openlearn-next 0.7.8 → 0.7.10

package/dist/server.cjs

@@ -507,6 +507,74 @@ var init_plugin_metrics = __esm({
   }
 });
 
+// packages/core/capability/catalog.ts
+function validateManifestCapabilities(capabilities) {
+  const unknown = [];
+  for (const cap of capabilities) {
+    if (typeof cap !== "string" || !KNOWN_CAPABILITIES.has(cap)) {
+      unknown.push(typeof cap === "string" ? cap : String(cap));
+    }
+  }
+  return { valid: unknown.length === 0, unknown };
+}
+var CAP_API_WRITE, CAP_API_ADMIN, CAP_GRADES_WRITE, CAP_AGENT_TOOL, CAP_AI_INVOKE, CAP_TASK_REGISTER, CAP_STUDENT_DATA_READ, CAP_STUDENT_DATA_WRITE, CAP, CAPABILITIES, KNOWN_CAPABILITIES;
+var init_catalog = __esm({
+  "packages/core/capability/catalog.ts"() {
+    "use strict";
+    CAP_API_WRITE = "api:write";
+    CAP_API_ADMIN = "api:admin";
+    CAP_GRADES_WRITE = "grades:write";
+    CAP_AGENT_TOOL = "agent:tool";
+    CAP_AI_INVOKE = "ai:invoke";
+    CAP_TASK_REGISTER = "task:register";
+    CAP_STUDENT_DATA_READ = "student-data:read";
+    CAP_STUDENT_DATA_WRITE = "student-data:write";
+    CAP = {
+      // ── 资源型（ActionDescriptor.capabilityRequired）──────────────────────
+      ASSIGNMENT_MANAGE: "assignment:manage",
+      ASSIGNMENT_READ: "assignment:read",
+      ASSIGNMENT_REVIEW: "assignment:review",
+      ASSIGNMENT_SUBMIT: "assignment:submit",
+      ASSIGNMENT_WRITE: "assignment:write",
+      LESSON_DELETE: "lesson:delete",
+      LESSON_READ: "lesson:read",
+      LESSON_WRITE: "lesson:write",
+      MANAGEMENT_READ: "management:read",
+      MANAGEMENT_WRITE: "management:write",
+      PLUGIN_READ: "plugin:read",
+      PLUGIN_WRITE: "plugin:write",
+      PROCESS_READ: "process:read",
+      PROCESS_WRITE: "process:write",
+      STUDENT_WRITE: "student:write",
+      VFS_READ: "vfs:read",
+      VFS_WRITE: "vfs:write",
+      WHITEBOARD_READ: "whiteboard:read",
+      WHITEBOARD_WRITE: "whiteboard:write",
+      // ── 历史上只出现在 capabilitiesProposed、从未作为 capabilityRequired ──
+      // 保留是为了不让内置 management 插件在升级后突然被标成「未知串」。
+      CLASS_READ: "class:read",
+      CLASS_WRITE: "class:write",
+      STUDENT_READ: "student:read",
+      // ── 方法级（method-policy / 服务代理的 Security Barrier 3）───────────
+      API_WRITE: CAP_API_WRITE,
+      API_ADMIN: CAP_API_ADMIN,
+      GRADES_WRITE: CAP_GRADES_WRITE,
+      AGENT_TOOL: CAP_AGENT_TOOL,
+      AI_INVOKE: CAP_AI_INVOKE,
+      TASK_REGISTER: CAP_TASK_REGISTER,
+      STUDENT_DATA_READ: CAP_STUDENT_DATA_READ,
+      STUDENT_DATA_WRITE: CAP_STUDENT_DATA_WRITE,
+      // ── 平台内部 ─────────────────────────────────────────────────────────
+      // 片段命令（segment gate）用，插件片段可声明；不在 AI 工具箱里。
+      SEGMENT_GATE_EVAL: "segment:gate_eval"
+    };
+    CAPABILITIES = Object.freeze(
+      Array.from(new Set(Object.values(CAP)))
+    );
+    KNOWN_CAPABILITIES = new Set(CAPABILITIES);
+  }
+});
+
 // packages/core/esm-loader/manifest-schema.ts
 var import_zod, classroomToolSchema, helpDocSchema, quickActivitySchema, timelineSegmentSchema, paletteItemSchema, cockpitWidgetSchema, stageCardSchema, classroomTopbarActionSchema, classroomAttributionAwardSchema, studentCompetencyDimensionSchema, studentProfileWidgetSchema, canvasWidgetSchema, barometerMetricSchema, peerReviewRubricSchema, peerReviewBadgeSchema, preclassPasscodeActionSchema, preclassPasscodeAddonSchema, commandPaletteItemSchema, quickInsertItemSchema, aiPromptTemplateSchema, aiSkillProviderSchema, classTabSchema, classBatchActionSchema, studentRowPanelSchema, editorHeaderActionSchema, postClassWidgetSchema, coursewareViewerToolbarSchema, coursewareViewerOverlaySchema, portalTelemetrySchema, portalCourseBadgeSchema, portalTeachingModeSchema, portalInsightSchema, portalPreflightSchema, portalLaunchActionSchema, countdownWidgetSchema, countdownActionSchema, studentCountdownSchema, studentQuickActionsItemSchema, studentQuickActionsActionSchema, studentQuickActionsFabSchema, notificationTabsSchema, pacingDashboardSchema, diagnosticFeedSchema, collabCanvasSchema, topbarPillSchema, attributionActionSchema, leaderboardActionSchema, studentProfileActionSchema, studentProfileTimelineItemSchema, classroomHeaderActionSchema, classroomAgendaActionSchema, whiteboardDockPluginSchema, classroomAuditEventSchema, peerReviewActionSchema, peerReviewShowcaseWidgetSchema, seatingToolbarSchema, seatingLegendSchema, seatingSeatBadgeSchema, seatingSeatActionsSchema, seatingSummarySchema, whiteboardAutosaveStatusSchema, whiteboardAutosaveActionSchema, teacherPanelSchema, studentFullscreenSchema, globalSettingSchema, navUserMenuSchema, frontendSlotEntrySchema, frontendSlotsShape, pluginLocalesSchema, contributesSchema, deploySchema, apiRouteSchema, apiSchema, requiresItemSchema, manifestSchema, requiresItemV3Schema, manifestSchemaV3;
 var init_manifest_schema = __esm({
@@ -1800,7 +1868,7 @@ var init_token = __esm({
 });
 
 // packages/core/di/interfaces.ts
-var ICommandBusServiceToken4, IEventBusServiceToken3, IActionRegistryServiceToken4, ICapabilityServiceToken, IProcessServiceToken2, IStorageServiceToken, IAIServiceToken, IDatabaseToken4, IPluginHostToken, IPluginLifecycleManagerToken, IPluginDistributionManagerToken, IPluginRuntimeCompositionToken, IUnifiedExtensionRegistryToken, IPluginCapabilityGatewayToken, ICapabilityRegistryToken, IAuthSessionBridgeToken, ISemesterGradeServiceToken, IPointsDimensionRegistryToken, IPointsLedgerServiceToken, ILessonEngineServiceToken, IClassroomRuntimeServiceToken, IPresenceEngineServiceToken, ITeachingCollaborationServiceToken, ILearningAnalyticsServiceToken, IAICapabilityServiceToken, ICapabilityRuntimeServiceToken, ICapabilityGovernanceServiceToken, IPlatformServiceRegistryToken, ICoursewareRuntimeScriptRegistryToken, IClassroomLifecycleServiceToken, IInteractionRuntimeServiceToken, IClassroomCountdownServiceToken, IAssessmentGraderRegistryToken, IStageGuardServiceToken, PLUGIN_RESOLVABLE_TOKENS, PLUGIN_RESOLVABLE_TOKEN_NAMES, INetworkProxyServiceToken;
+var ICommandBusServiceToken4, IEventBusServiceToken3, IActionRegistryServiceToken4, ICapabilityServiceToken, IProcessServiceToken2, IStorageServiceToken, IAIServiceToken, IDatabaseToken4, IPluginHostToken, IPluginLifecycleManagerToken, IPluginDistributionManagerToken, IPluginRuntimeCompositionToken, IUnifiedExtensionRegistryToken, IPluginCapabilityGatewayToken, ICapabilityRegistryToken, IAuthSessionBridgeToken, ISemesterGradeServiceToken, IPointsDimensionRegistryToken, IPointsLedgerServiceToken, IClassRosterServiceToken, ILessonEngineServiceToken, IClassroomRuntimeServiceToken, IPresenceEngineServiceToken, ITeachingCollaborationServiceToken, ILearningAnalyticsServiceToken, IAICapabilityServiceToken, ICapabilityRuntimeServiceToken, ICapabilityGovernanceServiceToken, IPlatformServiceRegistryToken, ICoursewareRuntimeScriptRegistryToken, IClassroomLifecycleServiceToken, IInteractionRuntimeServiceToken, IClassroomCountdownServiceToken, IAssessmentGraderRegistryToken, IStageGuardServiceToken, PLUGIN_RESOLVABLE_TOKENS, PLUGIN_RESOLVABLE_TOKEN_NAMES, INetworkProxyServiceToken;
 var init_interfaces = __esm({
   "packages/core/di/interfaces.ts"() {
     "use strict";
@@ -1839,6 +1907,7 @@ var init_interfaces = __esm({
       "@openlearn/core:IPointsDimensionRegistry"
     );
     IPointsLedgerServiceToken = new Token("@openlearn/core:IPointsLedgerService");
+    IClassRosterServiceToken = new Token("@openlearn/core:IClassRosterService");
     ILessonEngineServiceToken = new Token("@openlearn/core:ILessonEngineService");
     IClassroomRuntimeServiceToken = new Token(
       "@openlearn/core:IClassroomRuntimeService"
@@ -1889,6 +1958,7 @@ var init_interfaces = __esm({
       ISemesterGradeServiceToken,
       IPointsDimensionRegistryToken,
       IPointsLedgerServiceToken,
+      IClassRosterServiceToken,
       ILessonEngineServiceToken,
       IClassroomRuntimeServiceToken,
       IPresenceEngineServiceToken,
@@ -3929,9 +3999,9 @@ var init_http_router = __esm({
       /**
        * 注册指定动词与路径的 Handler
        */
-      route(method, path47, handler, options = {}) {
+      route(method, path48, handler, options = {}) {
         const upperMethod = method.toUpperCase();
-        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
+        const normalized = path48.startsWith("/") ? path48 : "/" + path48;
         const { regex, paramNames } = compileRoutePattern(normalized);
         this.warnIfUnscoped(upperMethod, normalized, options);
         this.routes.push({
@@ -3944,20 +4014,20 @@ var init_http_router = __esm({
           scope: options.scope
         });
       }
-      get(path47, handler, options) {
-        this.route("GET", path47, handler, options);
+      get(path48, handler, options) {
+        this.route("GET", path48, handler, options);
       }
-      post(path47, handler, options) {
-        this.route("POST", path47, handler, options);
+      post(path48, handler, options) {
+        this.route("POST", path48, handler, options);
       }
-      put(path47, handler, options) {
-        this.route("PUT", path47, handler, options);
+      put(path48, handler, options) {
+        this.route("PUT", path48, handler, options);
       }
-      patch(path47, handler, options) {
-        this.route("PATCH", path47, handler, options);
+      patch(path48, handler, options) {
+        this.route("PATCH", path48, handler, options);
       }
-      delete(path47, handler, options) {
-        this.route("DELETE", path47, handler, options);
+      delete(path48, handler, options) {
+        this.route("DELETE", path48, handler, options);
       }
       warnIfUnscoped(method, pattern, options) {
         if (options.scope) return;
@@ -3972,19 +4042,19 @@ var init_http_router = __esm({
       }
       stream(methodOrPath, pathOrHandler, maybeHandler) {
         if (typeof pathOrHandler === "function") {
-          const path47 = methodOrPath;
+          const path48 = methodOrPath;
           const handler = pathOrHandler;
-          this.registerStream("GET", path47, handler);
-          this.registerStream("POST", path47, handler);
+          this.registerStream("GET", path48, handler);
+          this.registerStream("POST", path48, handler);
         } else {
           const method = methodOrPath.toUpperCase();
-          const path47 = pathOrHandler;
+          const path48 = pathOrHandler;
           const handler = maybeHandler;
-          this.registerStream(method, path47, handler);
+          this.registerStream(method, path48, handler);
         }
       }
-      registerStream(method, path47, handler) {
-        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
+      registerStream(method, path48, handler) {
+        const normalized = path48.startsWith("/") ? path48 : "/" + path48;
         const { regex, paramNames } = compileRoutePattern(normalized);
         this.routes.push({
           method: method.toUpperCase(),
@@ -3998,9 +4068,9 @@ var init_http_router = __esm({
       /**
        * 检查指定动词与路径是否为流式路由
        */
-      isStream(method, path47) {
+      isStream(method, path48) {
         const upperMethod = method.toUpperCase();
-        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
+        const normalized = path48.startsWith("/") ? path48 : "/" + path48;
         for (const entry of this.routes) {
           if (entry.method !== upperMethod) continue;
           if (entry.regex.test(normalized)) {
@@ -4012,9 +4082,9 @@ var init_http_router = __esm({
       /**
        * 匹配路由并提取路由参数
        */
-      match(method, path47) {
+      match(method, path48) {
         const upperMethod = method.toUpperCase();
-        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
+        const normalized = path48.startsWith("/") ? path48 : "/" + path48;
         for (const entry of this.routes) {
           if (entry.method !== upperMethod) continue;
           const match = normalized.match(entry.regex);
@@ -4157,13 +4227,13 @@ function checkMethodPolicy(input) {
   if (tokens.frontendApi && token === tokens.frontendApi) {
     if (isReadOnlyMethod(method)) return null;
     if (method === "request" && !Array.isArray(args)) return null;
-    const path47 = extractPathArg(args);
-    const isHighRisk = HIGH_RISK_PATH_PREFIXES.some((p) => path47 === p || path47.startsWith(`${p}/`));
-    const isIrreversible = IRREVERSIBLE_PATH_SUFFIXES.some((s) => path47.endsWith(s));
-    const isEntityDelete = method === "del" && ENTITY_DELETE_RE.test(path47);
+    const path48 = extractPathArg(args);
+    const isHighRisk = HIGH_RISK_PATH_PREFIXES.some((p) => path48 === p || path48.startsWith(`${p}/`));
+    const isIrreversible = IRREVERSIBLE_PATH_SUFFIXES.some((s) => path48.endsWith(s));
+    const isEntityDelete = method === "del" && ENTITY_DELETE_RE.test(path48);
     if (isHighRisk || isIrreversible || isEntityDelete) {
       if (hasCapability(caps, CAP_API_ADMIN)) return null;
-      const why = isIrreversible ? `\u4E0D\u53EF\u9006\u64CD\u4F5C '${path47}'` : isEntityDelete ? `\u5B9E\u4F53\u7EA7\u5220\u9664 '${path47}'` : `\u5199\u5165\u9AD8\u5371\u8DEF\u5F84 '${path47 || "<\u672A\u63D0\u4F9B\u8DEF\u5F84>"}'`;
+      const why = isIrreversible ? `\u4E0D\u53EF\u9006\u64CD\u4F5C '${path48}'` : isEntityDelete ? `\u5B9E\u4F53\u7EA7\u5220\u9664 '${path48}'` : `\u5199\u5165\u9AD8\u5371\u8DEF\u5F84 '${path48 || "<\u672A\u63D0\u4F9B\u8DEF\u5F84>"}'`;
       return `${why} \u9700\u8981 manifest \u58F0\u660E '${CAP_API_ADMIN}' \u80FD\u529B`;
     }
     return hasCapability(caps, CAP_API_WRITE) ? null : `\u5199\u64CD\u4F5C\uFF08${method}\uFF09\u9700\u8981 manifest \u58F0\u660E '${CAP_API_WRITE}' \u80FD\u529B\uFF08\u666E\u901A\u53EA\u8BFB\u8C03\u7528\u8BF7\u7528 get\uFF09`;
@@ -4209,18 +4279,11 @@ function checkMethodPolicy(input) {
   if (tokens.uiService && token === tokens.uiService) return null;
   return null;
 }
-var CAP_API_WRITE, CAP_API_ADMIN, CAP_GRADES_WRITE, CAP_AGENT_TOOL, CAP_AI_INVOKE, CAP_TASK_REGISTER, CAP_STUDENT_DATA_READ, CAP_STUDENT_DATA_WRITE, HIGH_RISK_PATH_PREFIXES, IRREVERSIBLE_PATH_SUFFIXES, ENTITY_DELETE_RE;
+var HIGH_RISK_PATH_PREFIXES, IRREVERSIBLE_PATH_SUFFIXES, ENTITY_DELETE_RE;
 var init_method_policy = __esm({
   "packages/core/plugin-host/method-policy.ts"() {
     "use strict";
-    CAP_API_WRITE = "api:write";
-    CAP_API_ADMIN = "api:admin";
-    CAP_GRADES_WRITE = "grades:write";
-    CAP_AGENT_TOOL = "agent:tool";
-    CAP_AI_INVOKE = "ai:invoke";
-    CAP_TASK_REGISTER = "task:register";
-    CAP_STUDENT_DATA_READ = "student-data:read";
-    CAP_STUDENT_DATA_WRITE = "student-data:write";
+    init_catalog();
     HIGH_RISK_PATH_PREFIXES = Object.freeze([
       "/api/plugins",
       // 插件增删改、一键更新（可执行任意第三方代码）
@@ -4244,51 +4307,238 @@ var init_method_policy = __esm({
   }
 });
 
-// packages/core/command-bus/plugin-command.ts
-function bindPluginCommand(command, pluginActorId) {
-  const actor = typeof pluginActorId === "string" ? pluginActorId.trim() : "";
-  if (!actor) {
-    throw new Error("[Security] Refusing to dispatch a plugin command without a host-assigned actor");
+// packages/core/plugin-host/sql-guard.ts
+function sanitizeSql(sql) {
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let inBacktick = false;
+  let inBracket = false;
+  let result = "";
+  const len = sql.length;
+  for (let i = 0; i < len; i++) {
+    const ch = sql[i];
+    const next = i + 1 < len ? sql[i + 1] : "";
+    if (!inSingleQuote && !inDoubleQuote && !inBacktick && !inBracket && ch === "-" && next === "-") {
+      while (i < len && sql[i] !== "\n") i++;
+      result += " ";
+      continue;
+    }
+    if (!inSingleQuote && !inDoubleQuote && !inBacktick && !inBracket && ch === "/" && next === "*") {
+      i += 2;
+      while (i < len && !(sql[i] === "*" && i + 1 < len && sql[i + 1] === "/")) {
+        i++;
+      }
+      i++;
+      result += " ";
+      continue;
+    }
+    if (ch === "'" && !inDoubleQuote && !inBacktick && !inBracket) {
+      if (inSingleQuote) {
+        if (next === "'") {
+          i++;
+        } else {
+          inSingleQuote = false;
+        }
+      } else {
+        inSingleQuote = true;
+      }
+      result += " ";
+      continue;
+    }
+    if (inSingleQuote) {
+      result += " ";
+      continue;
+    }
+    if (ch === "[" && !inDoubleQuote && !inBacktick) {
+      inBracket = true;
+      result += " ";
+      continue;
+    }
+    if (ch === "]" && inBracket) {
+      inBracket = false;
+      result += " ";
+      continue;
+    }
+    if (ch === "`" && !inDoubleQuote) {
+      inBacktick = !inBacktick;
+      result += " ";
+      continue;
+    }
+    if (ch === '"' && !inBacktick) {
+      inDoubleQuote = !inDoubleQuote;
+      result += " ";
+      continue;
+    }
+    result += ch;
   }
-  const raw = command && typeof command === "object" ? { ...command } : {};
-  const metadata = raw.metadata && typeof raw.metadata === "object" ? { ...raw.metadata } : {};
-  delete metadata.approved;
-  return { ...raw, actorId: actor, metadata };
+  return result;
 }
-function pluginActorIdFor(manifestId, pluginId) {
-  const id = (manifestId || pluginId || "").trim();
-  if (!id) {
-    throw new Error("[Security] Refusing to dispatch a plugin command without a host-assigned actor");
+function extractFlatTables(flatSql, tables) {
+  const ddlRegex = /\b(?:CREATE|DROP|ALTER)\s+(?:TEMP(?:ORARY)?\s+)?TABLE\s+(?:IF\s+(?:NOT\s+)?EXISTS\s+)?([a-zA-Z_][\w]*)/gi;
+  for (const m of flatSql.matchAll(ddlRegex)) {
+    if (m[1] && m[1].toLowerCase() !== SUBQUERY_PLACEHOLDER) {
+      tables.add(m[1].toLowerCase());
+    }
+  }
+  const renameToRegex = /\bRENAME\s+TO\s+([a-zA-Z_][\w]*)/gi;
+  for (const m of flatSql.matchAll(renameToRegex)) {
+    if (m[1] && m[1].toLowerCase() !== SUBQUERY_PLACEHOLDER) {
+      tables.add(m[1].toLowerCase());
+    }
+  }
+  const simpleClauseRegex = /\b(?:INTO|UPDATE(?:\s+OR\s+(?:ROLLBACK|ABORT|REPLACE|FAIL|IGNORE))?|JOIN)\s+([a-zA-Z_][\w]*)/gi;
+  for (const m of flatSql.matchAll(simpleClauseRegex)) {
+    if (m[1] && m[1].toLowerCase() !== SUBQUERY_PLACEHOLDER) {
+      tables.add(m[1].toLowerCase());
+    }
+  }
+  const fromRegex = /\bFROM\s+([^;]+?)(?=\bWHERE\b|\bGROUP\b|\bHAVING\b|\bORDER\b|\bLIMIT\b|\bUNION\b|\bEXCEPT\b|\bINTERSECT\b|\bWINDOW\b|\bVALUES\b|\bSET\b|\bINTO\b|\bJOIN\b|\bLEFT\b|\bRIGHT\b|\bINNER\b|\bOUTER\b|\bCROSS\b|\bNATURAL\b|\bON\b|\bUSING\b|\bSELECT\b|;|$)/gi;
+  for (const match of flatSql.matchAll(fromRegex)) {
+    const clause = match[1];
+    if (!clause) continue;
+    const parts = clause.split(",");
+    for (const part of parts) {
+      const trimmed2 = part.trim();
+      if (!trimmed2) continue;
+      const tokenMatch = /^[a-zA-Z_][\w]*/.exec(trimmed2);
+      if (tokenMatch) {
+        const tableName = tokenMatch[0].toLowerCase();
+        if (tableName !== SUBQUERY_PLACEHOLDER) {
+          tables.add(tableName);
+        }
+      }
+    }
   }
-  return id.startsWith("plugin:") ? id : `plugin:${id}`;
 }
-var init_plugin_command = __esm({
-  "packages/core/command-bus/plugin-command.ts"() {
-    "use strict";
+function extractReferencedTables(cleanSql) {
+  const tables = /* @__PURE__ */ new Set();
+  let working = cleanSql;
+  const parenRegex = /\(([^()]*)\)/g;
+  let depth = 0;
+  while (parenRegex.test(working) && depth++ < 100) {
+    working = working.replace(parenRegex, (_full, inner) => {
+      extractFlatTables(inner, tables);
+      const trimmedInner = inner.trim();
+      if (/^(?:SELECT|VALUES|WITH)\b/i.test(trimmedInner)) {
+        return ` ${SUBQUERY_PLACEHOLDER} `;
+      }
+      return ` ${inner} `;
+    });
   }
-});
-
-// packages/core/plugin-host/plugin-namespace.ts
-function resolvePluginCommandType(type, pluginId) {
-  const prefix = pluginId + ".";
-  if (type.startsWith(prefix)) return type;
-  if (UUID_V7_PREFIX.test(type)) return type;
-  return prefix + type;
+  working = working.replace(/[()]/g, " ");
+  extractFlatTables(working, tables);
+  return tables;
 }
-function stripPluginCommandPrefix(type, pluginId) {
-  const prefix = pluginId + ".";
-  if (type.startsWith(prefix)) return type.slice(prefix.length);
-  if (UUID_V7_PREFIX.test(type)) {
-    const idx = type.indexOf(".");
-    return type.slice(idx + 1);
+function assertPluginSqlAllowed(options) {
+  const { sql, ownPrefix, allowedPrefixes = [], researchAllowed = false } = options;
+  if (typeof sql !== "string" || sql.trim() === "") return;
+  for (const opRegex of FORBIDDEN_OPERATIONS) {
+    if (opRegex.test(sql)) {
+      throw new Error(`Dangerous statement is forbidden: "${sql.trim()}"`);
+    }
+  }
+  const clean = sanitizeSql(sql);
+  const tables = extractReferencedTables(clean);
+  if (/\b(?:FROM|JOIN|INTO|UPDATE|TABLE)\b/i.test(clean) && tables.size === 0) {
+    throw new Error(`Worker plugin SQL rejected: unable to resolve target table in "${sql.trim()}"`);
+  }
+  const isDdl = /^\s*(DROP|CREATE|ALTER|TRUNCATE)\b/i.test(clean);
+  const words = clean.toLowerCase().match(/\b[a-zA-Z_][\w]*\b/g) || [];
+  for (const word of words) {
+    if (FORBIDDEN_CORE_TABLES_SET.has(word)) {
+      if (tables.has(word)) {
+        if (isDdl) {
+          throw new Error(
+            `Worker plugin is not permitted to perform DDL on table "${word}" (core security table is strictly forbidden)`
+          );
+        }
+        throw new Error(
+          `Worker plugin is not permitted to access table "${word}" (core security table is strictly forbidden)`
+        );
+      }
+    }
+  }
+  const ownPrefixLower = ownPrefix ? ownPrefix.toLowerCase() : "";
+  const validPrefixes = [ownPrefixLower, ...allowedPrefixes.map((p) => p.toLowerCase())].filter(Boolean);
+  for (const table of tables) {
+    if (table === "plugin_migrations") continue;
+    if (researchAllowed && table.startsWith("plugin_research_")) continue;
+    const isOwn = validPrefixes.some((p) => table.startsWith(p));
+    if (isOwn) continue;
+    if (table === "sqlite_master" || table === "sqlite_schema" || table === "sqlite_temp_master") {
+      const strippedComments = sql.replace(/--.*$/gm, " ").replace(/\/\*[\s\S]*?\*\//g, " ").trim();
+      const isAllowedMetaQuery = /^\s*SELECT\s+name\s+FROM\s+(?:sqlite_master|sqlite_schema)\s+WHERE\s+type\s*=\s*['"]table['"]\s+AND\s+name\s+LIKE\s+['"][A-Za-z0-9_%]+['"]\s*$/i.test(
+        strippedComments
+      ) && ownPrefixLower && strippedComments.toLowerCase().includes(ownPrefixLower);
+      if (isAllowedMetaQuery) continue;
+      throw new Error(`Direct access to sqlite metadata table "${table}" is forbidden`);
+    }
+    if (isDdl) {
+      throw new Error(
+        `Worker plugin is not permitted to perform DDL on table "${table}" (only ${ownPrefix || "<none>"} namespace is allowed)`
+      );
+    }
+    throw new Error(
+      `Worker plugin is not permitted to access table "${table}" (only ${ownPrefix || "<none>"} namespace is allowed)`
+    );
   }
-  return type;
 }
-var UUID_V7_PREFIX;
-var init_plugin_namespace = __esm({
-  "packages/core/plugin-host/plugin-namespace.ts"() {
+var FORBIDDEN_CORE_TABLES, FORBIDDEN_CORE_TABLES_SET, FORBIDDEN_OPERATIONS, SUBQUERY_PLACEHOLDER;
+var init_sql_guard = __esm({
+  "packages/core/plugin-host/sql-guard.ts"() {
     "use strict";
-    UUID_V7_PREFIX = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[0-9a-f]{4}-[0-9a-f]{12}\./i;
+    FORBIDDEN_CORE_TABLES = Object.freeze([
+      "users",
+      "client_sessions",
+      "plugins",
+      "plugin_storage",
+      "ai_providers",
+      "processes",
+      "pending_commands",
+      "classes",
+      "students",
+      "class_students",
+      "lessons",
+      "assignments",
+      "assignment_submissions",
+      "attendance",
+      "schedules",
+      "class_grade_weights",
+      "exams",
+      "exam_scores",
+      "student_semester_reports",
+      "student_rollcalls",
+      "student_seats",
+      "student_read_notifications",
+      "student_lesson_progress",
+      "courseware",
+      "courseware_attempt",
+      "system_resources",
+      "events",
+      "_migrations",
+      "site_settings",
+      "agent_conversations",
+      "classroom_sessions",
+      "lesson_quiz_submissions",
+      "courseware_score_config",
+      "demo_data_registry",
+      "whiteboard_elements",
+      "student_point_logs",
+      "lianyun_research_activities",
+      "lianyun_research_groups",
+      "lianyun_research_submissions",
+      "lianyun_research_reviews"
+    ]);
+    FORBIDDEN_CORE_TABLES_SET = new Set(FORBIDDEN_CORE_TABLES.map((t) => t.toLowerCase()));
+    FORBIDDEN_OPERATIONS = [
+      /\bATTACH(?:\s+DATABASE)?\b/i,
+      /\bDETACH(?:\s+DATABASE)?\b/i,
+      /\bPRAGMA\b/i,
+      /\bVACUUM\b/i,
+      /\bCREATE\s+(?:TEMP(?:ORARY)?\s+)?(?:TRIGGER|VIEW)\b/i,
+      /\bDROP\s+(?:TEMP(?:ORARY)?\s+)?(?:TRIGGER|VIEW)\b/i
+    ];
+    SUBQUERY_PLACEHOLDER = "__ol_subquery__";
   }
 });
 
@@ -4318,6 +4568,108 @@ var init_plugin_tables = __esm({
   }
 });
 
+// packages/core/plugin-host/inline-db-guard.ts
+function isSqlGuardAllModesEnabled(env = process.env) {
+  const raw = env.OPENLEARN_SQL_GUARD_ALL_MODES?.trim().toLowerCase();
+  return raw === "1" || raw === "true" || raw === "on" || raw === "yes";
+}
+function createGuardedPluginDatabase(db2, pluginId, manifestId) {
+  const ownPrefix = pluginTablePrefix(pluginId, manifestId);
+  const allowedPrefixes = listAllowedPluginTablePrefixes(pluginId, manifestId);
+  const assertSql = (sql) => {
+    try {
+      assertPluginSqlAllowed({ sql: typeof sql === "string" ? sql : String(sql ?? ""), ownPrefix, allowedPrefixes });
+    } catch (err) {
+      const message = err?.message ? String(err.message) : String(err);
+      const wrapped = new Error(`${SQL_GUARD_ERROR_PREFIX}\uFF1A${message}\uFF08\u63D2\u4EF6 "${pluginId}"\uFF09`);
+      wrapped.code = "PLUGIN_SQL_REJECTED";
+      throw wrapped;
+    }
+  };
+  return new Proxy(db2, {
+    get(target, prop, receiver) {
+      const value = Reflect.get(target, prop, receiver);
+      if (typeof value !== "function") return value;
+      if (prop === "prepare") {
+        return (sql, ...rest) => {
+          assertSql(sql);
+          return value.call(target, sql, ...rest);
+        };
+      }
+      if (prop === "exec") {
+        return (sql, ...rest) => {
+          assertSql(sql);
+          return value.call(target, sql, ...rest);
+        };
+      }
+      if (prop === "pragma") {
+        return (source, ...rest) => {
+          assertSql(`PRAGMA ${String(source ?? "")}`);
+          return value.call(target, source, ...rest);
+        };
+      }
+      return value.bind(target);
+    }
+  });
+}
+var SQL_GUARD_ERROR_PREFIX;
+var init_inline_db_guard = __esm({
+  "packages/core/plugin-host/inline-db-guard.ts"() {
+    "use strict";
+    init_sql_guard();
+    init_plugin_tables();
+    SQL_GUARD_ERROR_PREFIX = "[PluginHost] SQL \u88AB\u62D2\u7EDD";
+  }
+});
+
+// packages/core/command-bus/plugin-command.ts
+function bindPluginCommand(command, pluginActorId) {
+  const actor = typeof pluginActorId === "string" ? pluginActorId.trim() : "";
+  if (!actor) {
+    throw new Error("[Security] Refusing to dispatch a plugin command without a host-assigned actor");
+  }
+  const raw = command && typeof command === "object" ? { ...command } : {};
+  const metadata = raw.metadata && typeof raw.metadata === "object" ? { ...raw.metadata } : {};
+  delete metadata.approved;
+  return { ...raw, actorId: actor, metadata };
+}
+function pluginActorIdFor(manifestId, pluginId) {
+  const id = (manifestId || pluginId || "").trim();
+  if (!id) {
+    throw new Error("[Security] Refusing to dispatch a plugin command without a host-assigned actor");
+  }
+  return id.startsWith("plugin:") ? id : `plugin:${id}`;
+}
+var init_plugin_command = __esm({
+  "packages/core/command-bus/plugin-command.ts"() {
+    "use strict";
+  }
+});
+
+// packages/core/plugin-host/plugin-namespace.ts
+function resolvePluginCommandType(type, pluginId) {
+  const prefix = pluginId + ".";
+  if (type.startsWith(prefix)) return type;
+  if (UUID_V7_PREFIX.test(type)) return type;
+  return prefix + type;
+}
+function stripPluginCommandPrefix(type, pluginId) {
+  const prefix = pluginId + ".";
+  if (type.startsWith(prefix)) return type.slice(prefix.length);
+  if (UUID_V7_PREFIX.test(type)) {
+    const idx = type.indexOf(".");
+    return type.slice(idx + 1);
+  }
+  return type;
+}
+var UUID_V7_PREFIX;
+var init_plugin_namespace = __esm({
+  "packages/core/plugin-host/plugin-namespace.ts"() {
+    "use strict";
+    UUID_V7_PREFIX = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[0-9a-f]{4}-[0-9a-f]{12}\./i;
+  }
+});
+
 // packages/core/plugin-host/context-builder.ts
 var context_builder_exports = {};
 __export(context_builder_exports, {
@@ -4720,15 +5072,51 @@ function wrapInteractionRuntimeService(service, tracker, pluginId) {
     listActivityProviders: createSafeFunction(() => service.listActivityProviders())
   };
 }
-function wrapPluginRuntimeService(raw, tokenName, tracker, pluginId) {
+function wrapPluginRuntimeService(raw, tokenName, tracker, pluginId, manifestId) {
   if (tokenName === IClassroomLifecycleServiceToken.name) {
     return wrapClassroomLifecycleService(raw, tracker, pluginId);
   }
   if (tokenName === IInteractionRuntimeServiceToken.name) {
     return wrapInteractionRuntimeService(raw, tracker, pluginId);
   }
+  if (tokenName === "@openlearn/core:IDatabase" && isSqlGuardAllModesEnabled()) {
+    return createGuardedPluginDatabase(raw, pluginId, manifestId);
+  }
   return raw;
 }
+function wrapRosterService(service, pluginId, capabilities) {
+  const CAP_ROSTER_READ = "management:read";
+  const safe = (fn) => createSafeFunction(fn);
+  const assertReadable = (method, detail) => {
+    const hasCap = hasCapability(capabilities ?? [], CAP_ROSTER_READ);
+    recordSecurityAudit("plugin.roster_read", {
+      pluginId,
+      method,
+      ...detail,
+      hasCapability: hasCap,
+      ...hasCap ? {} : { denied: true }
+    });
+    if (hasCap) return;
+    console.error(
+      `[Security] \u63D2\u4EF6 "${pluginId}" \u8C03\u7528 roster.${method} \u88AB\u62D2\uFF1A\u7F3A\u5C11\u80FD\u529B "${CAP_ROSTER_READ}"\u3002\u8BF7\u5728 manifest.capabilitiesProposed \u58F0\u660E\u5B83\uFF08\u6559\u5E08\u89D2\u8272\u9ED8\u8BA4\u5177\u5907\uFF09\u3002`
+    );
+    throw new PluginCapabilityDeniedError(pluginId, CAP_ROSTER_READ, "read", method);
+  };
+  return {
+    listClasses: safe(async () => {
+      assertReadable("listClasses", {});
+      return service.listClasses();
+    }),
+    listClassStudents: safe(async (classId) => {
+      assertReadable("listClassStudents", { classId });
+      return service.listClassStudents(classId);
+    }),
+    getStudent: safe(async (studentId) => {
+      assertReadable("getStudent", { studentId });
+      return service.getStudent(studentId);
+    })
+  };
+}
 function wrapPointsLedgerService(service, pluginId, capabilities) {
   const auditAccess = (studentId, method, operation, requiredCap) => {
     const hasCap = hasCapability(capabilities ?? [], requiredCap);
@@ -4741,6 +5129,9 @@ function wrapPointsLedgerService(service, pluginId, capabilities) {
       ...hasCap ? {} : { denied: true }
     });
     if (!hasCap) {
+      console.error(
+        `[Security] \u63D2\u4EF6 "${pluginId}" \u8C03\u7528 pointsLedger.${method} \u88AB\u62D2\uFF1A\u7F3A\u5C11\u80FD\u529B "${requiredCap}"\uFF08${operation} / student=${studentId}\uFF09\u3002\u8BF7\u5728 manifest.capabilitiesProposed \u58F0\u660E\u5B83\u3002`
+      );
       throw new PluginCapabilityDeniedError(pluginId, requiredCap, operation, method);
     }
   };
@@ -4857,6 +5248,7 @@ async function buildContext(serviceRegistry, tracker, pluginId, manifest, db2, s
   const aiService = await serviceRegistry.resolve(IAIServiceToken);
   const pointsDimensionRegistry = await serviceRegistry.tryResolve(IPointsDimensionRegistryToken);
   const pointsLedgerService = await serviceRegistry.tryResolve(IPointsLedgerServiceToken);
+  const rosterService = await serviceRegistry.tryResolve(IClassRosterServiceToken);
   const wrappedCommandBus = wrapCommandBus(commandBusService, tracker, pluginId, manifest.id, actionRegistryService);
   const wrappedEventBus = wrapEventBus(eventBusService, tracker, pluginId);
   const wrappedProcessManager = wrapProcessManager(
@@ -4873,6 +5265,7 @@ async function buildContext(serviceRegistry, tracker, pluginId, manifest, db2, s
   const wrappedAI = wrapAI(aiService, pluginId, tracker);
   const wrappedPointsDimension = pointsDimensionRegistry ? wrapPointsDimensionRegistry(pointsDimensionRegistry, tracker, pluginId) : null;
   const wrappedPointsLedger = pointsLedgerService ? wrapPointsLedgerService(pointsLedgerService, pluginId, manifest.capabilitiesProposed) : null;
+  const wrappedRoster = rosterService ? wrapRosterService(rosterService, pluginId, manifest.capabilitiesProposed) : null;
   Object.setPrototypeOf(wrappedCommandBus, null);
   Object.setPrototypeOf(wrappedEventBus, null);
   Object.setPrototypeOf(wrappedProcessManager, null);
@@ -4900,7 +5293,8 @@ async function buildContext(serviceRegistry, tracker, pluginId, manifest, db2, s
     storage: wrappedStorage,
     ai: wrappedAI,
     pointsDimension: wrappedPointsDimension,
-    pointsLedger: wrappedPointsLedger
+    pointsLedger: wrappedPointsLedger,
+    roster: wrappedRoster
   };
   if (skipTokens && skipTokens.size > 0) {
     const TOKEN_TO_SERVICE_KEY = {
@@ -4912,7 +5306,8 @@ async function buildContext(serviceRegistry, tracker, pluginId, manifest, db2, s
       "@openlearn/core:IStorageService": "storage",
       "@openlearn/core:IAIService": "ai",
       "@openlearn/core:IPointsDimensionRegistry": "pointsDimension",
-      "@openlearn/core:IPointsLedgerService": "pointsLedger"
+      "@openlearn/core:IPointsLedgerService": "pointsLedger",
+      "@openlearn/core:IClassRosterService": "roster"
     };
     for (const tokenName of skipTokens) {
       const serviceKey = TOKEN_TO_SERVICE_KEY[tokenName];
@@ -5023,9 +5418,9 @@ async function buildContext(serviceRegistry, tracker, pluginId, manifest, db2, s
             `[PluginHost] Plugin "${manifest.id}" cannot resolve "${token}" by name. Use the Token object imported from @openlearn/plugin-sdk, or one of the SDK-exported Token names.`
           );
         }
-        return serviceRegistry.resolveByName(token).then((raw) => wrapPluginRuntimeService(raw, token, tracker, pluginId));
+        return serviceRegistry.resolveByName(token).then((raw) => wrapPluginRuntimeService(raw, token, tracker, pluginId, manifest.id));
       }
-      return serviceRegistry.resolve(token).then((raw) => wrapPluginRuntimeService(raw, token.name, tracker, pluginId));
+      return serviceRegistry.resolve(token).then((raw) => wrapPluginRuntimeService(raw, token.name, tracker, pluginId, manifest.id));
     },
     // V3.2: 插件向 DI 容器提供服务（对应 manifest.provides）
     provide: async (token, instance) => {
@@ -5125,6 +5520,7 @@ var init_context_builder = __esm({
     init_audit_log();
     init_method_policy();
     init_errors2();
+    init_inline_db_guard();
     init_extension_points();
     init_interfaces();
     init_plugin_command();
@@ -5862,7 +6258,7 @@ function isPidAlive(pid) {
 function writeBootstrapTempFile(code) {
   const file = import_node_path11.default.join(
     import_node_os.default.tmpdir(),
-    `${BOOTSTRAP_PREFIX}${process.pid}-${import_node_crypto7.default.randomBytes(8).toString("hex")}${BOOTSTRAP_SUFFIX}`
+    `${BOOTSTRAP_PREFIX}${process.pid}-${import_node_crypto6.default.randomBytes(8).toString("hex")}${BOOTSTRAP_SUFFIX}`
   );
   import_node_fs9.default.writeFileSync(file, code, { encoding: "utf8", mode: 384 });
   return file;
@@ -5925,12 +6321,12 @@ function resolveNetPreloadPath(options = {}) {
   }
   return found;
 }
-var import_node_child_process, import_node_crypto7, import_node_fs9, import_node_os, import_node_path11, import_node_url3, import_meta6, ENV_ALLOWLIST, ENV_DENYLIST, WORKER_DATA_ENV, BOOTSTRAP_PREFIX, BOOTSTRAP_SUFFIX, LEGACY_BOOTSTRAP_STALE_MS;
+var import_node_child_process, import_node_crypto6, import_node_fs9, import_node_os, import_node_path11, import_node_url3, import_meta6, ENV_ALLOWLIST, ENV_DENYLIST, WORKER_DATA_ENV, BOOTSTRAP_PREFIX, BOOTSTRAP_SUFFIX, LEGACY_BOOTSTRAP_STALE_MS;
 var init_child_spawn = __esm({
   "packages/core/worker-runtime/child-spawn.ts"() {
     "use strict";
     import_node_child_process = require("node:child_process");
-    import_node_crypto7 = __toESM(require("node:crypto"), 1);
+    import_node_crypto6 = __toESM(require("node:crypto"), 1);
     import_node_fs9 = __toESM(require("node:fs"), 1);
     import_node_os = __toESM(require("node:os"), 1);
     import_node_path11 = __toESM(require("node:path"), 1);
@@ -7518,241 +7914,6 @@ var init_event_forwarder = __esm({
   }
 });
 
-// packages/core/plugin-host/sql-guard.ts
-function sanitizeSql(sql) {
-  let inSingleQuote = false;
-  let inDoubleQuote = false;
-  let inBacktick = false;
-  let inBracket = false;
-  let result = "";
-  const len = sql.length;
-  for (let i = 0; i < len; i++) {
-    const ch = sql[i];
-    const next = i + 1 < len ? sql[i + 1] : "";
-    if (!inSingleQuote && !inDoubleQuote && !inBacktick && !inBracket && ch === "-" && next === "-") {
-      while (i < len && sql[i] !== "\n") i++;
-      result += " ";
-      continue;
-    }
-    if (!inSingleQuote && !inDoubleQuote && !inBacktick && !inBracket && ch === "/" && next === "*") {
-      i += 2;
-      while (i < len && !(sql[i] === "*" && i + 1 < len && sql[i + 1] === "/")) {
-        i++;
-      }
-      i++;
-      result += " ";
-      continue;
-    }
-    if (ch === "'" && !inDoubleQuote && !inBacktick && !inBracket) {
-      if (inSingleQuote) {
-        if (next === "'") {
-          i++;
-        } else {
-          inSingleQuote = false;
-        }
-      } else {
-        inSingleQuote = true;
-      }
-      result += " ";
-      continue;
-    }
-    if (inSingleQuote) {
-      result += " ";
-      continue;
-    }
-    if (ch === "[" && !inDoubleQuote && !inBacktick) {
-      inBracket = true;
-      result += " ";
-      continue;
-    }
-    if (ch === "]" && inBracket) {
-      inBracket = false;
-      result += " ";
-      continue;
-    }
-    if (ch === "`" && !inDoubleQuote) {
-      inBacktick = !inBacktick;
-      result += " ";
-      continue;
-    }
-    if (ch === '"' && !inBacktick) {
-      inDoubleQuote = !inDoubleQuote;
-      result += " ";
-      continue;
-    }
-    result += ch;
-  }
-  return result;
-}
-function extractFlatTables(flatSql, tables) {
-  const ddlRegex = /\b(?:CREATE|DROP|ALTER)\s+(?:TEMP(?:ORARY)?\s+)?TABLE\s+(?:IF\s+(?:NOT\s+)?EXISTS\s+)?([a-zA-Z_][\w]*)/gi;
-  for (const m of flatSql.matchAll(ddlRegex)) {
-    if (m[1] && m[1].toLowerCase() !== SUBQUERY_PLACEHOLDER) {
-      tables.add(m[1].toLowerCase());
-    }
-  }
-  const renameToRegex = /\bRENAME\s+TO\s+([a-zA-Z_][\w]*)/gi;
-  for (const m of flatSql.matchAll(renameToRegex)) {
-    if (m[1] && m[1].toLowerCase() !== SUBQUERY_PLACEHOLDER) {
-      tables.add(m[1].toLowerCase());
-    }
-  }
-  const simpleClauseRegex = /\b(?:INTO|UPDATE(?:\s+OR\s+(?:ROLLBACK|ABORT|REPLACE|FAIL|IGNORE))?|JOIN)\s+([a-zA-Z_][\w]*)/gi;
-  for (const m of flatSql.matchAll(simpleClauseRegex)) {
-    if (m[1] && m[1].toLowerCase() !== SUBQUERY_PLACEHOLDER) {
-      tables.add(m[1].toLowerCase());
-    }
-  }
-  const fromRegex = /\bFROM\s+([^;]+?)(?=\bWHERE\b|\bGROUP\b|\bHAVING\b|\bORDER\b|\bLIMIT\b|\bUNION\b|\bEXCEPT\b|\bINTERSECT\b|\bWINDOW\b|\bVALUES\b|\bSET\b|\bINTO\b|\bJOIN\b|\bLEFT\b|\bRIGHT\b|\bINNER\b|\bOUTER\b|\bCROSS\b|\bNATURAL\b|\bON\b|\bUSING\b|\bSELECT\b|;|$)/gi;
-  for (const match of flatSql.matchAll(fromRegex)) {
-    const clause = match[1];
-    if (!clause) continue;
-    const parts = clause.split(",");
-    for (const part of parts) {
-      const trimmed2 = part.trim();
-      if (!trimmed2) continue;
-      const tokenMatch = /^[a-zA-Z_][\w]*/.exec(trimmed2);
-      if (tokenMatch) {
-        const tableName = tokenMatch[0].toLowerCase();
-        if (tableName !== SUBQUERY_PLACEHOLDER) {
-          tables.add(tableName);
-        }
-      }
-    }
-  }
-}
-function extractReferencedTables(cleanSql) {
-  const tables = /* @__PURE__ */ new Set();
-  let working = cleanSql;
-  const parenRegex = /\(([^()]*)\)/g;
-  let depth = 0;
-  while (parenRegex.test(working) && depth++ < 100) {
-    working = working.replace(parenRegex, (_full, inner) => {
-      extractFlatTables(inner, tables);
-      const trimmedInner = inner.trim();
-      if (/^(?:SELECT|VALUES|WITH)\b/i.test(trimmedInner)) {
-        return ` ${SUBQUERY_PLACEHOLDER} `;
-      }
-      return ` ${inner} `;
-    });
-  }
-  working = working.replace(/[()]/g, " ");
-  extractFlatTables(working, tables);
-  return tables;
-}
-function assertPluginSqlAllowed(options) {
-  const { sql, ownPrefix, allowedPrefixes = [], researchAllowed = false } = options;
-  if (typeof sql !== "string" || sql.trim() === "") return;
-  for (const opRegex of FORBIDDEN_OPERATIONS) {
-    if (opRegex.test(sql)) {
-      throw new Error(`Dangerous statement is forbidden: "${sql.trim()}"`);
-    }
-  }
-  const clean = sanitizeSql(sql);
-  const tables = extractReferencedTables(clean);
-  if (/\b(?:FROM|JOIN|INTO|UPDATE|TABLE)\b/i.test(clean) && tables.size === 0) {
-    throw new Error(`Worker plugin SQL rejected: unable to resolve target table in "${sql.trim()}"`);
-  }
-  const isDdl = /^\s*(DROP|CREATE|ALTER|TRUNCATE)\b/i.test(clean);
-  const words = clean.toLowerCase().match(/\b[a-zA-Z_][\w]*\b/g) || [];
-  for (const word of words) {
-    if (FORBIDDEN_CORE_TABLES_SET.has(word)) {
-      if (tables.has(word)) {
-        if (isDdl) {
-          throw new Error(
-            `Worker plugin is not permitted to perform DDL on table "${word}" (core security table is strictly forbidden)`
-          );
-        }
-        throw new Error(
-          `Worker plugin is not permitted to access table "${word}" (core security table is strictly forbidden)`
-        );
-      }
-    }
-  }
-  const ownPrefixLower = ownPrefix ? ownPrefix.toLowerCase() : "";
-  const validPrefixes = [ownPrefixLower, ...allowedPrefixes.map((p) => p.toLowerCase())].filter(Boolean);
-  for (const table of tables) {
-    if (table === "plugin_migrations") continue;
-    if (researchAllowed && table.startsWith("plugin_research_")) continue;
-    const isOwn = validPrefixes.some((p) => table.startsWith(p));
-    if (isOwn) continue;
-    if (table === "sqlite_master" || table === "sqlite_schema" || table === "sqlite_temp_master") {
-      const strippedComments = sql.replace(/--.*$/gm, " ").replace(/\/\*[\s\S]*?\*\//g, " ").trim();
-      const isAllowedMetaQuery = /^\s*SELECT\s+name\s+FROM\s+(?:sqlite_master|sqlite_schema)\s+WHERE\s+type\s*=\s*['"]table['"]\s+AND\s+name\s+LIKE\s+['"][A-Za-z0-9_%]+['"]\s*$/i.test(
-        strippedComments
-      ) && ownPrefixLower && strippedComments.toLowerCase().includes(ownPrefixLower);
-      if (isAllowedMetaQuery) continue;
-      throw new Error(`Direct access to sqlite metadata table "${table}" is forbidden`);
-    }
-    if (isDdl) {
-      throw new Error(
-        `Worker plugin is not permitted to perform DDL on table "${table}" (only ${ownPrefix || "<none>"} namespace is allowed)`
-      );
-    }
-    throw new Error(
-      `Worker plugin is not permitted to access table "${table}" (only ${ownPrefix || "<none>"} namespace is allowed)`
-    );
-  }
-}
-var FORBIDDEN_CORE_TABLES, FORBIDDEN_CORE_TABLES_SET, FORBIDDEN_OPERATIONS, SUBQUERY_PLACEHOLDER;
-var init_sql_guard = __esm({
-  "packages/core/plugin-host/sql-guard.ts"() {
-    "use strict";
-    FORBIDDEN_CORE_TABLES = Object.freeze([
-      "users",
-      "client_sessions",
-      "plugins",
-      "plugin_storage",
-      "ai_providers",
-      "processes",
-      "pending_commands",
-      "classes",
-      "students",
-      "class_students",
-      "lessons",
-      "assignments",
-      "assignment_submissions",
-      "attendance",
-      "schedules",
-      "class_grade_weights",
-      "exams",
-      "exam_scores",
-      "student_semester_reports",
-      "student_rollcalls",
-      "student_seats",
-      "student_read_notifications",
-      "student_lesson_progress",
-      "courseware",
-      "courseware_attempt",
-      "system_resources",
-      "events",
-      "_migrations",
-      "site_settings",
-      "agent_conversations",
-      "classroom_sessions",
-      "lesson_quiz_submissions",
-      "courseware_score_config",
-      "demo_data_registry",
-      "whiteboard_elements",
-      "student_point_logs",
-      "lianyun_research_activities",
-      "lianyun_research_groups",
-      "lianyun_research_submissions",
-      "lianyun_research_reviews"
-    ]);
-    FORBIDDEN_CORE_TABLES_SET = new Set(FORBIDDEN_CORE_TABLES.map((t) => t.toLowerCase()));
-    FORBIDDEN_OPERATIONS = [
-      /\bATTACH(?:\s+DATABASE)?\b/i,
-      /\bDETACH(?:\s+DATABASE)?\b/i,
-      /\bPRAGMA\b/i,
-      /\bVACUUM\b/i,
-      /\bCREATE\s+(?:TEMP(?:ORARY)?\s+)?(?:TRIGGER|VIEW)\b/i,
-      /\bDROP\s+(?:TEMP(?:ORARY)?\s+)?(?:TRIGGER|VIEW)\b/i
-    ];
-    SUBQUERY_PLACEHOLDER = "__ol_subquery__";
-  }
-});
-
 // packages/core/worker-runtime/service-host.ts
 function sanitizeClonableValue(val, depth = 0, seen = /* @__PURE__ */ new WeakSet()) {
   if (depth > 12) return null;
@@ -7787,12 +7948,12 @@ function researchSqlPluginIds(env = process.env) {
   }
   return /* @__PURE__ */ new Set(["lianyun-course"]);
 }
-var import_node_crypto8, import_promises2, import_node_net2, CORE_WORKER_TOKENS, STACK_CAP, ServiceHost;
+var import_node_crypto7, import_promises2, import_node_net2, CORE_WORKER_TOKENS, STACK_CAP, ServiceHost;
 var init_service_host = __esm({
   "packages/core/worker-runtime/service-host.ts"() {
     "use strict";
     init_event_forwarder();
-    import_node_crypto8 = __toESM(require("node:crypto"), 1);
+    import_node_crypto7 = __toESM(require("node:crypto"), 1);
     import_promises2 = __toESM(require("node:dns/promises"), 1);
     import_node_net2 = __toESM(require("node:net"), 1);
     init_errors3();
@@ -8432,7 +8593,7 @@ var init_service_host = __esm({
               const [event] = msg.args;
               const pluginId = this.pluginId || this.pluginActorId.replace(/^plugin:/, "");
               const enrichedEvent = {
-                id: event.id || `evt_${Date.now()}_${import_node_crypto8.default.randomUUID()}`,
+                id: event.id || `evt_${Date.now()}_${import_node_crypto7.default.randomUUID()}`,
                 timestamp: event.timestamp || Date.now(),
                 ...event,
                 source: event.source ? `plugin:${pluginId}.${event.source}` : `plugin:${pluginId}`
@@ -10309,6 +10470,15 @@ var CommandBus = class {
   hasHandler(commandType) {
     return this.handlers.has(commandType) || this.legacyHandlers.has(commandType);
   }
+  /**
+   * 只读枚举已注册的命令类型（modern + legacy）。
+   *
+   * 供插件激活后的「handler 有、ActionDescriptor 没有」自检使用（Issue #369）：
+   * 自检要能看清「这次激活新增了哪些命令」，而不是去读私有 Map。
+   */
+  listRegisteredCommandTypes() {
+    return Array.from(/* @__PURE__ */ new Set([...this.handlers.keys(), ...this.legacyHandlers.keys()]));
+  }
   async execute(command) {
     const actorId = typeof command.actorId === "string" ? command.actorId.trim() : "";
     if (!actorId) {
@@ -10372,6 +10542,14 @@ var ActionRegistry = class {
     if (this.actions.has(descriptor.id)) {
       throw new Error(`Action ${descriptor.id} is already registered.`);
     }
+    const owner = this.getActionByCommandType(descriptor.commandType);
+    if (owner) {
+      const message = `Command type "${descriptor.commandType}" is already registered by action ${owner.id}; ${descriptor.id} cannot claim it again.`;
+      if (process.env.VITEST || process.env.NODE_ENV === "test") {
+        throw new Error(message);
+      }
+      console.warn(`[ActionRegistry] ${message}`);
+    }
     this.actions.set(descriptor.id, descriptor);
   }
   unregister(id) {
@@ -10403,6 +10581,20 @@ var ActionRegistry = class {
   getActionByCommandType(commandType) {
     return Array.from(this.actions.values()).find((a) => a.commandType === commandType);
   }
+  /** 已登记描述符覆盖的 commandType（去重、只读）。 */
+  listRegisteredCommandTypes() {
+    return Array.from(new Set(Array.from(this.actions.values()).map((a) => a.commandType))).sort();
+  }
+  /**
+   * 给定命令类型里**没有** ActionDescriptor 的那些。
+   *
+   * 命令总线是 default-deny：这种命令会在用户点击时被 403 `COMMAND_NOT_REGISTERED` 拒绝。
+   * 插件激活后用它把「注册了 handler 却忘了登记描述符」提前打成一条 WARN（Issue #369）。
+   */
+  listMissingDescriptors(commandTypes) {
+    const registered = new Set(Array.from(this.actions.values()).map((a) => a.commandType));
+    return Array.from(new Set(commandTypes)).filter((type) => !registered.has(type)).sort();
+  }
 };
 
 // packages/core/capability/event/capability-event-bus.ts
@@ -10670,6 +10862,7 @@ var InvocationEngine = class {
 };
 
 // packages/core/capability/guard/capability-guard.ts
+init_catalog();
 var CapabilityGuard = class _CapabilityGuard {
   constructor() {
     this.actorCapabilities = /* @__PURE__ */ new Map();
@@ -10685,20 +10878,20 @@ var CapabilityGuard = class _CapabilityGuard {
     ]);
     this.actorCapabilities.set("anonymous", []);
     this.actorCapabilities.set("agent-system-0", [
-      "lesson:write",
-      "lesson:delete",
-      "whiteboard:write",
+      CAP.LESSON_WRITE,
+      CAP.LESSON_DELETE,
+      CAP.WHITEBOARD_WRITE,
       "quiz:write",
-      "plugin:read",
-      "vfs:read",
-      "vfs:write",
-      "management:write",
-      "management:read",
-      "process:write",
-      "process:read"
+      CAP.PLUGIN_READ,
+      CAP.VFS_READ,
+      CAP.VFS_WRITE,
+      CAP.MANAGEMENT_WRITE,
+      CAP.MANAGEMENT_READ,
+      CAP.PROCESS_WRITE,
+      CAP.PROCESS_READ
     ]);
     this.actorCapabilities.set("teacher-demo", ["lesson:*", "whiteboard:*", "management:*", "quiz:*", "vfs:*"]);
-    this.actorCapabilities.set("student-demo", ["student:write", "lesson:read", "whiteboard:read"]);
+    this.actorCapabilities.set("student-demo", [CAP.STUDENT_WRITE, CAP.LESSON_READ, CAP.WHITEBOARD_READ]);
   }
   grant(actorId, cap) {
     const caps = this.actorCapabilities.get(actorId) || [];
@@ -10732,11 +10925,11 @@ var CapabilityGuard = class _CapabilityGuard {
         "vfs:*",
         "process:*",
         "plugin:*",
-        "student:write",
-        "assignment:read",
-        "assignment:submit",
-        "assignment:review",
-        "assignment:manage"
+        CAP.STUDENT_WRITE,
+        CAP.ASSIGNMENT_READ,
+        CAP.ASSIGNMENT_SUBMIT,
+        CAP.ASSIGNMENT_REVIEW,
+        CAP.ASSIGNMENT_MANAGE
       ];
       const [reqRes2, reqAct2] = requiredCap.split(":");
       if (teacherCaps.some((c) => {
@@ -10748,12 +10941,12 @@ var CapabilityGuard = class _CapabilityGuard {
     }
     if (role === "student") {
       const studentCaps = [
-        "student:write",
-        "lesson:read",
-        "whiteboard:read",
-        "assignment:read",
-        "assignment:submit",
-        "assignment:review"
+        CAP.STUDENT_WRITE,
+        CAP.LESSON_READ,
+        CAP.WHITEBOARD_READ,
+        CAP.ASSIGNMENT_READ,
+        CAP.ASSIGNMENT_SUBMIT,
+        CAP.ASSIGNMENT_REVIEW
       ];
       const [reqRes2, reqAct2] = requiredCap.split(":");
       if (studentCaps.some((c) => {
@@ -12092,18 +12285,25 @@ function generateUnambiguousPassword(length = 20) {
   }
   return out;
 }
+function resolveSeedPasswordMode(env = process.env) {
+  return env.OPENLEARN_SEED_PASSWORD_MODE?.trim().toLowerCase() === "random" ? "random" : "default";
+}
 function resolveSeedCredential(username, options) {
   if (options?.allowWellKnown) {
-    return { password: username, mustChange: false, generated: false };
+    return { password: username, mustChange: false, generated: false, source: "playwright" };
   }
   const envValue = options?.envValue?.trim();
   if (envValue) {
-    return { password: envValue, mustChange: envValue === username, generated: false };
+    return { password: envValue, mustChange: envValue === username, generated: false, source: "env" };
   }
   if (options?.vitestFallback) {
-    return { password: `Vitest-${username}-NotDefault9`, mustChange: false, generated: false };
+    return { password: `Vitest-${username}-NotDefault9`, mustChange: false, generated: false, source: "vitest" };
+  }
+  const mode = options?.mode ?? resolveSeedPasswordMode();
+  if (mode === "random") {
+    return { password: generateUnambiguousPassword(20), mustChange: true, generated: true, source: "random" };
   }
-  return { password: generateUnambiguousPassword(20), mustChange: true, generated: true };
+  return { password: username, mustChange: true, generated: false, source: "default" };
 }
 function resolveBootstrapCredentialDir() {
   if (process.env.OPENLEARN_DATA_DIR?.trim()) {
@@ -12127,6 +12327,11 @@ function persistGeneratedSeedCredentials(lines) {
     console.warn(`[SECURITY] \u65E0\u6CD5\u5199\u5165 ${filePath}\uFF0C\u8BF7\u4ECE\u4E0A\u65B9\u65E5\u5FD7\u6284\u5F55\u521D\u59CB\u53E3\u4EE4\u3002`, err);
   }
 }
+function logDefaultSeedCredentials(usernames) {
+  console.warn(
+    "[SECURITY] \u9996\u6B21\u542F\u52A8\u5DF2\u521B\u5EFA\u79CD\u5B50\u8D26\u53F7\uFF0C\u521D\u59CB\u53E3\u4EE4 = \u7528\u6237\u540D\uFF08\u9996\u6B21\u767B\u5F55\u540E\u5FC5\u987B\u4FEE\u6539\uFF09\uFF1A\n" + usernames.map((name) => `  ${name} / ${name}`).join("\n") + "\n  \u6539\u5BC6\u524D\uFF0C\u9664\u300C\u6539\u5BC6 / \u767B\u51FA\u300D\u4EE5\u5916\u7684\u6240\u6709\u63A5\u53E3\u90FD\u4F1A\u88AB\u62D2\u7EDD\uFF08403 FORBIDDEN_DEFAULT_PASSWORD\uFF09\u3002\n  \u5982\u9700\u968F\u673A\u521D\u59CB\u53E3\u4EE4\uFF0C\u8BBE\u7F6E OPENLEARN_SEED_PASSWORD_MODE=random \u540E\u91CD\u5EFA\u6570\u636E\u5E93\u3002"
+  );
+}
 function verifyPassword(pwd, storedHash) {
   if (storedHash.startsWith("$2")) {
     return { valid: import_bcryptjs.default.compareSync(pwd, storedHash), needsUpgrade: false };
@@ -12240,16 +12445,19 @@ function initializeDatabase(instance) {
     const countObj = instance.prepare("SELECT COUNT(*) as cnt FROM users").get();
     const allowWellKnown = isPlaywrightTestFlag(process.env.PLAYWRIGHT_TEST);
     const vitestFallback = Boolean(process.env.VITEST) && !allowWellKnown;
+    const seedMode = resolveSeedPasswordMode();
     if (countObj && countObj.cnt === 0) {
       const adminCred = resolveSeedCredential("admin", {
         envValue: process.env.OPENLEARN_ADMIN_PASSWORD,
         allowWellKnown,
-        vitestFallback
+        vitestFallback,
+        mode: seedMode
       });
       const teacherCred = resolveSeedCredential("teacher", {
         envValue: process.env.OPENLEARN_TEACHER_PASSWORD,
         allowWellKnown,
-        vitestFallback
+        vitestFallback,
+        mode: seedMode
       });
       const insertStmt = instance.prepare(
         "INSERT INTO users (id, username, password_hash, role, name, created_at, must_change_password) VALUES (?, ?, ?, ?, ?, ?, ?)"
@@ -12276,8 +12484,12 @@ function initializeDatabase(instance) {
       if (adminCred.generated) generated.push(`admin ${adminCred.password}`);
       if (teacherCred.generated) generated.push(`teacher ${teacherCred.password}`);
       if (generated.length > 0) persistGeneratedSeedCredentials(generated);
-    } else if (!allowWellKnown) {
-      const seeded = instance.prepare("SELECT id, username, password_hash FROM users WHERE username IN (?, ?)").all("admin", "teacher");
+      const defaulted = [];
+      if (adminCred.source === "default") defaulted.push("admin");
+      if (teacherCred.source === "default") defaulted.push("teacher");
+      if (defaulted.length > 0) logDefaultSeedCredentials(defaulted);
+    } else {
+      const seeded = allowWellKnown ? [] : instance.prepare("SELECT id, username, password_hash FROM users WHERE username IN (?, ?)").all("admin", "teacher");
       for (const user of seeded) {
         if (!verifyPassword(user.username, user.password_hash).valid) continue;
         instance.prepare("UPDATE users SET must_change_password = 1 WHERE id = ?").run(user.id);
@@ -12745,247 +12957,6 @@ var ProcessPlugin = {
 // packages/plugins/management.ts
 var import_uuid4 = require("uuid");
 var import_plugin_sdk3 = require("@openlearn/plugin-sdk");
-
-// packages/core/db/assignment-grade-writer.ts
-var import_node_crypto3 = __toESM(require("node:crypto"), 1);
-var AUTOMATED_SOURCES = /* @__PURE__ */ new Set(["auto", "ai", "system"]);
-function gradeActorRole(actorId) {
-  const match = /^user:[^:]+:(administrator|admin|teacher|student)$/.exec(String(actorId ?? ""));
-  return match ? match[1] : null;
-}
-function isPrivilegedGradeActor(actorId) {
-  const role = gradeActorRole(actorId);
-  return role === "teacher" || role === "administrator" || role === "admin";
-}
-function parseScore(raw) {
-  if (raw === null || raw === void 0) return { ok: true, value: null };
-  if (typeof raw === "string" && raw.trim() === "") return { ok: false };
-  const num = typeof raw === "number" ? raw : Number(raw);
-  if (!Number.isFinite(num)) return { ok: false };
-  const rounded = Math.round(num);
-  if (rounded < 0 || rounded > 100) return { ok: false };
-  return { ok: true, value: rounded };
-}
-var UPSERT_SUBMISSION = `
-  INSERT INTO assignment_submissions
-    (assignment_id, student_id, content, score, feedback, submitted_at, graded_at, status, source, academic_year, graded_by)
-  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  ON CONFLICT(assignment_id, student_id) DO UPDATE SET
-    content = COALESCE(excluded.content, assignment_submissions.content),
-    score = excluded.score,
-    feedback = COALESCE(excluded.feedback, assignment_submissions.feedback),
-    submitted_at = COALESCE(assignment_submissions.submitted_at, excluded.submitted_at),
-    graded_at = COALESCE(excluded.graded_at, assignment_submissions.graded_at),
-    status = excluded.status,
-    source = excluded.source,
-    academic_year = COALESCE(excluded.academic_year, assignment_submissions.academic_year),
-    graded_by = COALESCE(excluded.graded_by, assignment_submissions.graded_by)
-`;
-var INSERT_HISTORY = `
-  INSERT INTO assignment_grade_history
-    (id, assignment_id, student_id, old_score, new_score, old_status, new_status,
-     old_source, new_source, actor_id, actor_role, reason, created_at)
-  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-`;
-function applyGradeChange(db2, input) {
-  const assignmentId = String(input.assignmentId ?? "").trim();
-  const studentId = String(input.studentId ?? "").trim();
-  if (!assignmentId || !studentId) {
-    return { ok: false, reason: "invalid-target", assignmentId, studentId };
-  }
-  const parsed = parseScore(input.score);
-  if (!parsed.ok) {
-    return { ok: false, reason: "invalid-score", assignmentId, studentId };
-  }
-  const newScore = parsed.value;
-  const newStatus = input.status ?? (newScore === null ? "absent" : "graded");
-  if (newScore === null && newStatus !== "absent") {
-    return { ok: false, reason: "invalid-score", assignmentId, studentId };
-  }
-  const now = input.gradedAt ?? Date.now();
-  const submittedAt = input.submittedAt ?? now;
-  const createIfMissing = input.createIfMissing !== false;
-  const automatedIncoming = AUTOMATED_SOURCES.has(input.source);
-  const protectedIncoming = input.source !== "manual";
-  const actorId = input.actorId ?? (automatedIncoming ? "system" : null);
-  const actorRole = input.actorRole ?? gradeActorRole(actorId) ?? (actorId === "system" ? "system" : null);
-  let result = { ok: false, reason: "invalid-target", assignmentId, studentId };
-  const write = () => {
-    const existing = db2.prepare(
-      `SELECT score, feedback, status, source, academic_year
-         FROM assignment_submissions
-         WHERE assignment_id = ? AND student_id = ?
-         LIMIT 1`
-    ).get(assignmentId, studentId);
-    if (!existing && !createIfMissing) {
-      result = { ok: false, reason: "submission-not-found", assignmentId, studentId };
-      return;
-    }
-    if (existing && !input.overrideProtected && protectedIncoming) {
-      if (existing.status === "absent" && newStatus !== "absent") {
-        result = { ok: false, reason: "absent-protected", assignmentId, studentId, oldScore: existing.score };
-        return;
-      }
-      const existingHasGrade = existing.status === "graded" || existing.status === "absent" || existing.score !== null;
-      const existingProtected = existing.source === null || existing.source === "manual" || existing.source === "plugin";
-      if (existingHasGrade && existingProtected && existing.source !== input.source) {
-        result = { ok: false, reason: "manual-protected", assignmentId, studentId, oldScore: existing.score };
-        return;
-      }
-    }
-    const assignment = db2.prepare("SELECT academic_year FROM assignments WHERE id = ?").get(assignmentId);
-    if (!existing && !assignment) {
-      result = { ok: false, reason: "assignment-not-found", assignmentId, studentId };
-      return;
-    }
-    const academicYear = input.academicYear ?? existing?.academic_year ?? assignment?.academic_year ?? null;
-    const gradedBy = actorId ?? null;
-    db2.prepare(UPSERT_SUBMISSION).run(
-      assignmentId,
-      studentId,
-      input.content ?? null,
-      newScore,
-      input.feedback ?? null,
-      submittedAt,
-      now,
-      newStatus,
-      input.source,
-      academicYear,
-      gradedBy
-    );
-    const oldScore = existing?.score ?? null;
-    const oldStatus = existing?.status ?? null;
-    const oldSource = existing?.source ?? null;
-    const scoreChanged = newScore === null ? oldScore !== null : oldScore === null || Number(oldScore) !== newScore;
-    const changed = !existing || scoreChanged || oldStatus !== newStatus || oldSource !== input.source;
-    let historyId;
-    if (changed) {
-      historyId = `agh-${import_node_crypto3.default.randomUUID()}`;
-      db2.prepare(INSERT_HISTORY).run(
-        historyId,
-        assignmentId,
-        studentId,
-        oldScore,
-        newScore,
-        oldStatus,
-        newStatus,
-        oldSource,
-        input.source,
-        actorId,
-        actorRole,
-        input.reason ?? null,
-        now
-      );
-    }
-    result = {
-      ok: true,
-      assignmentId,
-      studentId,
-      historyId,
-      changed,
-      oldScore,
-      newScore
-    };
-  };
-  const tx = typeof db2.transaction === "function" ? db2.transaction(write) : null;
-  if (typeof tx === "function") tx();
-  else write();
-  return result;
-}
-
-// packages/core/db/assignment-resubmit.ts
-var import_node_crypto4 = __toESM(require("node:crypto"), 1);
-var RESUBMIT_CONTENT_REPLACED_REASON = "resubmit-content-replaced";
-function keepStatus(current) {
-  return current === "graded" || current === "absent" ? current : "submitted";
-}
-function writeContentReplacementHistory(db2, input) {
-  const historyId = `agh-${import_node_crypto4.default.randomUUID()}`;
-  try {
-    db2.prepare(
-      `INSERT INTO assignment_grade_history
-         (id, assignment_id, student_id, old_score, new_score, old_status, new_status,
-          old_source, new_source, actor_id, actor_role, reason, created_at, old_content)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-    ).run(
-      historyId,
-      input.assignmentId,
-      input.studentId,
-      input.score,
-      input.score,
-      input.status,
-      input.status,
-      input.source,
-      input.source,
-      input.actorId ?? null,
-      input.actorRole ?? null,
-      RESUBMIT_CONTENT_REPLACED_REASON,
-      input.now,
-      input.oldContent
-    );
-    return historyId;
-  } catch (err) {
-    console.warn("[assignment.resubmit] \u5185\u5BB9\u66FF\u6362\u7559\u75D5\u5931\u8D25:", err.message);
-    return void 0;
-  }
-}
-function applyResubmission(db2, input) {
-  const assignmentId = String(input.assignmentId ?? "").trim();
-  const studentId = String(input.studentId ?? "").trim();
-  if (!assignmentId || !studentId) {
-    return { ok: false, contentReplaced: false };
-  }
-  const now = input.now ?? Date.now();
-  const content = input.content ?? "";
-  let result = { ok: false, contentReplaced: false };
-  const write = () => {
-    const existing = db2.prepare(
-      `SELECT content, score, feedback, status, source, academic_year
-         FROM assignment_submissions
-         WHERE assignment_id = ? AND student_id = ?
-         LIMIT 1`
-    ).get(assignmentId, studentId);
-    if (!existing) {
-      db2.prepare(
-        `INSERT INTO assignment_submissions
-           (assignment_id, student_id, content, score, feedback, submitted_at, status)
-         VALUES (?, ?, ?, NULL, NULL, ?, 'submitted')`
-      ).run(assignmentId, studentId, content, now);
-      result = { ok: true, contentReplaced: false, status: "submitted" };
-      return;
-    }
-    const nextStatus = keepStatus(existing.status);
-    const contentChanged = (existing.content ?? "") !== content;
-    const gradedRow = existing.status === "graded" || existing.status === "absent";
-    const contentReplaced = gradedRow && contentChanged;
-    let historyId;
-    if (contentReplaced) {
-      historyId = writeContentReplacementHistory(db2, {
-        assignmentId,
-        studentId,
-        oldContent: existing.content,
-        score: existing.score,
-        status: existing.status,
-        source: existing.source,
-        actorId: input.actorId ?? null,
-        actorRole: input.actorRole ?? null,
-        now
-      });
-    }
-    db2.prepare(
-      `UPDATE assignment_submissions
-         SET content = ?, submitted_at = ?, status = ?
-       WHERE assignment_id = ? AND student_id = ?`
-    ).run(content, now, nextStatus, assignmentId, studentId);
-    result = { ok: true, contentReplaced, historyId, status: nextStatus };
-  };
-  const tx = typeof db2.transaction === "function" ? db2.transaction(write) : null;
-  if (typeof tx === "function") tx();
-  else write();
-  return result;
-}
-
-// packages/plugins/management.ts
 function parseUserActor(actorId) {
   const match = /^user:([^:]+):(administrator|admin|teacher|student)$/.exec(String(actorId || ""));
   if (!match) return null;
@@ -13518,137 +13489,6 @@ ${sampleRow}`;
         return { success: true, studentId: payload.studentId, category: payload.category, private_notes: serialized };
       }
     });
-    const assignmentCreateCmd = "assignment.create";
-    await actionRegistry.register({
-      id: "core-assignment-create",
-      commandType: assignmentCreateCmd,
-      description: "\u4E3A\u6307\u5B9A\u73ED\u7EA7\u521B\u5EFA\u8BFE\u540E\u4F5C\u4E1A",
-      capabilityRequired: "management:write",
-      inputSchema: {
-        type: "OBJECT",
-        properties: {
-          classId: { type: "STRING", description: "\u76EE\u6807\u73ED\u7EA7 ID" },
-          title: { type: "STRING", description: "\u4F5C\u4E1A\u6807\u9898" },
-          description: { type: "STRING", description: "\u4F5C\u4E1A\u7684\u7B80\u77ED\u6458\u8981\u6216\u6982\u8FF0" },
-          content: { type: "STRING", description: "\u8BE6\u7EC6\u7684\u4F5C\u4E1A\u8BF4\u660E\u6216\u8981\u6C42" }
-        },
-        required: ["classId", "title"]
-      }
-    });
-    await commandBus.registerHandler(assignmentCreateCmd, {
-      async execute(command) {
-        const payload = command.payload;
-        const assignmentId = (0, import_uuid4.v7)();
-        db2.prepare(
-          "INSERT INTO assignments (id, class_id, title, description, content, created_at) VALUES (?, ?, ?, ?, ?, ?)"
-        ).run(
-          assignmentId,
-          payload.classId,
-          payload.title,
-          payload.description || "",
-          payload.content || "",
-          Date.now()
-        );
-        return { assignmentId, classId: payload.classId, title: payload.title };
-      }
-    });
-    const assignmentSubmitCmd = "assignment.submit";
-    await actionRegistry.register({
-      id: "core-assignment-submit",
-      commandType: assignmentSubmitCmd,
-      description: "\u4EE3\u8868\u5B66\u751F\u63D0\u4EA4\u4F5C\u4E1A\u5185\u5BB9\uFF08\u6587\u672C\u3001Markdown \u6216\u4EE3\u7801\uFF09",
-      capabilityRequired: "management:write",
-      inputSchema: {
-        type: "OBJECT",
-        properties: {
-          assignmentId: { type: "STRING", description: "\u4F5C\u4E1A ID" },
-          studentId: { type: "STRING", description: "\u5B66\u751F ID" },
-          content: { type: "STRING", description: "\u63D0\u4EA4\u5185\u5BB9\uFF08\u6587\u672C\u3001Markdown \u6216\u4EE3\u7801\uFF09" }
-        },
-        required: ["assignmentId", "studentId", "content"]
-      }
-    });
-    await commandBus.registerHandler(assignmentSubmitCmd, {
-      async execute(command) {
-        const payload = command.payload;
-        const result = applyResubmission(db2, {
-          assignmentId: payload.assignmentId,
-          studentId: payload.studentId,
-          content: payload.content,
-          actorId: `user:${payload.studentId}:student`,
-          actorRole: "student"
-        });
-        return {
-          success: true,
-          assignmentId: payload.assignmentId,
-          studentId: payload.studentId,
-          /** 本次重交是否替换了已批改行的作答内容（内容替换已记入审计历史）。 */
-          contentReplaced: result.contentReplaced
-        };
-      }
-    });
-    const assignmentGradeCmd = "assignment.grade";
-    await actionRegistry.register({
-      id: "core-assignment-grade",
-      commandType: assignmentGradeCmd,
-      description: "\u4E3A\u5B66\u751F\u4F5C\u4E1A\u6253\u5206\u5E76\u7ED9\u51FA\u53CD\u9988\u610F\u89C1",
-      capabilityRequired: "management:write",
-      inputSchema: {
-        type: "OBJECT",
-        properties: {
-          assignmentId: { type: "STRING", description: "ID of the assignment" },
-          studentId: { type: "STRING", description: "ID of the student" },
-          score: { type: "INTEGER", description: "\u6EE1\u5206 100 \u7684\u5F97\u5206" },
-          feedback: { type: "STRING", description: "\u6709\u5EFA\u8BBE\u6027\u7684\u53CD\u9988\u8BC4\u8BED" }
-        },
-        required: ["assignmentId", "studentId", "score"]
-      }
-    });
-    await commandBus.registerHandler(assignmentGradeCmd, {
-      async execute(command) {
-        const payload = command.payload;
-        const actorId = command.actorId || null;
-        const result = applyGradeChange(db2, {
-          assignmentId: payload.assignmentId,
-          studentId: payload.studentId,
-          score: payload.score,
-          feedback: payload.feedback || "",
-          status: "graded",
-          source: "manual",
-          actorId,
-          reason: "management-grade",
-          createIfMissing: true,
-          overrideProtected: isPrivilegedGradeActor(actorId)
-        });
-        if (!result.ok) {
-          const err = new Error(
-            result.reason === "invalid-score" ? "\u6210\u7EE9\u5FC5\u987B\u662F 0~100 \u7684\u6570\u503C" : result.reason === "assignment-not-found" ? "\u4F5C\u4E1A\u4E0D\u5B58\u5728\uFF0C\u65E0\u6CD5\u5F55\u5165\u6210\u7EE9" : "\u6210\u7EE9\u5199\u5165\u88AB\u62D2\u7EDD"
-          );
-          err.reason = result.reason;
-          throw err;
-        }
-        await eventBus.publish({
-          id: (0, import_uuid4.v7)(),
-          type: "assignment.graded",
-          source: "management.student",
-          payload: {
-            assignmentId: payload.assignmentId,
-            studentId: payload.studentId,
-            score: result.newScore,
-            feedback: payload.feedback || ""
-          },
-          timestamp: Date.now(),
-          correlationId: command.id
-        });
-        return {
-          success: true,
-          assignmentId: payload.assignmentId,
-          studentId: payload.studentId,
-          score: result.newScore,
-          historyId: result.historyId
-        };
-      }
-    });
     const scheduleCreateCmd = "schedule.create";
     await actionRegistry.register({
       id: "core-schedule-create",
@@ -14480,10 +14320,10 @@ function parseScoreFields(fields) {
   if (typeof fields !== "string" || !fields.trim()) return [];
   return fields.split(/[\n\r,，;；|]+/).map((f) => f.trim()).filter(Boolean);
 }
-function getNested(raw, path47) {
+function getNested(raw, path48) {
   if (raw === null || raw === void 0) return void 0;
-  if (!path47) return void 0;
-  const parts = String(path47).split(".").map((p) => p.trim()).filter(Boolean);
+  if (!path48) return void 0;
+  const parts = String(path48).split(".").map((p) => p.trim()).filter(Boolean);
   let cursor = raw;
   for (let i = 0; i < parts.length; i += 1) {
     if (cursor === null || cursor === void 0) return void 0;
@@ -15284,6 +15124,45 @@ var BuiltinPlugin = {
       "page_meta"
       // 分页与大纲元数据
     ];
+    const normalizePluginElementData = (dataObj) => {
+      const pluginId = typeof dataObj.pluginId === "string" ? dataObj.pluginId.trim() : "";
+      if (!pluginId) {
+        console.warn("[Whiteboard] plugin \u5143\u7D20\u672A\u58F0\u660E pluginId\uFF0C\u5C06\u53EA\u80FD\u6309 widgetId \u67E5\u627E\u7EC4\u4EF6\uFF1B\u5EFA\u8BAE\u8865\u4E0A manifest id\u3002");
+      }
+      const teacher = typeof dataObj.teacherWidgetId === "string" ? dataObj.teacherWidgetId.trim() : "";
+      const student = typeof dataObj.studentWidgetId === "string" ? dataObj.studentWidgetId.trim() : "";
+      if (!teacher && !student) {
+        throw new Error(
+          "plugin \u5143\u7D20\u5FC5\u987B\u81F3\u5C11\u58F0\u660E teacherWidgetId \u6216 studentWidgetId \u4E4B\u4E00\uFF0C\u5426\u5219\u6559\u5E08\u7AEF / \u5B66\u751F\u7AEF\u90FD\u4F1A\u505C\u5728\u52A0\u8F7D\u6001\u3002"
+        );
+      }
+      if (!teacher) {
+        dataObj.teacherWidgetId = student;
+        console.warn(`[Whiteboard] plugin \u5143\u7D20\u53EA\u58F0\u660E\u4E86 studentWidgetId\uFF0C\u5DF2\u56DE\u9000 teacherWidgetId="${student}"\u3002`);
+      } else if (!student) {
+        dataObj.studentWidgetId = teacher;
+        console.warn(`[Whiteboard] plugin \u5143\u7D20\u53EA\u58F0\u660E\u4E86 teacherWidgetId\uFF0C\u5DF2\u56DE\u9000 studentWidgetId="${teacher}"\u3002`);
+      }
+    };
+    const buildElementData = (type, rawData, segmentId, page) => {
+      let dataObj = null;
+      try {
+        const parsed = JSON.parse(rawData);
+        dataObj = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+      } catch {
+        if (type === "plugin") {
+          throw new Error(
+            'plugin \u5143\u7D20\u7684 data \u5FC5\u987B\u662F\u5408\u6CD5 JSON \u5B57\u7B26\u4E32\uFF08\u4F8B\u5982 {"pluginId":"ext-x","teacherWidgetId":"w"}\uFF09\u3002'
+          );
+        }
+      }
+      if (!dataObj) return rawData;
+      if (segmentId && !dataObj.segmentId) dataObj.segmentId = segmentId;
+      if (page !== void 0 && dataObj.page === void 0) dataObj.page = page;
+      else if (dataObj.page === void 0) dataObj.page = 0;
+      if (type === "plugin") normalizePluginElementData(dataObj);
+      return JSON.stringify(dataObj);
+    };
     const isAllowedElementType = (type) => {
       if (!type || typeof type !== "string") return false;
       if (KNOWN_ELEMENT_TYPES2.includes(type)) return true;
@@ -15332,20 +15211,7 @@ var BuiltinPlugin = {
           throw new Error(`\u4E0D\u652F\u6301\u7684\u5143\u7D20\u7C7B\u578B "${payload.type}"\u3002${hint}`);
         }
         const elementId = (0, import_uuid7.v7)();
-        let dataStr = payload.data;
-        try {
-          const dataObj = JSON.parse(dataStr);
-          if (payload.segmentId && !dataObj.segmentId) {
-            dataObj.segmentId = payload.segmentId;
-          }
-          if (payload.page !== void 0 && dataObj.page === void 0) {
-            dataObj.page = payload.page;
-          } else if (dataObj.page === void 0) {
-            dataObj.page = 0;
-          }
-          dataStr = JSON.stringify(dataObj);
-        } catch {
-        }
+        const dataStr = buildElementData(payload.type, payload.data, payload.segmentId, payload.page);
         const stmt = db2.prepare(
           "INSERT INTO whiteboard_elements (id, lesson_id, type, data, created_at) VALUES (?, ?, ?, ?, ?)"
         );
@@ -15574,15 +15440,7 @@ var BuiltinPlugin = {
               throw new Error(`\u4E0D\u652F\u6301\u7684\u5143\u7D20\u7C7B\u578B "${el.type}"\u3002\u5DF2\u77E5\u7C7B\u578B\uFF1A${KNOWN_ELEMENT_TYPES2.join(", ")}`);
             }
             const elementId = (0, import_uuid7.v7)();
-            let dataStr = el.data;
-            try {
-              const dataObj = JSON.parse(dataStr);
-              if (el.segmentId && !dataObj.segmentId) dataObj.segmentId = el.segmentId;
-              if (el.page !== void 0 && dataObj.page === void 0) dataObj.page = el.page;
-              else if (dataObj.page === void 0) dataObj.page = 0;
-              dataStr = JSON.stringify(dataObj);
-            } catch {
-            }
+            const dataStr = buildElementData(el.type, el.data, el.segmentId, el.page);
             insertStmt.run(elementId, payload.lessonId, el.type, dataStr, Date.now());
             elementIds.push(elementId);
           }
@@ -16683,6 +16541,155 @@ var BuiltinPlugin = {
 // packages/plugins/ai-planner.ts
 var import_uuid8 = require("uuid");
 var import_plugin_sdk5 = require("@openlearn/plugin-sdk");
+
+// packages/core/db/assignment-grade-writer.ts
+var import_node_crypto3 = __toESM(require("node:crypto"), 1);
+var AUTOMATED_SOURCES = /* @__PURE__ */ new Set(["auto", "ai", "system"]);
+function gradeActorRole(actorId) {
+  const match = /^user:[^:]+:(administrator|admin|teacher|student)$/.exec(String(actorId ?? ""));
+  return match ? match[1] : null;
+}
+function isPrivilegedGradeActor(actorId) {
+  const role = gradeActorRole(actorId);
+  return role === "teacher" || role === "administrator" || role === "admin";
+}
+function parseScore(raw) {
+  if (raw === null || raw === void 0) return { ok: true, value: null };
+  if (typeof raw === "string" && raw.trim() === "") return { ok: false };
+  const num = typeof raw === "number" ? raw : Number(raw);
+  if (!Number.isFinite(num)) return { ok: false };
+  const rounded = Math.round(num);
+  if (rounded < 0 || rounded > 100) return { ok: false };
+  return { ok: true, value: rounded };
+}
+var UPSERT_SUBMISSION = `
+  INSERT INTO assignment_submissions
+    (assignment_id, student_id, content, score, feedback, submitted_at, graded_at, status, source, academic_year, graded_by)
+  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  ON CONFLICT(assignment_id, student_id) DO UPDATE SET
+    content = COALESCE(excluded.content, assignment_submissions.content),
+    score = excluded.score,
+    feedback = COALESCE(excluded.feedback, assignment_submissions.feedback),
+    submitted_at = COALESCE(assignment_submissions.submitted_at, excluded.submitted_at),
+    graded_at = COALESCE(excluded.graded_at, assignment_submissions.graded_at),
+    status = excluded.status,
+    source = excluded.source,
+    academic_year = COALESCE(excluded.academic_year, assignment_submissions.academic_year),
+    graded_by = COALESCE(excluded.graded_by, assignment_submissions.graded_by)
+`;
+var INSERT_HISTORY = `
+  INSERT INTO assignment_grade_history
+    (id, assignment_id, student_id, old_score, new_score, old_status, new_status,
+     old_source, new_source, actor_id, actor_role, reason, created_at)
+  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+`;
+function applyGradeChange(db2, input) {
+  const assignmentId = String(input.assignmentId ?? "").trim();
+  const studentId = String(input.studentId ?? "").trim();
+  if (!assignmentId || !studentId) {
+    return { ok: false, reason: "invalid-target", assignmentId, studentId };
+  }
+  const parsed = parseScore(input.score);
+  if (!parsed.ok) {
+    return { ok: false, reason: "invalid-score", assignmentId, studentId };
+  }
+  const newScore = parsed.value;
+  const newStatus = input.status ?? (newScore === null ? "absent" : "graded");
+  if (newScore === null && newStatus !== "absent") {
+    return { ok: false, reason: "invalid-score", assignmentId, studentId };
+  }
+  const now = input.gradedAt ?? Date.now();
+  const submittedAt = input.submittedAt ?? now;
+  const createIfMissing = input.createIfMissing !== false;
+  const automatedIncoming = AUTOMATED_SOURCES.has(input.source);
+  const protectedIncoming = input.source !== "manual";
+  const actorId = input.actorId ?? (automatedIncoming ? "system" : null);
+  const actorRole = input.actorRole ?? gradeActorRole(actorId) ?? (actorId === "system" ? "system" : null);
+  let result = { ok: false, reason: "invalid-target", assignmentId, studentId };
+  const write = () => {
+    const existing = db2.prepare(
+      `SELECT score, feedback, status, source, academic_year
+         FROM assignment_submissions
+         WHERE assignment_id = ? AND student_id = ?
+         LIMIT 1`
+    ).get(assignmentId, studentId);
+    if (!existing && !createIfMissing) {
+      result = { ok: false, reason: "submission-not-found", assignmentId, studentId };
+      return;
+    }
+    if (existing && !input.overrideProtected && protectedIncoming) {
+      if (existing.status === "absent" && newStatus !== "absent") {
+        result = { ok: false, reason: "absent-protected", assignmentId, studentId, oldScore: existing.score };
+        return;
+      }
+      const existingHasGrade = existing.status === "graded" || existing.status === "absent" || existing.score !== null;
+      const existingProtected = existing.source === null || existing.source === "manual" || existing.source === "plugin";
+      if (existingHasGrade && existingProtected && existing.source !== input.source) {
+        result = { ok: false, reason: "manual-protected", assignmentId, studentId, oldScore: existing.score };
+        return;
+      }
+    }
+    const assignment = db2.prepare("SELECT academic_year FROM assignments WHERE id = ?").get(assignmentId);
+    if (!existing && !assignment) {
+      result = { ok: false, reason: "assignment-not-found", assignmentId, studentId };
+      return;
+    }
+    const academicYear = input.academicYear ?? existing?.academic_year ?? assignment?.academic_year ?? null;
+    const gradedBy = actorId ?? null;
+    db2.prepare(UPSERT_SUBMISSION).run(
+      assignmentId,
+      studentId,
+      input.content ?? null,
+      newScore,
+      input.feedback ?? null,
+      submittedAt,
+      now,
+      newStatus,
+      input.source,
+      academicYear,
+      gradedBy
+    );
+    const oldScore = existing?.score ?? null;
+    const oldStatus = existing?.status ?? null;
+    const oldSource = existing?.source ?? null;
+    const scoreChanged = newScore === null ? oldScore !== null : oldScore === null || Number(oldScore) !== newScore;
+    const changed = !existing || scoreChanged || oldStatus !== newStatus || oldSource !== input.source;
+    let historyId;
+    if (changed) {
+      historyId = `agh-${import_node_crypto3.default.randomUUID()}`;
+      db2.prepare(INSERT_HISTORY).run(
+        historyId,
+        assignmentId,
+        studentId,
+        oldScore,
+        newScore,
+        oldStatus,
+        newStatus,
+        oldSource,
+        input.source,
+        actorId,
+        actorRole,
+        input.reason ?? null,
+        now
+      );
+    }
+    result = {
+      ok: true,
+      assignmentId,
+      studentId,
+      historyId,
+      changed,
+      oldScore,
+      newScore
+    };
+  };
+  const tx = typeof db2.transaction === "function" ? db2.transaction(write) : null;
+  if (typeof tx === "function") tx();
+  else write();
+  return result;
+}
+
+// packages/plugins/ai-planner.ts
 var AiPlannerPlugin = {
   manifest: {
     id: "@openlearn/plugin-ai-planner",
@@ -17319,11 +17326,6 @@ var AssignmentEvalPlugin = {
     for (const id of OWNED_ACTION_IDS) {
       actionRegistry.unregister(id);
     }
-    commandBus.unregisterHandler("assignment.submit");
-    commandBus.unregisterHandler("assignment.grade");
-    actionRegistry.unregister("core-assignment-create");
-    actionRegistry.unregister("core-assignment-submit");
-    actionRegistry.unregister("core-assignment-grade");
     const loadAssignment = (assignmentId) => db2.prepare("SELECT * FROM plugin_assignments WHERE id = ?").get(assignmentId);
     const resolveAssignment = (assignmentId, lessonId) => {
       if (assignmentId) {
@@ -18262,6 +18264,40 @@ var SemesterGradeService = class {
   }
 };
 
+// packages/core/di/roster-service.ts
+var ClassRosterService = class {
+  constructor(db2) {
+    this.db = db2;
+  }
+  async listClasses() {
+    const rows = this.db.prepare(
+      `SELECT c.id AS id, c.name AS name, COUNT(cs.student_id) AS student_count
+           FROM classes c
+           LEFT JOIN class_students cs ON cs.class_id = c.id
+          GROUP BY c.id, c.name
+          ORDER BY c.created_at DESC, c.name ASC`
+    ).all();
+    return rows.map((row) => ({ id: row.id, name: row.name, studentCount: Number(row.student_count) }));
+  }
+  async listClassStudents(classId) {
+    const rows = this.db.prepare(
+      `SELECT s.id AS id, s.name AS name, s.student_number AS student_number
+           FROM class_students cs
+           JOIN students s ON s.id = cs.student_id
+          WHERE cs.class_id = ?
+          ORDER BY s.name ASC`
+    ).all(classId);
+    return rows.map(toStudentRef);
+  }
+  async getStudent(studentId) {
+    const row = this.db.prepare("SELECT id, name, student_number FROM students WHERE id = ?").get(studentId);
+    return row ? toStudentRef(row) : null;
+  }
+};
+function toStudentRef(row) {
+  return { id: row.id, name: row.name, studentNumber: row.student_number ?? null };
+}
+
 // packages/core/di/points-dimension-registry.ts
 var PointsDimensionRegistry = class {
   constructor() {
@@ -18422,7 +18458,7 @@ var PointsLedgerService = class {
 };
 
 // packages/core/di/auth-session-bridge-service.ts
-var import_node_crypto5 = __toESM(require("node:crypto"), 1);
+var import_node_crypto4 = __toESM(require("node:crypto"), 1);
 var AuthSessionBridgeService = class {
   constructor(db2) {
     this.db = db2;
@@ -18434,7 +18470,7 @@ var AuthSessionBridgeService = class {
     const now = Date.now();
     const maxAgeSeconds = 7 * 24 * 60 * 60;
     const expiresAt = now + maxAgeSeconds * 1e3;
-    const sessionToken = "token_" + import_node_crypto5.default.randomBytes(16).toString("hex");
+    const sessionToken = "token_" + import_node_crypto4.default.randomBytes(16).toString("hex");
     if (user.role === "student") {
       const existingStudent = this.db.prepare("SELECT id FROM students WHERE id = ?").get(user.userId);
       if (!existingStudent) {
@@ -19162,7 +19198,7 @@ init_errors2();
 init_interfaces();
 
 // packages/core/plugin-host/student-data-privacy.ts
-var import_node_crypto6 = __toESM(require("node:crypto"), 1);
+var import_node_crypto5 = __toESM(require("node:crypto"), 1);
 async function dispatchStudentExport(pluginInstances, studentId, timeoutMs = 1e4) {
   const results = {};
   for (const [pluginId, instance] of pluginInstances.entries()) {
@@ -19170,7 +19206,7 @@ async function dispatchStudentExport(pluginInstances, studentId, timeoutMs = 1e4
     if (instance.workerRef?.transport) {
       try {
         const transport = instance.workerRef.transport;
-        const invokeId = import_node_crypto6.default.randomUUID();
+        const invokeId = import_node_crypto5.default.randomUUID();
         const responsePromise = new Promise((resolve2) => {
           const timer = setTimeout(() => {
             cleanup();
@@ -19236,7 +19272,7 @@ async function dispatchStudentDelete(pluginInstances, studentId, timeoutMs = 1e4
     if (instance.workerRef?.transport) {
       try {
         const transport = instance.workerRef.transport;
-        const invokeId = import_node_crypto6.default.randomUUID();
+        const invokeId = import_node_crypto5.default.randomUUID();
         const responsePromise = new Promise((resolve2) => {
           const timer = setTimeout(() => {
             cleanup();
@@ -20225,7 +20261,7 @@ var PluginHostHttp = class extends PluginHostCore {
   /**
    * 判断指定插件的某个请求路径是否为流式路由 (SSE)
    */
-  isStreamRoute(pluginIdOrManifestId, method, path47) {
+  isStreamRoute(pluginIdOrManifestId, method, path48) {
     const upperMethod = method.toUpperCase();
     const resolvedId = this.resolvePluginUuid(pluginIdOrManifestId);
     const instance = this.pluginInstances.get(resolvedId) ?? this.pluginInstances.get(pluginIdOrManifestId);
@@ -20234,7 +20270,7 @@ var PluginHostHttp = class extends PluginHostCore {
       for (const r of manifest.api.routes) {
         if (r.method.toUpperCase() === upperMethod && r.streaming === true) {
           const compiled = compileRoutePattern(r.path);
-          if (compiled.regex.test(path47)) {
+          if (compiled.regex.test(path48)) {
             return true;
           }
         }
@@ -20242,14 +20278,14 @@ var PluginHostHttp = class extends PluginHostCore {
     }
     if (!instance) return false;
     if (instance.context?.http) {
-      return instance.context.http.isStream(upperMethod, path47);
+      return instance.context.http.isStream(upperMethod, path48);
     }
     if (instance.workerRef) {
       const routes = instance.workerRef.serviceHost.getRegisteredRoutes();
       for (const r of routes) {
         if (r.method === upperMethod && r.isStream) {
           const compiled = compileRoutePattern(r.pattern);
-          if (compiled.regex.test(path47)) {
+          if (compiled.regex.test(path48)) {
             return true;
           }
         }
@@ -20473,6 +20509,7 @@ init_types();
 init_errors2();
 init_interfaces();
 init_plugin_grants();
+init_catalog();
 var PluginHostLifecycle = class extends PluginHostHttp {
   /**
    * 激活插件。
@@ -20530,12 +20567,47 @@ var PluginHostLifecycle = class extends PluginHostHttp {
     const currentState = this.pluginStates.get(pluginId) ?? "installed" /* INSTALLED */;
     this.validateTransition(pluginId, currentState, "activating" /* ACTIVATING */);
     this.setPluginState(pluginId, "activating" /* ACTIVATING */);
+    const commandTypesBefore = this.listHostCommandTypes();
     const preloaded = this.preloadedPlugins.get(pluginId);
     if (preloaded) {
       await this.activatePreloaded(pluginId, preloaded);
+      this.auditMissingActionDescriptors(pluginId, commandTypesBefore);
       return;
     }
     await this.activateFromDatabase(pluginId, currentState);
+    this.auditMissingActionDescriptors(pluginId, commandTypesBefore);
+  }
+  /** 宿主 CommandBus 当前注册的命令类型；解析失败返回空集（自检不能影响激活）。 */
+  listHostCommandTypes() {
+    try {
+      const bus = this.serviceRegistry.resolve(ICommandBusServiceToken4);
+      return new Set(bus.listRegisteredCommandTypes?.() ?? []);
+    } catch {
+      return /* @__PURE__ */ new Set();
+    }
+  }
+  /**
+   * 插件激活后的命令契约自检（Issue #369）。
+   *
+   * 命令总线是 default-deny：handler 有、ActionDescriptor 没有的命令会在用户点击时
+   * 403 `COMMAND_NOT_REGISTERED`。静态扫描抓不到循环注册 / 对象表 / `regHandler()` 包装，
+   * 所以改为激活后做一次运行时差集，把缺口提前打成立即可见的 WARN。
+   *
+   * 自检只服务可观测性：任何异常都不能影响激活结果，故整体 try/catch 且只打日志。
+   */
+  auditMissingActionDescriptors(pluginId, before) {
+    try {
+      if (this.inflightActivate.size > 1) return;
+      const added = Array.from(this.listHostCommandTypes()).filter((type) => !before.has(type));
+      if (added.length === 0) return;
+      const registry4 = this.serviceRegistry.resolve(IActionRegistryServiceToken4);
+      const missing = registry4.listMissingDescriptors?.(added) ?? [];
+      if (missing.length === 0) return;
+      console.warn(
+        `[PluginHost] \u63D2\u4EF6 "${pluginId}" \u6709 ${missing.length} \u4E2A\u547D\u4EE4 handler \u6CA1\u6709 ActionDescriptor\uFF1A${missing.join(", ")}\u3002\u8FD9\u4E9B\u547D\u4EE4\u4F1A\u88AB default-deny \u4EE5 403 COMMAND_NOT_REGISTERED \u62D2\u7EDD\uFF0C\u8BF7\u4E3A\u6BCF\u4E2A registerHandler \u540C\u65F6\u6CE8\u518C actionRegistry.register(...)\u3002`
+      );
+    } catch {
+    }
   }
   /**
    * preloaded 插件的激活（Phase 8，内置插件路径）。
@@ -20786,6 +20858,12 @@ var PluginHostLifecycle = class extends PluginHostHttp {
   async grantCapabilities(actorId, caps, opts) {
     if (caps.length === 0) return;
     try {
+      const { unknown } = validateManifestCapabilities(caps);
+      if (unknown.length > 0) {
+        console.error(
+          `[PluginHost] "${actorId}" \u7684 manifest \u58F0\u660E\u4E86\u672A\u77E5\u80FD\u529B\uFF1A${unknown.join(", ")}\u3002\u8FD9\u4E9B\u4E32\u4E0D\u4F1A\u751F\u6548\uFF08\u5B88\u536B\u53EA\u8BA4 ActionDescriptor.capabilityRequired\uFF09\u3002\u5408\u6CD5\u6E05\u5355\u89C1 packages/core/capability/catalog.ts \u4E0E docs/reference/plugin-capability-matrix.md\u3002`
+        );
+      }
       const capService = await this.serviceRegistry.resolve(ICapabilityServiceToken);
       for (const cap of caps) {
         if (typeof cap !== "string" || isBlockedPluginCapability(cap)) {
@@ -21126,7 +21204,7 @@ var import_node_fs11 = __toESM(require("node:fs"), 1);
 var import_node_path13 = __toESM(require("node:path"), 1);
 var import_node_url5 = require("node:url");
 var import_meta7 = {};
-var FALLBACK_VERSION = "0.7.8";
+var FALLBACK_VERSION = "0.7.10";
 function readPlatformVersion() {
   const bases = [];
   if (typeof __dirname !== "undefined") bases.push(__dirname);
@@ -23249,10 +23327,10 @@ var UnifiedExtensionRegistry = class {
 init_install_utils();
 
 // packages/core/security/plugin-signature.ts
-var import_node_crypto9 = __toESM(require("node:crypto"), 1);
+var import_node_crypto8 = __toESM(require("node:crypto"), 1);
 var import_node_fs13 = __toESM(require("node:fs"), 1);
 function computeSha256(input) {
-  const hash = import_node_crypto9.default.createHash("sha256");
+  const hash = import_node_crypto8.default.createHash("sha256");
   if (typeof input === "string") {
     if (import_node_fs13.default.existsSync(input)) {
       const fd = import_node_fs13.default.openSync(input, "r");
@@ -23306,10 +23384,10 @@ function verifySignature(integrity, signature, publicKeys, metadata, options) {
   for (const pem of keys) {
     if (!pem || !pem.trim()) continue;
     try {
-      const pubKey = import_node_crypto9.default.createPublicKey(pem.trim());
+      const pubKey = import_node_crypto8.default.createPublicKey(pem.trim());
       if (metadata && metadata.id) {
         const boundBuf = buildAttestationPayload(integrity, metadata);
-        if (import_node_crypto9.default.verify(null, boundBuf, pubKey, sig)) {
+        if (import_node_crypto8.default.verify(null, boundBuf, pubKey, sig)) {
           return { ok: true, matchedKey: pem };
         }
         if (!allowV1 || metadata.version !== void 0) {
@@ -23318,7 +23396,7 @@ function verifySignature(integrity, signature, publicKeys, metadata, options) {
       }
       if (allowV1) {
         const rawBuf = Buffer.from(integrity.trim(), "utf8");
-        if (import_node_crypto9.default.verify(null, rawBuf, pubKey, sig)) {
+        if (import_node_crypto8.default.verify(null, rawBuf, pubKey, sig)) {
           return { ok: true, matchedKey: pem };
         }
       }
@@ -23639,11 +23717,11 @@ var PluginDistributionManager = class {
       return;
     }
     const filePath = this.pluginHost.getPluginFilePath(this.pluginHost.resolvePluginUuid(pluginId));
-    const fs40 = await import("node:fs");
-    if (!fs40.existsSync(filePath)) {
+    const fs41 = await import("node:fs");
+    if (!fs41.existsSync(filePath)) {
       throw new Error(`Cannot reload plugin "${pluginId}": source file missing at ${filePath}`);
     }
-    const code = fs40.readFileSync(filePath, "utf-8");
+    const code = fs41.readFileSync(filePath, "utf-8");
     await this.pluginHost.reloadPlugin(pluginId, code);
   }
   async updateFromZip(zipPath, options = {}) {
@@ -23832,8 +23910,8 @@ var HotReloadController = class {
     const timer = setTimeout(async () => {
       this.debounceTimers.delete(pluginId);
       try {
-        const fs40 = await import("fs/promises");
-        const newSourceCode = await fs40.readFile(filePath, "utf-8");
+        const fs41 = await import("fs/promises");
+        const newSourceCode = await fs41.readFile(filePath, "utf-8");
         console.log(`[HotReload] File changed: ${filePath} \u2192 triggering reload for "${pluginId}"`);
         await this.pluginHost.reloadPlugin(pluginId, newSourceCode);
       } catch (err) {
@@ -30835,6 +30913,7 @@ var Kernel = class {
     this.serviceRegistry.register(ISemesterGradeServiceToken, new SemesterGradeService(this.db));
     this.serviceRegistry.register(IPointsDimensionRegistryToken, new PointsDimensionRegistry());
     this.serviceRegistry.register(IPointsLedgerServiceToken, new PointsLedgerService(this.db));
+    this.serviceRegistry.register(IClassRosterServiceToken, new ClassRosterService(this.db));
     this.serviceRegistry.register(ILessonEngineServiceToken, { getRuntime: async () => this.lessonRuntime });
     this.serviceRegistry.register(IClassroomRuntimeServiceToken, {
       getRuntimeKernel: async () => this.classroomRuntime
@@ -31307,7 +31386,7 @@ function clearLessonRuntimeState(lessonId) {
 init_plugin_namespace();
 
 // server/classroom-events.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var CLASSROOM_EVENTS = {
   /** 全班锁屏 / 解锁 */
   CLASSROOM_LOCK_CHANGED: "classroom.lock_changed",
@@ -31327,7 +31406,7 @@ var CLASSROOM_EVENTS = {
   SEGMENT_GATE_OVERRIDE_REVOKED: "segment.gate_override_revoked"
 };
 function newEventId() {
-  return `evt_${(0, import_node_crypto10.randomBytes)(8).toString("hex")}`;
+  return `evt_${(0, import_node_crypto9.randomBytes)(8).toString("hex")}`;
 }
 async function publishClassroomEvent(type, payload, options = {}) {
   const event = {
@@ -33028,21 +33107,29 @@ function validateStartupEnv(env = process.env) {
   if (isProduction) {
     const adminPassword = trimmed(env, "OPENLEARN_ADMIN_PASSWORD");
     if (adminPassword && adminPassword.toLowerCase() === "admin") {
-      errors.push({
+      warnings.push({
         key: "OPENLEARN_ADMIN_PASSWORD",
-        severity: "error",
-        message: '\u751F\u4EA7\u73AF\u5883\u7981\u6B62\u628A OPENLEARN_ADMIN_PASSWORD \u8BBE\u4E3A\u7528\u6237\u540D "admin"\u3002\u8BF7\u8BBE\u7F6E\u5F3A\u53E3\u4EE4\u3002'
+        severity: "warning",
+        message: "OPENLEARN_ADMIN_PASSWORD \u4E0E\u7528\u6237\u540D\u76F8\u540C\u3002\u8FD9\u4E0D\u6BD4\u7559\u7A7A\u66F4\u5F31\uFF08\u7559\u7A7A\u65F6\u521D\u59CB\u53E3\u4EE4\u540C\u6837\u662F admin\uFF09\uFF0C\u4F46\u8BF7\u786E\u8BA4\u9996\u6B21\u767B\u5F55\u540E\u7ACB\u5373\u6539\u5BC6\uFF1B\u751F\u4EA7\u90E8\u7F72\u5EFA\u8BAE\u76F4\u63A5\u8BBE\u7F6E\u4E3A\u5F3A\u53E3\u4EE4\u3002"
       });
     }
     const teacherPassword = trimmed(env, "OPENLEARN_TEACHER_PASSWORD");
     if (teacherPassword && teacherPassword.toLowerCase() === "teacher") {
-      errors.push({
+      warnings.push({
         key: "OPENLEARN_TEACHER_PASSWORD",
-        severity: "error",
-        message: '\u751F\u4EA7\u73AF\u5883\u7981\u6B62\u628A OPENLEARN_TEACHER_PASSWORD \u8BBE\u4E3A\u7528\u6237\u540D "teacher"\u3002\u8BF7\u8BBE\u7F6E\u5F3A\u53E3\u4EE4\u3002'
+        severity: "warning",
+        message: "OPENLEARN_TEACHER_PASSWORD \u4E0E\u7528\u6237\u540D\u76F8\u540C\u3002\u8BF7\u786E\u8BA4\u9996\u6B21\u767B\u5F55\u540E\u7ACB\u5373\u6539\u5BC6\uFF0C\u751F\u4EA7\u90E8\u7F72\u5EFA\u8BAE\u8BBE\u7F6E\u4E3A\u5F3A\u53E3\u4EE4\u3002"
       });
     }
   }
+  const seedMode = trimmed(env, "OPENLEARN_SEED_PASSWORD_MODE");
+  if (seedMode && !["default", "random"].includes(seedMode.toLowerCase())) {
+    errors.push({
+      key: "OPENLEARN_SEED_PASSWORD_MODE",
+      severity: "error",
+      message: `\u53EA\u652F\u6301 "default"\uFF08\u53E3\u4EE4 = \u7528\u6237\u540D\uFF0C\u9996\u6B21\u767B\u5F55\u5F3A\u5236\u6539\u5BC6\uFF09\u6216 "random"\uFF08\u968F\u673A\u53E3\u4EE4\u5199\u5165 bootstrap-credentials.txt\uFF09\uFF0C\u6536\u5230 "${seedMode}"\u3002`
+    });
+  }
   const metricsToken = trimmed(env, "METRICS_TOKEN");
   if (metricsToken && metricsToken.length < 16) {
     warnings.push({
@@ -34163,9 +34250,9 @@ function isWhitelisted(route, whitelist) {
     (entry) => entry.method.toUpperCase() === route.method && normalizePath2(entry.path) === normalizePath2(route.path)
   );
 }
-function normalizePath2(path47) {
-  if (!path47) return "/";
-  return path47.endsWith("/") && path47.length > 1 ? path47.slice(0, -1) : path47;
+function normalizePath2(path48) {
+  if (!path48) return "/";
+  return path48.endsWith("/") && path48.length > 1 ? path48.slice(0, -1) : path48;
 }
 function auditRouteScopes(app, whitelist = []) {
   const declared = [];
@@ -34343,11 +34430,11 @@ function enforcePasswordChanged(req, res, next) {
   if (isPasswordChangeGateSkipped()) {
     return next();
   }
-  const path47 = req.path || "";
-  if (!path47.startsWith("/api/")) {
+  const path48 = req.path || "";
+  if (!path48.startsWith("/api/")) {
     return next();
   }
-  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path47)) {
+  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path48)) {
     return next();
   }
   const token = getCookieToken(req);
@@ -34422,8 +34509,8 @@ function csrfGuard(req, res, next) {
       next();
       return;
     }
-    const path48 = req.path;
-    if (EXEMPT_PREFIXES.some((p) => path48 === p || path48.startsWith(p))) {
+    const path49 = req.path;
+    if (EXEMPT_PREFIXES.some((p) => path49 === p || path49.startsWith(p))) {
       next();
       return;
     }
@@ -34433,10 +34520,10 @@ function csrfGuard(req, res, next) {
   const origin = req.headers.origin;
   const referer = req.headers.referer;
   const host = req.headers.host;
-  const path47 = req.path;
+  const path48 = req.path;
   if (typeof origin === "string" && origin !== "") {
     if (origin === "null") {
-      if (!EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
+      if (!EXEMPT_PREFIXES.some((p) => path48 === p || path48.startsWith(p))) {
         res.status(403).json({ success: false, code: "FORBIDDEN_CROSS_SITE", error: "Opaque origin write request blocked" });
         return;
       }
@@ -34444,7 +34531,7 @@ function csrfGuard(req, res, next) {
       try {
         const originHost = new URL(origin).host;
         if (host && originHost.toLowerCase() !== host.toLowerCase()) {
-          if (!EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
+          if (!EXEMPT_PREFIXES.some((p) => path48 === p || path48.startsWith(p))) {
             res.status(403).json({
               success: false,
               code: "FORBIDDEN_CROSS_SITE",
@@ -34462,7 +34549,7 @@ function csrfGuard(req, res, next) {
     try {
       const refererHost = new URL(referer).host;
       if (host && refererHost.toLowerCase() !== host.toLowerCase()) {
-        if (!EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
+        if (!EXEMPT_PREFIXES.some((p) => path48 === p || path48.startsWith(p))) {
           res.status(403).json({
             success: false,
             code: "FORBIDDEN_CROSS_SITE",
@@ -34480,7 +34567,7 @@ function csrfGuard(req, res, next) {
 }
 
 // packages/core/observability/error-reporter.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 init_logger();
 init_sanitize();
 var testSink2 = null;
@@ -34515,8 +34602,8 @@ function parseSentryDsn(dsn) {
     const projectId = url.pathname.split("/").filter(Boolean).pop();
     if (!projectId || !/^\d+$/.test(projectId)) return null;
     const prefix = url.pathname.split("/").filter(Boolean).slice(0, -1).join("/");
-    const path47 = prefix ? `/${prefix}` : "";
-    const envelopeUrl = `${url.protocol}//${url.host}${path47}/api/${projectId}/envelope/`;
+    const path48 = prefix ? `/${prefix}` : "";
+    const envelopeUrl = `${url.protocol}//${url.host}${path48}/api/${projectId}/envelope/`;
     return { envelopeUrl, publicKey };
   } catch {
     return null;
@@ -34526,7 +34613,7 @@ function buildSentryEnvelope(report, dsn) {
   const safe = sanitizeErrorReport(report);
   const parsed = parseSentryDsn(dsn);
   if (!parsed) return null;
-  const eventId = (0, import_node_crypto11.randomBytes)(16).toString("hex");
+  const eventId = (0, import_node_crypto10.randomBytes)(16).toString("hex");
   const header = JSON.stringify({ event_id: eventId, sent_at: (/* @__PURE__ */ new Date()).toISOString(), dsn });
   const item = JSON.stringify({ type: "event", content_type: "application/json" });
   const event = {
@@ -34631,7 +34718,7 @@ function sendSafeError(res, err, status = 500, fallbackMessage = "Internal serve
 }
 
 // server/middleware/request-observability.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 init_logger();
 init_request_context();
 init_audit_log();
@@ -34775,7 +34862,7 @@ function resolveHttpAccessLogLevel(status, durationMs, mode = resolveHttpAccessL
 }
 function resolveRequestId(header) {
   if (header && REQUEST_ID_RE.test(header)) return header;
-  return (0, import_node_crypto12.randomUUID)();
+  return (0, import_node_crypto11.randomUUID)();
 }
 function resolveRequestUserId(req) {
   const attached = req.session;
@@ -34962,9 +35049,9 @@ var import_node_path18 = __toESM(require("node:path"), 1);
 // packages/core/observability/health.ts
 var import_node_fs16 = __toESM(require("node:fs"), 1);
 var import_node_path17 = __toESM(require("node:path"), 1);
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 function probeStorageWritable(dir) {
-  const probe = import_node_path17.default.join(dir, `.ready-${process.pid}-${(0, import_node_crypto13.randomBytes)(4).toString("hex")}`);
+  const probe = import_node_path17.default.join(dir, `.ready-${process.pid}-${(0, import_node_crypto12.randomBytes)(4).toString("hex")}`);
   try {
     import_node_fs16.default.mkdirSync(dir, { recursive: true });
     import_node_fs16.default.writeFileSync(probe, "ok", { flag: "w" });
@@ -35242,7 +35329,7 @@ var import_zod2 = require("zod");
 // server/services/course-package-assets.ts
 var import_node_fs18 = __toESM(require("node:fs"), 1);
 var import_node_path19 = __toESM(require("node:path"), 1);
-var import_node_crypto14 = __toESM(require("node:crypto"), 1);
+var import_node_crypto13 = __toESM(require("node:crypto"), 1);
 var import_jszip3 = __toESM(require("jszip"), 1);
 var import_jspdf = require("jspdf");
 
@@ -35507,7 +35594,7 @@ async function materializePackageAssets(assets) {
       if (isTextAssetType(asset.contentType) && buffer.includes(0)) {
         throw new Error(`\u8BFE\u7A0B\u5305\u8D44\u4EA7 "${asset.id}" \u58F0\u660E\u4E3A ${asset.contentType} \u4F46\u5185\u5BB9\u662F\u4E8C\u8FDB\u5236`);
       }
-      const uniqueName = `${Date.now()}-${import_node_crypto14.default.randomBytes(4).toString("hex")}${ext}`;
+      const uniqueName = `${Date.now()}-${import_node_crypto13.default.randomBytes(4).toString("hex")}${ext}`;
       const filePath = import_node_path19.default.join(uploadsDir, uniqueName);
       import_node_fs18.default.writeFileSync(filePath, buffer);
       writtenPaths.push(filePath);
@@ -35537,7 +35624,7 @@ function resolveAssetPlaceholders(value, assets) {
     return value.replace(ASSET_PLACEHOLDER_PATTERN, (match, assetId) => {
       const asset = assets.get(assetId);
       if (!asset) {
-        throw new Error(`\u5143\u7D20\u6570\u636E\u5F15\u7528\u4E86\u4E0D\u5B58\u5728\u7684\u8BFE\u7A0B\u5305\u8D44\u4EA7\uFF1A${assetId}`);
+        throw new Error(`\u8BFE\u7A0B\u5185\u5BB9\u5F15\u7528\u4E86\u4E0D\u5B58\u5728\u7684\u8BFE\u7A0B\u5305\u8D44\u4EA7\uFF1A${assetId}`);
       }
       return asset.fileUrl;
     });
@@ -35659,6 +35746,28 @@ function parseCoursePackage(input) {
   }
   return { ok: true, package: parsed.data };
 }
+var KNOWN_ELEMENT_TYPES = /* @__PURE__ */ new Set([
+  "pen",
+  "highlighter",
+  "rectangle",
+  "circle",
+  "text",
+  "quiz",
+  "rollcall",
+  "timer",
+  "assignment",
+  "hello-world",
+  "html-applet",
+  "code-sandbox",
+  "math-graph",
+  "presentation",
+  "plugin",
+  "page_meta"
+]);
+function isSupportedElementType(type) {
+  if (KNOWN_ELEMENT_TYPES.has(type)) return true;
+  return typeof type === "string" && (type.includes("/") || type.startsWith("plugin:") || type.startsWith("ext-") || type.startsWith("plugin-"));
+}
 var SEG = {
   intro: "seg-intro",
   lecture: "seg-lecture",
@@ -38966,6 +39075,71 @@ function registerResourcesRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
+  const actionRegistry = kernelContainer.actionRegistry;
+  const resourceIdProp = { id: { type: "STRING", description: "\u8D44\u6E90 ID\uFF08res_ \u524D\u7F00\uFF09" } };
+  try {
+    actionRegistry.register({
+      id: "core-resource-list",
+      commandType: "resource.list",
+      description: "\u5217\u51FA\u5168\u90E8\u7CFB\u7EDF\u516C\u5171\u6559\u5B66\u8D44\u6E90\uFF08\u6309\u521B\u5EFA\u65F6\u95F4\u5012\u5E8F\uFF0C\u4E0D\u542B\u6B63\u6587\uFF09",
+      capabilityRequired: "management:read",
+      // 无参命令沿用仓库既有写法（同 courseware.list / courseware.list_score_configs）：
+      // schema 声明为 OBJECT，payload 必须是对象 —— 调用方传 `{}`，不要省略 payload，
+      // 否则 validateJsonSchema 会以 "Expected object, got undefined" 拒绝。
+      inputSchema: { type: "OBJECT", properties: {} }
+    });
+  } catch {
+  }
+  try {
+    actionRegistry.register({
+      id: "core-resource-get",
+      commandType: "resource.get",
+      description: "\u6309 ID \u8BFB\u53D6\u5355\u4E2A\u6559\u5B66\u8D44\u6E90\u7684\u5B8C\u6574\u8BB0\u5F55\uFF08\u542B content \u6B63\u6587\uFF09",
+      capabilityRequired: "management:read",
+      inputSchema: {
+        type: "OBJECT",
+        properties: { ...resourceIdProp },
+        required: ["id"]
+      }
+    });
+  } catch {
+  }
+  try {
+    actionRegistry.register({
+      id: "core-resource-create",
+      commandType: "resource.create",
+      description: "\u521B\u5EFA\u6559\u5B66\u8D44\u6E90\u3002type=html \u65F6 content \u4E3A\u5B8C\u6574 HTML \u6587\u672C\uFF1Btype=folder \u65F6 content \u4E3A [{path, content}] \u6587\u4EF6\u6570\u7EC4\u7684 JSON \u5B57\u7B26\u4E32\u3002HTML \u4E2D\u82E5\u542B\u6210\u7EE9\u5C55\u793A\u4F46\u7F3A\u63D0\u4EA4\u57CB\u70B9\uFF0C\u5E73\u53F0\u4F1A\u81EA\u52A8\u6D3E\u751F\u300C[\u81EA\u52A8\u63D0\u4EA4\u7248]\u300D\u3002",
+      capabilityRequired: "management:write",
+      inputSchema: {
+        type: "OBJECT",
+        properties: {
+          name: { type: "STRING", description: "\u8D44\u6E90\u540D\u79F0\uFF1Btype=html \u65F6\u5EFA\u8BAE\u4EE5 .html \u7ED3\u5C3E" },
+          type: { type: "STRING", description: "\u8D44\u6E90\u7C7B\u578B\uFF1A'html' \u6216 'folder'" },
+          content: {
+            type: "STRING",
+            description: "html \u4E3A HTML \u6587\u672C\uFF1Bfolder \u4E3A [{path, content}] \u7684 JSON \u5B57\u7B26\u4E32"
+          }
+        },
+        required: ["name", "type", "content"]
+      }
+    });
+  } catch {
+  }
+  try {
+    actionRegistry.register({
+      id: "core-resource-delete",
+      commandType: "resource.delete",
+      description: "\u6309 ID \u5220\u9664\u6559\u5B66\u8D44\u6E90\uFF08\u542B system_resources \u884C\u4E0E\u78C1\u76D8\u7F13\u5B58\uFF09\u3002\u6B64\u4E3A\u9AD8\u98CE\u9669\u64CD\u4F5C\u3002",
+      capabilityRequired: "management:write",
+      isHighRisk: true,
+      inputSchema: {
+        type: "OBJECT",
+        properties: { ...resourceIdProp },
+        required: ["id"]
+      }
+    });
+  } catch {
+  }
   const RESOURCE_HANDLERS = {
     "resource.list": {
       execute: async () => {
@@ -42612,7 +42786,7 @@ var import_node_path20 = __toESM(require("node:path"), 1);
 var import_uuid18 = require("uuid");
 
 // server/services/course-package-identity.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 function stableStringify(value) {
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value ?? null) ?? "null";
@@ -42651,7 +42825,7 @@ function canonicalContent(pkg) {
   };
 }
 function computeCoursePackageHash(pkg) {
-  return (0, import_node_crypto15.createHash)("sha256").update(stableStringify(canonicalContent(pkg))).digest("hex");
+  return (0, import_node_crypto14.createHash)("sha256").update(stableStringify(canonicalContent(pkg))).digest("hex");
 }
 function resolveCoursePackageIdentity(pkg) {
   const hash = computeCoursePackageHash(pkg);
@@ -42688,24 +42862,6 @@ var CoursePackageDuplicateError = class extends Error {
     this.hasDeclaredId = params.hasDeclaredId;
   }
 };
-var KNOWN_ELEMENT_TYPES = /* @__PURE__ */ new Set([
-  "pen",
-  "highlighter",
-  "rectangle",
-  "circle",
-  "text",
-  "quiz",
-  "rollcall",
-  "timer",
-  "assignment",
-  "hello-world",
-  "html-applet",
-  "code-sandbox",
-  "math-graph",
-  "presentation",
-  "plugin",
-  "page_meta"
-]);
 async function importCoursePackage(pkg, options) {
   const db2 = options.db ?? kernelContainer.db;
   const creatorId = options.creatorId || "teacher";
@@ -42747,8 +42903,7 @@ async function importCoursePackage(pkg, options) {
   let elements = [];
   try {
     elements = pkg.elements.map((element) => {
-      const isAllowed = KNOWN_ELEMENT_TYPES.has(element.type) || typeof element.type === "string" && (element.type.includes("/") || element.type.startsWith("plugin:") || element.type.startsWith("ext-") || element.type.startsWith("plugin-"));
-      if (!isAllowed) {
+      if (!isSupportedElementType(element.type)) {
         throw new Error(`\u8BFE\u7A0B\u5305\u5305\u542B\u4E0D\u652F\u6301\u7684\u767D\u677F\u5143\u7D20\u7C7B\u578B\uFF1A${element.type}`);
       }
       const data = resolveAssetPlaceholders(element.data, materialized);
@@ -42770,6 +42925,7 @@ async function importCoursePackage(pkg, options) {
       if (data.page === void 0 && data.pageId === void 0) data.page = 0;
       return { type: element.type, data: JSON.stringify(data) };
     });
+    const lessonContent = resolveAssetPlaceholders(pkg.lesson.content ?? "", materialized);
     const write = db2.transaction(() => {
       const inTxDuplicate = findExistingImport(db2, creatorId, identity);
       if (inTxDuplicate && !allowDuplicate) {
@@ -42784,7 +42940,7 @@ async function importCoursePackage(pkg, options) {
       insertLesson.run(
         lessonId,
         pkg.lesson.title,
-        pkg.lesson.content ?? "",
+        lessonContent,
         JSON.stringify(timeline),
         pkg.lesson.progressMode ?? "manual",
         creatorId,
@@ -42896,6 +43052,307 @@ function cleanupMaterializedAssets(materialized) {
   }
 }
 
+// server/services/course-package-export.ts
+var import_node_fs21 = __toESM(require("node:fs"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
+var import_node_crypto15 = require("node:crypto");
+var CoursePackageExportError = class extends Error {
+  constructor(message, status = 500, code = "COURSE_PACKAGE_EXPORT_FAILED") {
+    super(message);
+    this.name = "CoursePackageExportError";
+    this.status = status;
+    this.code = code;
+  }
+};
+var UPLOAD_URL_PATTERN = /(?:https?:\/\/[A-Za-z0-9.:[\]_-]+)?\/uploads\/([A-Za-z0-9][A-Za-z0-9._-]*)/g;
+var EXT_TO_ASSET_TYPE = {
+  ".pdf": "pdf",
+  ".pptx": "pptx",
+  ".docx": "docx",
+  ".xlsx": "xlsx",
+  ".zip": "zip",
+  ".png": "png",
+  ".jpg": "jpg",
+  ".jpeg": "jpg",
+  ".md": "md",
+  ".txt": "txt",
+  ".csv": "csv"
+};
+async function exportLessonAsCoursePackage(lessonId, options = {}) {
+  const db2 = options.db ?? kernelContainer.db;
+  const lesson = db2.prepare(
+    "SELECT id, title, content, timeline, progress_mode, creator_id, source_package_id FROM lessons WHERE id = ?"
+  ).get(lessonId);
+  if (!lesson) {
+    throw new CoursePackageExportError("\u8BFE\u7A0B\u4E0D\u5B58\u5728\u6216\u5DF2\u88AB\u5220\u9664", 404, "LESSON_NOT_FOUND");
+  }
+  const elementRows = db2.prepare(
+    "SELECT type, data FROM whiteboard_elements WHERE lesson_id = ? AND type != 'snapshot_marker' ORDER BY created_at ASC, rowid ASC"
+  ).all(lessonId);
+  const rawTimeline = safeJsonParse(lesson.timeline);
+  const { timeline, idRemap } = normalizeTimeline(rawTimeline);
+  const stats = { assets: 0, skipped: [], skippedElements: 0 };
+  const elements = [];
+  const preferredFilenames = /* @__PURE__ */ new Map();
+  for (const row of elementRows) {
+    if (!isSupportedElementType(row.type)) {
+      stats.skippedElements += 1;
+      continue;
+    }
+    const data = safeJsonParse(row.data);
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+      stats.skippedElements += 1;
+      continue;
+    }
+    const elementData = data;
+    collectPreferredFilenames(elementData, preferredFilenames);
+    elements.push({
+      type: row.type,
+      ...liftElementGeometry(elementData),
+      data: elementData
+    });
+  }
+  const referenced = /* @__PURE__ */ new Set();
+  collectUploadReferences(lesson.content ?? "", referenced);
+  for (const element of elements) collectUploadReferences(element.data, referenced);
+  const pending = [];
+  const placeholderByStoredName = /* @__PURE__ */ new Map();
+  let totalBytes = 0;
+  const usedIds = /* @__PURE__ */ new Set();
+  for (const storedName of referenced) {
+    const ext = import_node_path21.default.extname(storedName).toLowerCase();
+    const contentType = EXT_TO_ASSET_TYPE[ext];
+    if (!contentType || !PACKAGE_ASSET_TYPES.includes(contentType)) {
+      stats.skipped.push({ url: `/uploads/${storedName}`, reason: `\u4E0D\u652F\u6301\u7684\u6587\u4EF6\u7C7B\u578B\uFF1A${ext || "(\u65E0\u6269\u5C55\u540D)"}` });
+      continue;
+    }
+    const filePath = resolveUploadsPath(storedName);
+    if (!filePath) {
+      stats.skipped.push({ url: `/uploads/${storedName}`, reason: "\u6587\u4EF6\u4E0D\u5B58\u5728" });
+      continue;
+    }
+    let buffer;
+    try {
+      buffer = import_node_fs21.default.readFileSync(filePath);
+    } catch (err) {
+      stats.skipped.push({ url: `/uploads/${storedName}`, reason: `\u8BFB\u53D6\u5931\u8D25\uFF1A${err.message}` });
+      continue;
+    }
+    if (buffer.length === 0) {
+      stats.skipped.push({ url: `/uploads/${storedName}`, reason: "\u6587\u4EF6\u4E3A\u7A7A" });
+      continue;
+    }
+    if (!isTextAssetType(contentType) && !validateMagicBytes(buffer, `asset.${contentType}`)) {
+      stats.skipped.push({ url: `/uploads/${storedName}`, reason: "\u6587\u4EF6\u7B7E\u540D\u4E0E\u6269\u5C55\u540D\u4E0D\u7B26" });
+      continue;
+    }
+    if (isTextAssetType(contentType) && buffer.includes(0)) {
+      stats.skipped.push({ url: `/uploads/${storedName}`, reason: "\u6587\u672C\u6587\u4EF6\u5305\u542B\u4E8C\u8FDB\u5236\u5185\u5BB9" });
+      continue;
+    }
+    totalBytes += buffer.length;
+    if (totalBytes > COURSE_PACKAGE_MAX_FILE_BYTES) {
+      throw new CoursePackageExportError(
+        `\u8BFE\u7A0B\u5F15\u7528\u7684\u9644\u4EF6\u5408\u8BA1\u8D85\u8FC7 ${COURSE_PACKAGE_MAX_FILE_BYTES / (1024 * 1024)}MB\uFF0C\u5BFC\u51FA\u540E\u65E0\u6CD5\u518D\u88AB\u5BFC\u5165\u3002\u8BF7\u7CBE\u7B80\u6559\u6848\u4E2D\u7684\u5927\u6587\u4EF6\u540E\u91CD\u8BD5\u3002`,
+        413,
+        "COURSE_PACKAGE_EXPORT_TOO_LARGE"
+      );
+    }
+    const assetId = buildAssetId(storedName, usedIds);
+    pending.push({
+      id: assetId,
+      filename: preferredFilenames.get(storedName) || storedName,
+      contentType,
+      buffer,
+      storedName
+    });
+    placeholderByStoredName.set(storedName, `\${asset:${assetId}}`);
+  }
+  const content = replaceUploadReferences(lesson.content ?? "", placeholderByStoredName);
+  const validSegmentIds = new Set(timeline.map((segment) => segment.id));
+  const resolvedElements = elements.map((element) => {
+    const { segmentId: rawSegmentId, ...rest } = element;
+    const segmentId = rawSegmentId ? idRemap.get(rawSegmentId) ?? rawSegmentId : void 0;
+    return {
+      ...rest,
+      ...segmentId && validSegmentIds.has(segmentId) ? { segmentId } : {},
+      data: replaceUploadReferences(element.data, placeholderByStoredName)
+    };
+  });
+  const assets = pending.map((asset) => ({
+    id: asset.id,
+    filename: asset.filename,
+    contentType: asset.contentType,
+    base64: asset.buffer.toString("base64")
+  }));
+  stats.assets = assets.length;
+  const pkg = {
+    format: COURSE_PACKAGE_FORMAT,
+    version: COURSE_PACKAGE_VERSION,
+    meta: {
+      // 从课程包导入来的课程沿用原包身份；自行创建的课程用 lesson id ——
+      // 改了标题再导出，身份不变（导入端去重仍然认得「同一个包」）。
+      id: lesson.source_package_id || lesson.id,
+      name: lesson.title,
+      description: `\u7531 OpenLearn \u8BFE\u7A0B\u300C${lesson.title}\u300D\u5BFC\u51FA\uFF1A\u5305\u542B\u6559\u5B66\u73AF\u8282\u3001\u767D\u677F\u5143\u7D20\u4E0E ${assets.length} \u4E2A\u5185\u8054\u9644\u4EF6\u3002`,
+      author: lesson.creator_id ?? "",
+      tags: ["\u5BFC\u51FA", "\u8BFE\u7A0B\u5305"]
+    },
+    lesson: {
+      title: lesson.title,
+      content,
+      progressMode: lesson.progress_mode || "manual",
+      timeline
+    },
+    assets,
+    elements: resolvedElements
+  };
+  const parsed = parseCoursePackage(pkg);
+  if (!parsed.ok) {
+    throw new CoursePackageExportError(`\u5BFC\u51FA\u7684\u8BFE\u7A0B\u5305\u672A\u901A\u8FC7\u7ED3\u6784\u6821\u9A8C\uFF1A${parsed.error}`, 500, "EXPORT_INVALID_PACKAGE");
+  }
+  return { package: parsed.package, stats };
+}
+function buildExportFilename(title) {
+  const safe = Array.from(title).filter((ch) => {
+    const code = ch.charCodeAt(0);
+    return code >= 32 && code !== 127;
+  }).join("").replace(/[\\/:*?"<>|]/g, "_").replace(/\s+/g, " ").trim().slice(0, 80);
+  return `${safe || "course"}.openlearn-package.json`;
+}
+function collectUploadReferences(value, out) {
+  if (typeof value === "string") {
+    for (const match of value.matchAll(UPLOAD_URL_PATTERN)) {
+      out.add(match[1]);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectUploadReferences(item, out);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const item of Object.values(value)) collectUploadReferences(item, out);
+  }
+}
+function replaceUploadReferences(value, placeholders) {
+  if (typeof value === "string") {
+    return value.replace(UPLOAD_URL_PATTERN, (match, storedName) => placeholders.get(storedName) ?? match);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => replaceUploadReferences(item, placeholders));
+  }
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = replaceUploadReferences(item, placeholders);
+    }
+    return out;
+  }
+  return value;
+}
+function collectPreferredFilenames(value, out) {
+  if (!value || typeof value !== "object") return;
+  if (Array.isArray(value)) {
+    for (const item of value) collectPreferredFilenames(item, out);
+    return;
+  }
+  const obj = value;
+  if (typeof obj.fileUrl === "string" && typeof obj.fileName === "string" && obj.fileName.trim()) {
+    for (const match of obj.fileUrl.matchAll(UPLOAD_URL_PATTERN)) {
+      if (!out.has(match[1])) out.set(match[1], obj.fileName.trim());
+    }
+  }
+  for (const item of Object.values(obj)) collectPreferredFilenames(item, out);
+}
+function liftElementGeometry(data) {
+  const lifted = {};
+  const take = (key) => {
+    const value = data[key];
+    delete data[key];
+    return value;
+  };
+  const segmentId = take("segmentId");
+  if (typeof segmentId === "string" && segmentId) lifted.segmentId = segmentId;
+  const page = take("page");
+  if (typeof page === "number" && Number.isInteger(page) && page >= 0) lifted.page = page;
+  const pageId = take("pageId");
+  if (typeof pageId === "string" && pageId) lifted.pageId = pageId;
+  const x = take("x");
+  if (typeof x === "number" && Number.isFinite(x)) lifted.x = x;
+  const y = take("y");
+  if (typeof y === "number" && Number.isFinite(y)) lifted.y = y;
+  const width = take("width");
+  if (typeof width === "number" && width > 0) lifted.width = width;
+  const height = take("height");
+  if (typeof height === "number" && height > 0) lifted.height = height;
+  return lifted;
+}
+function normalizeTimeline(raw) {
+  const idRemap = /* @__PURE__ */ new Map();
+  if (!Array.isArray(raw)) return { timeline: [], idRemap };
+  const timeline = [];
+  const seen = /* @__PURE__ */ new Set();
+  raw.forEach((item, index) => {
+    if (!item || typeof item !== "object") return;
+    const source = item;
+    const originalId = typeof source.id === "string" && source.id.trim() ? source.id.trim() : "";
+    let id = originalId || `seg-${index + 1}`;
+    if (seen.has(id)) {
+      let suffix = 2;
+      while (seen.has(`${id}-${suffix}`)) suffix += 1;
+      id = `${id}-${suffix}`;
+    }
+    if (originalId && originalId !== id) idRemap.set(originalId, id);
+    seen.add(id);
+    const title = typeof source.title === "string" && source.title.trim() ? source.title.trim() : `\u73AF\u8282 ${index + 1}`;
+    const type = typeof source.type === "string" && source.type.trim() ? source.type.trim() : "lecture";
+    const segment = { id, title, type };
+    if (typeof source.duration === "string" && source.duration.trim()) segment.duration = source.duration.trim();
+    if (typeof source.notes === "string") segment.notes = source.notes;
+    if (typeof source.color === "string" && source.color.trim()) segment.color = source.color.trim();
+    if (Array.isArray(source.gates)) {
+      const gates = source.gates.filter(
+        (gate) => Boolean(gate) && typeof gate === "object" && typeof gate.type === "string"
+      );
+      if (gates.length > 0) segment.gates = gates;
+    }
+    timeline.push(segment);
+  });
+  return { timeline, idRemap };
+}
+function resolveUploadsPath(storedName) {
+  const uploadsDir = import_node_path21.default.resolve(getUploadsDir());
+  if (import_node_path21.default.basename(storedName) !== storedName) return null;
+  const target = import_node_path21.default.resolve(uploadsDir, storedName);
+  if (import_node_path21.default.dirname(target) !== uploadsDir) return null;
+  try {
+    const stat = import_node_fs21.default.statSync(target);
+    return stat.isFile() ? target : null;
+  } catch {
+    return null;
+  }
+}
+function buildAssetId(storedName, used) {
+  const digest2 = (0, import_node_crypto15.createHash)("sha1").update(storedName).digest("hex").slice(0, 12);
+  let id = `asset-${digest2}`;
+  let suffix = 2;
+  while (used.has(id)) {
+    id = `asset-${digest2}-${suffix}`;
+    suffix += 1;
+  }
+  used.add(id);
+  return id;
+}
+function safeJsonParse(raw) {
+  if (typeof raw !== "string" || !raw.trim()) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
 // server/routes/course-packages.ts
 var TEMPLATE_FILENAME = "openlearn-course-template.json";
 var MAX_DECODED_ASSET_BYTES = COURSE_PACKAGE_MAX_FILE_BYTES;
@@ -42955,6 +43412,32 @@ function registerCoursePackageRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
+  app.get("/api/lessons/:id/export-package", requireAuth("teacher", "administrator"), async (req, res) => {
+    try {
+      const { id } = req.params;
+      const ownership = checkLessonOwnership(req, id);
+      if (!ownership.allowed) {
+        return res.status(ownership.status).json({ success: false, error: ownership.error });
+      }
+      const { package: pkg, stats } = await exportLessonAsCoursePackage(id);
+      const filename = buildExportFilename(pkg.lesson.title);
+      res.setHeader("Content-Type", "application/json; charset=utf-8");
+      res.setHeader(
+        "Content-Disposition",
+        `attachment; filename="course-package.json"; filename*=UTF-8''${encodeURIComponent(filename)}`
+      );
+      res.setHeader("X-Course-Package-Filename", encodeURIComponent(filename));
+      res.setHeader("X-Course-Package-Assets", String(stats.assets));
+      res.setHeader("X-Course-Package-Skipped", String(stats.skipped.length + stats.skippedElements));
+      res.send(JSON.stringify(pkg, null, 2));
+    } catch (e) {
+      if (e instanceof CoursePackageExportError) {
+        return res.status(e.status).json({ success: false, code: e.code, error: e.message });
+      }
+      console.error("[CoursePackage] \u5BFC\u51FA\u5931\u8D25:", e);
+      sendSafeError(res, e);
+    }
+  });
 }
 
 // server/routes/workspace.ts
@@ -44991,6 +45474,26 @@ function resolveWritableStudentId(session, rawId) {
   if (isTeacher(session) && teacherCanSeeStudent(kernelContainer.getReadDb(), session, studentId)) return studentId;
   return null;
 }
+var SEED_STATUS_TTL_MS = 15e3;
+var seedStatusCache = null;
+function readSeedDefaultStatus() {
+  const now = Date.now();
+  if (seedStatusCache && seedStatusCache.expiresAt > now) return seedStatusCache.payload;
+  const accounts = [];
+  try {
+    const rows = kernelContainer.db.prepare("SELECT username, password_hash FROM users WHERE username IN (?, ?)").all("admin", "teacher");
+    for (const row of rows) {
+      if (verifyPassword(row.username, row.password_hash).valid) accounts.push(row.username);
+    }
+  } catch {
+  }
+  const payload = { active: accounts.length > 0, accounts };
+  seedStatusCache = { payload, expiresAt: now + SEED_STATUS_TTL_MS };
+  return payload;
+}
+function invalidateSeedStatusCache() {
+  seedStatusCache = null;
+}
 function registerRosterRoutes(ctx) {
   const { app, io, loginLimiter } = ctx;
   const rosterService = new RosterService(kernelContainer.db, kernelContainer.getReadDb());
@@ -45272,6 +45775,7 @@ function registerRosterRoutes(ctx) {
           return res.status(400).json({ error: "New password must be different from the username" });
         }
         kernelContainer.db.prepare("UPDATE users SET password_hash = ?, must_change_password = 0 WHERE id = ?").run(hashPassword(newPassword), session.userId);
+        invalidateSeedStatusCache();
         kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id != ? AND session_data LIKE ?").run(token, `%${session.userId}%`);
         try {
           const updatedSession = { ...session, mustChangePassword: false };
@@ -45439,6 +45943,13 @@ function registerRosterRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
+  app.get("/api/auth/seed-status", (_req, res) => {
+    try {
+      res.json(readSeedDefaultStatus());
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
   app.post("/api/auth/login", loginLimiter, (req, res) => {
     try {
       const { entrance, username, password, studentId } = req.body;
@@ -46457,6 +46968,98 @@ function parseAllowedExt(raw) {
   return set.size > 0 ? set : null;
 }
 
+// packages/core/db/assignment-resubmit.ts
+var import_node_crypto16 = __toESM(require("node:crypto"), 1);
+var RESUBMIT_CONTENT_REPLACED_REASON = "resubmit-content-replaced";
+function keepStatus(current) {
+  return current === "graded" || current === "absent" ? current : "submitted";
+}
+function writeContentReplacementHistory(db2, input) {
+  const historyId = `agh-${import_node_crypto16.default.randomUUID()}`;
+  try {
+    db2.prepare(
+      `INSERT INTO assignment_grade_history
+         (id, assignment_id, student_id, old_score, new_score, old_status, new_status,
+          old_source, new_source, actor_id, actor_role, reason, created_at, old_content)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      historyId,
+      input.assignmentId,
+      input.studentId,
+      input.score,
+      input.score,
+      input.status,
+      input.status,
+      input.source,
+      input.source,
+      input.actorId ?? null,
+      input.actorRole ?? null,
+      RESUBMIT_CONTENT_REPLACED_REASON,
+      input.now,
+      input.oldContent
+    );
+    return historyId;
+  } catch (err) {
+    console.warn("[assignment.resubmit] \u5185\u5BB9\u66FF\u6362\u7559\u75D5\u5931\u8D25:", err.message);
+    return void 0;
+  }
+}
+function applyResubmission(db2, input) {
+  const assignmentId = String(input.assignmentId ?? "").trim();
+  const studentId = String(input.studentId ?? "").trim();
+  if (!assignmentId || !studentId) {
+    return { ok: false, contentReplaced: false };
+  }
+  const now = input.now ?? Date.now();
+  const content = input.content ?? "";
+  let result = { ok: false, contentReplaced: false };
+  const write = () => {
+    const existing = db2.prepare(
+      `SELECT content, score, feedback, status, source, academic_year
+         FROM assignment_submissions
+         WHERE assignment_id = ? AND student_id = ?
+         LIMIT 1`
+    ).get(assignmentId, studentId);
+    if (!existing) {
+      db2.prepare(
+        `INSERT INTO assignment_submissions
+           (assignment_id, student_id, content, score, feedback, submitted_at, status)
+         VALUES (?, ?, ?, NULL, NULL, ?, 'submitted')`
+      ).run(assignmentId, studentId, content, now);
+      result = { ok: true, contentReplaced: false, status: "submitted" };
+      return;
+    }
+    const nextStatus = keepStatus(existing.status);
+    const contentChanged = (existing.content ?? "") !== content;
+    const gradedRow = existing.status === "graded" || existing.status === "absent";
+    const contentReplaced = gradedRow && contentChanged;
+    let historyId;
+    if (contentReplaced) {
+      historyId = writeContentReplacementHistory(db2, {
+        assignmentId,
+        studentId,
+        oldContent: existing.content,
+        score: existing.score,
+        status: existing.status,
+        source: existing.source,
+        actorId: input.actorId ?? null,
+        actorRole: input.actorRole ?? null,
+        now
+      });
+    }
+    db2.prepare(
+      `UPDATE assignment_submissions
+         SET content = ?, submitted_at = ?, status = ?
+       WHERE assignment_id = ? AND student_id = ?`
+    ).run(content, now, nextStatus, assignmentId, studentId);
+    result = { ok: true, contentReplaced, historyId, status: nextStatus };
+  };
+  const tx = typeof db2.transaction === "function" ? db2.transaction(write) : null;
+  if (typeof tx === "function") tx();
+  else write();
+  return result;
+}
+
 // server/services/assignment-service.ts
 function safeSegment(value) {
   const cleaned = String(value || "").replace(/[^A-Za-z0-9._-]/g, "");
@@ -47174,8 +47777,22 @@ function registerAssignmentHubRoutes(ctx) {
     const row = kernelContainer.db.prepare("SELECT class_id FROM plugin_assignments WHERE id = ?").get(assignmentId);
     return row?.class_id;
   };
+  const requireAssignmentCommand = (res, ...types) => {
+    for (const type of types) {
+      if (!kernelContainer.commandBus.hasHandler(type)) {
+        res.status(503).json({
+          success: false,
+          code: "ASSIGNMENT_SERVICE_UNAVAILABLE",
+          error: "Assignment service is unavailable: the assignment-eval plugin is not active."
+        });
+        return true;
+      }
+    }
+    return false;
+  };
   app.post("/api/assignments", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
+      if (requireAssignmentCommand(res, "assignment.create")) return;
       const classId = (req.body || {}).classId || (req.body || {}).class_id;
       if (classId && rejectUnlessHubClass(req, res, String(classId), "staff")) return;
       const cmd = kernelContainer.commandBus.createCommand("assignment.create", req.body || {}, getActorId(req));
@@ -47187,6 +47804,7 @@ function registerAssignmentHubRoutes(ctx) {
   });
   app.get("/api/assignments", requireScopedAuth("class-member"), async (req, res) => {
     try {
+      if (requireAssignmentCommand(res, "assignment.list")) return;
       const payload = {
         lessonId: req.query.lessonId,
         classId: req.query.classId,
@@ -47217,6 +47835,7 @@ function registerAssignmentHubRoutes(ctx) {
   });
   app.get("/api/assignments/:assignmentId", requireScopedAuth("class-member"), async (req, res) => {
     try {
+      if (requireAssignmentCommand(res, "assignment.get")) return;
       const { isPrivileged: isPrivileged2, studentId } = describeRequester(req);
       const payload = { assignmentId: req.params.assignmentId };
       const requestedStudent = typeof req.query.studentId === "string" ? req.query.studentId : void 0;
@@ -47334,6 +47953,7 @@ function registerAssignmentHubRoutes(ctx) {
   });
   app.post("/api/assignments/:assignmentId/submit", requireScopedAuth("class-member"), async (req, res) => {
     try {
+      if (requireAssignmentCommand(res, "assignment.submit")) return;
       const { isPrivileged: isPrivileged2, studentId } = describeRequester(req);
       const body = req.body || {};
       const targetStudentId = isPrivileged2 ? String(body.studentId || "") : String(studentId || "");
@@ -47362,6 +47982,7 @@ function registerAssignmentHubRoutes(ctx) {
   });
   app.post("/api/assignments/:assignmentId/peer-review", requireScopedAuth("class-member"), async (req, res) => {
     try {
+      if (requireAssignmentCommand(res, "assignment.peer_review")) return;
       const { isPrivileged: isPrivileged2, studentId } = describeRequester(req);
       const body = req.body || {};
       const reviewerId = isPrivileged2 ? String(body.reviewerId || body.studentId || "") : String(studentId || "");
@@ -47397,6 +48018,7 @@ function registerAssignmentHubRoutes(ctx) {
     requireAuth("teacher", "administrator"),
     async (req, res) => {
       try {
+        if (requireAssignmentCommand(res, "assignment.assign_peer_reviews")) return;
         if (rejectUnlessHubClass(req, res, hubAssignmentClassId(req.params.assignmentId), "staff")) return;
         const body = req.body || {};
         const cmd = kernelContainer.commandBus.createCommand(
@@ -48899,7 +49521,7 @@ function registerGradingRoutes(ctx) {
 }
 
 // server/routes/plugins.ts
-var import_node_crypto17 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 init_types();
 init_install_utils();
 var import_path22 = __toESM(require("path"), 1);
@@ -49081,7 +49703,7 @@ async function checkVersion(source, installedVersion) {
 init_audit_log();
 
 // server/routes/plugin-api-gateway.ts
-var import_node_path21 = __toESM(require("node:path"), 1);
+var import_node_path22 = __toESM(require("node:path"), 1);
 init_http_router();
 init_interfaces();
 var RESERVED_ACTIONS = /* @__PURE__ */ new Set([
@@ -49255,7 +49877,7 @@ async function pluginApiGatewayMiddleware(req, res, next) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
   }
-  const normalizedSubPath = import_node_path21.default.posix.normalize("/" + rawSubPath);
+  const normalizedSubPath = import_node_path22.default.posix.normalize("/" + rawSubPath);
   if (normalizedSubPath.includes("..")) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
@@ -49692,10 +50314,10 @@ init_fetch_with_retry();
 
 // server/services/community-registry.ts
 var import_semver7 = __toESM(require("semver"), 1);
-var import_node_fs21 = __toESM(require("node:fs"), 1);
-var import_node_path22 = __toESM(require("node:path"), 1);
+var import_node_fs22 = __toESM(require("node:fs"), 1);
+var import_node_path23 = __toESM(require("node:path"), 1);
 var import_node_os3 = __toESM(require("node:os"), 1);
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var COMMUNITY_REGISTRY_ENV = "PLUGIN_COMMUNITY_REGISTRY_URL";
 var REGISTRY_FETCH_TIMEOUT_MS = 1e4;
 var PACKAGE_FETCH_TIMEOUT_MS = 6e4;
@@ -49915,8 +50537,8 @@ async function downloadPluginPackage(downloadUrl, options = {}) {
   if (!response.body) {
     throw new Error("\u4E0B\u8F7D\u63D2\u4EF6\u5305\u5931\u8D25: \u54CD\u5E94\u4F53\u4E3A\u7A7A");
   }
-  const zipPath = import_node_path22.default.join(import_node_os3.default.tmpdir(), `plugin-download-${(0, import_node_crypto16.randomUUID)()}.zip`);
-  const out = import_node_fs21.default.createWriteStream(zipPath);
+  const zipPath = import_node_path23.default.join(import_node_os3.default.tmpdir(), `plugin-download-${(0, import_node_crypto17.randomUUID)()}.zip`);
+  const out = import_node_fs22.default.createWriteStream(zipPath);
   let received = 0;
   try {
     for await (const chunk of response.body) {
@@ -49938,13 +50560,13 @@ async function downloadPluginPackage(downloadUrl, options = {}) {
   } catch (err) {
     out.destroy();
     try {
-      import_node_fs21.default.rmSync(zipPath, { force: true });
+      import_node_fs22.default.rmSync(zipPath, { force: true });
     } catch {
     }
     throw err;
   }
   if (received === 0) {
-    import_node_fs21.default.rmSync(zipPath, { force: true });
+    import_node_fs22.default.rmSync(zipPath, { force: true });
     throw new Error("\u63D2\u4EF6\u5305\u4E3A\u7A7A");
   }
   return { zipPath, filename: resolveFilename(response, downloadUrl), bytes: received };
@@ -50175,7 +50797,7 @@ function discardWriteStream(out, zipPath) {
 }
 function streamBodyToTempZip(req, res, maxBytes) {
   return new Promise((resolve2, reject) => {
-    const zipPath = import_path22.default.join(import_os2.default.tmpdir(), `plugin-upload-${(0, import_node_crypto17.randomUUID)()}.zip`);
+    const zipPath = import_path22.default.join(import_os2.default.tmpdir(), `plugin-upload-${(0, import_node_crypto18.randomUUID)()}.zip`);
     const out = import_fs19.default.createWriteStream(zipPath);
     let received = 0;
     let settled = false;
@@ -50230,7 +50852,7 @@ async function streamHttpBodyToFile(resp, maxBytes) {
   if (!resp.body) {
     throw new Error("\u54CD\u5E94\u4F53\u4E3A\u7A7A");
   }
-  const zipPath = import_path22.default.join(import_os2.default.tmpdir(), `plugin-download-${(0, import_node_crypto17.randomUUID)()}.zip`);
+  const zipPath = import_path22.default.join(import_os2.default.tmpdir(), `plugin-download-${(0, import_node_crypto18.randomUUID)()}.zip`);
   const out = import_fs19.default.createWriteStream(zipPath);
   let received = 0;
   try {
@@ -51677,12 +52299,12 @@ function buildItemSnapshot(input) {
 }
 
 // packages/core/assessment/anonymous.ts
-var import_node_crypto18 = require("node:crypto");
+var import_node_crypto19 = require("node:crypto");
 function deriveAnonKey(secret, assignmentId, studentId) {
   if (!secret) throw new Error("[assessment] anonymous surveys require a server secret");
   if (!assignmentId) throw new Error("[assessment] assignmentId is required to derive anon key");
   if (!studentId) throw new Error("[assessment] studentId is required to derive anon key");
-  return (0, import_node_crypto18.createHmac)("sha256", secret).update(`${assignmentId}:${studentId}`).digest("hex");
+  return (0, import_node_crypto19.createHmac)("sha256", secret).update(`${assignmentId}:${studentId}`).digest("hex");
 }
 function anonymousLabel(anonKey, index) {
   if (typeof index === "number") return `\u533F\u540D ${index + 1}`;
@@ -51905,7 +52527,7 @@ var notFound = (what) => new AssessmentError(404, `${what} not found`);
 var badRequest = (msg) => new AssessmentError(400, msg);
 var conflict = (msg) => new AssessmentError(409, msg);
 var forbidden = (msg) => new AssessmentError(403, msg);
-function safeJsonParse(raw, fallback) {
+function safeJsonParse2(raw, fallback) {
   if (!raw) return fallback;
   try {
     return JSON.parse(raw);
@@ -51989,8 +52611,8 @@ function toItemRecord(row) {
     sortOrder: row.sort_order,
     type: row.type,
     stem: row.stem,
-    config: safeJsonParse(row.config_json, {}),
-    answerKey: safeJsonParse(row.answer_key_json, null),
+    config: safeJsonParse2(row.config_json, {}),
+    answerKey: safeJsonParse2(row.answer_key_json, null),
     maxScore: row.max_score
   };
 }
@@ -52061,7 +52683,7 @@ var AssessmentService = class {
     const items = this.readItems(id);
     return {
       ...this.toSummary(row),
-      settings: parseAssessmentSettings(row.kind, safeJsonParse(row.settings_json, {})),
+      settings: parseAssessmentSettings(row.kind, safeJsonParse2(row.settings_json, {})),
       items: items.map(toTeacherItemView)
     };
   }
@@ -52339,7 +52961,7 @@ var AssessmentService = class {
     if (attempt.status !== "in_progress") {
       throw badRequest("\u4F5C\u7B54\u5DF2\u63D0\u4EA4\u6216\u7ED3\u675F\uFF0C\u65E0\u6CD5\u8BB0\u5F55\u76D1\u8003\u4E8B\u4EF6");
     }
-    const currentProctor = safeJsonParse(attempt.proctor_json, {
+    const currentProctor = safeJsonParse2(attempt.proctor_json, {
       blurCount: 0,
       switchTabCount: 0,
       fullscreenExitCount: 0,
@@ -52412,7 +53034,7 @@ var AssessmentService = class {
       if (!att) {
         notStartedCount++;
       } else {
-        proctor = safeJsonParse(att.proctor_json, {});
+        proctor = safeJsonParse2(att.proctor_json, {});
         submittedAt = att.submitted_at;
         if (att.status === "in_progress") {
           inProgressCount++;
@@ -52520,7 +53142,7 @@ var AssessmentService = class {
     ).all(...classIds);
     const now = this.now();
     const result = rows.map((row) => {
-      const settings = parseAssessmentSettings(row.kind, safeJsonParse(row.settings_json, {}));
+      const settings = parseAssessmentSettings(row.kind, safeJsonParse2(row.settings_json, {}));
       const attempt = settings.anonymous ? this.findAttemptByIdentity(row.id, null, this.anonKeyFor(row.id, studentId)) : this.findAttemptByIdentity(row.id, studentId, null);
       const settled = attempt ? this.settleIfExpired(attempt, now) : null;
       const completed = Boolean(settled && settled.status !== "in_progress");
@@ -52571,7 +53193,7 @@ var AssessmentService = class {
     const assessment = this.db.prepare("SELECT * FROM assessments WHERE id = ?").get(asg.assessmentId);
     if (!assessment) throw notFound("assessment");
     if (asg.status === "closed") throw conflict("assignment is closed");
-    const settings = parseAssessmentSettings(assessment.kind, safeJsonParse(assessment.settings_json, {}));
+    const settings = parseAssessmentSettings(assessment.kind, safeJsonParse2(assessment.settings_json, {}));
     const now = this.now();
     const windowState = readWindowState(this.windowOf(asg), now);
     if (windowState === "before_open") throw conflict("assessment has not opened yet");
@@ -52683,7 +53305,7 @@ var AssessmentService = class {
           type: item.type,
           stem: item.stem,
           maxScore: item.maxScore,
-          answer: row ? safeJsonParse(row.answer_json, null) : null,
+          answer: row ? safeJsonParse2(row.answer_json, null) : null,
           answerKey: item.answerKey,
           score: row?.score ?? null,
           isCorrect: row?.is_correct === null || row?.is_correct === void 0 ? null : row.is_correct === 1,
@@ -52754,7 +53376,7 @@ var AssessmentService = class {
     const definition = this.registry.get(item.type);
     if (definition?.category !== "subjective") throw badRequest("AI \u5EFA\u8BAE\u4EC5\u9002\u7528\u4E8E\u4E3B\u89C2\u9898");
     const answerRow = this.db.prepare("SELECT answer_json FROM assessment_answers WHERE attempt_id = ? AND item_id = ?").get(attemptId, itemId);
-    const studentAnswer = answerRow?.answer_json ? safeJsonParse(answerRow.answer_json, answerRow.answer_json) : null;
+    const studentAnswer = answerRow?.answer_json ? safeJsonParse2(answerRow.answer_json, answerRow.answer_json) : null;
     if (studentAnswer === null || studentAnswer === void 0 || typeof studentAnswer === "string" && studentAnswer.trim() === "") {
       throw badRequest("\u8BE5\u9898\u5C1A\u65E0\u5B66\u751F\u4F5C\u7B54\uFF0C\u65E0\u6CD5\u751F\u6210\u6279\u6539\u5EFA\u8BAE");
     }
@@ -52834,7 +53456,7 @@ var AssessmentService = class {
       const correct = answers.filter((a) => a.is_correct === 1);
       const distribution = {};
       for (const answer of answers) {
-        const parsed = safeJsonParse(answer.answer_json, null);
+        const parsed = safeJsonParse2(answer.answer_json, null);
         const key = Array.isArray(parsed) ? parsed.join(",") : String(parsed);
         distribution[key] = (distribution[key] ?? 0) + 1;
       }
@@ -52874,7 +53496,7 @@ var AssessmentService = class {
   exportCsv(assignmentId, ownerId) {
     const asg = this.requireOwnedAssignment(assignmentId, ownerId);
     const assessment = this.db.prepare("SELECT * FROM assessments WHERE id = ?").get(asg.assessmentId);
-    const settings = parseAssessmentSettings(assessment.kind, safeJsonParse(assessment.settings_json, {}));
+    const settings = parseAssessmentSettings(assessment.kind, safeJsonParse2(assessment.settings_json, {}));
     const items = this.readItems(asg.assessmentId).sort((a, b) => a.sortOrder - b.sortOrder);
     const attempts = this.db.prepare("SELECT * FROM assessment_attempts WHERE assignment_id = ? ORDER BY started_at ASC").all(assignmentId);
     const now = this.now();
@@ -52895,7 +53517,7 @@ var AssessmentService = class {
       const answerCells = items.map((item) => {
         const answerRow = this.db.prepare("SELECT * FROM assessment_answers WHERE attempt_id = ? AND item_id = ?").get(row.id, item.id);
         if (!answerRow) return "";
-        const parsed = safeJsonParse(answerRow.answer_json, null);
+        const parsed = safeJsonParse2(answerRow.answer_json, null);
         const text = Array.isArray(parsed) ? parsed.map((v) => String(v)).join(" | ") : String(parsed ?? "");
         const scorePart = answerRow.score === null ? "" : ` [${answerRow.score}]`;
         const clipped = text.length > EXPORT_TEXT_LIMIT ? `${text.slice(0, EXPORT_TEXT_LIMIT)}\u2026` : text;
@@ -52935,7 +53557,7 @@ var AssessmentService = class {
   async exportPaper(assessmentId, ownerId, format) {
     const assessment = this.requireOwnedAssessment(assessmentId, ownerId);
     const items = this.readItems(assessmentId).sort((a, b) => a.sortOrder - b.sortOrder);
-    const settings = parseAssessmentSettings(assessment.kind, safeJsonParse(assessment.settings_json, {}));
+    const settings = parseAssessmentSettings(assessment.kind, safeJsonParse2(assessment.settings_json, {}));
     const base = `assessment-${assessmentId}-paper`;
     const paper = {
       schema: PAPER_EXPORT_SCHEMA,
@@ -53291,7 +53913,7 @@ var AssessmentService = class {
       description: row.description,
       status: row.status,
       academicYear: row.academic_year,
-      settings: parseAssessmentSettings(row.kind, safeJsonParse(row.settings_json, {})),
+      settings: parseAssessmentSettings(row.kind, safeJsonParse2(row.settings_json, {})),
       itemCount: items.length,
       totalScore: roundScore(items.reduce((s, i) => s + i.maxScore, 0)),
       createdAt: row.created_at,
@@ -53320,7 +53942,7 @@ var AssessmentService = class {
           return false;
         }
         if (rules.tags && rules.tags.length > 0) {
-          const tags = safeJsonParse(bank.tags_json, []);
+          const tags = safeJsonParse2(bank.tags_json, []);
           if (!rules.tags.some((tag) => tags.includes(tag))) return false;
         }
         return true;
@@ -53336,7 +53958,7 @@ var AssessmentService = class {
   paperItemIds(attempt) {
     const raw = attempt.paper_json;
     if (!raw) return null;
-    const parsed = safeJsonParse(raw, {});
+    const parsed = safeJsonParse2(raw, {});
     if (!Array.isArray(parsed.itemIds)) return null;
     const ids = parsed.itemIds.filter((id) => typeof id === "string");
     return ids.length > 0 ? ids : null;
@@ -53357,9 +53979,9 @@ var AssessmentService = class {
       id: row.id,
       type: row.type,
       stem: row.stem,
-      config: safeJsonParse(row.config_json, {}),
-      answerKey: safeJsonParse(row.answer_key_json, null),
-      tags: safeJsonParse(row.tags_json, []),
+      config: safeJsonParse2(row.config_json, {}),
+      answerKey: safeJsonParse2(row.answer_key_json, null),
+      tags: safeJsonParse2(row.tags_json, []),
       difficulty: row.difficulty ?? null,
       createdAt: row.created_at,
       updatedAt: row.updated_at
@@ -53425,7 +54047,7 @@ var AssessmentService = class {
       score: row.score,
       maxScore: row.max_score,
       needsManualReview: row.needs_manual_review === 1,
-      proctor: safeJsonParse(row.proctor_json, {})
+      proctor: safeJsonParse2(row.proctor_json, {})
     };
   }
   /** 惰性结算：过期未交卷的尝试在这里落成 submitted（并立即判分）。 */
@@ -53449,11 +54071,11 @@ var AssessmentService = class {
   regrade(attempt, now, submittedAt) {
     const assessmentId = this.assignmentAssessmentId(attempt.assignment_id);
     const assessment = this.db.prepare("SELECT * FROM assessments WHERE id = ?").get(assessmentId);
-    const settings = parseAssessmentSettings(assessment.kind, safeJsonParse(assessment.settings_json, {}));
+    const settings = parseAssessmentSettings(assessment.kind, safeJsonParse2(assessment.settings_json, {}));
     const items = this.itemsForAttempt(attempt, this.readItems(assessmentId));
     const answerRows = this.db.prepare("SELECT * FROM assessment_answers WHERE attempt_id = ?").all(attempt.id);
     const answers = {};
-    for (const row of answerRows) answers[row.item_id] = safeJsonParse(row.answer_json, null);
+    for (const row of answerRows) answers[row.item_id] = safeJsonParse2(row.answer_json, null);
     const summary = gradeAttempt(this.registry, items, answers, {
       assessmentId,
       attemptId: attempt.id,
@@ -53526,7 +54148,7 @@ var AssessmentService = class {
     const items = this.itemsForAttempt(attempt, this.readItems(assessment.id));
     const answerRows = this.db.prepare("SELECT * FROM assessment_answers WHERE attempt_id = ?").all(attempt.id);
     const answers = {};
-    for (const row of answerRows) answers[row.item_id] = safeJsonParse(row.answer_json, null);
+    for (const row of answerRows) answers[row.item_id] = safeJsonParse2(row.answer_json, null);
     let sortedItems = items.sort((a, b) => a.sortOrder - b.sortOrder);
     if (settings.shuffleItems) {
       sortedItems = seededShuffle(sortedItems, attempt.id);
@@ -53571,7 +54193,7 @@ var AssessmentService = class {
   buildResultPayload(attempt) {
     const assignment = this.getAssignment(attempt.assignment_id);
     const assessment = this.db.prepare("SELECT * FROM assessments WHERE id = ?").get(assignment.assessmentId);
-    const settings = parseAssessmentSettings(assessment.kind, safeJsonParse(assessment.settings_json, {}));
+    const settings = parseAssessmentSettings(assessment.kind, safeJsonParse2(assessment.settings_json, {}));
     const items = this.itemsForAttempt(attempt, this.readItems(assessment.id)).sort(
       (a, b) => a.sortOrder - b.sortOrder
     );
@@ -53592,7 +54214,7 @@ var AssessmentService = class {
         type: item.type,
         stem: item.stem,
         maxScore: item.maxScore,
-        answer: row ? safeJsonParse(row.answer_json, null) : null
+        answer: row ? safeJsonParse2(row.answer_json, null) : null
       };
       if (!showAnalysis) {
         return {