+?-----END [A-Z0-9 ]+-----/g);
           if (filePems) {
             for (const fpem of filePems) {
@@ -22946,7 +23306,7 @@ async function verifyPluginPackage(options) {
       const JSZip5 = (await import("jszip")).default;
       let buffer;
       if (typeof packageSource === "string") {
-        buffer = import_node_fs12.default.readFileSync(packageSource);
+        buffer = import_node_fs13.default.readFileSync(packageSource);
       } else {
         buffer = packageSource;
       }
@@ -23152,11 +23512,11 @@ var PluginDistributionManager = class {
       return;
     }
     const filePath = this.pluginHost.getPluginFilePath(this.pluginHost.resolvePluginUuid(pluginId));
-    const fs39 = await import("node:fs");
-    if (!fs39.existsSync(filePath)) {
+    const fs40 = await import("node:fs");
+    if (!fs40.existsSync(filePath)) {
       throw new Error(`Cannot reload plugin "${pluginId}": source file missing at ${filePath}`);
     }
-    const code = fs39.readFileSync(filePath, "utf-8");
+    const code = fs40.readFileSync(filePath, "utf-8");
     await this.pluginHost.reloadPlugin(pluginId, code);
   }
   async updateFromZip(zipPath, options = {}) {
@@ -23345,8 +23705,8 @@ var HotReloadController = class {
     const timer = setTimeout(async () => {
       this.debounceTimers.delete(pluginId);
       try {
-        const fs39 = await import("fs/promises");
-        const newSourceCode = await fs39.readFile(filePath, "utf-8");
+        const fs40 = await import("fs/promises");
+        const newSourceCode = await fs40.readFile(filePath, "utf-8");
         console.log(`[HotReload] File changed: ${filePath} \u2192 triggering reload for "${pluginId}"`);
         await this.pluginHost.reloadPlugin(pluginId, newSourceCode);
       } catch (err) {
@@ -32579,24 +32939,24 @@ ${formatEnvIssues(warnings)}`);
 }
 
 // server/security/file-permissions.ts
-var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path13 = __toESM(require("node:path"), 1);
+var import_node_fs14 = __toESM(require("node:fs"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
 var FILE_PERMISSION_BASELINE_DOC = "\u4FEE\u590D\uFF1Achmod 600 <file>\uFF08\u76EE\u5F55 chmod 700\uFF09\uFF1B\u8BE6\u89C1 docs/administrator-guide/admin-manual.md \u6587\u4EF6\u6743\u9650\u57FA\u7EBF\u4E00\u8282\u3002";
 function modeOf(p) {
   try {
-    return import_node_fs13.default.statSync(p).mode & 511;
+    return import_node_fs14.default.statSync(p).mode & 511;
   } catch {
     return null;
   }
 }
 function defaultPaths() {
-  const dbPath2 = process.env.OPENLEARN_DB_PATH ? import_node_path13.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH) : import_node_path13.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
-  const backupDir = process.env.BACKUP_DIR ? import_node_path13.default.resolve(process.cwd(), process.env.BACKUP_DIR) : import_node_path13.default.join(import_node_path13.default.dirname(dbPath2), "backups");
+  const dbPath2 = process.env.OPENLEARN_DB_PATH ? import_node_path15.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH) : import_node_path15.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
+  const backupDir = process.env.BACKUP_DIR ? import_node_path15.default.resolve(process.cwd(), process.env.BACKUP_DIR) : import_node_path15.default.join(import_node_path15.default.dirname(dbPath2), "backups");
   return {
-    envPath: import_node_path13.default.resolve(process.cwd(), ".env"),
+    envPath: import_node_path15.default.resolve(process.cwd(), ".env"),
     dbPath: dbPath2,
     backupDir,
-    encryptionKeyPath: import_node_path13.default.resolve(process.cwd(), "storage", "encryption-key")
+    encryptionKeyPath: import_node_path15.default.resolve(process.cwd(), "storage", "encryption-key")
   };
 }
 function checkSensitiveFilePermissions(options = {}) {
@@ -32627,11 +32987,11 @@ function checkSensitiveFilePermissions(options = {}) {
   }
   if (dirMode !== null) {
     let scanned = 0;
-    for (const entry of import_node_fs13.default.readdirSync(backupDir)) {
+    for (const entry of import_node_fs14.default.readdirSync(backupDir)) {
       if (scanned >= maxBackupFiles) break;
       if (!entry.endsWith(".db")) continue;
       scanned++;
-      checkFile(import_node_path13.default.join(backupDir, entry), "600", "backup-file");
+      checkFile(import_node_path15.default.join(backupDir, entry), "600", "backup-file");
     }
   }
   return issues;
@@ -33531,8 +33891,8 @@ var runOpenAIAgentChat = async (provider, request) => {
 };
 
 // server/backup-scheduler.ts
-var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_fs15 = __toESM(require("node:fs"), 1);
+var import_node_path16 = __toESM(require("node:path"), 1);
 var HOUR_MS = 60 * 60 * 1e3;
 var DAY_MS2 = 24 * HOUR_MS;
 var WAL_FULL_THRESHOLD_BYTES = 50 * 1024 * 1024;
@@ -33549,8 +33909,8 @@ function shouldFullCheckpoint(walBytes, threshold = WAL_FULL_THRESHOLD_BYTES) {
 }
 function resolveDbPath(explicit) {
   if (explicit) return explicit;
-  if (process.env.OPENLEARN_DB_PATH) return import_node_path14.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH);
-  return import_node_path14.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
+  if (process.env.OPENLEARN_DB_PATH) return import_node_path16.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH);
+  return import_node_path16.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
 }
 function startBackupScheduler(deps) {
   const noop = { stop: () => {
@@ -33578,7 +33938,7 @@ function startBackupScheduler(deps) {
     try {
       let walBytes = 0;
       try {
-        walBytes = import_node_fs14.default.statSync(dbPath2 + "-wal").size;
+        walBytes = import_node_fs15.default.statSync(dbPath2 + "-wal").size;
       } catch {
         walBytes = 0;
       }
@@ -33669,9 +34029,9 @@ function isWhitelisted(route, whitelist) {
     (entry) => entry.method.toUpperCase() === route.method && normalizePath2(entry.path) === normalizePath2(route.path)
   );
 }
-function normalizePath2(path45) {
-  if (!path45) return "/";
-  return path45.endsWith("/") && path45.length > 1 ? path45.slice(0, -1) : path45;
+function normalizePath2(path47) {
+  if (!path47) return "/";
+  return path47.endsWith("/") && path47.length > 1 ? path47.slice(0, -1) : path47;
 }
 function auditRouteScopes(app, whitelist = []) {
   const declared = [];
@@ -33849,11 +34209,11 @@ function enforcePasswordChanged(req, res, next) {
   if (isPasswordChangeGateSkipped()) {
     return next();
   }
-  const path45 = req.path || "";
-  if (!path45.startsWith("/api/")) {
+  const path47 = req.path || "";
+  if (!path47.startsWith("/api/")) {
     return next();
   }
-  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path45)) {
+  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path47)) {
     return next();
   }
   const token = getCookieToken(req);
@@ -33928,8 +34288,8 @@ function csrfGuard(req, res, next) {
       next();
       return;
     }
-    const path46 = req.path;
-    if (EXEMPT_PREFIXES.some((p) => path46 === p || path46.startsWith(p))) {
+    const path48 = req.path;
+    if (EXEMPT_PREFIXES.some((p) => path48 === p || path48.startsWith(p))) {
       next();
       return;
     }
@@ -33939,10 +34299,10 @@ function csrfGuard(req, res, next) {
   const origin = req.headers.origin;
   const referer = req.headers.referer;
   const host = req.headers.host;
-  const path45 = req.path;
+  const path47 = req.path;
   if (typeof origin === "string" && origin !== "") {
     if (origin === "null") {
-      if (!EXEMPT_PREFIXES.some((p) => path45 === p || path45.startsWith(p))) {
+      if (!EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
         res.status(403).json({ success: false, code: "FORBIDDEN_CROSS_SITE", error: "Opaque origin write request blocked" });
         return;
       }
@@ -33950,7 +34310,7 @@ function csrfGuard(req, res, next) {
       try {
         const originHost = new URL(origin).host;
         if (host && originHost.toLowerCase() !== host.toLowerCase()) {
-          if (!EXEMPT_PREFIXES.some((p) => path45 === p || path45.startsWith(p))) {
+          if (!EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
             res.status(403).json({
               success: false,
               code: "FORBIDDEN_CROSS_SITE",
@@ -33968,7 +34328,7 @@ function csrfGuard(req, res, next) {
     try {
       const refererHost = new URL(referer).host;
       if (host && refererHost.toLowerCase() !== host.toLowerCase()) {
-        if (!EXEMPT_PREFIXES.some((p) => path45 === p || path45.startsWith(p))) {
+        if (!EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
           res.status(403).json({
             success: false,
             code: "FORBIDDEN_CROSS_SITE",
@@ -34021,8 +34381,8 @@ function parseSentryDsn(dsn) {
     const projectId = url.pathname.split("/").filter(Boolean).pop();
     if (!projectId || !/^\d+$/.test(projectId)) return null;
     const prefix = url.pathname.split("/").filter(Boolean).slice(0, -1).join("/");
-    const path45 = prefix ? `/${prefix}` : "";
-    const envelopeUrl = `${url.protocol}//${url.host}${path45}/api/${projectId}/envelope/`;
+    const path47 = prefix ? `/${prefix}` : "";
+    const envelopeUrl = `${url.protocol}//${url.host}${path47}/api/${projectId}/envelope/`;
     return { envelopeUrl, publicKey };
   } catch {
     return null;
@@ -34462,23 +34822,23 @@ function createSocketIoCors(options) {
 }
 
 // server/routes/health.ts
-var import_node_fs16 = __toESM(require("node:fs"), 1);
-var import_node_path16 = __toESM(require("node:path"), 1);
+var import_node_fs17 = __toESM(require("node:fs"), 1);
+var import_node_path18 = __toESM(require("node:path"), 1);
 
 // packages/core/observability/health.ts
-var import_node_fs15 = __toESM(require("node:fs"), 1);
-var import_node_path15 = __toESM(require("node:path"), 1);
+var import_node_fs16 = __toESM(require("node:fs"), 1);
+var import_node_path17 = __toESM(require("node:path"), 1);
 var import_node_crypto13 = require("node:crypto");
 function probeStorageWritable(dir) {
-  const probe = import_node_path15.default.join(dir, `.ready-${process.pid}-${(0, import_node_crypto13.randomBytes)(4).toString("hex")}`);
+  const probe = import_node_path17.default.join(dir, `.ready-${process.pid}-${(0, import_node_crypto13.randomBytes)(4).toString("hex")}`);
   try {
-    import_node_fs15.default.mkdirSync(dir, { recursive: true });
-    import_node_fs15.default.writeFileSync(probe, "ok", { flag: "w" });
-    import_node_fs15.default.unlinkSync(probe);
+    import_node_fs16.default.mkdirSync(dir, { recursive: true });
+    import_node_fs16.default.writeFileSync(probe, "ok", { flag: "w" });
+    import_node_fs16.default.unlinkSync(probe);
     return true;
   } catch {
     try {
-      import_node_fs15.default.unlinkSync(probe);
+      import_node_fs16.default.unlinkSync(probe);
     } catch {
     }
     return false;
@@ -34486,15 +34846,15 @@ function probeStorageWritable(dir) {
 }
 function listMigrationNames(migrationsDir) {
   try {
-    if (!import_node_fs15.default.existsSync(migrationsDir)) return null;
-    const names = import_node_fs15.default.readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).map((file) => import_node_path15.default.basename(file, ".sql"));
+    if (!import_node_fs16.default.existsSync(migrationsDir)) return null;
+    const names = import_node_fs16.default.readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).map((file) => import_node_path17.default.basename(file, ".sql"));
     return names.length > 0 ? names : null;
   } catch {
     return null;
   }
 }
 function migrationRecordName(name) {
-  return import_node_path15.default.basename(name.replace(/\r/g, "").trim(), ".sql");
+  return import_node_path17.default.basename(name.replace(/\r/g, "").trim(), ".sql");
 }
 function migrationsComplete(expected, applied) {
   if (!expected) return { ok: false, reason: "migrations" };
@@ -34586,15 +34946,15 @@ function countPendingMigrations(migrationsDir, appliedMigrations) {
 function newestBackupAgeSeconds(backupDir, now) {
   let names;
   try {
-    if (!import_node_fs16.default.existsSync(backupDir)) return OPERATIONAL_GAUGE_UNKNOWN;
-    names = import_node_fs16.default.readdirSync(backupDir);
+    if (!import_node_fs17.default.existsSync(backupDir)) return OPERATIONAL_GAUGE_UNKNOWN;
+    names = import_node_fs17.default.readdirSync(backupDir);
   } catch {
     return OPERATIONAL_GAUGE_UNKNOWN;
   }
   let newestMs = Number.NEGATIVE_INFINITY;
   for (const name of names) {
     try {
-      const stat = import_node_fs16.default.statSync(import_node_path16.default.join(backupDir, name));
+      const stat = import_node_fs17.default.statSync(import_node_path18.default.join(backupDir, name));
       if (!stat.isFile()) continue;
       if (stat.mtimeMs > newestMs) newestMs = stat.mtimeMs;
     } catch {
@@ -34626,7 +34986,7 @@ function defaultCountEvents() {
 function registerHealthRoutes(app, options) {
   const startTime = options?.startTime ?? Date.now();
   const platformVersion = options?.platformVersion ?? PLATFORM_VERSION;
-  const migrationsDir = options?.migrationsDir ?? import_node_path16.default.join(process.cwd(), "migrations");
+  const migrationsDir = options?.migrationsDir ?? import_node_path18.default.join(process.cwd(), "migrations");
   const storageDir = options?.storageDir ?? getStorageDir();
   const backupDir = options?.backupDir ?? getBackupsDir();
   const countEvents = options?.countEvents ?? defaultCountEvents;
@@ -34746,8 +35106,8 @@ var import_express2 = __toESM(require("express"), 1);
 var import_zod2 = require("zod");
 
 // server/services/course-package-assets.ts
-var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_path17 = __toESM(require("node:path"), 1);
+var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_path19 = __toESM(require("node:path"), 1);
 var import_node_crypto14 = __toESM(require("node:crypto"), 1);
 var import_jszip3 = __toESM(require("jszip"), 1);
 var import_jspdf = require("jspdf");
@@ -34991,8 +35351,8 @@ async function materializePackageAssets(assets) {
   const result = /* @__PURE__ */ new Map();
   if (assets.length === 0) return result;
   const uploadsDir = getUploadsDir();
-  if (!import_node_fs17.default.existsSync(uploadsDir)) {
-    import_node_fs17.default.mkdirSync(uploadsDir, { recursive: true });
+  if (!import_node_fs18.default.existsSync(uploadsDir)) {
+    import_node_fs18.default.mkdirSync(uploadsDir, { recursive: true });
   }
   const writtenPaths = [];
   try {
@@ -35014,8 +35374,8 @@ async function materializePackageAssets(assets) {
         throw new Error(`\u8BFE\u7A0B\u5305\u8D44\u4EA7 "${asset.id}" \u58F0\u660E\u4E3A ${asset.contentType} \u4F46\u5185\u5BB9\u662F\u4E8C\u8FDB\u5236`);
       }
       const uniqueName = `${Date.now()}-${import_node_crypto14.default.randomBytes(4).toString("hex")}${ext}`;
-      const filePath = import_node_path17.default.join(uploadsDir, uniqueName);
-      import_node_fs17.default.writeFileSync(filePath, buffer);
+      const filePath = import_node_path19.default.join(uploadsDir, uniqueName);
+      import_node_fs18.default.writeFileSync(filePath, buffer);
       writtenPaths.push(filePath);
       const slideCount = isEmbeddableAssetType(asset.contentType) ? asset.contentType === "pdf" ? countPdfPages(buffer) : await countPptxSlides(buffer) : 0;
       result.set(asset.id, {
@@ -35029,7 +35389,7 @@ async function materializePackageAssets(assets) {
   } catch (err) {
     for (const filePath of writtenPaths) {
       try {
-        import_node_fs17.default.unlinkSync(filePath);
+        import_node_fs18.default.unlinkSync(filePath);
       } catch (cleanupErr) {
         console.warn("[course-package] \u9644\u4EF6\u8865\u507F\u6E05\u7406\u5931\u8D25:", cleanupErr.message);
       }
@@ -40031,7 +40391,7 @@ ${runtimeScripts}` : BRIDGE_SDK_CODE;
 }
 
 // server/routes/lessons.ts
-var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_fs19 = __toESM(require("node:fs"), 1);
 
 // server/services/diagnostic-service.ts
 var import_crypto12 = require("crypto");
@@ -41943,8 +42303,8 @@ function registerLessonsRoutes(ctx) {
       passed += 1;
       try {
         const dir = getUploadsDir();
-        import_node_fs18.default.mkdirSync(dir, { recursive: true });
-        import_node_fs18.default.accessSync(dir, import_node_fs18.default.constants.W_OK);
+        import_node_fs19.default.mkdirSync(dir, { recursive: true });
+        import_node_fs19.default.accessSync(dir, import_node_fs19.default.constants.W_OK);
         checks.staticResources = { status: "passed", message: "\u8BFE\u4EF6\u5B58\u50A8\u76EE\u5F55\u53EF\u5199" };
         passed += 1;
       } catch (err) {
@@ -41977,8 +42337,8 @@ function registerLessonsRoutes(ctx) {
 }
 
 // server/services/course-package-import.ts
-var import_node_fs19 = __toESM(require("node:fs"), 1);
-var import_node_path18 = __toESM(require("node:path"), 1);
+var import_node_fs20 = __toESM(require("node:fs"), 1);
+var import_node_path20 = __toESM(require("node:path"), 1);
 var import_uuid18 = require("uuid");
 
 // server/services/course-package-identity.ts
@@ -42253,11 +42613,11 @@ function findReferencedAsset(rawData, assets) {
 function cleanupMaterializedAssets(materialized) {
   const uploadsDir = getUploadsDir();
   for (const asset of materialized.values()) {
-    const fileName = import_node_path18.default.basename(asset.fileUrl);
-    const target = import_node_path18.default.join(uploadsDir, fileName);
+    const fileName = import_node_path20.default.basename(asset.fileUrl);
+    const target = import_node_path20.default.join(uploadsDir, fileName);
     try {
-      if (import_node_fs19.default.existsSync(target)) {
-        import_node_fs19.default.unlinkSync(target);
+      if (import_node_fs20.default.existsSync(target)) {
+        import_node_fs20.default.unlinkSync(target);
       }
     } catch (err) {
       console.warn(`[course-package] \u6E05\u7406\u5B64\u513F\u9644\u4EF6\u5931\u8D25\uFF1A${target}`, err.message);
@@ -46390,6 +46750,85 @@ function registerAssignmentsRoutes(ctx) {
 
 // server/routes/assignment-hub.ts
 var import_express3 = __toESM(require("express"), 1);
+
+// packages/core/assignment/file-preview-policy.ts
+function extensionOf(fileName) {
+  if (typeof fileName !== "string") return "";
+  const base = fileName.split(/[\\/]/).pop() || "";
+  const dot = base.lastIndexOf(".");
+  if (dot <= 0 || dot === base.length - 1) return "";
+  return base.slice(dot).toLowerCase();
+}
+var PREVIEW_CONTENT_TYPES = Object.freeze({
+  // 文档
+  ".pdf": "application/pdf",
+  ".rtf": "application/rtf",
+  ".odt": "application/vnd.oasis.opendocument.text",
+  ".odp": "application/vnd.oasis.opendocument.presentation",
+  ".ods": "application/vnd.oasis.opendocument.spreadsheet",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  // 纯文本 / 代码 / 数据 —— 宿主按文本渲染
+  ".txt": "text/plain",
+  ".md": "text/plain",
+  ".csv": "text/plain",
+  ".json": "text/plain",
+  ".xml": "text/plain",
+  ".html": "text/plain",
+  ".css": "text/plain",
+  ".py": "text/plain",
+  ".js": "text/plain",
+  ".mjs": "text/plain",
+  ".cjs": "text/plain",
+  ".ts": "text/plain",
+  ".tsx": "text/plain",
+  ".jsx": "text/plain",
+  ".java": "text/plain",
+  ".c": "text/plain",
+  ".h": "text/plain",
+  ".cpp": "text/plain",
+  ".cs": "text/plain",
+  ".go": "text/plain",
+  ".rs": "text/plain",
+  ".rb": "text/plain",
+  ".php": "text/plain",
+  ".sql": "text/plain",
+  ".ino": "text/plain",
+  // 图片
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".bmp": "image/bmp",
+  ".svg": "image/svg+xml",
+  ".heic": "image/heic",
+  // 压缩包
+  ".zip": "application/zip"
+});
+var INLINE_SAFE_CONTENT_TYPES = /* @__PURE__ */ new Set([
+  "application/pdf",
+  "text/plain",
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/bmp"
+]);
+var TEXT_PREVIEW_MAX_BYTES = 512 * 1024;
+function resolveContentType(fileName) {
+  const extension = extensionOf(fileName);
+  return PREVIEW_CONTENT_TYPES[extension] ?? "application/octet-stream";
+}
+function isInlineSafeContentType(contentType) {
+  return INLINE_SAFE_CONTENT_TYPES.has((contentType || "").toLowerCase());
+}
+
+// server/routes/assignment-hub.ts
 function decodeFileName(raw) {
   const text = String(raw ?? "").trim();
   if (!text) return "";
@@ -46569,6 +47008,19 @@ function registerAssignmentHubRoutes(ctx) {
       );
       res.setHeader("X-Content-Type-Options", "nosniff");
       res.setHeader("Cache-Control", "private, no-store");
+      const wantsInline = String(req.query.disposition || "").toLowerCase() === "inline";
+      const contentType = resolveContentType(originalName);
+      if (wantsInline && isInlineSafeContentType(contentType)) {
+        res.setHeader("Content-Type", contentType);
+        res.setHeader(
+          "Content-Security-Policy",
+          contentType === "application/pdf" ? "sandbox allow-scripts" : "sandbox"
+        );
+        const safeName = encodeURIComponent(originalName).replace(/['()]/g, escape);
+        res.setHeader("Content-Disposition", `inline; filename*=UTF-8''${safeName}`);
+        res.sendFile(absPath);
+        return;
+      }
       res.download(absPath, originalName);
     } catch (e) {
       sendHubError(res, e);
@@ -48334,7 +48786,7 @@ async function checkVersion(source, installedVersion) {
 init_audit_log();
 
 // server/routes/plugin-api-gateway.ts
-var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
 init_http_router();
 init_interfaces();
 var RESERVED_ACTIONS = /* @__PURE__ */ new Set([
@@ -48508,7 +48960,7 @@ async function pluginApiGatewayMiddleware(req, res, next) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
   }
-  const normalizedSubPath = import_node_path19.default.posix.normalize("/" + rawSubPath);
+  const normalizedSubPath = import_node_path21.default.posix.normalize("/" + rawSubPath);
   if (normalizedSubPath.includes("..")) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
@@ -48945,8 +49397,8 @@ init_fetch_with_retry();
 
 // server/services/community-registry.ts
 var import_semver7 = __toESM(require("semver"), 1);
-var import_node_fs20 = __toESM(require("node:fs"), 1);
-var import_node_path20 = __toESM(require("node:path"), 1);
+var import_node_fs21 = __toESM(require("node:fs"), 1);
+var import_node_path22 = __toESM(require("node:path"), 1);
 var import_node_os3 = __toESM(require("node:os"), 1);
 var import_node_crypto16 = require("node:crypto");
 var COMMUNITY_REGISTRY_ENV = "PLUGIN_COMMUNITY_REGISTRY_URL";
@@ -49168,8 +49620,8 @@ async function downloadPluginPackage(downloadUrl, options = {}) {
   if (!response.body) {
     throw new Error("\u4E0B\u8F7D\u63D2\u4EF6\u5305\u5931\u8D25: \u54CD\u5E94\u4F53\u4E3A\u7A7A");
   }
-  const zipPath = import_node_path20.default.join(import_node_os3.default.tmpdir(), `plugin-download-${(0, import_node_crypto16.randomUUID)()}.zip`);
-  const out = import_node_fs20.default.createWriteStream(zipPath);
+  const zipPath = import_node_path22.default.join(import_node_os3.default.tmpdir(), `plugin-download-${(0, import_node_crypto16.randomUUID)()}.zip`);
+  const out = import_node_fs21.default.createWriteStream(zipPath);
   let received = 0;
   try {
     for await (const chunk of response.body) {
@@ -49191,13 +49643,13 @@ async function downloadPluginPackage(downloadUrl, options = {}) {
   } catch (err) {
     out.destroy();
     try {
-      import_node_fs20.default.rmSync(zipPath, { force: true });
+      import_node_fs21.default.rmSync(zipPath, { force: true });
     } catch {
     }
     throw err;
   }
   if (received === 0) {
-    import_node_fs20.default.rmSync(zipPath, { force: true });
+    import_node_fs21.default.rmSync(zipPath, { force: true });
     throw new Error("\u63D2\u4EF6\u5305\u4E3A\u7A7A");
   }
   return { zipPath, filename: resolveFilename(response, downloadUrl), bytes: received };
@@ -57121,8 +57573,10 @@ async function startServer() {
     if (migrations.length === 0) {
       throw new Error(`[Migration] FATAL: ${migrationsDir} \u4E2D\u6CA1\u6709\u8FC1\u79FB\u6587\u4EF6\uFF0C\u62D2\u7EDD\u542F\u52A8\u3002`);
     }
-    runMigrations(kernelContainer.db, migrations);
+    runMigrations(kernelContainer.db, migrations, { strictLedger: true });
     console.log(`[Migration] \u542F\u52A8\u590D\u67E5\u5B8C\u6210\uFF1A${migrationsDir}\uFF08${migrations.length} \u4E2A\u6587\u4EF6\uFF09`);
+    assertSchemaMatchesGolden(kernelContainer.db, migrationsDir);
+    console.log("[SchemaGolden] \u542F\u52A8\u7EC8\u68C0\u901A\u8FC7\uFF1A\u6570\u636E\u5E93\u7ED3\u6784\u8986\u76D6\u4EE3\u7801\u671F\u671B\u7684\u5168\u90E8\u8868\u4E0E\u5217\u3002");
   } catch (err) {
     console.error("[Migration] FATAL: \u6570\u636E\u5E93\u8FC1\u79FB\u5931\u8D25\uFF0C\u62D2\u7EDD\u5728\u672A\u5B8C\u6210\u8FC1\u79FB\u7684\u5E93\u4E0A\u63D0\u4F9B\u670D\u52A1\u3002");
     console.error(err);