fix(wp7-02): route stable Gemini through secure broker

# Conflicts:
#	package.json

apps/api/package.json

@@ -9,13 +9,16 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
+    "@dada/asset-release-manifest": "workspace:*",
     "@dada/shared-contracts": "workspace:*",
+    "@dada/static-sticker-catalog": "workspace:*",
     "@fastify/multipart": "10.1.0",
     "@fastify/swagger": "9.8.1",
     "@sinclair/typebox": "0.34.52",
     "better-sqlite3": "13.0.1",
     "drizzle-orm": "0.45.2",
-    "fastify": "5.10.0"
+    "fastify": "5.10.0",
+    "sharp": "0.35.3"
   },
   "devDependencies": {
     "@types/better-sqlite3": "7.6.13",

apps/api/src/admin-audit.ts

@@ -0,0 +1,148 @@
+import type BetterSqlite3 from "better-sqlite3";
+
+import type {
+  AdminAuditQuery,
+  AdminOperationAuditItem,
+  AdminOperationAuditResponse,
+  PrivateContentAccessAuditItem,
+  PrivateContentAccessAuditResponse,
+} from "@dada/shared-contracts";
+
+interface AuditCursor {
+  logId: string;
+  occurredAt: number;
+}
+
+interface AdminOperationRow {
+  actor_ref: string;
+  actor_type: "system" | "super_admin";
+  after_summary: string | null;
+  before_summary: string | null;
+  expires_at: number;
+  log_id: string;
+  occurred_at: number;
+  operation_type: string;
+  result: "failed" | "succeeded";
+  target_ref: string;
+  target_type: string;
+}
+
+interface PrivateContentAccessRow {
+  actor_ref: string;
+  content_type: "image" | "prompt";
+  expires_at: number;
+  log_id: string;
+  occurred_at: number;
+  target_ref: string;
+}
+
+export class AdminAuditQueryError extends Error {
+  constructor() {
+    super("admin_audit_query_invalid");
+    this.name = "AdminAuditQueryError";
+  }
+}
+
+function encodeCursor(row: { log_id: string; occurred_at: number }) {
+  return Buffer.from(JSON.stringify([row.occurred_at, row.log_id]), "utf8").toString("base64url");
+}
+
+function decodeCursor(cursor: string | undefined): AuditCursor | undefined {
+  if (!cursor) return undefined;
+  try {
+    const parsed: unknown = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+    if (!Array.isArray(parsed) || parsed.length !== 2 || !Number.isSafeInteger(parsed[0])
+      || typeof parsed[1] !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,159}$/.test(parsed[1])) {
+      throw new AdminAuditQueryError();
+    }
+    return { occurredAt: parsed[0] as number, logId: parsed[1] };
+  } catch (error) {
+    if (error instanceof AdminAuditQueryError) throw error;
+    throw new AdminAuditQueryError();
+  }
+}
+
+function normalizeLimit(limit: number | undefined) {
+  if (limit === undefined) return 50;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) throw new AdminAuditQueryError();
+  return limit;
+}
+
+function pageRows<Row extends { log_id: string; occurred_at: number }>(rows: Row[], limit: number) {
+  const hasMore = rows.length > limit;
+  const items = hasMore ? rows.slice(0, limit) : rows;
+  return { items, nextCursor: hasMore ? encodeCursor(items[items.length - 1]!) : null };
+}
+
+function iso(value: number) {
+  return new Date(value).toISOString();
+}
+
+export function listAdminOperationAudit(
+  database: BetterSqlite3.Database,
+  query: AdminAuditQuery,
+  clock: () => number = Date.now,
+): AdminOperationAuditResponse {
+  const cursor = decodeCursor(query.cursor);
+  const limit = normalizeLimit(query.limit);
+  const rows = (cursor
+    ? database.prepare(`
+        SELECT actor_ref, actor_type, after_summary, before_summary, expires_at, log_id,
+          occurred_at, operation_type, result, target_ref, target_type
+        FROM admin_operation_logs
+        WHERE occurred_at < ? OR (occurred_at = ? AND log_id < ?)
+        ORDER BY occurred_at DESC, log_id DESC LIMIT ?
+      `).all(cursor.occurredAt, cursor.occurredAt, cursor.logId, limit + 1)
+    : database.prepare(`
+        SELECT actor_ref, actor_type, after_summary, before_summary, expires_at, log_id,
+          occurred_at, operation_type, result, target_ref, target_type
+        FROM admin_operation_logs
+        ORDER BY occurred_at DESC, log_id DESC LIMIT ?
+      `).all(limit + 1)) as AdminOperationRow[];
+  const page = pageRows(rows, limit);
+  const items: AdminOperationAuditItem[] = page.items.map((row) => ({
+    actor_ref: row.actor_ref,
+    actor_type: row.actor_type,
+    after_summary: row.after_summary,
+    before_summary: row.before_summary,
+    expires_at: iso(row.expires_at),
+    log_id: row.log_id,
+    occurred_at: iso(row.occurred_at),
+    operation_type: row.operation_type,
+    result: row.result,
+    target_ref: row.target_ref,
+    target_type: row.target_type,
+  }));
+  return { generated_at: iso(clock()), items, next_cursor: page.nextCursor };
+}
+
+export function listPrivateContentAccessAudit(
+  database: BetterSqlite3.Database,
+  query: AdminAuditQuery,
+  clock: () => number = Date.now,
+): PrivateContentAccessAuditResponse {
+  const cursor = decodeCursor(query.cursor);
+  const limit = normalizeLimit(query.limit);
+  const rows = (cursor
+    ? database.prepare(`
+        SELECT actor_ref, content_type, expires_at, log_id, occurred_at, target_ref
+        FROM private_content_access_logs
+        WHERE occurred_at < ? OR (occurred_at = ? AND log_id < ?)
+        ORDER BY occurred_at DESC, log_id DESC LIMIT ?
+      `).all(cursor.occurredAt, cursor.occurredAt, cursor.logId, limit + 1)
+    : database.prepare(`
+        SELECT actor_ref, content_type, expires_at, log_id, occurred_at, target_ref
+        FROM private_content_access_logs
+        ORDER BY occurred_at DESC, log_id DESC LIMIT ?
+      `).all(limit + 1)) as PrivateContentAccessRow[];
+  const page = pageRows(rows, limit);
+  const items: PrivateContentAccessAuditItem[] = page.items.map((row) => ({
+    actor_ref: row.actor_ref,
+    content_type: row.content_type,
+    expires_at: iso(row.expires_at),
+    log_id: row.log_id,
+    occurred_at: iso(row.occurred_at),
+    target_ref: row.target_ref,
+  }));
+  return { generated_at: iso(clock()), items, next_cursor: page.nextCursor };
+}

apps/api/src/admin-state.ts

@@ -0,0 +1,194 @@
+import type BetterSqlite3 from "better-sqlite3";
+
+import type { AdminDiagnosticsResponse, AdminServicesStorageResponse } from "@dada/shared-contracts";
+
+import type { BrowserSupportRelease } from "./browser-support.js";
+import type { ManagedStorage } from "./managed-storage.js";
+import type { ModelConfigurationService } from "./model-configuration.js";
+
+type AdminService = AdminServicesStorageResponse["services"][number];
+const adminServiceIds = ["resend", "amap", "ai_gateway", "worker", "api", "asset_root"] as const;
+const forbiddenDiagnosticPatterns = [
+  /\b(?:api[_ -]?key|secret|password|credential|authorization|bearer|session[_ -]?token|cookie|prompt|email|token)\b/i,
+  /[A-Z]:[\\/](?:Users|Documents|ProgramData|Windows)[\\/]/i,
+  /\\\\[^\\\s]+\\[^\s]+/,
+  /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i,
+  /https?:\/\//i,
+];
+const safePauseReasons = new Set([
+  "asset_root_state_missing", "balance_insufficient", "configured_disabled", "contract_blocked",
+  "contract_unverified", "gateway_balance_insufficient", "gateway_paused", "health_check_failed",
+  "model_disabled", "provider_unavailable", "quota_exhausted", "service_state_missing", "unknown",
+  "worker_degraded", "worker_state_missing", "worker_stopped",
+]);
+
+function iso(value: number | string | null | undefined) {
+  if (value === null || value === undefined) return null;
+  return typeof value === "number" ? new Date(value).toISOString() : value;
+}
+
+function tableExists(database: BetterSqlite3.Database, table: string) {
+  return Boolean(database.prepare("SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = ?").get(table));
+}
+
+function safeService(
+  service_id: AdminService["service_id"],
+  status: AdminService["status"],
+  impact_scope: AdminService["impact_scope"],
+  configured: boolean,
+  checked_at: string | null,
+  pause_reason: string | null = null,
+): AdminService {
+  return { checked_at, configured, impact_scope, pause_reason, service_id, status };
+}
+
+function safeReason(value: unknown) {
+  return typeof value === "string" && safePauseReasons.has(value) ? value : null;
+}
+
+function serviceUsage(database: BetterSqlite3.Database, serviceName: string) {
+  if (!tableExists(database, "external_service_usage")) return undefined;
+  const columns = new Set((database.prepare("PRAGMA table_info(external_service_usage)").all() as Array<{ name: string }>).map((column) => column.name));
+  const serviceColumn = columns.has("service_name") ? "service_name" : columns.has("service_id") ? "service_id" : undefined;
+  if (!serviceColumn || !columns.has("service_status")) return undefined;
+  const row = database.prepare(`SELECT service_status, ${columns.has("checked_at") ? "checked_at" : "NULL AS checked_at"}, ${columns.has("pause_reason") ? "pause_reason" : "NULL AS pause_reason"} FROM external_service_usage WHERE ${serviceColumn} = ? ORDER BY rowid DESC LIMIT 1`).get(serviceName) as { service_status: string; checked_at: number | string | null; pause_reason: string | null } | undefined;
+  if (!row) return undefined;
+  const status = new Set<AdminService["status"]>(["active", "paused_quota", "paused_provider", "disabled"]).has(row.service_status as AdminService["status"])
+    ? row.service_status as AdminService["status"]
+    : "degraded";
+  return { status, checked_at: iso(row.checked_at), pause_reason: safeReason(row.pause_reason) };
+}
+
+function workerStatus(database: BetterSqlite3.Database) {
+  if (!tableExists(database, "worker_runtime_state")) return { status: "unavailable" as const, checked_at: null, pause_reason: "worker_state_missing" };
+  const row = database.prepare("SELECT status, reason, updated_at FROM worker_runtime_state WHERE singleton = 1").get() as { status: string; reason: string | null; updated_at: number | string | null } | undefined;
+  if (!row) return { status: "unavailable" as const, checked_at: null, pause_reason: "worker_state_missing" };
+  return {
+    status: row.status === "ready" ? "active" as const : row.status === "degraded" ? "degraded" as const : "unavailable" as const,
+    checked_at: iso(row.updated_at),
+    pause_reason: safeReason(row.reason),
+  };
+}
+
+export function createAdminServicesStorageProvider(input: {
+  database: BetterSqlite3.Database;
+  models?: ModelConfigurationService;
+  storage?: ManagedStorage;
+  assetRoot?: Pick<AdminService, "configured" | "status" | "checked_at" | "pause_reason">;
+  clock?: () => number;
+}): () => AdminServicesStorageResponse {
+  const clock = input.clock ?? Date.now;
+  return () => {
+    const generatedAt = new Date(clock()).toISOString();
+    const resend = serviceUsage(input.database, "resend");
+    const amap = serviceUsage(input.database, "amap");
+    const worker = workerStatus(input.database);
+    const modelRuntime = input.models?.read().models ?? [];
+    const unavailableModels = modelRuntime.filter((model) => !model.runtime_availability.available_for_new_jobs);
+    const gatewayReason = unavailableModels[0]?.runtime_availability.reason ?? null;
+    const storageState = input.storage?.getState();
+    const cleanupPendingCount = tableExists(input.database, "file_cleanup_queue")
+      ? (input.database.prepare("SELECT COUNT(*) AS count FROM file_cleanup_queue WHERE status IN ('pending', 'failed')").get() as { count: number }).count
+      : 0;
+    const services: AdminService[] = [
+      safeService("resend", resend?.status ?? "unavailable", "authentication", Boolean(resend), resend?.checked_at ?? null, resend?.pause_reason ?? "service_state_missing"),
+      safeService("amap", amap?.status ?? "unavailable", "location", Boolean(amap), amap?.checked_at ?? null, amap?.pause_reason ?? "service_state_missing"),
+      safeService("ai_gateway", unavailableModels.length > 0 ? "degraded" : modelRuntime.length > 0 ? "active" : "unavailable", "generation", modelRuntime.length > 0, generatedAt, safeReason(gatewayReason)),
+      safeService("worker", worker.status, "generation", worker.status !== "unavailable", worker.checked_at, worker.pause_reason),
+      safeService("api", "active", "api", true, generatedAt),
+      safeService(
+        "asset_root",
+        input.assetRoot?.status ?? "unavailable",
+        "storage",
+        input.assetRoot?.configured ?? false,
+        input.assetRoot?.checked_at ?? null,
+        input.assetRoot?.pause_reason ?? "asset_root_state_missing",
+      ),
+    ];
+    return assertSafeAdminServicesStorage({
+      generated_at: generatedAt,
+      services,
+      storage: {
+        capacity_notice_level: storageState?.capacity_notice_level ?? "normal",
+        cleanup_pending_count: cleanupPendingCount,
+        data_root_ref: "configured_local_data_root",
+        hard_limit_bytes: storageState?.hard_limit_bytes ?? 5_368_709_120,
+        last_measured_at: storageState?.measured_at ?? null,
+        managed_content_bytes: storageState?.managed_content_bytes ?? 0,
+        remeasurement_required: storageState?.storage_status === "unavailable",
+        status: storageState?.storage_status ?? "unavailable",
+        storage_backend: "local_filesystem",
+      },
+    });
+  };
+}
+
+function diagnosticText(input: AdminServicesStorageResponse, system: AdminDiagnosticsResponse["system"]) {
+  const lines = [
+    "Dada P0-A diagnostics",
+    `app_version=${system.app_version}`,
+    `api_status=${system.api_status}`,
+    `worker_status=${system.worker_status}`,
+    `storage_status=${input.storage.status}`,
+    `capacity_notice_level=${input.storage.capacity_notice_level}`,
+    `managed_content_bytes=${input.storage.managed_content_bytes}`,
+    `hard_limit_bytes=${input.storage.hard_limit_bytes}`,
+    `cleanup_pending_count=${input.storage.cleanup_pending_count}`,
+  ];
+  for (const service of input.services) lines.push(`service.${service.service_id}=${service.status}`);
+  return lines.join("\n");
+}
+
+export function createAdminDiagnosticsProvider(input: {
+  servicesStorage: () => AdminServicesStorageResponse;
+  browserSupportRelease?: BrowserSupportRelease;
+  appVersion?: string;
+  clock?: () => number;
+}): () => AdminDiagnosticsResponse {
+  const clock = input.clock ?? Date.now;
+  return () => {
+    const services = input.servicesStorage();
+    const system: AdminDiagnosticsResponse["system"] = {
+      api_status: "ready",
+      app_version: input.appVersion ?? input.browserSupportRelease?.appVersion ?? "0.0.0",
+      browser_support: (input.browserSupportRelease?.browsers ?? []).map((browser) => ({
+        brand: browser.brand,
+        major: Number.parseInt(browser.fullVersion.split(".")[0] ?? "0", 10),
+      })).filter((browser) => Number.isSafeInteger(browser.major) && browser.major > 0),
+      worker_status: services.services.find((service) => service.service_id === "worker")?.status === "active"
+        ? "ready"
+        : services.services.find((service) => service.service_id === "worker")?.status === "unavailable"
+          ? "unavailable"
+          : "degraded",
+    };
+    return assertSafeAdminDiagnostics({
+      generated_at: new Date(clock()).toISOString(),
+      diagnostic_text: diagnosticText(services, system),
+      services,
+      system,
+    });
+  };
+}
+
+export function assertSafeAdminServicesStorage(input: AdminServicesStorageResponse) {
+  const ids = input.services.map((service) => service.service_id);
+  if (ids.length !== adminServiceIds.length || new Set(ids).size !== adminServiceIds.length
+    || adminServiceIds.some((serviceId) => !ids.includes(serviceId))) {
+    throw new Error("admin_service_state_incomplete");
+  }
+  if (input.services.some((service) => service.pause_reason !== null && !safePauseReasons.has(service.pause_reason))) {
+    throw new Error("admin_services_redaction_failed");
+  }
+  if (forbiddenDiagnosticPatterns.some((pattern) => pattern.test(JSON.stringify(input)))) {
+    throw new Error("admin_services_redaction_failed");
+  }
+  return input;
+}
+
+export function assertSafeAdminDiagnostics(input: AdminDiagnosticsResponse) {
+  assertSafeAdminServicesStorage(input.services);
+  if (forbiddenDiagnosticPatterns.some((pattern) => pattern.test(input.diagnostic_text))) {
+    throw new Error("admin_diagnostics_redaction_failed");
+  }
+  return input;
+}

apps/api/src/external-service-usage.ts

@@ -0,0 +1,459 @@
+import { randomUUID } from "node:crypto";
+
+import type BetterSqlite3 from "better-sqlite3";
+
+import { serializeAuditSummary } from "./audit-policy.js";
+
+export type ExternalServiceId = "resend_email" | "amap_web_service";
+export type ExternalServicePeriodType = "daily" | "monthly";
+export type ExternalServiceStatus = "active" | "paused_quota" | "paused_provider" | "disabled";
+
+const retentionMilliseconds = 180 * 24 * 60 * 60 * 1_000;
+const recoveryCheckLifetimeMilliseconds = 15 * 60 * 1_000;
+const maximumHardLimits: Record<ExternalServiceId, Partial<Record<ExternalServicePeriodType, number>>> = {
+  resend_email: { daily: 80, monthly: 2_400 },
+  amap_web_service: { monthly: 1_000 },
+};
+
+export interface ExternalServiceUsageRow {
+  serviceId: ExternalServiceId;
+  periodType: ExternalServicePeriodType;
+  periodStart: number;
+  hardLimit: number;
+  usedCount: number;
+  status: ExternalServiceStatus;
+  pauseReason: string | null;
+  updatedAt: number;
+}
+
+export class ExternalServiceUsageError extends Error {
+  constructor(
+    readonly code:
+      | "service_paused_quota"
+      | "service_paused_provider"
+      | "service_disabled"
+      | "hard_limit_increase_forbidden"
+      | "hard_limit_invalid"
+      | "health_check_required"
+      | "quota_exhausted"
+      | "service_not_found",
+    message = code,
+  ) {
+    super(message);
+    this.name = "ExternalServiceUsageError";
+  }
+}
+
+interface ExternalServiceUsageOptions {
+  clock?: () => number;
+  database: BetterSqlite3.Database;
+}
+
+interface RawUsageRow {
+  service_id: ExternalServiceId;
+  period_type: ExternalServicePeriodType;
+  period_start: number;
+  hard_limit: number;
+  used_count: number;
+  service_status: ExternalServiceStatus;
+  pause_reason: string | null;
+  updated_at: number;
+}
+
+function periodStart(periodType: ExternalServicePeriodType, now: number) {
+  const date = new Date(now);
+  if (periodType === "daily") return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
+  return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1);
+}
+
+function requiredPeriods(serviceId: ExternalServiceId): ExternalServicePeriodType[] {
+  return serviceId === "resend_email" ? ["daily", "monthly"] : ["monthly"];
+}
+
+function toPublic(row: RawUsageRow): ExternalServiceUsageRow {
+  return {
+    hardLimit: row.hard_limit,
+    pauseReason: row.pause_reason,
+    periodStart: row.period_start,
+    periodType: row.period_type,
+    serviceId: row.service_id,
+    status: row.service_status,
+    updatedAt: row.updated_at,
+    usedCount: row.used_count,
+  };
+}
+
+export class ExternalServiceUsage {
+  readonly database: BetterSqlite3.Database;
+  readonly clock: () => number;
+
+  constructor(options: ExternalServiceUsageOptions) {
+    this.database = options.database;
+    this.clock = options.clock ?? Date.now;
+    this.ensureSchema();
+    this.runImmediate(() => {
+      this.ensureCurrentRows(this.clock(), "resend_email");
+      this.ensureCurrentRows(this.clock(), "amap_web_service");
+    });
+  }
+
+  claimResend(now = this.clock()) {
+    return this.runImmediate(() => this.claimWithinTransaction("resend_email", now));
+  }
+
+  claimResendWithinTransaction(now = this.clock()) {
+    return this.claimWithinTransaction("resend_email", now);
+  }
+
+  claimAmap(now = this.clock()) {
+    return this.runImmediate(() => this.claimWithinTransaction("amap_web_service", now));
+  }
+
+  claimAmapWithinTransaction(now = this.clock()) {
+    return this.claimWithinTransaction("amap_web_service", now);
+  }
+
+  markProviderFailure(input: { serviceId: ExternalServiceId; reason: string; now?: number }) {
+    return this.runImmediate(() => this.markProviderFailureWithinTransaction(input));
+  }
+
+  markProviderFailureWithinTransaction(input: { serviceId: ExternalServiceId; reason: string; now?: number }) {
+    const now = input.now ?? this.clock();
+    const rows = this.ensureCurrentRows(now, input.serviceId);
+    const reason = normalizeReason(input.reason);
+    for (const row of rows) {
+      if (row.service_status === "disabled") continue;
+      this.database.prepare(`
+        UPDATE external_service_usage
+        SET service_status = 'paused_provider', pause_reason = ?, updated_at = ?
+        WHERE service_id = ? AND period_type = ? AND period_start = ?
+      `).run(reason, now, row.service_id, row.period_type, row.period_start);
+    }
+    this.recordAudit({
+      actorRef: "external_service_runtime",
+      actorType: "system",
+      afterSummary: { pause_reason: reason, status: "paused_provider" },
+      beforeSummary: { status: rows[0]?.service_status ?? "active" },
+      operationType: "service_provider_pause",
+      result: "succeeded",
+      targetRef: input.serviceId,
+      targetType: "external_service",
+    }, now);
+    return this.read(input.serviceId);
+  }
+
+  recordHealthCheck(input: { serviceId: ExternalServiceId; available: boolean; reason?: string; now?: number }) {
+    const now = input.now ?? this.clock();
+    const checkId = randomUUID();
+    const currentPeriod = periodStart(requiredPeriods(input.serviceId)[0]!, now);
+    const result = this.runImmediate(() => {
+      this.database.prepare(`
+        INSERT INTO service_recovery_checks (
+          check_id, service_name, target_ref, status, checked_at, expires_at, details_json,
+          service_id, period_start, available, check_reason
+        ) VALUES (?, 'external_service', ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        checkId,
+        input.serviceId,
+        input.available ? "passed" : "failed",
+        now,
+        now + recoveryCheckLifetimeMilliseconds,
+        JSON.stringify({ non_sensitive: true }),
+        input.serviceId,
+        currentPeriod,
+        input.available ? 1 : 0,
+        input.reason ? normalizeReason(input.reason) : null,
+      );
+      return { checkId, available: input.available, checkedAt: now };
+    });
+    return result;
+  }
+
+  recover(input: { serviceId: ExternalServiceId; actorId: string; checkId: string; now?: number }) {
+    const now = input.now ?? this.clock();
+    const result = this.runImmediate(() => {
+      const check = this.database.prepare(`
+        SELECT check_id, period_start, available, expires_at
+        FROM service_recovery_checks
+        WHERE check_id = ? AND service_id = ? AND service_name = 'external_service'
+      `).get(input.checkId, input.serviceId) as { available: number; check_id: string; expires_at: number; period_start: number } | undefined;
+      const currentPeriod = periodStart(requiredPeriods(input.serviceId)[0]!, now);
+      if (!check?.available || check.period_start !== currentPeriod || check.expires_at <= now) {
+        this.recordAudit({
+          actorRef: input.actorId,
+          actorType: "super_admin",
+          afterSummary: { reason: "health_check_required" },
+          beforeSummary: null,
+          operationType: "service_recovery",
+          result: "failed",
+          targetRef: input.serviceId,
+          targetType: "external_service",
+        }, now);
+        return { error: new ExternalServiceUsageError("health_check_required") };
+      }
+      const rows = this.ensureCurrentRows(now, input.serviceId);
+      if (rows.some((row) => row.used_count >= row.hard_limit)) {
+        this.recordAudit({
+          actorRef: input.actorId,
+          actorType: "super_admin",
+          afterSummary: { reason: "quota_exhausted" },
+          beforeSummary: { status: rows[0]?.service_status ?? "paused_quota" },
+          operationType: "service_recovery",
+          result: "failed",
+          targetRef: input.serviceId,
+          targetType: "external_service",
+        }, now);
+        return { error: new ExternalServiceUsageError("quota_exhausted") };
+      }
+      for (const row of rows) {
+        this.database.prepare(`
+          UPDATE external_service_usage
+          SET service_status = 'active', pause_reason = NULL, updated_at = ?
+          WHERE service_id = ? AND period_type = ? AND period_start = ?
+        `).run(now, row.service_id, row.period_type, row.period_start);
+      }
+      this.recordAudit({
+        actorRef: input.actorId,
+        actorType: "super_admin",
+        afterSummary: { check_id: input.checkId, status: "active" },
+        beforeSummary: { status: rows[0]?.service_status ?? "paused_provider" },
+        operationType: "service_recovery",
+        result: "succeeded",
+        targetRef: input.serviceId,
+        targetType: "external_service",
+      }, now);
+      return { status: "active" as const };
+    });
+    if ("error" in result && result.error) throw result.error;
+    return result;
+  }
+
+  setHardLimit(input: {
+    serviceId: ExternalServiceId;
+    periodType: ExternalServicePeriodType;
+    hardLimit: number;
+    actorId: string;
+    now?: number;
+  }) {
+    const now = input.now ?? this.clock();
+    const result = this.runImmediate(() => {
+      const maximum = maximumHardLimits[input.serviceId][input.periodType];
+      const current = this.ensureCurrentRows(now, input.serviceId).find((row) => row.period_type === input.periodType);
+      if (current && input.hardLimit > current.hard_limit) {
+        this.recordAudit({
+          actorRef: input.actorId,
+          actorType: "super_admin",
+          afterSummary: { reason: "hard_limit_increase_forbidden" },
+          beforeSummary: { hard_limit: current.hard_limit },
+          operationType: "service_hard_limit_update",
+          result: "failed",
+          targetRef: `${input.serviceId}:${input.periodType}`,
+          targetType: "external_service_limit",
+        }, now);
+        return { error: new ExternalServiceUsageError("hard_limit_increase_forbidden") };
+      }
+      const valid = maximum !== undefined && Number.isSafeInteger(input.hardLimit) && input.hardLimit >= 1 && input.hardLimit <= maximum;
+      if (!valid || !current) {
+        this.recordAudit({
+          actorRef: input.actorId,
+          actorType: "super_admin",
+          afterSummary: { reason: "hard_limit_invalid" },
+          beforeSummary: current ? { hard_limit: current.hard_limit } : null,
+          operationType: "service_hard_limit_update",
+          result: "failed",
+          targetRef: `${input.serviceId}:${input.periodType}`,
+          targetType: "external_service_limit",
+        }, now);
+        return { error: new ExternalServiceUsageError("hard_limit_invalid") };
+      }
+      this.database.prepare(`
+        UPDATE external_service_usage
+        SET hard_limit = ?, service_status = CASE
+          WHEN used_count >= ? THEN 'paused_quota'
+          ELSE service_status
+        END, pause_reason = CASE
+          WHEN used_count >= ? THEN 'hard_limit_reached'
+          ELSE pause_reason
+        END, updated_at = ?
+        WHERE service_id = ? AND period_type = ? AND period_start = ?
+      `).run(input.hardLimit, input.hardLimit, input.hardLimit, now, current.service_id, current.period_type, current.period_start);
+      this.recordAudit({
+        actorRef: input.actorId,
+        actorType: "super_admin",
+        afterSummary: { hard_limit: input.hardLimit },
+        beforeSummary: { hard_limit: current.hard_limit },
+        operationType: "service_hard_limit_update",
+        result: "succeeded",
+        targetRef: `${input.serviceId}:${input.periodType}`,
+        targetType: "external_service_limit",
+      }, now);
+      return this.read(input.serviceId);
+    });
+    if ("error" in result && result.error) throw result.error;
+    return result;
+  }
+
+  read(serviceId?: ExternalServiceId) {
+    const rows = (serviceId
+      ? this.database.prepare("SELECT * FROM external_service_usage WHERE service_id = ? ORDER BY period_type").all(serviceId)
+      : this.database.prepare("SELECT * FROM external_service_usage ORDER BY service_id, period_type").all()) as RawUsageRow[];
+    return rows.map(toPublic);
+  }
+
+  readCurrent() {
+    const now = this.clock();
+    return this.read().filter((row) => row.periodStart === periodStart(row.periodType, now));
+  }
+
+  readStatus(serviceId: ExternalServiceId) {
+    const rows = this.read(serviceId).filter((row) => row.periodStart >= periodStart(row.periodType, this.clock()));
+    const status = rows.some((row) => row.status === "disabled")
+      ? "disabled"
+      : rows.some((row) => row.status === "paused_provider")
+        ? "paused_provider"
+        : rows.some((row) => row.status === "paused_quota")
+          ? "paused_quota"
+          : "active";
+    return { serviceId, status, rows } as const;
+  }
+
+  private claimWithinTransaction(serviceId: ExternalServiceId, now: number) {
+    const rows = this.ensureCurrentRows(now, serviceId);
+    for (const row of rows) {
+      if (row.service_status === "paused_quota") throw new ExternalServiceUsageError("service_paused_quota");
+      if (row.service_status === "paused_provider") throw new ExternalServiceUsageError("service_paused_provider");
+      if (row.service_status === "disabled") throw new ExternalServiceUsageError("service_disabled");
+      if (row.used_count >= row.hard_limit) {
+        this.database.prepare(`
+          UPDATE external_service_usage
+          SET service_status = 'paused_quota', pause_reason = 'hard_limit_reached', updated_at = ?
+          WHERE service_id = ? AND period_type = ? AND period_start = ?
+        `).run(now, row.service_id, row.period_type, row.period_start);
+        throw new ExternalServiceUsageError("service_paused_quota");
+      }
+    }
+    const updated = rows.map((row) => {
+      const usedCount = row.used_count + 1;
+      const status: ExternalServiceStatus = usedCount >= row.hard_limit ? "paused_quota" : "active";
+      this.database.prepare(`
+        UPDATE external_service_usage
+        SET used_count = ?, service_status = ?, pause_reason = CASE WHEN ? = 'active' THEN NULL ELSE 'hard_limit_reached' END, updated_at = ?
+        WHERE service_id = ? AND period_type = ? AND period_start = ?
+      `).run(usedCount, status, status, now, row.service_id, row.period_type, row.period_start);
+      return { periodType: row.period_type, remaining: Math.max(0, row.hard_limit - usedCount), usedCount };
+    });
+    return { allowed: true as const, serviceId, allocations: updated, remaining: Math.min(...updated.map((item) => item.remaining)) };
+  }
+
+  private ensureCurrentRows(now: number, serviceId: ExternalServiceId) {
+    const periods = requiredPeriods(serviceId);
+    for (const periodType of periods) {
+      const start = periodStart(periodType, now);
+      const current = this.database.prepare(`
+        SELECT * FROM external_service_usage WHERE service_id = ? AND period_type = ? AND period_start = ?
+      `).get(serviceId, periodType, start) as RawUsageRow | undefined;
+      if (current) continue;
+      const previous = this.database.prepare(`
+        SELECT hard_limit FROM external_service_usage
+        WHERE service_id = ? AND period_type = ? ORDER BY period_start DESC LIMIT 1
+      `).get(serviceId, periodType) as { hard_limit: number } | undefined;
+      const maximum = maximumHardLimits[serviceId][periodType];
+      if (maximum === undefined) throw new ExternalServiceUsageError("service_not_found");
+      this.database.prepare(`
+        INSERT INTO external_service_usage (
+          service_id, period_type, period_start, hard_limit, used_count,
+          service_status, pause_reason, updated_at
+        ) VALUES (?, ?, ?, ?, 0, ?, ?, ?)
+      `).run(serviceId, periodType, start, previous?.hard_limit ?? maximum, previous ? "paused_quota" : "active", previous ? "period_confirmation_required" : null, now);
+    }
+    return this.database.prepare(`
+      SELECT * FROM external_service_usage
+      WHERE service_id = ? AND period_start IN (${periods.map(() => "?").join(",")})
+      ORDER BY period_type
+    `).all(serviceId, ...periods.map((period) => periodStart(period, now))) as RawUsageRow[];
+  }
+
+  private ensureSchema() {
+    this.database.exec(`
+      CREATE TABLE IF NOT EXISTS external_service_usage (
+        service_id TEXT NOT NULL CHECK (service_id IN ('resend_email', 'amap_web_service')),
+        period_type TEXT NOT NULL CHECK (period_type IN ('daily', 'monthly')),
+        period_start INTEGER NOT NULL,
+        hard_limit INTEGER NOT NULL CHECK (hard_limit >= 1),
+        used_count INTEGER NOT NULL CHECK (used_count >= 0 AND used_count <= hard_limit),
+        service_status TEXT NOT NULL CHECK (service_status IN ('active', 'paused_quota', 'paused_provider', 'disabled')),
+        pause_reason TEXT,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (service_id, period_type, period_start)
+      );
+      CREATE TABLE IF NOT EXISTS service_recovery_checks (
+        check_id TEXT PRIMARY KEY,
+        service_name TEXT NOT NULL DEFAULT 'external_service',
+        target_ref TEXT NOT NULL DEFAULT '',
+        status TEXT NOT NULL DEFAULT 'passed' CHECK (status IN ('passed', 'failed')),
+        checked_at INTEGER NOT NULL DEFAULT 0,
+        expires_at INTEGER NOT NULL DEFAULT 0,
+        details_json TEXT NOT NULL DEFAULT '{}',
+        service_id TEXT CHECK (service_id IS NULL OR service_id IN ('resend_email', 'amap_web_service')),
+        period_start INTEGER,
+        available INTEGER CHECK (available IS NULL OR available IN (0, 1)),
+        check_reason TEXT
+      );
+    `);
+    const columns = new Set((this.database.prepare("PRAGMA table_info(service_recovery_checks)").all() as Array<{ name: string }>).map((column) => column.name));
+    const additions: Array<[string, string]> = [
+      ["service_name", "TEXT NOT NULL DEFAULT 'external_service'"],
+      ["target_ref", "TEXT NOT NULL DEFAULT ''"],
+      ["status", "TEXT NOT NULL DEFAULT 'passed'"],
+      ["expires_at", "INTEGER NOT NULL DEFAULT 0"],
+      ["details_json", "TEXT NOT NULL DEFAULT '{}'"],
+      ["service_id", "TEXT"],
+      ["period_start", "INTEGER"],
+      ["available", "INTEGER"],
+      ["check_reason", "TEXT"],
+    ];
+    for (const [name, definition] of additions) {
+      if (!columns.has(name)) this.database.exec(`ALTER TABLE service_recovery_checks ADD COLUMN ${name} ${definition}`);
+    }
+  }
+
+  private runImmediate<T>(action: () => T): T {
+    const nested = this.database.inTransaction;
+    if (!nested) this.database.exec("BEGIN IMMEDIATE");
+    try {
+      const result = action();
+      if (!nested) this.database.exec("COMMIT");
+      return result;
+    } catch (error) {
+      if (!nested && this.database.inTransaction) this.database.exec("ROLLBACK");
+      throw error;
+    }
+  }
+
+  private recordAudit(input: {
+    actorRef: string;
+    actorType: "system" | "super_admin";
+    afterSummary: Record<string, unknown> | null;
+    beforeSummary: Record<string, unknown> | null;
+    operationType: string;
+    result: "succeeded" | "failed";
+    targetRef: string;
+    targetType: string;
+  }, now: number) {
+    this.database.prepare(`
+      INSERT INTO admin_operation_logs (
+        log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
+        result, before_summary, after_summary, occurred_at, expires_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      randomUUID(), input.actorType, input.actorRef, input.operationType, input.targetType, input.targetRef,
+      input.result, serializeAuditSummary(input.beforeSummary), serializeAuditSummary(input.afterSummary), now,
+      now + retentionMilliseconds,
+    );
+  }
+}
+
+function normalizeReason(reason: string) {
+  const normalized = reason.trim().toLowerCase().replace(/[^a-z0-9_.-]/g, "_").slice(0, 120);
+  return normalized || "provider_unavailable";
+}

apps/api/src/main.ts

@@ -18,6 +18,8 @@ import { StructuredJsonlLogger } from "./structured-log.js";
 import { attachApiSupervisorControl, initializeApiCredentialClients, receiveApiCredentials } from "./supervisor-channel.js";
 import { ModelConfigurationService } from "./model-configuration.js";
 import { MockAmapAdapter } from "./amap-adapter.js";
+import { StickerReleaseService } from "./sticker-releases.js";
+import { createAdminDiagnosticsProvider, createAdminServicesStorageProvider } from "./admin-state.js";
 
 const credentialChannelEnabled = process.argv.includes("--dada-credential-stdin");
 let registration: RegistrationService | undefined;
@@ -27,6 +29,7 @@ let storage: ManagedStorage | undefined;
 let latestExports: LatestExportService | undefined;
 let models: ModelConfigurationService | undefined;
 let recentAssets: RecentAssetService | undefined;
+let stickers: StickerReleaseService | undefined;
 const instanceConfigPath = process.env.DADA_INSTANCE_CONFIG_PATH ?? defaultInstanceConfigPath();
 if (credentialChannelEnabled) {
   const clients = initializeApiCredentialClients(await receiveApiCredentials());
@@ -48,11 +51,14 @@ if (credentialChannelEnabled) {
     projects = new ProjectService({ databasePath });
     credits = new CreditService({ databasePath });
     storage = new ManagedStorage({ dataRoot, databasePath });
+    stickers = new StickerReleaseService({ databasePath, storage });
     latestExports = new LatestExportService({ databasePath, storage });
     models = new ModelConfigurationService({ database: registration.database });
     recentAssets = new RecentAssetService({ database: registration.database });
     registration.applySecureConfig(readSecureConfigCandidate(instanceConfigPath));
   } catch (error) {
+    stickers?.close();
+    stickers = undefined;
     latestExports?.close();
     latestExports = undefined;
     storage?.close();
@@ -70,7 +76,22 @@ if (credentialChannelEnabled) {
 }
 
 const browserSupportRelease = readBrowserSupportRelease(resolve("RELEASE.json"));
+const adminServicesStorage = registration
+  ? createAdminServicesStorageProvider({
+    database: registration.database,
+    ...(models ? { models } : {}),
+    ...(storage ? { storage } : {}),
+  })
+  : undefined;
+const adminDiagnostics = adminServicesStorage
+  ? createAdminDiagnosticsProvider({
+    ...(browserSupportRelease ? { browserSupportRelease, appVersion: browserSupportRelease.appVersion } : {}),
+    servicesStorage: adminServicesStorage,
+  })
+  : undefined;
 const app = await createApp({
+  ...(adminServicesStorage ? { adminServicesStorage } : {}),
+  ...(adminDiagnostics ? { adminDiagnostics } : {}),
   amap: new MockAmapAdapter(),
   ...(browserSupportRelease ? { browserSupportRelease } : {}),
   ...(credits ? { credits } : {}),
@@ -79,6 +100,8 @@ const app = await createApp({
   ...(projects ? { projects } : {}),
   ...(registration ? { registration } : {}),
   ...(recentAssets ? { recentAssets } : {}),
+  ...(stickers ? { stickers } : {}),
+  ...(storage ? { storage } : {}),
 });
 
 await app.listen({
@@ -97,6 +120,7 @@ if (controlPipeIndex >= 0) {
     projects?.close();
     registration?.close();
     storage?.close();
+    stickers?.close();
   });
   try {
     const dataRoot = readConfiguredLocalDataRoot(instanceConfigPath);

apps/api/src/managed-storage.ts

@@ -75,6 +75,31 @@ interface CleanupQueueRow {
   relative_path: string;
 }
 
+export interface AssetCleanupCandidateView {
+  byte_size: number;
+  file_id: string;
+  file_kind: "original" | "thumbnail";
+  hash_prefix: string;
+  reference_count: 0;
+  resource_version: string;
+  stable_id: string;
+}
+
+export interface AssetCleanupCandidatesView {
+  candidate_snapshot_version: string;
+  expires_at: string;
+  items: AssetCleanupCandidateView[];
+}
+
+export interface AssetCleanupIntentView {
+  confirmation_token: string;
+  expires_at: string;
+  file_count: number;
+  request_id: string;
+  status: "pending_confirmation" | "denied" | "queued" | "completed";
+  total_bytes: number;
+}
+
 export class StorageCapacityError extends Error {
   readonly code = "STORAGE_CAPACITY_EXCEEDED";
   readonly httpStatus = 507;
@@ -104,6 +129,10 @@ function auditExpiry(occurredAt: number) {
   return occurredAt + auditRetentionMilliseconds;
 }
 
+function digest(value: string) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+
 function validatePositiveBytes(value: number, name: string) {
   if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${name}_invalid`);
 }
@@ -255,6 +284,28 @@ export class ManagedStorage {
         FOREIGN KEY (request_id) REFERENCES asset_cleanup_requests(request_id),
         FOREIGN KEY (managed_file_id) REFERENCES managed_files(file_id)
       );
+      CREATE TABLE IF NOT EXISTS asset_cleanup_candidate_snapshots (
+        snapshot_version TEXT PRIMARY KEY,
+        items_json TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS sticker_managed_file_history (
+        managed_file_id TEXT NOT NULL,
+        stable_id TEXT NOT NULL,
+        resource_version TEXT NOT NULL,
+        file_kind TEXT NOT NULL CHECK (file_kind IN ('original', 'thumbnail')),
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (managed_file_id, file_kind),
+        FOREIGN KEY (managed_file_id) REFERENCES managed_files(file_id)
+      );
+      CREATE TABLE IF NOT EXISTS project_sticker_asset_refs (
+        reference_id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL,
+        stable_id TEXT NOT NULL,
+        resource_version TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      );
       CREATE TABLE IF NOT EXISTS admin_operation_logs (
         log_id TEXT PRIMARY KEY,
         actor_type TEXT NOT NULL CHECK (actor_type IN ('system', 'super_admin')),
@@ -277,6 +328,49 @@ export class ManagedStorage {
     if (!managedFileColumns.some((column) => column.name === "owner_ref")) {
       this.database.exec("ALTER TABLE managed_files ADD COLUMN owner_ref TEXT");
     }
+    if (!managedFileColumns.some((column) => column.name === "cleanup_status")) {
+      this.database.exec("ALTER TABLE managed_files ADD COLUMN cleanup_status TEXT");
+    }
+    const cleanupRequestColumns = this.database.prepare("PRAGMA table_info(asset_cleanup_requests)").all() as Array<{ name: string }>;
+    const cleanupRequestAdditions: Array<[string, string]> = [
+      ["created_by", "TEXT"],
+      ["confirmed_by", "TEXT"],
+      ["snapshot_version", "TEXT"],
+      ["expires_at", "INTEGER"],
+      ["confirmation_token_digest", "TEXT"],
+      ["idempotency_key_digest", "TEXT"],
+      ["request_hash", "TEXT"],
+      ["file_count", "INTEGER"],
+      ["total_bytes", "INTEGER"],
+      ["denied_reason", "TEXT"],
+    ];
+    for (const [column, type] of cleanupRequestAdditions) {
+      if (!cleanupRequestColumns.some((item) => item.name === column)) {
+        this.database.exec(`ALTER TABLE asset_cleanup_requests ADD COLUMN ${column} ${type}`);
+      }
+    }
+    const cleanupItemColumns = this.database.prepare("PRAGMA table_info(asset_cleanup_request_items)").all() as Array<{ name: string }>;
+    const cleanupItemAdditions: Array<[string, string]> = [
+      ["stable_id", "TEXT"],
+      ["resource_version", "TEXT"],
+      ["file_kind", "TEXT"],
+      ["byte_size", "INTEGER"],
+      ["sha256_prefix", "TEXT"],
+    ];
+    for (const [column, type] of cleanupItemAdditions) {
+      if (!cleanupItemColumns.some((item) => item.name === column)) {
+        this.database.exec(`ALTER TABLE asset_cleanup_request_items ADD COLUMN ${column} ${type}`);
+      }
+    }
+    this.database.exec(`
+      CREATE UNIQUE INDEX IF NOT EXISTS asset_cleanup_requests_actor_idempotency
+      ON asset_cleanup_requests (created_by, idempotency_key_digest)
+      WHERE created_by IS NOT NULL AND idempotency_key_digest IS NOT NULL;
+      CREATE INDEX IF NOT EXISTS sticker_managed_file_history_lookup
+      ON sticker_managed_file_history (stable_id, resource_version, file_kind);
+      CREATE INDEX IF NOT EXISTS asset_cleanup_candidate_snapshots_expiry
+      ON asset_cleanup_candidate_snapshots (expires_at);
+    `);
     ensureAdminOperationAuditSchema(this.database, Date.now());
     const initial = classifyCapacity(0, 0);
     this.database.prepare(`
@@ -299,6 +393,106 @@ export class ManagedStorage {
     return withReservations;
   }
 
+  private readAssetCleanupCandidates(): AssetCleanupCandidateView[] {
+    const releaseReferenceClause = this.tableExists("sticker_release_items") ? `
+        AND NOT EXISTS (
+          SELECT 1 FROM sticker_release_items release_items
+          WHERE release_items.original_file_id = mf.file_id OR release_items.thumbnail_file_id = mf.file_id
+        )` : "";
+    return this.database.prepare(`
+      SELECT
+        mf.file_id,
+        mf.byte_size,
+        history.stable_id,
+        history.resource_version,
+        history.file_kind,
+        substr(mf.sha256, 1, 12) AS hash_prefix,
+        0 AS reference_count
+      FROM sticker_managed_file_history history
+      JOIN managed_files mf ON mf.file_id = history.managed_file_id
+      WHERE mf.status = 'committed'
+        AND mf.cleanup_status IS NULL
+        AND mf.file_kind IN ('sticker_original', 'sticker_thumbnail')
+        AND NOT EXISTS (
+          SELECT 1 FROM project_asset_refs refs WHERE refs.managed_file_id = mf.file_id
+        )
+        AND NOT EXISTS (
+          SELECT 1 FROM project_sticker_asset_refs project_refs
+          WHERE project_refs.stable_id = history.stable_id
+            AND project_refs.resource_version = history.resource_version
+        )
+        ${releaseReferenceClause}
+        AND NOT EXISTS (
+          SELECT 1 FROM asset_cleanup_request_items request_items
+          JOIN asset_cleanup_requests requests ON requests.request_id = request_items.request_id
+          WHERE request_items.managed_file_id = mf.file_id
+            AND requests.status IN ('pending_confirmation', 'queued')
+        )
+      ORDER BY history.stable_id, history.resource_version, history.file_kind, mf.file_id
+    `).all() as AssetCleanupCandidateView[];
+  }
+
+  private assertActiveAdmin(actorId: string) {
+    const admin = this.database.prepare(`
+      SELECT 1 AS allowed FROM users u
+      JOIN admin_access access ON access.user_id = u.user_id
+      WHERE u.user_id = ? AND u.role = 'super_admin' AND u.status = 'active' AND access.allowed = 1
+    `).get(actorId);
+    if (!admin) throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
+  }
+
+  private assetReferenceCount(fileId: string, requestId: string) {
+    const projectOrRelease = (this.database.prepare(`
+      SELECT COUNT(*) AS count FROM project_asset_refs WHERE managed_file_id = ?
+    `).get(fileId) as { count: number }).count;
+    const releaseItems = this.tableExists("sticker_release_items")
+      ? (this.database.prepare(`
+          SELECT COUNT(*) AS count FROM sticker_release_items
+          WHERE original_file_id = ? OR thumbnail_file_id = ?
+        `).get(fileId, fileId) as { count: number }).count
+      : 0;
+    const projectStickerRefs = (this.database.prepare(`
+      SELECT COUNT(*) AS count
+      FROM sticker_managed_file_history history
+      JOIN project_sticker_asset_refs refs
+        ON refs.stable_id = history.stable_id AND refs.resource_version = history.resource_version
+      WHERE history.managed_file_id = ?
+    `).get(fileId) as { count: number }).count;
+    const otherCleanup = (this.database.prepare(`
+      SELECT COUNT(*) AS count FROM asset_cleanup_request_items items
+      JOIN asset_cleanup_requests requests ON requests.request_id = items.request_id
+      WHERE items.managed_file_id = ? AND items.request_id <> ?
+        AND requests.status IN ('pending_confirmation', 'queued')
+    `).get(fileId, requestId) as { count: number }).count;
+    return projectOrRelease + releaseItems + projectStickerRefs + otherCleanup;
+  }
+
+  private cleanupConfirmationToken(requestId: string, actorId: string, keyDigest: string) {
+    return digest(`Dada/P0A/asset-cleanup-confirm/v1:${requestId}:${actorId}:${keyDigest}`);
+  }
+
+  private tableExists(name: string) {
+    return Boolean(this.database.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(name));
+  }
+
+  private insertCleanupAudit(input: {
+    actorRef: string;
+    afterSummary: Record<string, unknown>;
+    operationType: string;
+    requestId: string;
+    result: "failed" | "succeeded";
+  }, occurredAt: number) {
+    this.database.prepare(`
+      INSERT INTO admin_operation_logs (
+        log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
+        result, before_summary, after_summary, occurred_at, expires_at
+      ) VALUES (?, 'super_admin', ?, ?, 'asset_cleanup_request', ?, ?, NULL, ?, ?, ?)
+    `).run(
+      randomUUID(), input.actorRef, input.operationType, input.requestId, input.result,
+      serializeAuditSummary(input.afterSummary), occurredAt, auditExpiry(occurredAt),
+    );
+  }
+
   private activeReservationBytes(excludingOperationId?: string) {
     const row = this.database.prepare(`
       SELECT COALESCE(SUM(projected_bytes), 0) AS bytes
@@ -496,9 +690,11 @@ export class ManagedStorage {
     }
   }
 
-  async stagePrivateImage(input: {
+  async stageManagedImage(input: {
     content: Readable;
     expectedMimeType: "image/png" | "image/jpeg" | "image/webp";
+    expectedSha256?: string;
+    fileKind: ManagedFileKind;
     fileName: string;
     maximumBytes: number;
     operationId: string;
@@ -509,7 +705,7 @@ export class ManagedStorage {
     const destination = this.destination({
       content: input.content,
       expectedMimeType: input.expectedMimeType,
-      fileKind: "reference",
+      fileKind: input.fileKind,
       fileName: input.fileName,
       operationId: input.operationId,
       ownerRef: input.ownerRef,
@@ -537,6 +733,8 @@ export class ManagedStorage {
       await pipeline(input.content, inspect, createWriteStream(stagingPath, { flags: "wx" }));
       validatePositiveBytes(byteSize, "actual_write_bytes");
       if (sniffMime(prefix) !== input.expectedMimeType) throw new Error("content_mime_invalid");
+      const sha256 = hash.digest("hex");
+      if (input.expectedSha256 && sha256.toLowerCase() !== input.expectedSha256.toLowerCase()) throw new Error("content_hash_invalid");
       const state = this.getState();
       const otherReservations = this.activeReservationBytes(input.operationId);
       if (state.managed_content_bytes + otherReservations + byteSize > HARD_LIMIT_BYTES) {
@@ -549,12 +747,12 @@ export class ManagedStorage {
         bytes: byteSize,
         destinationPath: destination.absolutePath,
         fileId,
-        fileKind: "reference",
+        fileKind: input.fileKind,
         mimeType: input.expectedMimeType,
         operationId: input.operationId,
         ownerRef: input.ownerRef,
         relativePath: destination.relativePath,
-        sha256: hash.digest("hex"),
+        sha256,
         stagingDirectory,
         stagingPath,
       };
@@ -565,6 +763,18 @@ export class ManagedStorage {
     }
   }
 
+  async stagePrivateImage(input: {
+    content: Readable;
+    expectedMimeType: "image/png" | "image/jpeg" | "image/webp";
+    fileName: string;
+    maximumBytes: number;
+    operationId: string;
+    ownerRef: string;
+    projectedWriteBytes: number;
+  }): Promise<StagedManagedFile> {
+    return this.stageManagedImage({ ...input, fileKind: "reference" });
+  }
+
   moveStagedFile(file: StagedManagedFile) {
     mkdirSync(dirname(file.destinationPath), { recursive: true });
     renameSync(file.stagingPath, file.destinationPath);
@@ -676,6 +886,203 @@ export class ManagedStorage {
     this.database.prepare("DELETE FROM project_asset_refs WHERE managed_file_id = ?").run(fileId);
   }
 
+  listAssetCleanupCandidates(): AssetCleanupCandidatesView {
+    const createdAt = Date.now();
+    const expiresAt = createdAt + 5 * 60 * 1_000;
+    const items = this.readAssetCleanupCandidates();
+    const snapshotVersion = digest(JSON.stringify({
+      created_at: createdAt,
+      nonce: randomUUID(),
+      items: items.map((item) => ({ byte_size: item.byte_size, file_id: item.file_id, hash_prefix: item.hash_prefix })),
+    }));
+    this.database.prepare("DELETE FROM asset_cleanup_candidate_snapshots WHERE expires_at <= ?").run(createdAt);
+    this.database.prepare(`
+      INSERT INTO asset_cleanup_candidate_snapshots (
+        snapshot_version, items_json, created_at, expires_at
+      ) VALUES (?, ?, ?, ?)
+    `).run(snapshotVersion, JSON.stringify(items), createdAt, expiresAt);
+    return {
+      candidate_snapshot_version: snapshotVersion,
+      expires_at: new Date(expiresAt).toISOString(),
+      items,
+    };
+  }
+
+  createAssetCleanupIntent(input: {
+    actorId: string;
+    fileIds: string[];
+    idempotencyKey: string;
+    snapshotVersion: string;
+  }): AssetCleanupIntentView {
+    if (this.inspectAction("explicit_cleanup") !== "allow") throw new Error("cleanup_uncommitted");
+    const fileIds = [...new Set(input.fileIds)].sort();
+    if (!uuidPattern.test(input.actorId) || fileIds.length === 0 || fileIds.length !== input.fileIds.length
+      || fileIds.length > 100 || fileIds.some((fileId) => !uuidPattern.test(fileId))
+      || !/^[A-Za-z0-9_-]{32,200}$/.test(input.idempotencyKey)
+      || !/^[0-9a-f]{64}$/.test(input.snapshotVersion)) {
+      throw new Error("cleanup_candidates_invalid");
+    }
+    const keyDigest = digest(input.idempotencyKey);
+    const requestHash = digest(JSON.stringify({ file_ids: fileIds, snapshot_version: input.snapshotVersion }));
+    const existing = this.database.prepare(`
+      SELECT request_id, request_hash, expires_at, file_count, total_bytes, status
+      FROM asset_cleanup_requests
+      WHERE created_by = ? AND idempotency_key_digest = ?
+    `).get(input.actorId, keyDigest) as {
+      expires_at: number; file_count: number; request_hash: string; request_id: string; status: AssetCleanupIntentView["status"]; total_bytes: number;
+    } | undefined;
+    if (existing) {
+      if (existing.request_hash !== requestHash) throw new Error("IDEMPOTENCY_KEY_CONFLICT");
+      return {
+        confirmation_token: this.cleanupConfirmationToken(existing.request_id, input.actorId, keyDigest),
+        expires_at: new Date(existing.expires_at).toISOString(),
+        file_count: existing.file_count,
+        request_id: existing.request_id,
+        status: existing.status,
+        total_bytes: existing.total_bytes,
+      };
+    }
+
+    const requestId = randomUUID();
+    const confirmationToken = this.cleanupConfirmationToken(requestId, input.actorId, keyDigest);
+    const createdAt = Date.now();
+    let view!: AssetCleanupIntentView;
+    const transaction = this.database.transaction(() => {
+      this.assertActiveAdmin(input.actorId);
+      const snapshot = this.database.prepare(`
+        SELECT items_json, expires_at FROM asset_cleanup_candidate_snapshots
+        WHERE snapshot_version = ?
+      `).get(input.snapshotVersion) as { expires_at: number; items_json: string } | undefined;
+      if (!snapshot || snapshot.expires_at <= createdAt) throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
+      const snapshotItems = JSON.parse(snapshot.items_json) as AssetCleanupCandidateView[];
+      const byId = new Map(snapshotItems.map((item) => [item.file_id, item]));
+      const selected = fileIds.map((fileId) => byId.get(fileId));
+      if (selected.some((item) => !item)) throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
+      const current = new Map(this.readAssetCleanupCandidates().map((item) => [item.file_id, item]));
+      if (fileIds.some((fileId) => !current.has(fileId))) throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
+      const safeItems = selected as AssetCleanupCandidateView[];
+      const totalBytes = safeItems.reduce((sum, item) => sum + item.byte_size, 0);
+      this.database.prepare(`
+        INSERT INTO asset_cleanup_requests (
+          request_id, status, created_at, confirmed_at, created_by, confirmed_by,
+          snapshot_version, expires_at, confirmation_token_digest,
+          idempotency_key_digest, request_hash, file_count, total_bytes, denied_reason
+        ) VALUES (?, 'pending_confirmation', ?, NULL, ?, NULL, ?, ?, ?, ?, ?, ?, ?, NULL)
+      `).run(
+        requestId, new Date(createdAt).toISOString(), input.actorId, input.snapshotVersion,
+        snapshot.expires_at, digest(confirmationToken), keyDigest, requestHash, safeItems.length, totalBytes,
+      );
+      const insert = this.database.prepare(`
+        INSERT INTO asset_cleanup_request_items (
+          request_id, managed_file_id, stable_id, resource_version, file_kind, byte_size, sha256_prefix
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+      `);
+      for (const item of safeItems) {
+        insert.run(requestId, item.file_id, item.stable_id, item.resource_version, item.file_kind, item.byte_size, item.hash_prefix);
+      }
+      this.insertCleanupAudit({
+        actorRef: input.actorId,
+        afterSummary: { file_count: safeItems.length, snapshot_version: input.snapshotVersion, total_bytes: totalBytes },
+        operationType: "asset_cleanup_requested",
+        requestId,
+        result: "succeeded",
+      }, createdAt);
+      view = {
+        confirmation_token: confirmationToken,
+        expires_at: new Date(snapshot.expires_at).toISOString(),
+        file_count: safeItems.length,
+        request_id: requestId,
+        status: "pending_confirmation",
+        total_bytes: totalBytes,
+      };
+    });
+    transaction.immediate();
+    return view;
+  }
+
+  confirmAssetCleanupIntent(input: { actorId: string; confirmationToken: string; requestId: string }) {
+    if (this.inspectAction("explicit_cleanup") !== "allow") throw new Error("cleanup_uncommitted");
+    if (!uuidPattern.test(input.actorId) || !uuidPattern.test(input.requestId) || !/^[0-9a-f]{64}$/.test(input.confirmationToken)) {
+      throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
+    }
+    const confirmedAt = Date.now();
+    const outcome = this.database.transaction(() => {
+      this.assertActiveAdmin(input.actorId);
+      const request = this.database.prepare(`
+        SELECT status, created_by, expires_at, confirmation_token_digest, file_count, total_bytes
+        FROM asset_cleanup_requests WHERE request_id = ?
+      `).get(input.requestId) as {
+        confirmation_token_digest: string | null; created_by: string | null; expires_at: number | null;
+        file_count: number | null; status: string; total_bytes: number | null;
+      } | undefined;
+      if (!request || request.status !== "pending_confirmation" || request.created_by !== input.actorId
+        || !request.expires_at || request.expires_at <= confirmedAt
+        || request.confirmation_token_digest !== digest(input.confirmationToken)) {
+        throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
+      }
+      const files = this.database.prepare(`
+        SELECT mf.file_id, mf.file_kind, mf.relative_path, mf.byte_size, mf.status
+        FROM asset_cleanup_request_items items
+        JOIN managed_files mf ON mf.file_id = items.managed_file_id
+        WHERE items.request_id = ? ORDER BY mf.file_id
+      `).all(input.requestId) as ManagedFileRow[];
+      if (files.length !== request.file_count) throw new Error("ASSET_CLEANUP_CANDIDATE_STALE");
+      const conflicted = files.some((file) => file.status !== "committed"
+        || !new Set(["sticker_original", "sticker_thumbnail"]).has(file.file_kind)
+        || this.assetReferenceCount(file.file_id, input.requestId) > 0);
+      if (conflicted) {
+        this.database.prepare(`
+          UPDATE asset_cleanup_requests
+          SET status = 'denied', confirmed_at = ?, confirmed_by = ?, denied_reason = 'reference_conflict'
+          WHERE request_id = ?
+        `).run(new Date(confirmedAt).toISOString(), input.actorId, input.requestId);
+        this.insertCleanupAudit({
+          actorRef: input.actorId,
+          afterSummary: { file_count: files.length, reason: "reference_conflict", status: "denied" },
+          operationType: "asset_cleanup_reference_denied",
+          requestId: input.requestId,
+          result: "failed",
+        }, confirmedAt);
+        return { conflict: true as const };
+      }
+
+      this.insertCleanupAudit({
+        actorRef: input.actorId,
+        afterSummary: { file_count: files.length, status: "validated" },
+        operationType: "asset_cleanup_validated",
+        requestId: input.requestId,
+        result: "succeeded",
+      }, confirmedAt);
+      for (const file of files) {
+        this.database.prepare(`
+          UPDATE managed_files SET status = 'purged', purged_at = ?, cleanup_status = 'pending_delete'
+          WHERE file_id = ? AND status = 'committed'
+        `).run(new Date(confirmedAt).toISOString(), file.file_id);
+        this.database.prepare(`
+          INSERT INTO file_cleanup_queue (
+            cleanup_id, managed_file_id, relative_path, byte_size, counts_toward_managed,
+            reason, status, created_at, completed_at, last_error
+          ) VALUES (?, ?, ?, ?, 1, 'purge', 'pending', ?, NULL, NULL)
+        `).run(randomUUID(), file.file_id, file.relative_path, file.byte_size, new Date(confirmedAt).toISOString());
+      }
+      this.database.prepare(`
+        UPDATE asset_cleanup_requests
+        SET status = 'queued', confirmed_at = ?, confirmed_by = ?
+        WHERE request_id = ?
+      `).run(new Date(confirmedAt).toISOString(), input.actorId, input.requestId);
+      this.insertCleanupAudit({
+        actorRef: input.actorId,
+        afterSummary: { file_count: files.length, status: "queued", total_bytes: request.total_bytes ?? 0 },
+        operationType: "asset_cleanup_scheduled",
+        requestId: input.requestId,
+        result: "succeeded",
+      }, confirmedAt + 1);
+      return { conflict: false as const, file_count: files.length, request_id: input.requestId, status: "queued" as const };
+    }).immediate();
+    if (outcome.conflict) throw new Error("ASSET_HISTORY_REFERENCE_CONFLICT");
+    return outcome;
+  }
+
   createCleanupIntent(fileIds: string[]) {
     if (this.inspectAction("explicit_cleanup") !== "allow") throw new Error("cleanup_uncommitted");
     if (fileIds.length === 0 || new Set(fileIds).size !== fileIds.length) throw new Error("cleanup_candidates_invalid");
@@ -761,6 +1168,7 @@ export class ManagedStorage {
             this.database.prepare("DELETE FROM project_asset_refs WHERE managed_file_id = ?").run(row.managed_file_id);
             const requests = this.database.prepare("SELECT request_id FROM asset_cleanup_request_items WHERE managed_file_id = ?").all(row.managed_file_id) as Array<{ request_id: string }>;
             this.database.prepare("DELETE FROM asset_cleanup_request_items WHERE managed_file_id = ?").run(row.managed_file_id);
+            this.database.prepare("DELETE FROM sticker_managed_file_history WHERE managed_file_id = ?").run(row.managed_file_id);
             this.database.prepare("DELETE FROM managed_files WHERE file_id = ?").run(row.managed_file_id);
             for (const request of requests) {
               const pendingItems = this.database.prepare("SELECT COUNT(*) AS count FROM asset_cleanup_request_items WHERE request_id = ?").get(request.request_id) as { count: number };

apps/api/src/preview-grants.ts

@@ -0,0 +1,483 @@
+import { createHash, randomUUID } from "node:crypto";
+
+import type {
+  AssetReleaseManifestItem,
+  AssetReleaseManifestProjection,
+  AssetReleaseReader,
+} from "@dada/asset-release-manifest";
+
+import { auditRetentionMilliseconds, serializeAuditSummary } from "./audit-policy.js";
+import type { RegistrationService } from "./registration.js";
+
+export type PreviewBatchStatus = "active" | "closed";
+export type PreviewGrantStatus = "active" | "revoked" | "expired";
+
+export interface PreviewBatchView {
+  batchId: string;
+  createdAt: number;
+  createdBy: string;
+  name: string;
+  status: PreviewBatchStatus;
+}
+
+export interface PreviewGrantView {
+  batchId: string;
+  expiresAt: number;
+  grantId: string;
+  grantedAt: number;
+  grantedBy: string;
+  status: PreviewGrantStatus;
+  userId: string;
+}
+
+export class PreviewGrantError extends Error {
+  constructor(
+    public readonly reason:
+      | "admin_invalid"
+      | "batch_closed"
+      | "batch_not_found"
+      | "grant_not_found"
+      | "invalid_expiry"
+      | "invalid_request"
+      | "resource_not_found"
+      | "user_not_eligible",
+  ) {
+    super(reason);
+    this.name = "PreviewGrantError";
+  }
+}
+
+interface PreviewGrantServiceOptions {
+  assetReleases: AssetReleaseReader;
+  clock?: () => number;
+  registration: RegistrationService;
+}
+
+interface PreviewManifestItemMapping {
+  releaseVersion: string;
+  resourceId: string;
+  userId: string;
+}
+
+function isUuid(value: string) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+
+function assertText(value: string, name: string) {
+  const normalized = value.trim();
+  if (!normalized || normalized.length > 160) throw new PreviewGrantError("invalid_request");
+  if (name === "batchId" && !isUuid(normalized)) throw new PreviewGrantError("invalid_request");
+  return normalized;
+}
+
+function manifestHash(items: readonly AssetReleaseManifestItem[], releaseVersion: string) {
+  return createHash("sha256")
+    .update(JSON.stringify({
+      items,
+      release_version: releaseVersion,
+      schema_version: "AssetReleaseManifest/v1",
+    }))
+    .digest("hex");
+}
+
+/**
+ * Owns the P0-A preview grant state. Preview URLs are deliberately ephemeral:
+ * the random item id is kept only in this process and every read rechecks the
+ * persisted grant, so revocation and expiry take effect without cache busting.
+ */
+export class AssetPreviewGrantService {
+  readonly database: RegistrationService["database"];
+  readonly options: Required<Pick<PreviewGrantServiceOptions, "clock">> & PreviewGrantServiceOptions;
+  private readonly itemMappings = new Map<string, PreviewManifestItemMapping>();
+
+  constructor(options: PreviewGrantServiceOptions) {
+    this.database = options.registration.database;
+    this.options = { ...options, clock: options.clock ?? Date.now };
+    this.migrate();
+  }
+
+  createBatch(input: { adminUserId: string; batchId?: string; name: string }): PreviewBatchView {
+    const adminUserId = assertText(input.adminUserId, "adminUserId");
+    const name = assertText(input.name, "name");
+    const batchId = input.batchId ? assertText(input.batchId, "batchId") : randomUUID();
+    const now = this.options.clock();
+    this.assertAdmin(adminUserId, now);
+    this.immediate(() => {
+      this.database.prepare(`
+        INSERT INTO test_batches (batch_id, name, status, created_by, created_at, closed_at)
+        VALUES (?, ?, 'active', ?, ?, NULL)
+      `).run(batchId, name, adminUserId, now);
+      this.audit({
+        actorRef: adminUserId,
+        afterSummary: { batch_id: batchId, status: "active" },
+        beforeSummary: null,
+        operationType: "preview_batch_create",
+        targetRef: batchId,
+        targetType: "preview_batch",
+      }, now);
+    });
+    return { batchId, createdAt: now, createdBy: adminUserId, name, status: "active" };
+  }
+
+  closeBatch(input: { adminUserId: string; batchId: string }): PreviewBatchView {
+    const adminUserId = assertText(input.adminUserId, "adminUserId");
+    const batchId = assertText(input.batchId, "batchId");
+    const now = this.options.clock();
+    this.assertAdmin(adminUserId, now);
+    return this.immediate(() => {
+      const batch = this.readBatch(batchId);
+      if (!batch) throw new PreviewGrantError("batch_not_found");
+      if (batch.status === "active") {
+        this.database.prepare("UPDATE test_batches SET status = 'closed', closed_at = ? WHERE batch_id = ?").run(now, batchId);
+        this.audit({
+          actorRef: adminUserId,
+          afterSummary: { batch_id: batchId, status: "closed" },
+          beforeSummary: { batch_id: batchId, status: batch.status },
+          operationType: "preview_batch_close",
+          targetRef: batchId,
+          targetType: "preview_batch",
+        }, now);
+      }
+      return { ...batch, status: "closed" as const };
+    });
+  }
+
+  addBatchItems(input: {
+    adminUserId: string;
+    batchId: string;
+    releaseVersion: string;
+    resourceIds: readonly string[];
+  }) {
+    const adminUserId = assertText(input.adminUserId, "adminUserId");
+    const batchId = assertText(input.batchId, "batchId");
+    const releaseVersion = assertText(input.releaseVersion, "releaseVersion");
+    const resourceIds = [...new Set(input.resourceIds.map((resourceId) => assertText(resourceId, "resourceId")))];
+    if (resourceIds.length === 0) throw new PreviewGrantError("invalid_request");
+    const now = this.options.clock();
+    this.assertAdmin(adminUserId, now);
+    for (const resourceId of resourceIds) {
+      if (!this.options.assetReleases.read("internal_preview_asset", releaseVersion, resourceId)) {
+        throw new PreviewGrantError("resource_not_found");
+      }
+    }
+    this.immediate(() => {
+      const batch = this.readBatch(batchId);
+      if (!batch) throw new PreviewGrantError("batch_not_found");
+      if (batch.status !== "active") throw new PreviewGrantError("batch_closed");
+      const insert = this.database.prepare(`
+        INSERT OR IGNORE INTO test_batch_items (test_batch_id, release_version, resource_id)
+        VALUES (?, ?, ?)
+      `);
+      for (const resourceId of resourceIds) insert.run(batchId, releaseVersion, resourceId);
+      this.audit({
+        actorRef: adminUserId,
+        afterSummary: { batch_id: batchId, item_count: resourceIds.length, release_version: releaseVersion },
+        beforeSummary: null,
+        operationType: "preview_batch_items_add",
+        targetRef: batchId,
+        targetType: "preview_batch",
+      }, now);
+    });
+    return { batchId, releaseVersion, resourceIds };
+  }
+
+  grant(input: {
+    adminUserId: string;
+    batchId: string;
+    expiresAt: number;
+    userId: string;
+  }): PreviewGrantView {
+    const adminUserId = assertText(input.adminUserId, "adminUserId");
+    const batchId = assertText(input.batchId, "batchId");
+    const userId = assertText(input.userId, "userId");
+    if (!isUuid(userId)) throw new PreviewGrantError("invalid_request");
+    const now = this.options.clock();
+    if (!Number.isSafeInteger(input.expiresAt) || input.expiresAt <= now) throw new PreviewGrantError("invalid_expiry");
+    this.assertAdmin(adminUserId, now);
+    return this.immediate(() => {
+      const batch = this.readBatch(batchId);
+      if (!batch) throw new PreviewGrantError("batch_not_found");
+      if (batch.status !== "active") throw new PreviewGrantError("batch_closed");
+      const user = this.database.prepare("SELECT role, status FROM users WHERE user_id = ?").get(userId) as { role: string; status: string } | undefined;
+      if (!user || user.role !== "user" || user.status !== "active") throw new PreviewGrantError("user_not_eligible");
+      const grantId = randomUUID();
+      this.database.prepare(`
+        INSERT INTO asset_preview_grants (
+          grant_id, user_id, test_batch_id, granted_by, granted_at, expires_at, status
+        ) VALUES (?, ?, ?, ?, ?, ?, 'active')
+      `).run(grantId, userId, batchId, adminUserId, now, input.expiresAt);
+      this.audit({
+        actorRef: adminUserId,
+        afterSummary: { batch_id: batchId, expires_at: input.expiresAt, grant_id: grantId, status: "active", user_id: userId },
+        beforeSummary: null,
+        operationType: "preview_grant_create",
+        targetRef: grantId,
+        targetType: "preview_grant",
+      }, now);
+      return {
+        batchId,
+        expiresAt: input.expiresAt,
+        grantId,
+        grantedAt: now,
+        grantedBy: adminUserId,
+        status: "active" as const,
+        userId,
+      };
+    });
+  }
+
+  revoke(input: { adminUserId: string; grantId: string }): PreviewGrantView {
+    const adminUserId = assertText(input.adminUserId, "adminUserId");
+    const grantId = assertText(input.grantId, "grantId");
+    const now = this.options.clock();
+    this.assertAdmin(adminUserId, now);
+    return this.immediate(() => {
+      this.expireDue(now);
+      const grant = this.readGrant(grantId);
+      if (!grant) throw new PreviewGrantError("grant_not_found");
+      if (grant.status === "active") {
+        this.database.prepare("UPDATE asset_preview_grants SET status = 'revoked' WHERE grant_id = ? AND status = 'active'").run(grantId);
+        this.audit({
+          actorRef: adminUserId,
+          afterSummary: { grant_id: grantId, status: "revoked" },
+          beforeSummary: { grant_id: grantId, status: grant.status },
+          operationType: "preview_grant_revoke",
+          targetRef: grantId,
+          targetType: "preview_grant",
+        }, now);
+      }
+      return { ...grant, status: "revoked" as const };
+    });
+  }
+
+  listBatches(input: { adminUserId: string }): PreviewBatchView[] {
+    const adminUserId = assertText(input.adminUserId, "adminUserId");
+    this.assertAdmin(adminUserId, this.options.clock());
+    return (this.database.prepare(`
+      SELECT batch_id, name, status, created_by, created_at
+      FROM test_batches ORDER BY created_at DESC, batch_id DESC
+    `).all() as Array<{ batch_id: string; created_at: number; created_by: string; name: string; status: PreviewBatchStatus }>).map((row) => ({
+      batchId: row.batch_id,
+      createdAt: row.created_at,
+      createdBy: row.created_by,
+      name: row.name,
+      status: row.status,
+    }));
+  }
+
+  listGrants(input: { adminUserId: string; batchId?: string; userId?: string }): PreviewGrantView[] {
+    const adminUserId = assertText(input.adminUserId, "adminUserId");
+    this.assertAdmin(adminUserId, this.options.clock());
+    const batchId = input.batchId ? assertText(input.batchId, "batchId") : undefined;
+    const userId = input.userId ? assertText(input.userId, "userId") : undefined;
+    const now = this.options.clock();
+    return this.immediate(() => {
+      this.expireDue(now);
+      const rows = this.database.prepare(`
+        SELECT grant_id, user_id, test_batch_id, granted_by, granted_at, expires_at, status
+        FROM asset_preview_grants
+        WHERE (? IS NULL OR test_batch_id = ?) AND (? IS NULL OR user_id = ?)
+        ORDER BY granted_at DESC, grant_id DESC
+      `).all(batchId ?? null, batchId ?? null, userId ?? null, userId ?? null) as Array<{
+        expires_at: number; grant_id: string; granted_at: number; granted_by: string;
+        status: PreviewGrantStatus; test_batch_id: string; user_id: string;
+      }>;
+      return rows.map((row) => ({
+        batchId: row.test_batch_id,
+        expiresAt: row.expires_at,
+        grantId: row.grant_id,
+        grantedAt: row.granted_at,
+        grantedBy: row.granted_by,
+        status: row.status,
+        userId: row.user_id,
+      }));
+    });
+  }
+
+  projectManifest(input: { releaseVersion: string; userId: string }): AssetReleaseManifestProjection | undefined {
+    const releaseVersion = assertText(input.releaseVersion, "releaseVersion");
+    const userId = assertText(input.userId, "userId");
+    const base = this.options.assetReleases.project("internal_preview_asset", releaseVersion);
+    if (!base) return undefined;
+    const authorized = base.items.filter((item) => this.authorizeAsset({ releaseVersion, resourceId: item.resource_id, userId }));
+    if (authorized.length === 0) return undefined;
+    const items = authorized.map((item) => {
+      const manifestItemId = randomUUID();
+      const mapped: AssetReleaseManifestItem = {
+        ...item,
+        resource_id: manifestItemId,
+        url: `/api/v1/assets/preview/${releaseVersion}/${manifestItemId}`,
+      };
+      this.itemMappings.set(manifestItemId, {
+        releaseVersion,
+        resourceId: item.resource_id,
+        userId,
+      });
+      return mapped;
+    });
+    return Object.freeze({
+      items: Object.freeze(items.map((item) => Object.freeze(item))),
+      manifest_sha256: manifestHash(items, releaseVersion),
+      release_version: releaseVersion,
+      schema_version: "AssetReleaseManifest/v1" as const,
+    });
+  }
+
+  authorizeAsset(input: { releaseVersion: string; resourceId: string; userId: string }) {
+    const releaseVersion = assertText(input.releaseVersion, "releaseVersion");
+    const resourceId = assertText(input.resourceId, "resourceId");
+    const userId = assertText(input.userId, "userId");
+    const now = this.options.clock();
+    return this.immediate(() => {
+      this.expireDue(now);
+      const user = this.database.prepare("SELECT role, status FROM users WHERE user_id = ?").get(userId) as { role: string; status: string } | undefined;
+      if (!user || user.role !== "user" || user.status !== "active") return false;
+      const row = this.database.prepare(`
+        SELECT 1 AS authorized
+        FROM asset_preview_grants g
+        JOIN test_batch_items i ON i.test_batch_id = g.test_batch_id
+        WHERE g.user_id = ? AND g.status = 'active' AND g.expires_at > ?
+          AND i.release_version = ? AND i.resource_id = ?
+        LIMIT 1
+      `).get(userId, now, releaseVersion, resourceId) as { authorized: 1 } | undefined;
+      return Boolean(row);
+    });
+  }
+
+  readManifestItem(input: { manifestItemId: string; releaseVersion: string; userId: string }) {
+    const manifestItemId = assertText(input.manifestItemId, "manifestItemId");
+    const releaseVersion = assertText(input.releaseVersion, "releaseVersion");
+    const userId = assertText(input.userId, "userId");
+    const mapping = this.itemMappings.get(manifestItemId);
+    if (!mapping || mapping.releaseVersion !== releaseVersion || mapping.userId !== userId) return undefined;
+    if (!this.authorizeAsset({ releaseVersion, resourceId: mapping.resourceId, userId })) {
+      this.itemMappings.delete(manifestItemId);
+      return undefined;
+    }
+    const resource = this.options.assetReleases.read("internal_preview_asset", releaseVersion, mapping.resourceId);
+    return resource ? { ...resource, resourceId: manifestItemId } : undefined;
+  }
+
+  private migrate() {
+    this.database.exec(`
+      CREATE TABLE IF NOT EXISTS test_batches (
+        batch_id TEXT PRIMARY KEY,
+        name TEXT NOT NULL CHECK (length(name) BETWEEN 1 AND 160),
+        status TEXT NOT NULL CHECK (status IN ('active', 'closed')),
+        created_by TEXT NOT NULL REFERENCES users(user_id),
+        created_at INTEGER NOT NULL,
+        closed_at INTEGER
+      );
+      CREATE TABLE IF NOT EXISTS test_batch_items (
+        test_batch_id TEXT NOT NULL REFERENCES test_batches(batch_id),
+        release_version TEXT NOT NULL,
+        resource_id TEXT NOT NULL,
+        PRIMARY KEY (test_batch_id, release_version, resource_id)
+      );
+      CREATE TABLE IF NOT EXISTS asset_preview_grants (
+        grant_id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL REFERENCES users(user_id),
+        test_batch_id TEXT NOT NULL REFERENCES test_batches(batch_id),
+        granted_by TEXT NOT NULL REFERENCES users(user_id),
+        granted_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL CHECK (expires_at > granted_at),
+        status TEXT NOT NULL CHECK (status IN ('active', 'revoked', 'expired'))
+      );
+      CREATE INDEX IF NOT EXISTS asset_preview_grants_user_status
+        ON asset_preview_grants(user_id, status, expires_at);
+    `);
+  }
+
+  private immediate<T>(action: () => T): T {
+    this.database.exec("BEGIN IMMEDIATE");
+    try {
+      const value = action();
+      this.database.exec("COMMIT");
+      return value;
+    } catch (error) {
+      if (this.database.inTransaction) this.database.exec("ROLLBACK");
+      throw error;
+    }
+  }
+
+  private assertAdmin(adminUserId: string, now: number) {
+    const admin = this.database.prepare(`
+      SELECT 1 AS allowed FROM users u JOIN admin_access a ON a.user_id = u.user_id
+      WHERE u.user_id = ? AND u.role = 'super_admin' AND u.status = 'active' AND a.allowed = 1
+    `).get(adminUserId) as { allowed: 1 } | undefined;
+    if (!admin) throw new PreviewGrantError("admin_invalid");
+    void now;
+  }
+
+  private readBatch(batchId: string): PreviewBatchView | undefined {
+    const row = this.database.prepare(`
+      SELECT batch_id, name, status, created_by, created_at
+      FROM test_batches WHERE batch_id = ?
+    `).get(batchId) as { batch_id: string; created_at: number; created_by: string; name: string; status: PreviewBatchStatus } | undefined;
+    return row ? {
+      batchId: row.batch_id,
+      createdAt: row.created_at,
+      createdBy: row.created_by,
+      name: row.name,
+      status: row.status,
+    } : undefined;
+  }
+
+  private readGrant(grantId: string): PreviewGrantView | undefined {
+    const row = this.database.prepare(`
+      SELECT grant_id, user_id, test_batch_id, granted_by, granted_at, expires_at, status
+      FROM asset_preview_grants WHERE grant_id = ?
+    `).get(grantId) as {
+      expires_at: number; grant_id: string; granted_at: number; granted_by: string;
+      status: PreviewGrantStatus; test_batch_id: string; user_id: string;
+    } | undefined;
+    return row ? {
+      batchId: row.test_batch_id,
+      expiresAt: row.expires_at,
+      grantId: row.grant_id,
+      grantedAt: row.granted_at,
+      grantedBy: row.granted_by,
+      status: row.status,
+      userId: row.user_id,
+    } : undefined;
+  }
+
+  private expireDue(now: number) {
+    const rows = this.database.prepare(`
+      SELECT grant_id, user_id, test_batch_id FROM asset_preview_grants
+      WHERE status = 'active' AND expires_at <= ?
+    `).all(now) as Array<{ grant_id: string; test_batch_id: string; user_id: string }>;
+    if (rows.length === 0) return;
+    this.database.prepare("UPDATE asset_preview_grants SET status = 'expired' WHERE status = 'active' AND expires_at <= ?").run(now);
+    for (const row of rows) {
+      this.audit({
+        actorRef: "preview_grant_expiry",
+        afterSummary: { grant_id: row.grant_id, status: "expired" },
+        beforeSummary: { grant_id: row.grant_id, status: "active" },
+        operationType: "preview_grant_expire",
+        targetRef: row.grant_id,
+        targetType: "preview_grant",
+      }, now, "system");
+    }
+  }
+
+  private audit(input: {
+    actorRef: string;
+    afterSummary: Record<string, unknown> | null;
+    beforeSummary: Record<string, unknown> | null;
+    operationType: string;
+    targetRef: string;
+    targetType: string;
+  }, now: number, actorType: "super_admin" | "system" = "super_admin") {
+    this.database.prepare(`
+      INSERT INTO admin_operation_logs (
+        log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
+        result, before_summary, after_summary, occurred_at, expires_at
+      ) VALUES (?, ?, ?, ?, ?, ?, 'succeeded', ?, ?, ?, ?)
+    `).run(
+      randomUUID(), actorType, input.actorRef, input.operationType, input.targetType, input.targetRef,
+      serializeAuditSummary(input.beforeSummary), serializeAuditSummary(input.afterSummary),
+      now, now + auditRetentionMilliseconds,
+    );
+  }
+}

apps/api/src/private-content.ts

@@ -0,0 +1,186 @@
+import { randomUUID } from "node:crypto";
+import type BetterSqlite3 from "better-sqlite3";
+
+import { auditRetentionMilliseconds } from "./audit-policy.js";
+
+type GenerationStatus = "queued" | "running" | "succeeded" | "failed" | "rejected";
+
+export class PrivateContentError extends Error {
+  constructor(readonly code: "notice_required" | "notice_version_conflict" | "not_found") {
+    super(code);
+    this.name = "PrivateContentError";
+  }
+}
+
+function iso(value: number) {
+  return new Date(value).toISOString();
+}
+
+function isGenerationTablePresent(database: BetterSqlite3.Database) {
+  return Boolean(database.prepare(
+    "SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = 'generation_jobs'",
+  ).get());
+}
+
+export class PrivateContentService {
+  constructor(
+    readonly database: BetterSqlite3.Database,
+    readonly currentNoticeVersion: string,
+    private readonly clock: () => number = Date.now,
+  ) {}
+
+  currentNotice() {
+    return {
+      version: this.currentNoticeVersion,
+      messageKey: "admin.private_content.notice",
+    } as const;
+  }
+
+  readAcknowledgement(adminUserId: string) {
+    const row = this.database.prepare(`
+      SELECT private_content_notice_version, private_content_notice_acknowledged_at
+      FROM user_profiles WHERE user_id = ?
+    `).get(adminUserId) as { private_content_notice_version: string | null; private_content_notice_acknowledged_at: number | null } | undefined;
+    return {
+      version: row?.private_content_notice_version ?? null,
+      acknowledgedAt: row?.private_content_notice_acknowledged_at === null || row?.private_content_notice_acknowledged_at === undefined
+        ? null : iso(row.private_content_notice_acknowledged_at),
+    };
+  }
+
+  isAcknowledged(adminUserId: string) {
+    return this.readAcknowledgement(adminUserId).version === this.currentNoticeVersion;
+  }
+
+  requireAcknowledgement(adminUserId: string) {
+    if (!this.isAcknowledged(adminUserId)) throw new PrivateContentError("notice_required");
+  }
+
+  acknowledge(adminUserId: string, expectedNoticeVersion: string) {
+    const now = this.clock();
+    return this.database.transaction(() => {
+      if (expectedNoticeVersion !== this.currentNoticeVersion) {
+        throw new PrivateContentError("notice_version_conflict");
+      }
+      this.database.prepare(`
+        INSERT INTO user_profiles (
+          user_id, creator_name, social_id, private_content_notice_version,
+          private_content_notice_acknowledged_at
+        ) VALUES (?, '', '', ?, ?)
+        ON CONFLICT(user_id) DO UPDATE SET
+          private_content_notice_version = excluded.private_content_notice_version,
+          private_content_notice_acknowledged_at =
+            CASE WHEN user_profiles.private_content_notice_version = excluded.private_content_notice_version
+              THEN user_profiles.private_content_notice_acknowledged_at ELSE excluded.private_content_notice_acknowledged_at END
+      `).run(adminUserId, this.currentNoticeVersion, now);
+      const acknowledged = this.readAcknowledgement(adminUserId);
+      return {
+        noticeVersion: this.currentNoticeVersion,
+        acknowledgedAt: acknowledged.acknowledgedAt ?? iso(now),
+      };
+    })();
+  }
+
+  listGenerations() {
+    const generatedAt = iso(this.clock());
+    if (!isGenerationTablePresent(this.database)) return { generated_at: generatedAt, items: [] };
+    const rows = this.database.prepare(`
+      SELECT generation_id, owner_id, project_id, model_id, ratio, status,
+        confirmed_credit_cost, reserved_credits, final_credit_state,
+        error_category, created_at, updated_at
+      FROM generation_jobs
+      WHERE submission_ready = 1
+      ORDER BY created_at DESC, generation_id DESC
+      LIMIT 100
+    `).all() as Array<{
+      generation_id: string;
+      owner_id: string;
+      project_id: string;
+      model_id: string;
+      ratio: "3:4" | "1:1" | "4:3" | "9:16";
+      status: GenerationStatus;
+      confirmed_credit_cost: number;
+      reserved_credits: number;
+      final_credit_state: "committed" | "released" | null;
+      error_category: string | null;
+      created_at: number;
+      updated_at: number;
+    }>;
+    return {
+      generated_at: generatedAt,
+      items: rows.map((row) => {
+        const terminal = row.status === "succeeded" || row.status === "failed" || row.status === "rejected";
+        return {
+          generation_id: row.generation_id,
+          owner_ref: row.owner_id,
+          project_id: row.project_id,
+          model_id: row.model_id,
+          ratio: row.ratio,
+          status: row.status,
+          created_at: iso(row.created_at),
+          completed_at: terminal ? iso(row.updated_at) : null,
+          duration_ms: terminal ? Math.max(0, row.updated_at - row.created_at) : null,
+          confirmed_credit_cost: row.confirmed_credit_cost,
+          reserved_credits: row.reserved_credits,
+          final_credit_state: row.final_credit_state,
+          error_category: row.error_category,
+        };
+      }),
+    };
+  }
+
+  private generation(generationId: string) {
+    if (!isGenerationTablePresent(this.database)) throw new PrivateContentError("not_found");
+    const row = this.database.prepare(`
+      SELECT generation_id, owner_id, project_id
+      FROM generation_jobs WHERE generation_id = ? AND submission_ready = 1
+    `).get(generationId) as { generation_id: string; owner_id: string; project_id: string } | undefined;
+    if (!row) throw new PrivateContentError("not_found");
+    return row;
+  }
+
+  private recordAccess(input: { adminUserId: string; ownerId: string; generationId: string; contentType: "image" | "prompt" }) {
+    const now = this.clock();
+    // The insert is committed before the caller reads the private value. A failed
+    // constraint therefore cannot accidentally release a private response.
+    this.database.transaction(() => {
+      this.database.prepare(`
+        INSERT INTO private_content_access_logs (
+          log_id, actor_ref, subject_ref, target_ref, content_type, occurred_at, expires_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        randomUUID(), input.adminUserId, input.ownerId, input.generationId,
+        input.contentType, now, now + auditRetentionMilliseconds,
+      );
+    })();
+  }
+
+  recordPrivateAssetAccess(adminUserId: string, ownerId: string, resourceId: string) {
+    this.recordAccess({ adminUserId, ownerId, generationId: resourceId, contentType: "image" });
+  }
+
+  readPrompt(adminUserId: string, generationId: string) {
+    this.requireAcknowledgement(adminUserId);
+    const row = this.generation(generationId);
+    this.recordAccess({ adminUserId, ownerId: row.owner_id, generationId: row.generation_id, contentType: "prompt" });
+    const content = this.database.prepare(
+      "SELECT prompt FROM generation_jobs WHERE generation_id = ? AND submission_ready = 1",
+    ).get(row.generation_id) as { prompt: string } | undefined;
+    if (!content) throw new PrivateContentError("not_found");
+    return { generationId: row.generation_id, prompt: content.prompt };
+  }
+
+  readImageTarget(adminUserId: string, generationId: string) {
+    this.requireAcknowledgement(adminUserId);
+    const row = this.database.prepare(`
+      SELECT g.generation_id, g.owner_id, g.project_id, pi.image_id
+      FROM generation_jobs g
+      JOIN project_images pi ON pi.project_id = g.project_id AND pi.generation_id = g.generation_id
+      WHERE g.generation_id = ? AND g.status = 'succeeded'
+      ORDER BY pi.created_at DESC LIMIT 1
+    `).get(generationId) as { generation_id: string; owner_id: string; project_id: string; image_id: string } | undefined;
+    if (!row) throw new PrivateContentError("not_found");
+    this.recordAccess({ adminUserId, ownerId: row.owner_id, generationId: row.generation_id, contentType: "image" });
+    return { projectId: row.project_id, imageId: row.image_id, ownerId: row.owner_id };
+  }
+}

apps/api/src/projects.ts

@@ -366,6 +366,7 @@ export class ProjectService {
         throw new ProjectError("project_state_conflict", latest);
       }
       this.insertProjectState({ canvasState: canvas, name, projectId: input.projectId, stateVersion: nextVersion }, now);
+      this.rebuildProjectStickerReferences(input.projectId, canvas, now);
       this.database.prepare(`
         INSERT INTO project_state_idempotency (
           owner_id, project_id, idempotency_key, request_hash, response_state_version, created_at
@@ -377,6 +378,25 @@ export class ProjectService {
     return result;
   }
 
+  private rebuildProjectStickerReferences(projectId: string, canvas: CanvasState, now: number) {
+    if (!this.tableExists("project_sticker_asset_refs")) return;
+    this.database.prepare("DELETE FROM project_sticker_asset_refs WHERE project_id = ?").run(projectId);
+    const insert = this.database.prepare(`
+      INSERT INTO project_sticker_asset_refs (reference_id, project_id, stable_id, resource_version, created_at)
+      VALUES (?, ?, ?, ?, ?)
+    `);
+    for (const element of canvas.elements) {
+      if (element.type !== "static_sticker") continue;
+      insert.run(
+        `project:${projectId}:sticker:${element.element_id}`,
+        projectId,
+        element.template_or_asset_id,
+        element.resource_version,
+        now,
+      );
+    }
+  }
+
   trashFailedEmpty(ownerId: string, projectIds: string[]) {
     const uniqueIds = [...new Set(projectIds)];
     if (uniqueIds.length === 0 || uniqueIds.length > projectLimit) throw new ProjectError("generation_state_invalid");
@@ -774,6 +794,16 @@ export class ProjectService {
         FOREIGN KEY (project_id) REFERENCES projects(project_id) ON DELETE CASCADE
       );
       CREATE INDEX IF NOT EXISTS project_resource_files_managed ON project_resource_files(managed_file_id, project_id);
+      CREATE TABLE IF NOT EXISTS project_sticker_asset_refs (
+        reference_id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL,
+        stable_id TEXT NOT NULL,
+        resource_version TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        FOREIGN KEY (project_id) REFERENCES projects(project_id) ON DELETE CASCADE
+      );
+      CREATE INDEX IF NOT EXISTS project_sticker_asset_refs_lookup
+        ON project_sticker_asset_refs (stable_id, resource_version);
       CREATE TABLE IF NOT EXISTS latest_exports (
         project_id TEXT NOT NULL,
         format TEXT NOT NULL CHECK (format IN ('jpg', 'png')),

apps/api/src/registration.ts

@@ -4,6 +4,7 @@ import { createRequire } from "node:module";
 import type BetterSqlite3 from "better-sqlite3";
 
 import {
+  auditRetentionMilliseconds,
   ensureAdminOperationAuditSchema,
   ensurePrivateAccessAuditSchema,
   isSafeAuditRef,
@@ -11,6 +12,7 @@ import {
   serializeAuditSummary,
 } from "./audit-policy.js";
 import type { ResendAdapter } from "./resend-adapter.js";
+import { ExternalServiceUsage } from "./external-service-usage.js";
 import {
   RegistrationError,
   type RegistrationErrorReason,
@@ -226,6 +228,7 @@ function constantTimeTextEqual(left: string, right: string) {
 
 export class RegistrationService {
   readonly database: BetterSqlite3.Database;
+  readonly serviceUsage: ExternalServiceUsage;
   readonly options: Required<Pick<RegistrationServiceOptions, "clock" | "codeGenerator" | "inviteCodeGenerator">> & RegistrationServiceOptions;
   private adminAllowlistHashes = new Set<string>();
   private privacyPurgeActive = false;
@@ -254,6 +257,7 @@ export class RegistrationService {
     this.database.function("dada_allow_retention_purge", { deterministic: false }, () => 0);
     this.database.function("dada_retention_purge_now", { deterministic: false }, () => 0);
     this.migrate();
+    this.serviceUsage = new ExternalServiceUsage({ database: this.database, clock: this.options.clock });
   }
 
   close() {
@@ -278,6 +282,39 @@ export class RegistrationService {
     return { code, inviteId };
   }
 
+  createAdminInvite(input: { actorId: string; expiresAt: number; maxUses: number }) {
+    if (!Number.isSafeInteger(input.expiresAt) || !Number.isSafeInteger(input.maxUses) || input.maxUses < 1) {
+      throw new Error("Invite request is invalid.");
+    }
+    const code = this.options.inviteCodeGenerator();
+    const inviteId = randomUUID();
+    const now = this.options.clock();
+    this.runImmediate("invite_create", () => {
+      const admin = this.database.prepare(`
+        SELECT u.user_id FROM users u JOIN admin_access a ON a.user_id = u.user_id
+        WHERE u.user_id = ? AND u.role = 'super_admin' AND u.status = 'active' AND a.allowed = 1
+      `).get(input.actorId);
+      if (!admin) throw new RegistrationError("AUTH_SESSION_INVALID", "session_invalid");
+      this.database.prepare(`
+        INSERT INTO invite_codes (
+          invite_id, code_hmac, max_uses, used_count, expires_at, status, created_at
+        ) VALUES (?, ?, ?, 0, ?, 'enabled', ?)
+      `).run(inviteId, this.inviteHmac(code), input.maxUses, input.expiresAt, now);
+      this.recordAdminAudit({
+        actorRef: input.actorId,
+        actorType: "super_admin",
+        afterSummary: { max_uses: input.maxUses, status: "enabled" },
+        beforeSummary: null,
+        operationType: "invite_create",
+        result: "succeeded",
+        targetRef: inviteId,
+        targetType: "invite",
+      }, now);
+      return { outcome: "committed", value: undefined };
+    });
+    return { code, inviteId };
+  }
+
   async sendRegistrationCode(input: { email: string; inviteCode: string }): Promise<RegistrationSendResult> {
     const email = normalizeEmail(input.email);
     const inviteCode = normalizeProfileValue(input.inviteCode, 160);
@@ -299,6 +336,7 @@ export class RegistrationService {
       if (existing) throw new RegistrationError("AUTH_ENTRY_REJECTED", "registration_login_required");
       this.assertChallengeSendAllowed(email, "register", "registration", now);
       this.recordRateSend(email, "registration", now);
+      this.serviceUsage.claimResendWithinTransaction(now);
 
       this.database.prepare(`
         INSERT INTO email_challenges (
@@ -328,6 +366,7 @@ export class RegistrationService {
     try {
       await this.options.resend.sendVerificationCode({ challengeId, code, email, purpose: "register" });
     } catch {
+      this.serviceUsage.markProviderFailure({ serviceId: "resend_email", reason: "provider_unavailable", now });
       this.runImmediate("registration_send_compensation", () => {
         this.database.prepare("DELETE FROM email_challenges WHERE challenge_id = ? AND consumed_at IS NULL").run(challengeId);
         return { outcome: "committed", value: undefined };
@@ -355,6 +394,7 @@ export class RegistrationService {
       if (user.role !== "user") throw new RegistrationError("AUTH_ENTRY_REJECTED", "login_admin_required");
       this.assertChallengeSendAllowed(email, "login", clientKey, now);
       this.recordRateSend(email, clientKey, now);
+      this.serviceUsage.claimResendWithinTransaction(now);
       this.database.prepare(`
         INSERT INTO email_challenges (
           challenge_id, email, invite_id, code_hmac, purpose, expires_at,
@@ -382,6 +422,7 @@ export class RegistrationService {
     try {
       await this.options.resend.sendVerificationCode({ challengeId, code, email, purpose: "login" });
     } catch {
+      this.serviceUsage.markProviderFailure({ serviceId: "resend_email", reason: "provider_unavailable", now });
       this.runImmediate("registration_send_compensation", () => {
         this.database.prepare("DELETE FROM email_challenges WHERE challenge_id = ? AND consumed_at IS NULL").run(challengeId);
         return { outcome: "committed", value: undefined };
@@ -768,6 +809,7 @@ export class RegistrationService {
       }
       this.assertChallengeSendAllowed(email, "admin_login", clientKey, now);
       this.recordRateSend(email, clientKey, now);
+      this.serviceUsage.claimResendWithinTransaction(now);
       this.database.prepare(`
         INSERT INTO email_challenges (
           challenge_id, email, invite_id, code_hmac, purpose, expires_at,
@@ -795,6 +837,7 @@ export class RegistrationService {
     try {
       await this.options.resend.sendVerificationCode({ challengeId, code, email, purpose: "admin_login" });
     } catch {
+      this.serviceUsage.markProviderFailure({ serviceId: "resend_email", reason: "provider_unavailable", now });
       this.runImmediate("registration_send_compensation", () => {
         this.database.prepare("DELETE FROM email_challenges WHERE challenge_id = ? AND consumed_at IS NULL").run(challengeId);
         this.recordAdminLoginRejection("service_unavailable", now);
@@ -1097,6 +1140,7 @@ export class RegistrationService {
         now + resendDelayMilliseconds,
         now,
       );
+      this.serviceUsage.claimResendWithinTransaction(now);
       return {
         outcome: "committed",
         value: {
@@ -1116,6 +1160,7 @@ export class RegistrationService {
         purpose: "account_delete",
       });
     } catch {
+      this.serviceUsage.markProviderFailure({ serviceId: "resend_email", reason: "provider_unavailable", now });
       this.runImmediate("registration_send_compensation", () => {
         this.database.prepare("DELETE FROM account_deletion_challenges WHERE deletion_id = ? AND consumed_at IS NULL").run(deletionId);
         return { outcome: "committed", value: undefined };
@@ -1230,14 +1275,35 @@ export class RegistrationService {
     return outcome;
   }
 
-  changeUserStatus(userId: string, status: "suspended" | "deleted") {
+  changeUserStatus(userId: string, status: "suspended" | "deleted", actorId?: string) {
     const now = this.options.clock();
     this.runImmediate("session_revoke", () => {
+      if (actorId) {
+        const admin = this.database.prepare(`
+          SELECT u.user_id FROM users u JOIN admin_access a ON a.user_id = u.user_id
+          WHERE u.user_id = ? AND u.role = 'super_admin' AND u.status = 'active' AND a.allowed = 1
+        `).get(actorId);
+        if (!admin) throw new RegistrationError("AUTH_SESSION_INVALID", "session_invalid");
+      }
+      const before = this.database.prepare("SELECT status FROM users WHERE user_id = ? AND role = 'user'")
+        .get(userId) as { status: "active" | "suspended" | "deleted" } | undefined;
       const changed = this.database.prepare("UPDATE users SET status = ? WHERE user_id = ? AND role = 'user'")
         .run(status, userId);
       if (changed.changes !== 1) throw new RegistrationError("AUTH_SESSION_INVALID", "session_invalid");
       this.database.prepare("UPDATE sessions SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL")
         .run(now, userId);
+      if (actorId) {
+        this.recordAdminAudit({
+          actorRef: actorId,
+          actorType: "super_admin",
+          afterSummary: { status },
+          beforeSummary: { status: before?.status ?? "unknown" },
+          operationType: "user_status_change",
+          result: "succeeded",
+          targetRef: userId,
+          targetType: "user_account",
+        }, now);
+      }
       return { outcome: "committed", value: undefined };
     });
   }
@@ -1761,7 +1827,7 @@ export class RegistrationService {
       serializeAuditSummary(input.beforeSummary),
       serializeAuditSummary(input.afterSummary),
       now,
-      now + 180 * 24 * 60 * 60 * 1_000,
+      now + auditRetentionMilliseconds,
     );
   }
 

apps/api/src/sticker-release-errors.ts

@@ -0,0 +1,8 @@
+export class StickerReleaseError extends Error {
+  readonly httpStatus: number;
+
+  constructor(readonly reason: string, httpStatus = 400) {
+    super(reason);
+    this.httpStatus = httpStatus;
+  }
+}

apps/api/src/sticker-releases.ts

@@ -0,0 +1,602 @@
+import { createHash, randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { basename, extname } from "node:path";
+import { Readable } from "node:stream";
+
+import type BetterSqlite3 from "better-sqlite3";
+import sharp, { type Metadata } from "sharp";
+
+import type { StaticStickerCatalogItem } from "@dada/static-sticker-catalog";
+
+import {
+  auditRetentionMilliseconds,
+  isSafeAuditRef,
+  isSafeAuditSummaryJson,
+  serializeAuditSummary,
+} from "./audit-policy.js";
+import { ManagedStorage, type StagedManagedFile } from "./managed-storage.js";
+import { StickerReleaseError } from "./sticker-release-errors.js";
+import { classifyCapacity } from "./storage-policy.js";
+
+export { StickerReleaseError } from "./sticker-release-errors.js";
+
+const require = createRequire(import.meta.url);
+const Database = require("better-sqlite3") as typeof BetterSqlite3;
+const stableIdPattern = /^STK([0-9]{4,})$/;
+const idempotencyPattern = /^[A-Za-z0-9_-]{32,200}$/;
+const sha256Pattern = /^[0-9a-f]{64}$/i;
+const maximumOriginalBytes = 20 * 1024 * 1024;
+const maximumDimension = 8_192;
+const bundledPartCounts = [203, 36, 27, 48, 38, 75, 37, 67, 48, 24, 40, 30, 27, 51, 62, 19, 36, 45, 92, 53, 69, 31, 36, 30, 183] as const;
+
+type StickerMime = "image/png" | "image/webp";
+type StickerVariant = "original" | "thumbnail";
+
+interface StickerItemRow {
+  enabled: 0 | 1;
+  height: number;
+  mime_type: StickerMime;
+  order_index: number;
+  original_byte_size: number;
+  original_file_id: string;
+  original_filename: string;
+  original_relative_path: string;
+  original_sha256: string;
+  part: number;
+  release_version: string;
+  stable_id: string;
+  thumbnail_byte_size: number;
+  thumbnail_file_id: string;
+  thumbnail_relative_path: string;
+  thumbnail_sha256: string;
+  width: number;
+}
+
+export interface StickerUploadInput {
+  actorId: string;
+  content: Readable;
+  enabled: boolean;
+  expectedByteSize: number;
+  expectedMimeType: StickerMime;
+  expectedSha256: string;
+  fileName: string;
+  idempotencyKey: string;
+  order: number;
+  part: number;
+  stableId: string;
+}
+
+function digest(value: string) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+
+function stableJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function iso(timestamp: number) {
+  return new Date(timestamp).toISOString();
+}
+
+function itemView(row: StickerItemRow): StaticStickerCatalogItem {
+  const originalReference = `/api/v1/assets/public/${encodeURIComponent(row.release_version)}/${encodeURIComponent(row.stable_id)}`;
+  return {
+    enabled: row.enabled === 1,
+    height: row.height,
+    mime: row.mime_type,
+    mime_type: row.mime_type,
+    order: row.order_index,
+    original_filename: row.original_filename,
+    original_reference: originalReference,
+    origin: "admin_uploaded",
+    part: row.part,
+    relative_path: `static-stickers/${row.stable_id}${row.mime_type === "image/png" ? ".png" : ".webp"}`,
+    resource_version: row.release_version,
+    sha256: row.original_sha256,
+    stable_id: row.stable_id,
+    thumbnail_reference: {
+      media: "thumbnail",
+      resource_id: row.stable_id,
+      resource_version: row.release_version,
+      url: `${originalReference}?variant=thumbnail`,
+    },
+    width: row.width,
+  };
+}
+
+export class StickerReleaseService {
+  private readonly clock: () => number;
+  private readonly database: BetterSqlite3.Database;
+  private readonly storage: ManagedStorage;
+
+  constructor(input: { clock?: () => number; databasePath: string; storage: ManagedStorage }) {
+    this.clock = input.clock ?? Date.now;
+    const nativeBinding = process.env.DADA_SQLITE_NATIVE_BINDING;
+    this.database = new Database(input.databasePath, nativeBinding ? { nativeBinding } : undefined);
+    this.database.pragma("journal_mode = WAL");
+    this.database.pragma("foreign_keys = ON");
+    this.database.pragma("busy_timeout = 5000");
+    this.database.function("dada_audit_ref_is_safe", { deterministic: true }, isSafeAuditRef);
+    this.database.function("dada_audit_summary_is_safe", { deterministic: true }, isSafeAuditSummaryJson);
+    this.database.function("dada_allow_privacy_purge", { deterministic: false }, () => 0);
+    this.database.function("dada_privacy_purge_subject", { deterministic: false }, () => "");
+    this.database.function("dada_allow_retention_purge", { deterministic: false }, () => 0);
+    this.database.function("dada_retention_purge_now", { deterministic: false }, () => 0);
+    this.storage = input.storage;
+    this.migrate();
+  }
+
+  close() {
+    this.database.close();
+  }
+
+  async upload(input: StickerUploadInput) {
+    this.validateUpload(input);
+    const requestHash = digest(stableJson({
+      enabled: input.enabled,
+      expected_byte_size: input.expectedByteSize,
+      expected_mime_type: input.expectedMimeType,
+      expected_sha256: input.expectedSha256.toLowerCase(),
+      order: input.order,
+      part: input.part,
+      stable_id: input.stableId,
+    }));
+    const keyDigest = digest(input.idempotencyKey);
+    const receipt = this.database.prepare(`
+      SELECT request_hash, release_version FROM sticker_upload_receipts
+      WHERE actor_id = ? AND idempotency_key_digest = ?
+    `).get(input.actorId, keyDigest) as { release_version: string; request_hash: string } | undefined;
+    if (receipt) {
+      input.content.destroy();
+      if (receipt.request_hash !== requestHash) throw new StickerReleaseError("sticker_idempotency_conflict", 409);
+      return this.uploadResult(receipt.release_version, input.stableId, false);
+    }
+    this.assertNewPosition(input.stableId, input.part, input.order);
+
+    const staged: StagedManagedFile[] = [];
+    try {
+      const original = await this.storage.stageManagedImage({
+        content: input.content,
+        expectedMimeType: input.expectedMimeType,
+        expectedSha256: input.expectedSha256,
+        fileKind: "sticker_original",
+        fileName: `${input.stableId}${input.expectedMimeType === "image/png" ? ".png" : ".webp"}`,
+        maximumBytes: maximumOriginalBytes,
+        operationId: randomUUID(),
+        ownerRef: input.actorId,
+        projectedWriteBytes: input.expectedByteSize,
+      });
+      staged.push(original);
+      if (original.bytes !== input.expectedByteSize) throw new StickerReleaseError("content_size_invalid");
+
+      let metadata: Metadata;
+      let thumbnail: Buffer;
+      const decoder = sharp(readFileSync(original.stagingPath), { failOn: "warning", limitInputPixels: maximumDimension * maximumDimension });
+      try {
+        metadata = await decoder.metadata();
+        if (metadata.format !== (input.expectedMimeType === "image/png" ? "png" : "webp")
+          || !metadata.width || !metadata.height || metadata.width > maximumDimension || metadata.height > maximumDimension) {
+          throw new Error("content_decode_invalid");
+        }
+        thumbnail = await decoder
+          .rotate()
+          .resize({ fit: "inside", height: 256, width: 256, withoutEnlargement: true })
+          .png({ adaptiveFiltering: true, compressionLevel: 9 })
+          .toBuffer();
+      } catch {
+        throw new StickerReleaseError("content_decode_invalid");
+      } finally {
+        decoder.destroy();
+      }
+
+      const thumbnailStaged = await this.storage.stageManagedImage({
+        content: Readable.from(thumbnail),
+        expectedMimeType: "image/png",
+        fileKind: "sticker_thumbnail",
+        fileName: `${input.stableId}-thumbnail.png`,
+        maximumBytes: maximumOriginalBytes,
+        operationId: randomUUID(),
+        ownerRef: input.actorId,
+        projectedWriteBytes: thumbnail.byteLength,
+      });
+      staged.push(thumbnailStaged);
+      const releaseVersion = this.immediate(() => this.commitUpload({
+        ...input,
+        height: metadata.height!,
+        keyDigest,
+        original,
+        requestHash,
+        thumbnail: thumbnailStaged,
+        width: metadata.width!,
+      }));
+      return this.uploadResult(releaseVersion, input.stableId, true);
+    } catch (error) {
+      for (const file of staged) this.storage.abandonStagedFile(file);
+      if (!(error instanceof StickerReleaseError) && error instanceof Error
+        && new Set(["content_hash_invalid", "content_mime_invalid", "content_size_invalid", "file_name_invalid"]).has(error.message)) {
+        throw new StickerReleaseError("sticker_upload_invalid");
+      }
+      throw error;
+    }
+  }
+
+  update(input: { actorId: string; enabled?: boolean; order?: number; part?: number; stableId: string }) {
+    const current = this.currentVersion();
+    if (!current) throw new StickerReleaseError("sticker_not_found", 404);
+    const existing = this.readItem(current, input.stableId);
+    if (!existing) throw new StickerReleaseError("sticker_not_found", 404);
+    const part = input.part ?? existing.part;
+    const order = input.order ?? existing.order_index;
+    this.validatePosition(input.stableId, part, order);
+    const releaseVersion = this.immediate(() => {
+      const version = this.nextReleaseVersion();
+      this.copyRelease(current, version);
+      const conflict = this.database.prepare(`
+        SELECT stable_id FROM sticker_release_items
+        WHERE release_version = ? AND part = ? AND order_index = ? AND stable_id <> ?
+      `).get(version, part, order, input.stableId);
+      if (conflict) throw new StickerReleaseError("sticker_order_conflict", 409);
+      this.database.prepare(`
+        UPDATE sticker_release_items SET enabled = ?, part = ?, order_index = ?
+        WHERE release_version = ? AND stable_id = ?
+      `).run((input.enabled ?? existing.enabled === 1) ? 1 : 0, part, order, version, input.stableId);
+      this.finalizeRelease(version, current, input.actorId);
+      this.insertReleaseAudit({
+        actorId: input.actorId,
+        afterSummary: { enabled: input.enabled ?? existing.enabled === 1, order, part, stable_id: input.stableId },
+        beforeSummary: { enabled: existing.enabled === 1, order: existing.order_index, part: existing.part, stable_id: input.stableId },
+        operationType: "sticker_release_update",
+        releaseVersion: version,
+      });
+      return version;
+    });
+    return { item: itemView(this.readItem(releaseVersion, input.stableId)!), release_version: releaseVersion };
+  }
+
+  listPublic(releaseVersion = this.currentVersion()) {
+    if (!releaseVersion) return { count: 0, items: [], release_version: null };
+    const exists = this.database.prepare("SELECT 1 FROM sticker_releases WHERE release_version = ?").get(releaseVersion);
+    if (!exists) return { count: 0, items: [], release_version: null };
+    const items = (this.database.prepare(`
+      SELECT * FROM sticker_release_items WHERE release_version = ? AND enabled = 1
+      ORDER BY part, order_index, stable_id
+    `).all(releaseVersion) as StickerItemRow[]).map(itemView);
+    return { count: items.length, items, release_version: releaseVersion };
+  }
+
+  adminView() {
+    const releaseVersion = this.currentVersion();
+    const items = releaseVersion
+      ? (this.database.prepare("SELECT * FROM sticker_release_items WHERE release_version = ? ORDER BY part, order_index, stable_id").all(releaseVersion) as StickerItemRow[])
+      : [];
+    return {
+      count: items.length,
+      items: items.map((row) => ({
+        ...itemView(row),
+        file_state: "committed" as const,
+        original_byte_size: row.original_byte_size,
+        thumbnail_byte_size: row.thumbnail_byte_size,
+      })),
+      release_version: releaseVersion,
+      storage: this.storage.getState(),
+    };
+  }
+
+  readPublicAsset(releaseVersion: string, stableId: string, variant: StickerVariant) {
+    const row = this.readItem(releaseVersion, stableId);
+    if (!row || row.enabled !== 1) return undefined;
+    const fileId = variant === "thumbnail" ? row.thumbnail_file_id : row.original_file_id;
+    const path = this.storage.resolveManagedFile(fileId);
+    if (!path) return undefined;
+    return {
+      bytes: readFileSync(path),
+      mimeType: variant === "thumbnail" ? "image/png" as const : row.mime_type,
+      sha256: variant === "thumbnail" ? row.thumbnail_sha256 : row.original_sha256,
+    };
+  }
+
+  inspectCounts() {
+    const count = (table: string) => (this.database.prepare(`SELECT COUNT(*) AS count FROM ${table}`).get() as { count: number }).count;
+    return { items: count("sticker_release_items"), releases: count("sticker_releases"), upload_receipts: count("sticker_upload_receipts") };
+  }
+
+  private uploadResult(releaseVersion: string, stableId: string, created: boolean) {
+    const row = this.readItem(releaseVersion, stableId);
+    if (!row) throw new StickerReleaseError("sticker_not_found", 404);
+    return {
+      created,
+      item: itemView(row),
+      original: { byte_size: row.original_byte_size, file_id: row.original_file_id, sha256: row.original_sha256 },
+      release_version: releaseVersion,
+      thumbnail: { byte_size: row.thumbnail_byte_size, file_id: row.thumbnail_file_id, sha256: row.thumbnail_sha256 },
+    };
+  }
+
+  private commitUpload(input: StickerUploadInput & {
+    height: number;
+    keyDigest: string;
+    original: StagedManagedFile;
+    requestHash: string;
+    thumbnail: StagedManagedFile;
+    width: number;
+  }) {
+    this.assertNewPosition(input.stableId, input.part, input.order);
+    const previous = this.currentVersion();
+    const releaseVersion = this.nextReleaseVersion();
+    if (previous) this.copyRelease(previous, releaseVersion);
+    for (const file of [input.original, input.thumbnail]) {
+      this.storage.moveStagedFile(file);
+      this.database.prepare(`
+        INSERT INTO managed_files (file_id, file_kind, owner_ref, relative_path, byte_size, mime_type, sha256, status, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, 'committed', ?)
+      `).run(file.fileId, file.fileKind, file.ownerRef, file.relativePath, file.bytes, file.mimeType, file.sha256, iso(this.clock()));
+    }
+    this.database.prepare(`
+      INSERT INTO sticker_release_items (
+        release_version, stable_id, part, order_index, original_filename, original_relative_path,
+        width, height, mime_type, original_sha256, original_file_id, original_byte_size,
+        thumbnail_file_id, thumbnail_relative_path, thumbnail_sha256, thumbnail_byte_size, enabled
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      releaseVersion, input.stableId, input.part, input.order, input.fileName, input.original.relativePath,
+      input.width, input.height, input.expectedMimeType, input.original.sha256, input.original.fileId, input.original.bytes,
+      input.thumbnail.fileId, input.thumbnail.relativePath, input.thumbnail.sha256, input.thumbnail.bytes, input.enabled ? 1 : 0,
+    );
+    this.database.prepare(`
+      INSERT OR IGNORE INTO sticker_managed_file_history (
+        managed_file_id, stable_id, resource_version, file_kind, created_at
+      ) VALUES (?, ?, ?, 'original', ?), (?, ?, ?, 'thumbnail', ?)
+    `).run(
+      input.original.fileId, input.stableId, releaseVersion, this.clock(),
+      input.thumbnail.fileId, input.stableId, releaseVersion, this.clock(),
+    );
+    this.consumeStagedStorage([input.original, input.thumbnail]);
+    this.database.prepare(`
+      INSERT INTO sticker_upload_receipts (actor_id, idempotency_key_digest, request_hash, release_version, stable_id, created_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(input.actorId, input.keyDigest, input.requestHash, releaseVersion, input.stableId, iso(this.clock()));
+    this.finalizeRelease(releaseVersion, previous, input.actorId);
+    this.insertReleaseAudit({
+      actorId: input.actorId,
+      afterSummary: { enabled: input.enabled, order: input.order, part: input.part, stable_id: input.stableId },
+      beforeSummary: previous ? { release_version: previous } : null,
+      operationType: "sticker_release_publish",
+      releaseVersion,
+    });
+    return releaseVersion;
+  }
+
+  private insertReleaseAudit(input: {
+    actorId: string;
+    afterSummary: Record<string, unknown>;
+    beforeSummary: Record<string, unknown> | null;
+    operationType: "sticker_release_publish" | "sticker_release_update";
+    releaseVersion: string;
+  }) {
+    const occurredAt = this.clock();
+    this.database.prepare(`
+      INSERT INTO admin_operation_logs (
+        log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
+        result, before_summary, after_summary, occurred_at, expires_at
+      ) VALUES (?, 'super_admin', ?, ?, 'sticker_release', ?, 'succeeded', ?, ?, ?, ?)
+    `).run(
+      randomUUID(), input.actorId, input.operationType, input.releaseVersion,
+      serializeAuditSummary(input.beforeSummary), serializeAuditSummary(input.afterSummary),
+      occurredAt, occurredAt + auditRetentionMilliseconds,
+    );
+  }
+
+  private finalizeRelease(releaseVersion: string, previous: string | null, actorId: string) {
+    const rows = this.database.prepare(`
+      SELECT stable_id, part, order_index, original_sha256, thumbnail_sha256, enabled
+      FROM sticker_release_items WHERE release_version = ? ORDER BY stable_id
+    `).all(releaseVersion);
+    const manifestSha256 = digest(stableJson(rows));
+    this.database.prepare(`
+      INSERT INTO sticker_releases (release_version, previous_release_version, manifest_sha256, published_at, published_by)
+      VALUES (?, ?, ?, ?, ?)
+    `).run(releaseVersion, previous, manifestSha256, iso(this.clock()), actorId);
+    this.database.prepare(`
+      INSERT INTO current_sticker_release (singleton, release_version) VALUES (1, ?)
+      ON CONFLICT(singleton) DO UPDATE SET release_version = excluded.release_version
+    `).run(releaseVersion);
+    const files = this.database.prepare(`
+      SELECT original_file_id AS file_id FROM sticker_release_items WHERE release_version = ?
+      UNION SELECT thumbnail_file_id AS file_id FROM sticker_release_items WHERE release_version = ?
+    `).all(releaseVersion, releaseVersion) as Array<{ file_id: string }>;
+    for (const file of files) {
+      this.database.prepare(`
+        INSERT INTO project_asset_refs (reference_id, managed_file_id, reference_type, created_at)
+        VALUES (?, ?, 'release', ?)
+      `).run(`release:${releaseVersion}:${file.file_id}`, file.file_id, iso(this.clock()));
+    }
+  }
+
+  private copyRelease(from: string, to: string) {
+    this.database.prepare(`
+      INSERT INTO sticker_release_items (
+        release_version, stable_id, part, order_index, original_filename, original_relative_path,
+        width, height, mime_type, original_sha256, original_file_id, original_byte_size,
+        thumbnail_file_id, thumbnail_relative_path, thumbnail_sha256, thumbnail_byte_size, enabled
+      )
+      SELECT ?, stable_id, part, order_index, original_filename, original_relative_path,
+        width, height, mime_type, original_sha256, original_file_id, original_byte_size,
+        thumbnail_file_id, thumbnail_relative_path, thumbnail_sha256, thumbnail_byte_size, enabled
+      FROM sticker_release_items WHERE release_version = ?
+    `).run(to, from);
+  }
+
+  private consumeStagedStorage(files: StagedManagedFile[]) {
+    const timestamp = iso(this.clock());
+    for (const file of files) {
+      this.database.prepare(`
+        UPDATE storage_reservations SET status = 'consumed', resolved_at = ?
+        WHERE operation_id = ? AND status = 'active'
+      `).run(timestamp, file.operationId);
+    }
+    const total = files.reduce((sum, file) => sum + file.bytes, 0);
+    const state = this.database.prepare("SELECT managed_content_bytes FROM local_backend_storage_state WHERE singleton = 1").get() as { managed_content_bytes: number };
+    const active = this.database.prepare("SELECT COALESCE(SUM(projected_bytes), 0) AS bytes FROM storage_reservations WHERE status = 'active'").get() as { bytes: number };
+    const nextBytes = state.managed_content_bytes + total;
+    const classification = classifyCapacity(nextBytes, active.bytes);
+    this.database.prepare(`
+      UPDATE local_backend_storage_state
+      SET managed_content_bytes = ?, capacity_notice_level = ?, storage_status = ?, measured_at = ?, version = version + 1
+      WHERE singleton = 1
+    `).run(nextBytes, classification.capacity_notice_level, classification.storage_status, timestamp);
+  }
+
+  private currentVersion() {
+    return (this.database.prepare("SELECT release_version FROM current_sticker_release WHERE singleton = 1").get() as { release_version: string } | undefined)?.release_version ?? null;
+  }
+
+  private nextReleaseVersion() {
+    const date = new Date(this.clock()).toISOString().slice(0, 10).replaceAll("-", "");
+    const row = this.database.prepare("SELECT next_sequence FROM sticker_release_sequences WHERE release_date = ?").get(date) as { next_sequence: number } | undefined;
+    const sequence = row?.next_sequence ?? 1;
+    this.database.prepare(`
+      INSERT INTO sticker_release_sequences (release_date, next_sequence) VALUES (?, ?)
+      ON CONFLICT(release_date) DO UPDATE SET next_sequence = excluded.next_sequence
+    `).run(date, sequence + 1);
+    return `asset-${date}.${sequence}`;
+  }
+
+  private readItem(releaseVersion: string, stableId: string) {
+    return this.database.prepare("SELECT * FROM sticker_release_items WHERE release_version = ? AND stable_id = ?")
+      .get(releaseVersion, stableId) as StickerItemRow | undefined;
+  }
+
+  private assertNewPosition(stableId: string, part: number, order: number) {
+    this.validatePosition(stableId, part, order);
+    const current = this.currentVersion();
+    if (!current) return;
+    if (this.readItem(current, stableId)) throw new StickerReleaseError("sticker_stable_id_conflict", 409);
+    const conflict = this.database.prepare(`
+      SELECT stable_id FROM sticker_release_items WHERE release_version = ? AND part = ? AND order_index = ?
+    `).get(current, part, order);
+    if (conflict) throw new StickerReleaseError("sticker_order_conflict", 409);
+  }
+
+  private validatePosition(stableId: string, part: number, order: number) {
+    const matched = stableId.match(stableIdPattern);
+    const numericId = matched ? Number(matched[1]) : Number.NaN;
+    if (!matched || !Number.isSafeInteger(numericId) || numericId <= 1_407) throw new StickerReleaseError("sticker_stable_id_invalid");
+    if (!Number.isSafeInteger(part) || part < 1 || part > bundledPartCounts.length
+      || !Number.isSafeInteger(order) || order <= bundledPartCounts[part - 1]!) {
+      throw new StickerReleaseError("sticker_part_order_invalid");
+    }
+  }
+
+  private validateUpload(input: StickerUploadInput) {
+    this.validatePosition(input.stableId, input.part, input.order);
+    if (!/^[0-9a-f-]{36}$/i.test(input.actorId) || !idempotencyPattern.test(input.idempotencyKey)
+      || !sha256Pattern.test(input.expectedSha256) || !Number.isSafeInteger(input.expectedByteSize)
+      || input.expectedByteSize <= 0 || input.expectedByteSize > maximumOriginalBytes
+      || !new Set(["image/png", "image/webp"]).has(input.expectedMimeType)) {
+      throw new StickerReleaseError("sticker_upload_invalid");
+    }
+    const expectedExtension = input.expectedMimeType === "image/png" ? ".png" : ".webp";
+    if (input.fileName.length > 255 || basename(input.fileName) !== input.fileName || /[\u0000-\u001f]/.test(input.fileName)
+      || extname(input.fileName).toLowerCase() !== expectedExtension) throw new StickerReleaseError("sticker_upload_invalid");
+  }
+
+  private immediate<T>(action: () => T) {
+    this.database.exec("BEGIN IMMEDIATE");
+    try {
+      const result = action();
+      this.database.exec("COMMIT");
+      return result;
+    } catch (error) {
+      if (this.database.inTransaction) this.database.exec("ROLLBACK");
+      throw error;
+    }
+  }
+
+  private migrate() {
+    this.database.exec(`
+      CREATE TABLE IF NOT EXISTS sticker_release_sequences (
+        release_date TEXT PRIMARY KEY,
+        next_sequence INTEGER NOT NULL CHECK (next_sequence >= 1)
+      );
+      CREATE TABLE IF NOT EXISTS sticker_releases (
+        release_version TEXT PRIMARY KEY,
+        previous_release_version TEXT,
+        manifest_sha256 TEXT NOT NULL CHECK (length(manifest_sha256) = 64),
+        published_at TEXT NOT NULL,
+        published_by TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS sticker_release_items (
+        release_version TEXT NOT NULL,
+        stable_id TEXT NOT NULL,
+        part INTEGER NOT NULL CHECK (part BETWEEN 1 AND 25),
+        order_index INTEGER NOT NULL CHECK (order_index > 0),
+        original_filename TEXT NOT NULL,
+        original_relative_path TEXT NOT NULL,
+        width INTEGER NOT NULL CHECK (width > 0),
+        height INTEGER NOT NULL CHECK (height > 0),
+        mime_type TEXT NOT NULL CHECK (mime_type IN ('image/png', 'image/webp')),
+        original_sha256 TEXT NOT NULL CHECK (length(original_sha256) = 64),
+        original_file_id TEXT NOT NULL REFERENCES managed_files(file_id),
+        original_byte_size INTEGER NOT NULL CHECK (original_byte_size > 0),
+        thumbnail_file_id TEXT NOT NULL REFERENCES managed_files(file_id),
+        thumbnail_relative_path TEXT NOT NULL,
+        thumbnail_sha256 TEXT NOT NULL CHECK (length(thumbnail_sha256) = 64),
+        thumbnail_byte_size INTEGER NOT NULL CHECK (thumbnail_byte_size > 0),
+        enabled INTEGER NOT NULL CHECK (enabled IN (0, 1)),
+        PRIMARY KEY (release_version, stable_id),
+        UNIQUE (release_version, part, order_index)
+      );
+      CREATE TABLE IF NOT EXISTS current_sticker_release (
+        singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+        release_version TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS sticker_upload_receipts (
+        actor_id TEXT NOT NULL,
+        idempotency_key_digest TEXT NOT NULL CHECK (length(idempotency_key_digest) = 64),
+        request_hash TEXT NOT NULL CHECK (length(request_hash) = 64),
+        release_version TEXT NOT NULL,
+        stable_id TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        PRIMARY KEY (actor_id, idempotency_key_digest)
+      );
+      CREATE TABLE IF NOT EXISTS sticker_managed_file_history (
+        managed_file_id TEXT NOT NULL,
+        stable_id TEXT NOT NULL,
+        resource_version TEXT NOT NULL,
+        file_kind TEXT NOT NULL CHECK (file_kind IN ('original', 'thumbnail')),
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (managed_file_id, file_kind),
+        FOREIGN KEY (managed_file_id) REFERENCES managed_files(file_id)
+      );
+      CREATE TRIGGER IF NOT EXISTS sticker_releases_no_update
+      BEFORE UPDATE ON sticker_releases BEGIN SELECT RAISE(ABORT, 'sticker_releases_immutable'); END;
+      CREATE TRIGGER IF NOT EXISTS sticker_releases_no_delete
+      BEFORE DELETE ON sticker_releases BEGIN SELECT RAISE(ABORT, 'sticker_releases_immutable'); END;
+      CREATE TRIGGER IF NOT EXISTS sticker_release_items_no_update
+      BEFORE UPDATE ON sticker_release_items
+      WHEN EXISTS (SELECT 1 FROM sticker_releases WHERE release_version = OLD.release_version)
+      BEGIN SELECT RAISE(ABORT, 'sticker_release_items_immutable'); END;
+      CREATE TRIGGER IF NOT EXISTS sticker_release_items_no_delete
+      BEFORE DELETE ON sticker_release_items
+      WHEN EXISTS (SELECT 1 FROM sticker_releases WHERE release_version = OLD.release_version)
+      BEGIN SELECT RAISE(ABORT, 'sticker_release_items_immutable'); END;
+    `);
+    this.database.exec(`
+      INSERT OR IGNORE INTO sticker_managed_file_history (
+        managed_file_id, stable_id, resource_version, file_kind, created_at
+      )
+      SELECT original_file_id, stable_id, release_version, 'original', strftime('%s', 'now') * 1000
+      FROM sticker_release_items;
+      INSERT OR IGNORE INTO sticker_managed_file_history (
+        managed_file_id, stable_id, resource_version, file_kind, created_at
+      )
+      SELECT thumbnail_file_id, stable_id, release_version, 'thumbnail', strftime('%s', 'now') * 1000
+      FROM sticker_release_items;
+    `);
+  }
+}

apps/web/src/admin-assets.css

@@ -0,0 +1,71 @@
+.admin-assets-page { min-height: 100vh; color: #111111; background: #f6f6f4; }
+.admin-assets-page > main { width: min(1360px, calc(100% - 64px)); margin: 0 auto; padding: 36px 0 80px; }
+.admin-assets-heading { display: flex; align-items: end; justify-content: space-between; gap: 24px; padding-bottom: 18px; border-bottom: 1px solid #999993; }
+.admin-assets-heading p { margin: 0 0 4px; font: 700 11px Consolas, monospace; }
+.admin-assets-heading h1 { margin: 0; font-size: 34px; }
+.admin-assets-heading > strong { font: 700 13px Consolas, monospace; }
+.admin-assets-summary { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); margin: 22px 0; border-block: 1px solid #8c8c86; background: #ffffff; }
+.admin-assets-summary > span { display: grid; min-width: 0; gap: 6px; padding: 17px 18px; border-right: 1px solid #c1c1ba; color: #65655f; font-size: 12px; }
+.admin-assets-summary > span:last-child { border-right: 0; }
+.admin-assets-summary strong { color: #111111; font-size: 15px; overflow-wrap: anywhere; }
+.admin-assets-summary .is-active { color: #1f6639; }
+.admin-assets-summary .is-full,
+.admin-assets-summary .is-unavailable { color: #9b2c23; }
+.admin-assets-upload,
+.admin-assets-list { margin-top: 22px; border-block: 1px solid #8c8c86; background: #ffffff; }
+.admin-assets-upload > header,
+.admin-assets-list > header { display: flex; align-items: center; justify-content: space-between; min-height: 54px; padding: 0 16px; border-bottom: 1px solid #c1c1ba; background: #e7e7e2; }
+.admin-assets-upload h2,
+.admin-assets-list h2 { margin: 0; font-size: 16px; }
+.admin-assets-upload header span,
+.admin-assets-list header span { font: 700 11px Consolas, monospace; }
+.admin-assets-form { display: grid; grid-template-columns: minmax(230px, 2fr) minmax(130px, 1fr) 84px 92px 130px auto; align-items: end; gap: 12px; padding: 18px 16px; }
+.admin-assets-form label { display: grid; gap: 6px; min-width: 0; color: #4c4c47; font-size: 11px; font-weight: 800; }
+.admin-assets-form input { width: 100%; min-height: 40px; padding: 7px 9px; border: 1px solid #777770; border-radius: 0; background: #ffffff; }
+.admin-assets-form input[type="file"] { padding: 7px; }
+.admin-assets-form .admin-assets-enabled { display: flex; min-height: 40px; align-items: center; gap: 8px; color: #111111; }
+.admin-assets-enabled input { width: 18px; min-height: 18px; }
+.admin-assets-form button,
+.admin-assets-alert button { min-height: 42px; padding: 9px 14px; border: 1px solid #111111; border-radius: 0; background: #f2f500; font-weight: 900; }
+.admin-assets-form button:disabled { color: #777770; background: #dfdfda; cursor: not-allowed; }
+.admin-assets-blocked { margin: 0; padding: 12px 16px; border-top: 1px solid #e2b8b3; color: #812219; background: #fff1ef; font-weight: 700; }
+.admin-assets-table-wrap { overflow-x: auto; }
+.admin-assets-table-wrap table { width: 100%; min-width: 1120px; border-collapse: collapse; table-layout: fixed; }
+.admin-assets-table-wrap th,
+.admin-assets-table-wrap td { padding: 12px 10px; border-right: 1px solid #d0d0ca; border-bottom: 1px solid #d0d0ca; text-align: left; vertical-align: middle; font-size: 12px; }
+.admin-assets-table-wrap thead th { background: #f1f1ed; font-weight: 900; }
+.admin-assets-table-wrap th:first-child { width: 78px; }
+.admin-assets-table-wrap th:nth-child(2) { width: 150px; }
+.admin-assets-table-wrap th:nth-child(3) { width: 140px; }
+.admin-assets-table-wrap th:nth-child(4) { width: 210px; }
+.admin-assets-table-wrap th:nth-child(5) { width: 92px; }
+.admin-assets-table-wrap th:nth-child(6),
+.admin-assets-table-wrap th:nth-child(7) { width: 92px; }
+.admin-assets-table-wrap th:last-child { width: 180px; }
+.admin-assets-table-wrap img { display: block; width: 48px; height: 48px; object-fit: contain; border: 1px solid #c1c1ba; background: #f6f6f4; }
+.admin-assets-table-wrap strong,
+.admin-assets-table-wrap small { display: block; }
+.admin-assets-table-wrap small { margin-top: 4px; color: #65655f; font-size: 10px; overflow-wrap: anywhere; }
+.admin-assets-table-wrap input[type="number"] { width: 70px; min-height: 34px; margin-top: 5px; padding: 5px 7px; border: 1px solid #777770; border-radius: 0; }
+.admin-assets-table-wrap td:last-child { display: flex; gap: 6px; }
+.admin-assets-table-wrap button { min-height: 34px; padding: 6px 8px; border: 1px solid #555550; border-radius: 0; background: #ffffff; font-weight: 800; }
+.admin-assets-table-wrap button:disabled { color: #8a8a84; background: #ecece8; }
+.admin-assets-table-wrap .is-enabled { color: #1f6639; font-weight: 800; }
+.admin-assets-table-wrap .is-disabled { color: #812219; font-weight: 800; }
+.admin-assets-empty { margin: 0; padding: 34px 16px; color: #65655f; }
+.admin-assets-notice { margin: 16px 0 0; padding: 13px 16px; border-left: 4px solid #287b45; background: #edf8f0; font-weight: 800; }
+.admin-assets-alert { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-top: 24px; padding: 16px; border-left: 5px solid #d14a3b; background: #fff1ef; }
+.admin-assets-loading { display: grid; gap: 10px; margin-top: 24px; }
+.admin-assets-loading span { display: block; height: 62px; background: #dfdfda; }
+@media (max-width: 900px) {
+  .admin-assets-page > main { width: 100%; padding-right: 16px; padding-left: 16px; }
+  .admin-assets-summary { grid-template-columns: 1fr; }
+  .admin-assets-summary > span { border-right: 0; border-bottom: 1px solid #c1c1ba; }
+  .admin-assets-form { grid-template-columns: 1fr 1fr; }
+}
+@media (max-width: 580px) {
+  .admin-product-header { padding: 0 12px; overflow-x: auto; }
+  .admin-product-header nav a { min-width: 66px; }
+  .admin-assets-form { grid-template-columns: 1fr; }
+  .admin-assets-heading { align-items: start; flex-direction: column; }
+}

apps/web/src/admin-assets.tsx

@@ -0,0 +1,191 @@
+import { useEffect, useMemo, useState } from "react";
+
+import "./admin-assets.css";
+
+interface AdminSession { csrf_token: string }
+interface StorageState {
+  capacity_notice_level: "normal" | "warning" | "critical";
+  hard_limit_bytes: number;
+  managed_content_bytes: number;
+  storage_status: "active" | "full" | "unavailable";
+}
+interface AdminSticker {
+  enabled: boolean;
+  file_state: "committed";
+  height: number;
+  mime_type: "image/png" | "image/webp";
+  order: number;
+  original_byte_size: number;
+  original_filename: string;
+  part: number;
+  resource_version: string;
+  stable_id: string;
+  thumbnail_byte_size: number;
+  thumbnail_reference: { url: string };
+  width: number;
+}
+interface AdminAssetsResponse {
+  count: number;
+  items: AdminSticker[];
+  release_version: string | null;
+  storage: StorageState;
+}
+
+function idempotencyKey() {
+  return crypto.randomUUID().replaceAll("-", "") + crypto.randomUUID().replaceAll("-", "");
+}
+
+function bytesLabel(bytes: number) {
+  return new Intl.NumberFormat("zh-CN", { maximumFractionDigits: 2, minimumFractionDigits: 2 }).format(bytes / (1024 ** 3));
+}
+
+async function loadJson<T>(url: string, init?: RequestInit) {
+  const response = await fetch(url, { credentials: "same-origin", ...init });
+  const body = response.headers.get("content-type")?.includes("application/json") ? await response.json() as T : undefined;
+  return { body, response };
+}
+
+export function AdminAssetsPage() {
+  const [session, setSession] = useState<AdminSession>();
+  const [assets, setAssets] = useState<AdminAssetsResponse>();
+  const [loadingFailed, setLoadingFailed] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [notice, setNotice] = useState("");
+  const [file, setFile] = useState<File>();
+  const [stableId, setStableId] = useState("STK1408");
+  const [part, setPart] = useState(25);
+  const [order, setOrder] = useState(184);
+  const [enabled, setEnabled] = useState(true);
+  const [orderDrafts, setOrderDrafts] = useState<Record<string, number>>({});
+
+  async function load() {
+    setLoadingFailed(false);
+    try {
+      const [sessionResult, assetsResult] = await Promise.all([
+        loadJson<AdminSession>("/api/v1/admin-auth/session"),
+        loadJson<AdminAssetsResponse>("/api/v1/admin/assets/static-stickers"),
+      ]);
+      if (!sessionResult.response.ok || !assetsResult.response.ok || !sessionResult.body || !assetsResult.body) throw new Error("load_failed");
+      setSession(sessionResult.body);
+      setAssets(assetsResult.body);
+      setOrderDrafts(Object.fromEntries(assetsResult.body.items.map((item) => [item.stable_id, item.order])));
+      const numericIds = assetsResult.body.items.map((item) => Number(item.stable_id.slice(3))).filter(Number.isFinite);
+      setStableId(`STK${Math.max(1407, ...numericIds) + 1}`);
+      setOrder(Math.max(183, ...assetsResult.body.items.filter((item) => item.part === 25).map((item) => item.order)) + 1);
+      setNotice("");
+    } catch {
+      setLoadingFailed(true);
+    }
+  }
+
+  useEffect(() => { void load(); }, []);
+
+  const uploadBlocked = !assets || assets.storage.storage_status !== "active";
+  const formValid = useMemo(() => Boolean(
+    file && /^(image\/png|image\/webp)$/.test(file.type) && /^STK[0-9]{4,}$/.test(stableId)
+      && Number.isSafeInteger(part) && part >= 1 && part <= 25 && Number.isSafeInteger(order) && order > 0,
+  ), [file, order, part, stableId]);
+
+  async function upload() {
+    if (!file || !session || !formValid || uploadBlocked || busy) return;
+    setBusy(true);
+    setNotice("");
+    try {
+      const sha256 = Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", await file.arrayBuffer())))
+        .map((byte) => byte.toString(16).padStart(2, "0")).join("");
+      const form = new FormData();
+      form.append("stable_id", stableId);
+      form.append("part", String(part));
+      form.append("order", String(order));
+      form.append("enabled", String(enabled));
+      form.append("original_byte_size", String(file.size));
+      form.append("original_sha256", sha256);
+      form.append("sticker_file", file, file.name);
+      const response = await fetch("/api/v1/admin/assets/static-stickers", {
+        body: form,
+        credentials: "same-origin",
+        headers: { "Idempotency-Key": idempotencyKey(), "X-CSRF-Token": session.csrf_token },
+        method: "POST",
+      });
+      if (!response.ok) {
+        setNotice(response.status === 507 ? "存储容量已满或暂不可用，未写入任何文件。" : response.status === 409 ? "稳定 ID 或 part 顺序已存在。" : "文件格式、内容或字段校验未通过。");
+        return;
+      }
+      setFile(undefined);
+      await load();
+      setNotice("贴纸已生成缩略图并发布新资源版本。");
+    } catch {
+      setNotice("上传未完成，未发布新资源版本。");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function update(item: AdminSticker, change: { enabled?: boolean; order?: number }) {
+    if (!session || busy) return;
+    setBusy(true);
+    setNotice("");
+    try {
+      const { response } = await loadJson(`/api/v1/admin/assets/static-stickers/${encodeURIComponent(item.stable_id)}`, {
+        body: JSON.stringify(change),
+        headers: { "Content-Type": "application/json", "X-CSRF-Token": session.csrf_token },
+        method: "PATCH",
+      });
+      if (!response.ok) throw new Error("update_failed");
+      await load();
+      setNotice(change.enabled === false ? "贴纸已停用，新项目目录不再显示。" : change.enabled === true ? "贴纸已重新启用。" : "part 顺序已发布到新资源版本。");
+    } catch {
+      setNotice("素材状态未更新。");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return <div className="admin-assets-page">
+    <header className="admin-product-header">
+      <a href="/admin">DADA ADMIN</a>
+      <nav aria-label="后台导航"><a href="/admin/users">用户</a><a href="/admin/models">模型</a><a aria-current="page" href="/admin/assets">素材</a><a href="/admin/audit">审计</a></nav>
+    </header>
+    <main>
+      <header className="admin-assets-heading"><div><p>ASSET OPERATIONS</p><h1>普通贴纸</h1></div><strong>{assets?.release_version ?? "尚未发布"}</strong></header>
+      {!assets && !loadingFailed ? <div aria-label="贴纸素材加载中" className="admin-assets-loading"><span /><span /><span /></div> : null}
+      {loadingFailed ? <p className="admin-assets-alert" role="alert">素材状态暂时无法读取。<button onClick={() => void load()} type="button">重试</button></p> : null}
+      {assets ? <>
+        <div className="admin-assets-summary" aria-label="素材存储摘要">
+          <span>后台贴纸<strong>{assets.count}</strong></span>
+          <span>受管内容<strong>{bytesLabel(assets.storage.managed_content_bytes)} / {bytesLabel(assets.storage.hard_limit_bytes)} GB</strong></span>
+          <span>存储状态<strong className={`is-${assets.storage.storage_status}`}>{assets.storage.storage_status}</strong></span>
+        </div>
+        <section className="admin-assets-upload" aria-labelledby="asset-upload-title">
+          <header><h2 id="asset-upload-title">上传并发布</h2><span>PNG / WebP</span></header>
+          <div className="admin-assets-form">
+            <label>文件<input accept="image/png,image/webp" aria-label="贴纸文件" disabled={uploadBlocked || busy} key={file?.name ?? "empty"} onChange={(event) => setFile(event.target.files?.[0])} type="file" /></label>
+            <label>稳定 ID<input aria-label="稳定 ID" disabled={uploadBlocked || busy} onChange={(event) => setStableId(event.target.value.toUpperCase())} value={stableId} /></label>
+            <label>Part<input aria-label="Part" disabled={uploadBlocked || busy} max="25" min="1" onChange={(event) => setPart(Number(event.target.value))} type="number" value={part} /></label>
+            <label>顺序<input aria-label="顺序" disabled={uploadBlocked || busy} min="1" onChange={(event) => setOrder(Number(event.target.value))} type="number" value={order} /></label>
+            <label className="admin-assets-enabled"><input checked={enabled} disabled={uploadBlocked || busy} onChange={(event) => setEnabled(event.target.checked)} type="checkbox" />发布后启用</label>
+            <button disabled={!formValid || uploadBlocked || busy} onClick={() => void upload()} type="button">{busy ? "处理中" : "上传并发布"}</button>
+          </div>
+          {uploadBlocked ? <p className="admin-assets-blocked" role="status">当前存储状态禁止新增原图和缩略图。</p> : null}
+        </section>
+        <section className="admin-assets-list" aria-labelledby="asset-list-title">
+          <header><h2 id="asset-list-title">当前版本</h2><span>{assets.count} 项</span></header>
+          {assets.items.length === 0 ? <p className="admin-assets-empty">当前没有后台上传的普通贴纸。</p> : <div className="admin-assets-table-wrap"><table>
+            <thead><tr><th>预览</th><th>稳定 ID</th><th>Part / 顺序</th><th>原文件</th><th>尺寸</th><th>文件状态</th><th>发布状态</th><th>操作</th></tr></thead>
+            <tbody>{assets.items.map((item) => <tr key={item.stable_id}>
+              <td><img alt="" src={item.thumbnail_reference.url} /></td>
+              <th scope="row"><strong>{item.stable_id}</strong><small>{item.resource_version}</small></th>
+              <td><span>part{item.part}</span><input aria-label={`${item.stable_id} 顺序`} min="1" onChange={(event) => setOrderDrafts((current) => ({ ...current, [item.stable_id]: Number(event.target.value) }))} type="number" value={orderDrafts[item.stable_id] ?? item.order} /></td>
+              <td><span>{item.original_filename}</span><small>{item.mime_type} · {item.original_byte_size.toLocaleString("zh-CN")} B</small></td>
+              <td>{item.width} x {item.height}</td>
+              <td>{item.file_state}</td>
+              <td><span className={item.enabled ? "is-enabled" : "is-disabled"}>{item.enabled ? "已启用" : "已停用"}</span></td>
+              <td><button disabled={busy || (orderDrafts[item.stable_id] ?? item.order) === item.order} onClick={() => void update(item, { order: orderDrafts[item.stable_id] ?? item.order })} type="button">更新顺序</button><button disabled={busy} onClick={() => void update(item, { enabled: !item.enabled })} type="button">{item.enabled ? "停用" : "启用"}</button></td>
+            </tr>)}</tbody>
+          </table></div>}
+        </section>
+        {notice ? <p className="admin-assets-notice" role="status">{notice}</p> : null}
+      </> : null}
+    </main>
+  </div>;
+}

apps/web/src/admin-audit.css

@@ -0,0 +1,164 @@
+.admin-audit-page {
+  width: min(100% - 48px, 1440px);
+  margin: 0 auto;
+  padding: 28px 0 40px;
+  color: #1a1a18;
+}
+
+.admin-audit-heading {
+  display: flex;
+  min-height: 72px;
+  align-items: flex-end;
+  justify-content: space-between;
+  gap: 24px;
+  border-bottom: 2px solid #1a1a18;
+}
+
+.admin-audit-heading p,
+.admin-audit-heading h2 {
+  margin: 0;
+}
+
+.admin-audit-heading p {
+  color: #686861;
+  font-size: 12px;
+  font-weight: 800;
+}
+
+.admin-audit-heading h2 {
+  padding: 4px 0 12px;
+  font-size: 28px;
+  line-height: 40px;
+}
+
+.admin-audit-heading time {
+  padding-bottom: 14px;
+  color: #686861;
+  font-size: 12px;
+}
+
+.admin-audit-tabs {
+  display: flex;
+  gap: 0;
+  margin-top: 24px;
+  border-bottom: 1px solid #a9a9a2;
+}
+
+.admin-audit-tabs button {
+  min-height: 40px;
+  padding: 0 18px;
+  border: 0;
+  border-bottom: 3px solid transparent;
+  color: #4f4f49;
+  background: transparent;
+  font-weight: 700;
+}
+
+.admin-audit-tabs button[aria-selected="true"] {
+  border-bottom-color: #1a1a18;
+  color: #1a1a18;
+  background: #f4df32;
+}
+
+.admin-audit-failure {
+  display: flex;
+  min-height: 44px;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  margin-top: 16px;
+  padding: 8px 12px;
+  border-left: 4px solid #c92a24;
+  background: #fff1ef;
+}
+
+.admin-audit-failure button,
+.admin-audit-pagination button {
+  min-height: 36px;
+  padding: 0 14px;
+  border: 1px solid #1a1a18;
+  background: #fff;
+  font-weight: 700;
+}
+
+.admin-audit-status {
+  margin: 0;
+  padding: 48px 16px;
+  color: #686861;
+}
+
+.admin-audit-table-scroll {
+  overflow-x: auto;
+  border-bottom: 1px solid #a9a9a2;
+}
+
+.admin-audit-page table {
+  width: 100%;
+  min-width: 1120px;
+  border-collapse: collapse;
+  table-layout: fixed;
+}
+
+.admin-audit-page th,
+.admin-audit-page td {
+  min-height: 40px;
+  padding: 10px 12px;
+  border-bottom: 1px solid #d7d7d1;
+  overflow-wrap: anywhere;
+  text-align: left;
+  vertical-align: top;
+  font-size: 12px;
+}
+
+.admin-audit-page th {
+  color: #55554f;
+  background: #efefeb;
+  font-weight: 800;
+}
+
+.admin-audit-page th:nth-child(1) { width: 132px; }
+.admin-audit-page th:nth-child(2) { width: 210px; }
+.admin-audit-page th:nth-child(3) { width: 180px; }
+.admin-audit-page th:nth-child(5) { width: 100px; }
+.admin-audit-page th:nth-child(6) { width: 210px; }
+
+.admin-audit-page td small {
+  display: block;
+  margin-top: 4px;
+  color: #686861;
+}
+
+.admin-audit-page td strong {
+  color: #16794b;
+}
+
+.admin-audit-page td strong.is-failed {
+  color: #c92a24;
+}
+
+.admin-audit-pagination {
+  display: flex;
+  justify-content: flex-end;
+  padding-top: 16px;
+}
+
+.admin-audit-retention {
+  margin: 24px 0 0;
+  padding-top: 12px;
+  border-top: 1px solid #d7d7d1;
+  color: #686861;
+  font-size: 12px;
+}
+
+.admin-audit-page :focus-visible {
+  outline: 2px solid #005fcc;
+  outline-offset: 2px;
+}
+
+@media (max-width: 700px) {
+  .admin-audit-page { width: calc(100% - 24px); }
+  .admin-audit-heading { align-items: flex-start; flex-direction: column; gap: 4px; }
+  .admin-audit-heading time { padding-bottom: 12px; }
+  .admin-audit-tabs { display: grid; grid-template-columns: 1fr 1fr; }
+  .admin-audit-tabs button { min-width: 0; padding: 8px; }
+}

apps/web/src/admin-audit.tsx

@@ -0,0 +1,181 @@
+import type {
+  AdminOperationAuditItem,
+  AdminOperationAuditResponse,
+  PrivateContentAccessAuditItem,
+  PrivateContentAccessAuditResponse,
+} from "@dada/shared-contracts";
+import { useCallback, useEffect, useState } from "react";
+
+import "./admin-audit.css";
+
+type AuditTab = "operations" | "private-content";
+
+interface AuditPageState<Item> {
+  failed: boolean;
+  generatedAt: string | null;
+  items: Item[];
+  loading: boolean;
+  nextCursor: string | null;
+}
+
+const emptyState = <Item,>(): AuditPageState<Item> => ({
+  failed: false,
+  generatedAt: null,
+  items: [],
+  loading: false,
+  nextCursor: null,
+});
+
+function formatTime(value: string) {
+  return new Intl.DateTimeFormat("zh-CN", {
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    month: "2-digit",
+    second: "2-digit",
+  }).format(new Date(value));
+}
+
+function operationSummary(item: AdminOperationAuditItem) {
+  if (item.after_summary) return item.after_summary;
+  if (item.before_summary) return item.before_summary;
+  return "无变更摘要";
+}
+
+export function AdminAuditPage() {
+  const [tab, setTab] = useState<AuditTab>("operations");
+  const [operations, setOperations] = useState<AuditPageState<AdminOperationAuditItem>>(emptyState);
+  const [privateAccess, setPrivateAccess] = useState<AuditPageState<PrivateContentAccessAuditItem>>(emptyState);
+
+  const loadOperations = useCallback(async (cursor?: string, append = false) => {
+    setOperations((current) => ({ ...current, failed: false, loading: true }));
+    try {
+      const query = new URLSearchParams({ limit: "50" });
+      if (cursor) query.set("cursor", cursor);
+      const response = await fetch(`/api/v1/admin/audit/operations?${query}`, { credentials: "same-origin" });
+      if (response.status === 401) {
+        window.dispatchEvent(new Event("dada:session-invalid"));
+        return;
+      }
+      if (!response.ok) throw new Error("admin_operation_audit_unavailable");
+      const body = await response.json() as AdminOperationAuditResponse;
+      setOperations((current) => ({
+        failed: false,
+        generatedAt: body.generated_at,
+        items: append ? [...current.items, ...body.items] : body.items,
+        loading: false,
+        nextCursor: body.next_cursor,
+      }));
+    } catch {
+      setOperations((current) => ({ ...current, failed: true, loading: false }));
+    }
+  }, []);
+
+  const loadPrivateAccess = useCallback(async (cursor?: string, append = false) => {
+    setPrivateAccess((current) => ({ ...current, failed: false, loading: true }));
+    try {
+      const query = new URLSearchParams({ limit: "50" });
+      if (cursor) query.set("cursor", cursor);
+      const response = await fetch(`/api/v1/admin/audit/private-content?${query}`, { credentials: "same-origin" });
+      if (response.status === 401) {
+        window.dispatchEvent(new Event("dada:session-invalid"));
+        return;
+      }
+      if (!response.ok) throw new Error("private_content_audit_unavailable");
+      const body = await response.json() as PrivateContentAccessAuditResponse;
+      setPrivateAccess((current) => ({
+        failed: false,
+        generatedAt: body.generated_at,
+        items: append ? [...current.items, ...body.items] : body.items,
+        loading: false,
+        nextCursor: body.next_cursor,
+      }));
+    } catch {
+      setPrivateAccess((current) => ({ ...current, failed: true, loading: false }));
+    }
+  }, []);
+
+  useEffect(() => { void loadOperations(); }, [loadOperations]);
+
+  function selectTab(next: AuditTab) {
+    setTab(next);
+    if (next === "private-content" && !privateAccess.generatedAt && !privateAccess.loading) void loadPrivateAccess();
+  }
+
+  const state = tab === "operations" ? operations : privateAccess;
+  const reload = tab === "operations" ? loadOperations : loadPrivateAccess;
+
+  return (
+    <main className="admin-audit-page" id="admin-main">
+      <header className="admin-audit-heading">
+        <div><p>IMMUTABLE / 180 DAYS</p><h2>审计</h2></div>
+        {state.generatedAt ? <time dateTime={state.generatedAt}>读取于 {formatTime(state.generatedAt)}</time> : null}
+      </header>
+
+      <div aria-label="审计类型" className="admin-audit-tabs" role="tablist">
+        <button aria-controls="operation-audit-panel" aria-selected={tab === "operations"} id="operation-audit-tab" onClick={() => selectTab("operations")} role="tab" type="button">后台操作审计</button>
+        <button aria-controls="private-audit-panel" aria-selected={tab === "private-content"} id="private-audit-tab" onClick={() => selectTab("private-content")} role="tab" type="button">私有内容访问审计</button>
+      </div>
+
+      {state.failed ? (
+        <div className="admin-audit-failure" role="alert">
+          <span>审计记录暂时无法读取{state.generatedAt ? "，已保留上次结果" : ""}。</span>
+          <button disabled={state.loading} onClick={() => void reload()} type="button">重试</button>
+        </div>
+      ) : null}
+
+      {tab === "operations" ? (
+        <section aria-labelledby="operation-audit-tab" id="operation-audit-panel" role="tabpanel">
+          {operations.loading && operations.items.length === 0 ? <p aria-live="polite" className="admin-audit-status">正在读取后台操作审计</p> : null}
+          {!operations.loading && !operations.failed && operations.items.length === 0 ? <p className="admin-audit-status">当前没有后台操作审计记录。</p> : null}
+          {operations.items.length > 0 ? (
+            <div className="admin-audit-table-scroll">
+              <table>
+                <thead><tr><th>时间</th><th>管理员</th><th>操作类型</th><th>对象安全摘要</th><th>结果</th><th>Operation ID</th></tr></thead>
+                <tbody>{operations.items.map((item) => (
+                  <tr key={item.log_id}>
+                    <td><time dateTime={item.occurred_at}>{formatTime(item.occurred_at)}</time></td>
+                    <td><code>{item.actor_ref}</code><small>{item.actor_type}</small></td>
+                    <td><code>{item.operation_type}</code></td>
+                    <td><code>{item.target_type}:{item.target_ref}</code><small>{operationSummary(item)}</small></td>
+                    <td><strong className={`is-${item.result}`}>{item.result}</strong></td>
+                    <td><code>{item.log_id}</code></td>
+                  </tr>
+                ))}</tbody>
+              </table>
+            </div>
+          ) : null}
+        </section>
+      ) : (
+        <section aria-labelledby="private-audit-tab" id="private-audit-panel" role="tabpanel">
+          {privateAccess.loading && privateAccess.items.length === 0 ? <p aria-live="polite" className="admin-audit-status">正在读取私有内容访问审计</p> : null}
+          {!privateAccess.loading && !privateAccess.failed && privateAccess.items.length === 0 ? <p className="admin-audit-status">当前没有私有内容访问审计记录。</p> : null}
+          {privateAccess.items.length > 0 ? (
+            <div className="admin-audit-table-scroll">
+              <table>
+                <thead><tr><th>时间</th><th>管理员</th><th>安全目标标识</th><th>内容类型</th><th>到期时间</th><th>Access ID</th></tr></thead>
+                <tbody>{privateAccess.items.map((item) => (
+                  <tr key={item.log_id}>
+                    <td><time dateTime={item.occurred_at}>{formatTime(item.occurred_at)}</time></td>
+                    <td><code>{item.actor_ref}</code></td>
+                    <td><code>{item.target_ref}</code></td>
+                    <td>{item.content_type}</td>
+                    <td><time dateTime={item.expires_at}>{formatTime(item.expires_at)}</time></td>
+                    <td><code>{item.log_id}</code></td>
+                  </tr>
+                ))}</tbody>
+              </table>
+            </div>
+          ) : null}
+        </section>
+      )}
+
+      {state.nextCursor ? (
+        <div className="admin-audit-pagination">
+          <button disabled={state.loading} onClick={() => void reload(state.nextCursor!, true)} type="button">{state.loading ? "正在读取" : "下一页"}</button>
+        </div>
+      ) : null}
+      <p className="admin-audit-retention">记录保留 180 天。此页面不提供编辑、删除或清空能力。</p>
+    </main>
+  );
+}

apps/web/src/admin-generations.css

@@ -0,0 +1,24 @@
+.admin-generations { display: grid; gap: 20px; }
+.admin-generations-refresh { align-self: start; }
+.admin-generations-notice-panel { display: grid; gap: 14px; max-width: 760px; padding: 24px; border: 1px solid #d5b36a; background: #fffaf0; }
+.admin-generations-notice-panel p { margin: 0; }
+.admin-generations-notice-panel button { justify-self: start; }
+.admin-generations-error, .admin-generations-notice { padding: 12px 16px; border: 1px solid #d46a6a; background: #fff4f4; }
+.admin-generations-error button { margin-left: 12px; }
+.admin-generations-table-wrap { overflow-x: auto; border: 1px solid #d9dde5; background: #fff; }
+.admin-generations-table-wrap table { width: 100%; min-width: 1050px; border-collapse: collapse; }
+.admin-generations-table-wrap th, .admin-generations-table-wrap td { padding: 12px 14px; border-bottom: 1px solid #e9ebef; text-align: left; vertical-align: top; }
+.admin-generations-table-wrap th { background: #f5f6f8; color: #4d5664; font-size: 12px; }
+.admin-generations-table-wrap small { color: #6c7481; }
+.admin-generations-status { display: inline-block; padding: 3px 7px; border-radius: 4px; background: #edf0f4; }
+.admin-generations-status.is-succeeded { color: #23623d; background: #e6f4ea; }
+.admin-generations-status.is-failed, .admin-generations-status.is-rejected { color: #8b2b2b; background: #fff0f0; }
+.admin-generations-status.is-running { color: #7a5a10; background: #fff5d8; }
+.admin-generations-actions { display: grid; gap: 8px; min-width: 190px; }
+.admin-generations-actions button { white-space: normal; }
+.admin-generations-empty { margin: 0; padding: 28px; color: #6c7481; }
+.admin-generations-opened { display: grid; gap: 10px; padding: 18px; border: 1px solid #cbd2dd; background: #fff; }
+.admin-generations-opened header { display: flex; align-items: center; justify-content: space-between; }
+.admin-generations-opened h3 { margin: 0; }
+.admin-generations-opened pre { max-height: 360px; overflow: auto; margin: 0; padding: 14px; white-space: pre-wrap; background: #f6f7f9; }
+.admin-generations-opened img { max-width: 100%; max-height: 620px; object-fit: contain; }

apps/web/src/admin-generations.tsx

@@ -0,0 +1,156 @@
+import { useEffect, useState } from "react";
+
+import "./admin-generations.css";
+
+interface AdminSession {
+  acknowledged_private_content_notice_version: string | null;
+  current_private_content_notice_version: string | null;
+  csrf_token: string;
+  notice_acknowledged: boolean;
+}
+
+interface GenerationRecord {
+  generation_id: string;
+  owner_ref: string;
+  project_id: string;
+  model_id: string;
+  ratio: string;
+  status: "queued" | "running" | "succeeded" | "failed" | "rejected";
+  created_at: string;
+  completed_at: string | null;
+  duration_ms: number | null;
+  confirmed_credit_cost: number;
+  reserved_credits: number;
+  final_credit_state: "committed" | "released" | null;
+  error_category: string | null;
+}
+
+interface GenerationResponse { generated_at: string; items: GenerationRecord[] }
+interface OpenedPrompt { generation_id: string; prompt: string }
+
+function idempotencyKey() {
+  return `${crypto.randomUUID().replaceAll("-", "")}${crypto.randomUUID().replaceAll("-", "")}`;
+}
+
+function compactId(value: string) { return `${value.slice(0, 8)}...${value.slice(-4)}`; }
+function formatTime(value: string | null) { return value ? new Intl.DateTimeFormat("zh-CN", { dateStyle: "short", timeStyle: "medium" }).format(new Date(value)) : "未完成"; }
+function statusLabel(value: GenerationRecord["status"]) { return { queued: "排队", running: "运行中", succeeded: "成功", failed: "失败", rejected: "已拒绝" }[value]; }
+
+export function AdminGenerationsPage() {
+  const [session, setSession] = useState<AdminSession>();
+  const [records, setRecords] = useState<GenerationRecord[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [failed, setFailed] = useState(false);
+  const [acknowledging, setAcknowledging] = useState(false);
+  const [notice, setNotice] = useState("");
+  const [openedPrompt, setOpenedPrompt] = useState<OpenedPrompt>();
+  const [openedImage, setOpenedImage] = useState<{ generationId: string; url: string }>();
+
+  async function load() {
+    setLoading(true);
+    setFailed(false);
+    try {
+      const sessionResponse = await fetch("/api/v1/admin-auth/session", { credentials: "same-origin" });
+      if (sessionResponse.status === 401) throw new Error("session_invalid");
+      if (!sessionResponse.ok) throw new Error("session_unavailable");
+      const current = await sessionResponse.json() as AdminSession;
+      setSession(current);
+      setNotice("");
+      if (!current.notice_acknowledged) {
+        setRecords([]);
+        return;
+      }
+      const listResponse = await fetch("/api/v1/admin/generations", { credentials: "same-origin" });
+      if (!listResponse.ok) throw new Error("generation_list_unavailable");
+      setRecords((await listResponse.json() as GenerationResponse).items);
+    } catch {
+      setFailed(true);
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  useEffect(() => { void load(); }, []);
+  useEffect(() => () => { if (openedImage) URL.revokeObjectURL(openedImage.url); }, [openedImage]);
+
+  async function acknowledge() {
+    if (!session?.current_private_content_notice_version || acknowledging) return;
+    setAcknowledging(true);
+    setNotice("");
+    try {
+      const response = await fetch("/api/v1/admin/private-content-notice/ack", {
+        body: JSON.stringify({ expected_notice_version: session.current_private_content_notice_version }),
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json", "Idempotency-Key": idempotencyKey(), "X-CSRF-Token": session.csrf_token },
+        method: "POST",
+      });
+      if (!response.ok) throw new Error("notice_ack_failed");
+      await load();
+    } catch {
+      setNotice("告知版本已变化或确认未完成，请重新读取。 ");
+    } finally {
+      setAcknowledging(false);
+    }
+  }
+
+  async function openPrompt(generationId: string) {
+    setNotice("");
+    try {
+      const response = await fetch(`/api/v1/admin/private-content/generations/${generationId}/prompt`, { credentials: "same-origin" });
+      if (!response.ok) throw new Error("prompt_unavailable");
+      setOpenedPrompt(await response.json() as OpenedPrompt);
+    } catch {
+      setNotice("内容读取未完成，访问审计未成功时不会返回内容。 ");
+    }
+  }
+
+  async function openImage(generationId: string) {
+    setNotice("");
+    try {
+      const response = await fetch(`/api/v1/admin/private-content/generations/${generationId}/image`, { credentials: "same-origin" });
+      if (!response.ok) throw new Error("image_unavailable");
+      const url = URL.createObjectURL(await response.blob());
+      setOpenedImage((previous) => {
+        if (previous) URL.revokeObjectURL(previous.url);
+        return { generationId, url };
+      });
+    } catch {
+      setNotice("内容读取未完成，访问审计未成功时不会返回内容。 ");
+    }
+  }
+
+  return (
+    <main className="admin-generations" id="admin-main">
+      <header className="admin-page-heading"><div><p>OPERATIONS / GENERATION RECORDS</p><h2>生成记录</h2></div><button className="admin-generations-refresh" onClick={() => void load()} type="button">重新读取</button></header>
+      {loading ? <p aria-live="polite">正在读取生成记录</p> : null}
+      {failed ? <div className="admin-generations-error" role="alert">后台生成记录暂时无法读取。<button onClick={() => void load()} type="button">重试</button></div> : null}
+      {notice ? <p className="admin-generations-notice" role="alert">{notice}</p> : null}
+      {session && !session.notice_acknowledged ? (
+        <section aria-labelledby="private-content-notice-title" className="admin-generations-notice-panel">
+          <p>PRIVATE CONTENT ACCESS</p>
+          <h3 id="private-content-notice-title">查看私有内容前，请确认当前规则告知</h3>
+          <p>生成记录默认只显示安全元数据。打开图片或完整提示词时，系统会自动记录本次管理员、目标和内容类型访问审计。</p>
+          <button disabled={acknowledging} onClick={() => void acknowledge()} type="button">{acknowledging ? "确认中" : "确认并进入记录"}</button>
+        </section>
+      ) : null}
+      {session?.notice_acknowledged ? (
+        <section aria-label="生成记录元数据" className="admin-generations-table-wrap">
+          <table><thead><tr><th>任务</th><th>用户标识</th><th>模型 / 比例</th><th>状态</th><th>创建 / 完成</th><th>点数</th><th>私有内容</th></tr></thead><tbody>
+            {records.map((record) => <tr key={record.generation_id}>
+              <td><code>{compactId(record.generation_id)}</code></td>
+              <td><code>{compactId(record.owner_ref)}</code></td>
+              <td>{record.model_id}<br /><small>{record.ratio}</small></td>
+              <td><span className={`admin-generations-status is-${record.status}`}>{statusLabel(record.status)}</span>{record.error_category ? <small>{record.error_category}</small> : null}</td>
+              <td><time dateTime={record.created_at}>{formatTime(record.created_at)}</time><br /><small>{formatTime(record.completed_at)}</small></td>
+              <td>{record.confirmed_credit_cost} / {record.final_credit_state ?? "冻结"}</td>
+              <td className="admin-generations-actions"><button onClick={() => void openPrompt(record.generation_id)} type="button">打开提示词并记录审计</button><button disabled={record.status !== "succeeded"} onClick={() => void openImage(record.generation_id)} type="button">打开图片并记录审计</button></td>
+            </tr>)}
+          </tbody></table>
+          {!records.length && !loading ? <p className="admin-generations-empty">当前无生成记录</p> : null}
+        </section>
+      ) : null}
+      {openedPrompt ? <section aria-label="已审计的完整提示词" className="admin-generations-opened"><header><h3>已记录审计的完整提示词</h3><button onClick={() => setOpenedPrompt(undefined)} type="button">关闭</button></header><p><code>{compactId(openedPrompt.generation_id)}</code></p><pre>{openedPrompt.prompt}</pre></section> : null}
+      {openedImage ? <section aria-label="已审计的生成图片" className="admin-generations-opened"><header><h3>已记录审计的生成图片</h3><button onClick={() => { URL.revokeObjectURL(openedImage.url); setOpenedImage(undefined); }} type="button">关闭</button></header><img alt="已记录审计的生成图片" src={openedImage.url} /></section> : null}
+    </main>
+  );
+}

apps/web/src/admin-models.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useMemo, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 
 import "./admin-models.css";
 
@@ -64,7 +64,7 @@ export function AdminModelsPage() {
   const priorityRefs = useRef<Record<string, HTMLInputElement | null>>({});
   const defaultRefs = useRef<Record<string, HTMLInputElement | null>>({});
 
-  async function load() {
+  const load = useCallback(async () => {
     setLoadingFailed(false);
     setConflicted(false);
     try {
@@ -80,9 +80,16 @@ export function AdminModelsPage() {
     } catch {
       setLoadingFailed(true);
     }
-  }
+  }, []);
 
-  useEffect(() => { void load(); }, []);
+  useEffect(() => { void load(); }, [load]);
+
+  useEffect(() => {
+    if (typeof EventSource === "undefined") return undefined;
+    const source = new EventSource("/api/v1/events");
+    source.onmessage = () => { void load(); };
+    return () => source.close();
+  }, [load]);
 
   const validation = useMemo(() => {
     if (!draft) return { valid: false, message: "" };
@@ -147,11 +154,7 @@ export function AdminModelsPage() {
 
   return (
     <div className="admin-models-page">
-      <header className="admin-product-header">
-        <a href="/admin">DADA ADMIN</a>
-        <nav aria-label="后台导航"><a href="/admin/users">用户</a><a aria-current="page" href="/admin/models">模型</a><a href="/admin/audit">审计</a></nav>
-      </header>
-      <main>
+      <main id="admin-main">
         <header className="admin-models-heading">
           <div><p>MODEL OPERATIONS</p><h1>模型配置</h1></div>
           {configuration ? <strong>配置集合 v{configuration.config_set_version}</strong> : null}

apps/web/src/admin-services-storage.css

@@ -0,0 +1,37 @@
+.admin-services-storage { max-width: 1180px; }
+.admin-services-heading { align-items: end; }
+.admin-services-heading-actions { align-items: center; display: flex; gap: 16px; }
+.admin-services-heading-actions button, .admin-diagnostics-section button { background: #111827; border: 0; color: #fff; cursor: pointer; font: inherit; padding: 10px 14px; }
+.admin-health-section { border-top: 1px solid #d9dde5; margin-top: 26px; padding-top: 22px; }
+.admin-health-section > header { align-items: center; display: flex; justify-content: space-between; margin-bottom: 18px; }
+.admin-health-section h3 { margin: 4px 0 0; }
+.admin-health-section header p { color: #7b8493; font-size: 11px; letter-spacing: .12em; margin: 0; }
+.admin-safe-note { color: #667085; font-size: 13px; }
+.admin-service-grid { display: grid; gap: 12px; grid-template-columns: repeat(3, minmax(0, 1fr)); }
+.admin-service-card { background: #fff; border: 1px solid #e1e5ea; min-height: 160px; padding: 18px; }
+.admin-service-card.is-degraded, .admin-service-card.is-paused_quota, .admin-service-card.is-paused_provider, .admin-service-card.is-unavailable { border-color: #e5b6b6; }
+.admin-service-card-heading { align-items: center; display: flex; justify-content: space-between; }
+.admin-service-card-heading span, .admin-storage-state { color: #147a50; font-size: 13px; }
+.admin-service-card.is-degraded .admin-service-card-heading span, .admin-service-card.is-paused_quota .admin-service-card-heading span, .admin-service-card.is-paused_provider .admin-service-card-heading span, .admin-service-card.is-unavailable .admin-service-card-heading span { color: #b42318; }
+.admin-service-card dl, .admin-storage-details { display: grid; gap: 10px; margin: 18px 0 0; }
+.admin-service-card dl div, .admin-storage-details div { align-items: baseline; display: flex; justify-content: space-between; }
+.admin-service-card dt, .admin-storage-details dt { color: #667085; font-size: 12px; }
+.admin-service-card dd, .admin-storage-details dd { margin: 0; text-align: right; }
+.admin-storage-state.is-full, .admin-storage-state.is-unavailable { color: #b42318; }
+.admin-storage-metrics { display: grid; gap: 16px; grid-template-columns: repeat(4, minmax(0, 1fr)); }
+.admin-storage-metrics div { background: #f7f8fa; padding: 14px 16px; }
+.admin-storage-metrics span { color: #667085; display: block; font-size: 12px; }
+.admin-storage-metrics strong { display: block; font-size: 20px; margin-top: 6px; }
+.admin-storage-progress { background: #e5e7eb; height: 8px; margin-top: 18px; overflow: hidden; }
+.admin-storage-progress span { background: #147a50; display: block; height: 100%; }
+.admin-storage-description { color: #667085; font-size: 13px; line-height: 1.7; max-width: 780px; }
+.admin-storage-description code { color: #344054; }
+.admin-diagnostics-section > header button:disabled { background: #98a2b3; cursor: not-allowed; }
+.admin-diagnostics-section > p { color: #667085; font-size: 13px; }
+.admin-diagnostics-section pre { background: #111827; color: #d1fadf; font: 12px/1.65 ui-monospace, SFMono-Regular, Consolas, monospace; margin: 16px 0 0; max-height: 280px; overflow: auto; padding: 16px; white-space: pre-wrap; }
+.admin-services-loading { display: grid; gap: 12px; grid-template-columns: repeat(3, 1fr); }
+.admin-services-loading span, .admin-diagnostics-placeholder { background: #eef1f4; display: block; height: 160px; }
+.admin-services-failure { align-items: center; background: #fff4f2; color: #b42318; display: flex; gap: 16px; justify-content: space-between; padding: 14px 16px; }
+.admin-services-failure button { background: transparent; border: 1px solid #b42318; color: #b42318; cursor: pointer; padding: 6px 12px; }
+@media (max-width: 900px) { .admin-service-grid, .admin-storage-metrics { grid-template-columns: repeat(2, minmax(0, 1fr)); } }
+@media (max-width: 620px) { .admin-service-grid, .admin-storage-metrics { grid-template-columns: 1fr; } .admin-services-heading-actions { align-items: flex-end; flex-direction: column; gap: 8px; } }

apps/web/src/admin-services-storage.tsx

@@ -0,0 +1,136 @@
+import { useCallback, useEffect, useState } from "react";
+
+import type { AdminDiagnosticsResponse, AdminServicesStorageResponse } from "@dada/shared-contracts";
+
+import "./admin-services-storage.css";
+
+const serviceLabels: Record<AdminServicesStorageResponse["services"][number]["service_id"], string> = {
+  ai_gateway: "AI 网关",
+  amap: "高德",
+  api: "API",
+  asset_root: "素材根",
+  resend: "Resend",
+  worker: "Worker",
+};
+
+const statusLabels: Record<AdminServicesStorageResponse["services"][number]["status"], string> = {
+  active: "正常",
+  degraded: "有异常",
+  disabled: "已停用",
+  paused_provider: "供应商暂停",
+  paused_quota: "额度暂停",
+  unavailable: "不可用",
+};
+
+const impactLabels: Record<AdminServicesStorageResponse["services"][number]["impact_scope"], string> = {
+  account: "账户模型",
+  api: "后台接口",
+  authentication: "认证",
+  generation: "生成",
+  location: "定位",
+  model: "单模型",
+  none: "无",
+  storage: "存储",
+  unknown: "未知范围",
+};
+
+function formatTime(value: string | null) {
+  if (!value) return "未记录";
+  return new Intl.DateTimeFormat("zh-CN", { dateStyle: "short", timeStyle: "short" }).format(new Date(value));
+}
+
+async function getJson<T>(url: string) {
+  const response = await fetch(url, { credentials: "same-origin" });
+  if (response.status === 401) window.dispatchEvent(new Event("dada:session-invalid"));
+  if (!response.ok) throw new Error("admin_state_unavailable");
+  return await response.json() as T;
+}
+
+export function AdminServicesStoragePage() {
+  const [state, setState] = useState<AdminServicesStorageResponse>();
+  const [diagnostics, setDiagnostics] = useState<AdminDiagnosticsResponse>();
+  const [loading, setLoading] = useState(true);
+  const [failed, setFailed] = useState(false);
+  const [copied, setCopied] = useState(false);
+
+  const load = useCallback(async () => {
+    setLoading(true);
+    setFailed(false);
+    try {
+      const [nextState, nextDiagnostics] = await Promise.all([
+        getJson<AdminServicesStorageResponse>("/api/v1/admin/services-storage"),
+        getJson<AdminDiagnosticsResponse>("/api/v1/admin/diagnostics"),
+      ]);
+      setState(nextState);
+      setDiagnostics(nextDiagnostics);
+    } catch {
+      setFailed(true);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => { void load(); }, [load]);
+
+  async function copyDiagnostics() {
+    if (!diagnostics) return;
+    try {
+      await navigator.clipboard.writeText(diagnostics.diagnostic_text);
+      setCopied(true);
+      window.setTimeout(() => setCopied(false), 1800);
+    } catch {
+      setCopied(false);
+    }
+  }
+
+  return (
+    <main className="admin-services-storage" id="admin-main">
+      <header className="admin-page-heading admin-services-heading">
+        <div><p>OPERATIONS / HEALTH</p><h2>服务与存储</h2></div>
+        <div className="admin-services-heading-actions">
+          {state ? <time dateTime={state.generated_at}>更新于 {formatTime(state.generated_at)}</time> : null}
+          <button aria-label="重新读取服务与存储状态" onClick={() => void load()} type="button">重新读取</button>
+        </div>
+      </header>
+      {loading && !state ? <div aria-label="服务与存储状态加载中" className="admin-services-loading"><span /><span /><span /><span /></div> : null}
+      {failed ? <div className="admin-services-failure" role="alert"><span>状态暂时无法读取{state ? `，保留 ${formatTime(state.generated_at)} 的结果` : ""}。</span><button onClick={() => void load()} type="button">重试</button></div> : null}
+      {state ? (
+        <>
+          <section aria-labelledby="admin-services-list-heading" className="admin-health-section">
+            <header><div><p>SERVICE STATUS</p><h3 id="admin-services-list-heading">外部服务与本机组件</h3></div><span className="admin-safe-note">仅显示脱敏状态</span></header>
+            <div className="admin-service-grid">
+              {state.services.map((service) => (
+                <article className={`admin-service-card is-${service.status}`} key={service.service_id}>
+                  <div className="admin-service-card-heading"><strong>{serviceLabels[service.service_id]}</strong><span>{statusLabels[service.status]}</span></div>
+                  <dl>
+                    <div><dt>配置状态</dt><dd>{service.configured ? "已配置" : "未配置"}</dd></div>
+                    <div><dt>影响范围</dt><dd>{impactLabels[service.impact_scope]}</dd></div>
+                    <div><dt>最近检查</dt><dd>{formatTime(service.checked_at)}</dd></div>
+                    {service.pause_reason ? <div><dt>安全原因</dt><dd>{service.pause_reason}</dd></div> : null}
+                  </dl>
+                </article>
+              ))}
+            </div>
+          </section>
+          <section aria-labelledby="admin-storage-heading" className="admin-health-section">
+            <header><div><p>LOCAL DATA ROOT</p><h3 id="admin-storage-heading">本机内容容量</h3></div><span className={`admin-storage-state is-${state.storage.status}`}>{state.storage.status === "active" ? "可写" : state.storage.status === "full" ? "已满" : "不可用"}</span></header>
+            <div className="admin-storage-metrics">
+              <div><span>已用内容</span><strong>{(state.storage.managed_content_bytes / 1024 / 1024 / 1024).toFixed(2)} GB</strong></div>
+              <div><span>固定上限</span><strong>{(state.storage.hard_limit_bytes / 1024 / 1024 / 1024).toFixed(2)} GB</strong></div>
+              <div><span>容量提醒</span><strong>{state.storage.capacity_notice_level}</strong></div>
+              <div><span>清理队列</span><strong>{state.storage.cleanup_pending_count}</strong></div>
+            </div>
+            <div className="admin-storage-progress" aria-label={`本机内容容量 ${(state.storage.managed_content_bytes / state.storage.hard_limit_bytes * 100).toFixed(1)}%`}><span style={{ width: `${Math.min(100, state.storage.managed_content_bytes / state.storage.hard_limit_bytes * 100)}%` }} /></div>
+            <p className="admin-storage-description">测试数据仅保存在本机，不自动备份，也不会迁移到正式系统。当前 Windows 用户的 Dada 本机数据目录引用：<code>{state.storage.data_root_ref}</code>。只读规范素材库不计入 5 GB 内容额度。</p>
+            <dl className="admin-storage-details"><div><dt>最后计量</dt><dd>{formatTime(state.storage.last_measured_at)}</dd></div><div><dt>重新计量</dt><dd>{state.storage.remeasurement_required ? "需要完成" : "无需等待"}</dd></div></dl>
+          </section>
+          <section aria-labelledby="admin-diagnostics-heading" className="admin-health-section admin-diagnostics-section">
+            <header><div><p>DIAGNOSTICS</p><h3 id="admin-diagnostics-heading">脱敏诊断</h3></div><button disabled={!diagnostics} onClick={() => void copyDiagnostics()} type="button">{copied ? "已复制" : "复制诊断"}</button></header>
+            <p>诊断内容只包含固定版本、组件状态、逻辑位置和容量计量，不包含密钥、邮箱、绝对路径、提示词、图片或供应商原文。</p>
+            {diagnostics ? <pre aria-label="脱敏诊断内容">{diagnostics.diagnostic_text}</pre> : <div aria-label="诊断加载中" className="admin-diagnostics-placeholder" />}
+          </section>
+        </>
+      ) : null}
+    </main>
+  );
+}

apps/web/src/admin-shell.css

@@ -0,0 +1,523 @@
+:root {
+  color-scheme: light;
+  font-family: "Segoe UI", "Microsoft YaHei UI", sans-serif;
+  background: #f3f3ef;
+}
+
+* {
+  box-sizing: border-box;
+  letter-spacing: 0;
+}
+
+body {
+  margin: 0;
+}
+
+button,
+a,
+input,
+textarea {
+  font: inherit;
+}
+
+.admin-shell {
+  min-height: 100vh;
+  color: #171715;
+  background: #f3f3ef;
+}
+
+.admin-skip-link {
+  position: fixed;
+  z-index: 100;
+  top: 8px;
+  left: 228px;
+  padding: 8px 12px;
+  color: #ffffff;
+  background: #171715;
+  transform: translateY(-160%);
+}
+
+.admin-skip-link:focus {
+  transform: translateY(0);
+}
+
+.admin-sidebar {
+  position: fixed;
+  z-index: 20;
+  inset: 0 auto 0 0;
+  display: grid;
+  width: 216px;
+  grid-template-rows: auto 1fr auto;
+  color: #ffffff;
+  background: #171715;
+}
+
+.admin-wordmark {
+  display: grid;
+  min-height: 104px;
+  align-content: center;
+  padding: 20px 22px;
+  border-bottom: 1px solid #494944;
+  color: #ffffff;
+  text-decoration: none;
+}
+
+.admin-wordmark span {
+  font-family: "Arial Black", "Segoe UI", sans-serif;
+  font-size: 30px;
+  line-height: 1;
+}
+
+.admin-wordmark small {
+  margin-top: 6px;
+  color: #d9dc00;
+  font-family: Consolas, monospace;
+  font-size: 10px;
+}
+
+.admin-sidebar nav {
+  display: grid;
+  align-content: start;
+  padding: 12px 0;
+}
+
+.admin-sidebar nav a {
+  display: grid;
+  min-height: 48px;
+  grid-template-columns: 38px 1fr;
+  align-items: center;
+  padding: 0 18px;
+  border-left: 4px solid transparent;
+  color: #d5d5cf;
+  font-size: 13px;
+  font-weight: 700;
+  text-decoration: none;
+}
+
+.admin-sidebar nav a > span {
+  color: #85857d;
+  font-family: Consolas, monospace;
+  font-size: 10px;
+}
+
+.admin-sidebar nav a:hover,
+.admin-sidebar nav a:focus-visible {
+  color: #ffffff;
+  background: #2c2c29;
+}
+
+.admin-sidebar nav a[aria-current="page"] {
+  border-left-color: #e8eb00;
+  color: #171715;
+  background: #eef000;
+}
+
+.admin-sidebar nav a[aria-current="page"] > span {
+  color: #4d4d00;
+}
+
+.admin-sidebar-foot {
+  display: grid;
+  gap: 10px;
+  padding: 18px 22px;
+  border-top: 1px solid #494944;
+  font-family: Consolas, monospace;
+  font-size: 10px;
+}
+
+.admin-sidebar-foot span {
+  color: #a5a59d;
+}
+
+.admin-sidebar-foot strong {
+  color: #ffffff;
+  font-weight: 700;
+}
+
+.admin-shell-workspace {
+  min-width: 0;
+  margin-left: 216px;
+  padding-top: 52px;
+}
+
+.admin-topbar {
+  position: fixed;
+  z-index: 15;
+  top: 0;
+  right: 0;
+  left: 216px;
+  display: flex;
+  height: 52px;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0 28px;
+  border-bottom: 1px solid #b7b7b0;
+  background: rgb(255 255 255 / 96%);
+}
+
+.admin-topbar h1 {
+  margin: 0;
+  font-size: 15px;
+}
+
+.admin-topbar-status {
+  display: flex;
+  align-items: center;
+  gap: 20px;
+  color: #62625c;
+  font-size: 11px;
+}
+
+.admin-topbar-status span {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+}
+
+.admin-topbar-status i {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: #777770;
+}
+
+.admin-topbar-status code {
+  color: #171715;
+}
+
+.admin-shell-content {
+  min-width: 0;
+}
+
+.admin-session-gate {
+  display: grid;
+  min-height: 100vh;
+  place-items: center;
+  color: #171715;
+  background: #f3f3ef;
+}
+
+.admin-session-gate p,
+.admin-session-gate div {
+  padding: 22px;
+  border-left: 5px solid #171715;
+  background: #ffffff;
+}
+
+.admin-session-gate div {
+  display: grid;
+  gap: 12px;
+}
+
+.admin-session-gate button,
+.admin-overview-failure button,
+.admin-placeholder-toolbar button {
+  min-height: 40px;
+  padding: 8px 14px;
+  border: 1px solid #171715;
+  border-radius: 0;
+  color: #171715;
+  background: #eef000;
+  font-weight: 800;
+}
+
+.admin-overview,
+.admin-placeholder {
+  width: min(1320px, calc(100% - 64px));
+  margin: 0 auto;
+  padding: 34px 0 72px;
+}
+
+.admin-page-heading {
+  display: flex;
+  min-height: 74px;
+  align-items: end;
+  justify-content: space-between;
+  gap: 24px;
+  padding-bottom: 18px;
+  border-bottom: 1px solid #8c8c85;
+}
+
+.admin-page-heading p,
+.admin-status-section header p,
+.admin-operation-strip header p {
+  margin: 0 0 5px;
+  font-family: Consolas, monospace;
+  font-size: 10px;
+  font-weight: 700;
+}
+
+.admin-page-heading h2 {
+  margin: 0;
+  font-size: 32px;
+}
+
+.admin-page-heading time {
+  color: #66665f;
+  font-size: 11px;
+}
+
+.admin-capacity-alert {
+  display: grid;
+  min-height: 44px;
+  grid-template-columns: 1fr auto auto;
+  align-items: center;
+  gap: 18px;
+  padding: 9px 14px;
+  border-bottom: 1px solid #171715;
+  color: #171715;
+  background: #eef000;
+  font-size: 12px;
+  text-decoration: none;
+}
+
+.admin-capacity-alert.is-full,
+.admin-capacity-alert.is-unavailable {
+  color: #ffffff;
+  background: #b33a2f;
+}
+
+.admin-overview-loading {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  margin-top: 22px;
+  border-block: 1px solid #b7b7b0;
+}
+
+.admin-overview-loading span {
+  height: 130px;
+  border-right: 1px solid #c7c7c0;
+  background: #e2e2dd;
+}
+
+.admin-overview-failure {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 20px;
+  margin-top: 20px;
+  padding: 14px 16px;
+  border-left: 5px solid #b33a2f;
+  background: #fff0ed;
+}
+
+.admin-metric-band {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  margin-top: 22px;
+  border-block: 1px solid #8c8c85;
+  background: #ffffff;
+}
+
+.admin-metric-band a {
+  display: grid;
+  min-width: 0;
+  min-height: 132px;
+  align-content: center;
+  gap: 7px;
+  padding: 20px;
+  border-right: 1px solid #c3c3bc;
+  color: #171715;
+  text-decoration: none;
+}
+
+.admin-metric-band a:last-child {
+  border-right: 0;
+}
+
+.admin-metric-band span,
+.admin-metric-band small {
+  color: #65655f;
+  font-size: 11px;
+}
+
+.admin-metric-band strong {
+  overflow-wrap: anywhere;
+  font-size: 25px;
+}
+
+.admin-overview-columns {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 24px;
+  margin-top: 24px;
+}
+
+.admin-status-section,
+.admin-operation-strip,
+.admin-placeholder > section {
+  border-top: 3px solid #171715;
+  border-bottom: 1px solid #8c8c85;
+  background: #ffffff;
+}
+
+.admin-status-section > header,
+.admin-operation-strip > header {
+  display: flex;
+  min-height: 64px;
+  align-items: center;
+  justify-content: space-between;
+  padding: 12px 16px;
+  border-bottom: 1px solid #c3c3bc;
+}
+
+.admin-status-section h3,
+.admin-operation-strip h3 {
+  margin: 0;
+  font-size: 17px;
+}
+
+.admin-status-section header a,
+.admin-operation-strip header a {
+  color: #171715;
+  font-size: 12px;
+  font-weight: 800;
+}
+
+.admin-status-section dl {
+  margin: 0;
+}
+
+.admin-status-section dl > div {
+  display: grid;
+  min-height: 52px;
+  grid-template-columns: 126px 1fr;
+  align-items: center;
+  padding: 0 16px;
+  border-bottom: 1px solid #ddddD7;
+}
+
+.admin-status-section dl > div:last-child {
+  border-bottom: 0;
+}
+
+.admin-status-section dt {
+  color: #65655f;
+  font-size: 11px;
+}
+
+.admin-status-section dd {
+  min-width: 0;
+  margin: 0;
+  overflow-wrap: anywhere;
+  font-family: Consolas, monospace;
+  font-size: 12px;
+  font-weight: 700;
+}
+
+.admin-service-list {
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+
+.admin-service-list li {
+  display: grid;
+  min-height: 42px;
+  grid-template-columns: 1fr 84px 76px;
+  align-items: center;
+  padding: 0 16px;
+  border-bottom: 1px solid #ddddd7;
+  font-size: 11px;
+}
+
+.admin-service-list li:last-child {
+  border-bottom: 0;
+}
+
+.admin-service-list strong {
+  color: #1f6639;
+}
+
+.admin-service-list strong.is-degraded,
+.admin-service-list strong.is-paused {
+  color: #8b5608;
+}
+
+.admin-service-list strong.is-unavailable {
+  color: #a52e24;
+}
+
+.admin-service-list time {
+  color: #65655f;
+  text-align: right;
+}
+
+.admin-operation-strip {
+  margin-top: 24px;
+}
+
+.admin-operation-strip > p {
+  margin: 0;
+  padding: 22px 16px;
+  color: #65655f;
+}
+
+.admin-operation-strip table {
+  width: 100%;
+  border-collapse: collapse;
+  table-layout: fixed;
+}
+
+.admin-operation-strip th,
+.admin-operation-strip td {
+  padding: 12px 16px;
+  border-bottom: 1px solid #ddddd7;
+  overflow-wrap: anywhere;
+  text-align: left;
+  font-size: 11px;
+}
+
+.admin-operation-strip th {
+  color: #65655f;
+  background: #efefeb;
+}
+
+.admin-placeholder > section {
+  margin-top: 22px;
+}
+
+.admin-placeholder-toolbar {
+  display: flex;
+  min-height: 58px;
+  align-items: center;
+  justify-content: space-between;
+  padding: 8px 16px;
+  border-bottom: 1px solid #c3c3bc;
+  font-weight: 800;
+}
+
+.admin-placeholder-toolbar button:disabled {
+  color: #777770;
+  background: #dfdfda;
+}
+
+.admin-placeholder > section > p {
+  margin: 0;
+  padding: 44px 16px;
+  color: #65655f;
+}
+
+:is(.admin-shell, .admin-session-gate) :focus-visible {
+  outline: 2px solid #225dd8;
+  outline-offset: 2px;
+}
+
+@media (max-width: 1000px) {
+  .admin-overview,
+  .admin-placeholder {
+    width: calc(100% - 32px);
+  }
+
+  .admin-metric-band {
+    grid-template-columns: 1fr 1fr;
+  }
+
+  .admin-metric-band a:nth-child(2) {
+    border-right: 0;
+  }
+
+  .admin-overview-columns {
+    grid-template-columns: 1fr;
+  }
+}

apps/web/src/admin-shell.tsx

@@ -0,0 +1,229 @@
+import type { AdminOverviewResponse } from "@dada/shared-contracts";
+import { useCallback, useEffect, useState, type ReactNode } from "react";
+
+import "./admin-shell.css";
+
+interface AdminSession {
+  admin: { role: "super_admin"; status: "active"; user_id: string };
+  audience: "admin";
+  authenticated: true;
+  expires_at: string;
+}
+
+interface AdminProtectedRouteProps {
+  children: ReactNode;
+  currentPath: string;
+  title: string;
+}
+
+const adminNavigation = [
+  { href: "/admin", label: "总览", marker: "01" },
+  { href: "/admin/users", label: "用户与点数", marker: "02" },
+  { href: "/admin/invites", label: "邀请码", marker: "03" },
+  { href: "/admin/models", label: "模型", marker: "04" },
+  { href: "/admin/assets", label: "素材", marker: "05" },
+  { href: "/admin/preview", label: "内部预览", marker: "06" },
+  { href: "/admin/generations", label: "生成记录", marker: "07" },
+  { href: "/admin/services-storage", label: "服务与存储", marker: "08" },
+  { href: "/admin/audit", label: "审计", marker: "09" },
+] as const;
+
+function redirectToAdminLogin() {
+  window.location.replace("/admin/login");
+}
+
+export function AdminProtectedRoute({ children, currentPath, title }: AdminProtectedRouteProps) {
+  const [session, setSession] = useState<AdminSession>();
+  const [failed, setFailed] = useState(false);
+  const [revision, setRevision] = useState(0);
+
+  useEffect(() => {
+    const controller = new AbortController();
+    setFailed(false);
+    void fetch("/api/v1/admin-auth/session", { credentials: "same-origin", signal: controller.signal })
+      .then(async (response) => {
+        if (response.status === 401) {
+          redirectToAdminLogin();
+          return;
+        }
+        if (!response.ok) throw new Error("admin_session_unavailable");
+        const body = await response.json() as AdminSession;
+        if (body.audience !== "admin" || body.admin.role !== "super_admin" || body.admin.status !== "active") {
+          redirectToAdminLogin();
+          return;
+        }
+        setSession(body);
+      })
+      .catch((error: unknown) => {
+        if (!(error instanceof DOMException && error.name === "AbortError")) setFailed(true);
+      });
+    return () => controller.abort();
+  }, [revision]);
+
+  if (!session) {
+    return (
+      <main className="admin-session-gate">
+        {failed ? (
+          <div role="alert">
+            <strong>管理员会话暂时无法确认</strong>
+            <button onClick={() => setRevision((value) => value + 1)} type="button">重试</button>
+          </div>
+        ) : <p aria-live="polite">正在确认管理员会话</p>}
+      </main>
+    );
+  }
+
+  return (
+    <div className="admin-shell">
+      <a className="admin-skip-link" href="#admin-main">跳到主要内容</a>
+      <aside className="admin-sidebar">
+        <a className="admin-wordmark" href="/admin" aria-label="Dada 后台总览">
+          <span>DADA</span>
+          <small>OPERATIONS</small>
+        </a>
+        <nav aria-label="后台主导航">
+          {adminNavigation.map((item) => (
+            <a aria-current={currentPath === item.href ? "page" : undefined} href={item.href} key={item.href}>
+              <span aria-hidden="true">{item.marker}</span>
+              {item.label}
+            </a>
+          ))}
+        </nav>
+        <div className="admin-sidebar-foot">
+          <span>LOCAL P0-A</span>
+          <strong>独立管理员会话</strong>
+        </div>
+      </aside>
+      <div className="admin-shell-workspace">
+        <header className="admin-topbar">
+          <h1>{title}</h1>
+          <div className="admin-topbar-status">
+            <span><i aria-hidden="true" />状态摘要</span>
+            <code>{session.admin.user_id.slice(0, 8)}</code>
+          </div>
+        </header>
+        <div className="admin-shell-content">{children}</div>
+      </div>
+    </div>
+  );
+}
+
+const serviceLabels: Record<AdminOverviewResponse["services"][number]["service_id"], string> = {
+  ai_gateway: "AI 网关",
+  amap: "高德",
+  asset_root: "素材根",
+  resend: "Resend",
+  worker: "Worker",
+};
+
+const stateLabels = {
+  available: "正常",
+  degraded: "有异常",
+  paused: "已暂停",
+  unavailable: "不可用",
+} as const;
+
+function formatTime(value: string | null) {
+  if (!value) return "未记录";
+  return new Intl.DateTimeFormat("zh-CN", { hour: "2-digit", minute: "2-digit", month: "2-digit", day: "2-digit" }).format(new Date(value));
+}
+
+export function AdminOverviewPage() {
+  const [summary, setSummary] = useState<AdminOverviewResponse>();
+  const [failed, setFailed] = useState(false);
+  const [loading, setLoading] = useState(true);
+
+  const load = useCallback(async () => {
+    setLoading(true);
+    setFailed(false);
+    try {
+      const response = await fetch("/api/v1/admin/overview", { credentials: "same-origin" });
+      if (response.status === 401) {
+        window.dispatchEvent(new Event("dada:session-invalid"));
+        return;
+      }
+      if (!response.ok) throw new Error("admin_overview_unavailable");
+      setSummary(await response.json() as AdminOverviewResponse);
+    } catch {
+      setFailed(true);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => { void load(); }, [load]);
+
+  const storagePercent = summary
+    ? Math.min(100, (summary.storage.managed_content_bytes / summary.storage.limit_bytes) * 100)
+    : 0;
+  const hasServiceIssue = summary?.services.some((service) => service.status !== "available") ?? false;
+
+  return (
+    <main className="admin-overview" id="admin-main">
+      <header className="admin-page-heading">
+        <div><p>OPERATIONS / LIVE SUMMARY</p><h2>运营总览</h2></div>
+        {summary ? <time dateTime={summary.generated_at}>更新于 {formatTime(summary.generated_at)}</time> : null}
+      </header>
+      {summary && summary.storage.status !== "normal" ? (
+        <a className={`admin-capacity-alert is-${summary.storage.status}`} href="/admin/services-storage">
+          <span>本机内容容量</span>
+          <strong>{storagePercent.toFixed(1)}%</strong>
+          <span>{summary.storage.status === "critical" ? "接近上限" : summary.storage.status === "full" ? "已满" : "不可用"}</span>
+        </a>
+      ) : null}
+      {loading && !summary ? (
+        <div aria-label="运营摘要加载中" className="admin-overview-loading"><span /><span /><span /><span /></div>
+      ) : null}
+      {failed ? (
+        <div className="admin-overview-failure" role="alert">
+          <span>运营摘要暂时无法读取{summary ? `，当前保留 ${formatTime(summary.generated_at)} 的结果` : ""}。</span>
+          <button onClick={() => void load()} type="button">重试</button>
+        </div>
+      ) : null}
+      {summary ? (
+        <>
+          <section aria-label="关键运营指标" className="admin-metric-band">
+            <a href="/admin/users"><span>普通用户名额</span><strong>{summary.user_slots.active_and_suspended} / {summary.user_slots.limit}</strong><small>active + suspended</small></a>
+            <a href="/admin/generations"><span>进行中任务</span><strong>{summary.generation_jobs.queued + summary.generation_jobs.running}</strong><small>排队 {summary.generation_jobs.queued} · 运行 {summary.generation_jobs.running}</small></a>
+            <a href="/admin/generations"><span>成本核对</span><strong>待人工核对 {summary.generation_jobs.pending_manual_review}</strong><small>最早 {formatTime(summary.generation_jobs.pending_manual_review_oldest_at)}</small></a>
+            <a href="/admin/assets"><span>清理任务</span><strong>{summary.asset_cleanup.pending_jobs}</strong><small>等待处理</small></a>
+          </section>
+          <div className="admin-overview-columns">
+            <section className="admin-status-section" aria-labelledby="model-status-heading">
+              <header><div><p>MODEL STATE</p><h3 id="model-status-heading">模型状态</h3></div><a href="/admin/models">查看</a></header>
+              <dl>
+                <div><dt>配置默认</dt><dd>{summary.models.configured_default_model_id ?? "无"}</dd></div>
+                <div><dt>运行时可用</dt><dd>{summary.models.runtime_available_count} / {summary.models.configured_model_count}</dd></div>
+                <div><dt>当前推荐</dt><dd>{summary.models.recommended_model_id ?? "无"}</dd></div>
+              </dl>
+            </section>
+            <section className="admin-status-section" aria-labelledby="service-status-heading">
+              <header><div><p>SERVICE STATE</p><h3 id="service-status-heading">服务状态</h3></div><a href="/admin/services-storage">{hasServiceIssue ? "有异常" : "全部正常"}</a></header>
+              <ul className="admin-service-list">
+                {summary.services.map((service) => <li key={service.service_id}><span>{serviceLabels[service.service_id]}</span><strong className={`is-${service.status}`}>{stateLabels[service.status]}</strong><time dateTime={service.checked_at ?? undefined}>{formatTime(service.checked_at)}</time></li>)}
+              </ul>
+            </section>
+          </div>
+          <section className="admin-operation-strip" aria-labelledby="recent-operation-heading">
+            <header><div><p>AUDIT SNAPSHOT</p><h3 id="recent-operation-heading">最近后台操作</h3></div><a href="/admin/audit">查看全部</a></header>
+            {summary.recent_operations.length === 0 ? <p>当前无近期操作</p> : (
+              <table><thead><tr><th>时间</th><th>操作</th><th>对象摘要</th><th>结果</th></tr></thead><tbody>{summary.recent_operations.map((operation) => <tr key={operation.operation_id}><td>{formatTime(operation.created_at)}</td><td>{operation.operation_type}</td><td><code>{operation.target_ref}</code></td><td>{operation.result}</td></tr>)}</tbody></table>
+            )}
+          </section>
+        </>
+      ) : null}
+    </main>
+  );
+}
+
+export function AdminPlaceholderPage({ title }: { title: string }) {
+  return (
+    <main className="admin-placeholder" id="admin-main">
+      <header className="admin-page-heading"><div><p>OPERATIONS</p><h2>{title}</h2></div></header>
+      <section aria-label={`${title}安全摘要`}>
+        <div className="admin-placeholder-toolbar"><span>安全摘要</span><button disabled type="button">新建</button></div>
+        <p>当前无记录</p>
+      </section>
+    </main>
+  );
+}

apps/web/src/admin-users.tsx

@@ -100,11 +100,7 @@ export function AdminUsersPage() {
 
   return (
     <div className="admin-users-page">
-      <header className="admin-product-header">
-        <a href="/admin">DADA ADMIN</a>
-        <nav aria-label="后台导航"><a aria-current="page" href="/admin/users">用户</a><a href="/admin/models">模型</a><a href="/admin/audit">审计</a></nav>
-      </header>
-      <main>
+      <main id="admin-main">
         <header className="admin-users-heading">
           <div><p>USER OPERATIONS</p><h1>用户点数</h1></div>
           {balance ? <button onClick={openAdjustment} type="button">调整点数</button> : null}

apps/web/src/dynamic-render-models.ts

@@ -1,4 +1,5 @@
 import type { CanvasState } from "@dada/shared-contracts";
+import { P0A_COMPLEX_RELEASE_VERSION } from "@dada/template-registry";
 
 import { fontOption, type FontOption } from "./text-assets.js";
 import type { DynamicTemplateId } from "./dynamic-provider.js";
@@ -46,7 +47,7 @@ export interface DynamicRenderModel {
   textLayers: readonly DynamicTextLayer[];
 }
 
-export const DYNAMIC_RESOURCE_VERSION = "wp4-dynamic-source-v1";
+export const DYNAMIC_RESOURCE_VERSION = P0A_COMPLEX_RELEASE_VERSION;
 
 const dynamicFont = (fontId: string): FontOption => ({
   displayName: fontId,

apps/web/src/editor-page.tsx

@@ -49,7 +49,7 @@ import {
   type DynamicTemplateId,
 } from "./dynamic-provider.js";
 import { dynamicFontOptionsFor } from "./dynamic-render-models.js";
-import { P0A_STATIC_STICKER_CATALOG, P0A_STATIC_STICKER_COUNT, stickerWindow } from "./static-sticker-catalog.js";
+import { P0A_STATIC_STICKER_CATALOG, stickerWindow, type StaticStickerCatalogItem } from "./static-sticker-catalog.js";
 import {
   createColorCardElement,
   extractPaletteFromImage,
@@ -136,6 +136,7 @@ export function EditorPage({ projectId }: { projectId: string }) {
   const [notice, setNotice] = useState("");
   const [activePanel, setActivePanel] = useState<EditorAssetPanel>("background");
   const [stickerScrollTop, setStickerScrollTop] = useState(0);
+  const [stickerCatalog, setStickerCatalog] = useState<StaticStickerCatalogItem[]>(P0A_STATIC_STICKER_CATALOG);
   const [selectedIds, setSelectedIds] = useState<string[]>([]);
   const [guides, setGuides] = useState<string[]>([]);
   const [multiMode, setMultiMode] = useState(false);
@@ -187,6 +188,18 @@ export function EditorPage({ projectId }: { projectId: string }) {
     return () => { active = false; };
   }, [session?.user.user_id]);
 
+  useEffect(() => {
+    let active = true;
+    readEditorJson<{ items: StaticStickerCatalogItem[] }>("/api/v1/static-stickers/current")
+      .then((response) => {
+        if (!active) return;
+        const uploaded = response.items.filter((item) => item.enabled && item.origin === "admin_uploaded");
+        setStickerCatalog([...P0A_STATIC_STICKER_CATALOG, ...uploaded].sort((left, right) => left.part - right.part || left.order - right.order || left.stable_id.localeCompare(right.stable_id)));
+      })
+      .catch(() => { if (active) setStickerCatalog(P0A_STATIC_STICKER_CATALOG); });
+    return () => { active = false; };
+  }, []);
+
   useEffect(() => {
     if (!project || !session || !canvasState) return undefined;
     const queue = new ProjectAutoSaveQueue({
@@ -343,15 +356,15 @@ export function EditorPage({ projectId }: { projectId: string }) {
     setNotice(message);
   }
 
-  function addSticker(assetId: string) {
+  function addSticker(sticker: StaticStickerCatalogItem) {
     const controller = controllerForCurrent();
     if (!controller || !canvasState) return;
     try {
       controller.add(createStaticStickerElement({
-        assetId,
+        assetId: sticker.stable_id,
         identity: newElementIdentity(),
         position: { x: 0.5, y: 0.5 },
-        resourceVersion: "fixture-v1",
+        resourceVersion: sticker.resource_version,
         zIndex: canvasState.elements.length,
       }));
       commitElementOperation(controller, "贴纸已加入画布");
@@ -832,11 +845,11 @@ export function EditorPage({ projectId }: { projectId: string }) {
             {...(templateCategory ? { category: templateCategory } : {})}
           /> : null}
           {activePanel === "stickers" ? (() => {
-            const visibleStickers = stickerWindow(P0A_STATIC_STICKER_CATALOG, stickerScrollTop, 280);
-            return <section><h2>普通贴纸</h2><p aria-live="polite" className="editor-sticker-count">共 {P0A_STATIC_STICKER_COUNT.toLocaleString("zh-CN")} 张</p><div className="editor-sticker-virtual-list" data-testid="static-sticker-list" onScroll={(event) => setStickerScrollTop(event.currentTarget.scrollTop)} role="list">
+            const visibleStickers = stickerWindow(stickerCatalog, stickerScrollTop, 280);
+            return <section><h2>普通贴纸</h2><p aria-live="polite" className="editor-sticker-count">共 {stickerCatalog.length.toLocaleString("zh-CN")} 张</p><div className="editor-sticker-virtual-list" data-testid="static-sticker-list" onScroll={(event) => setStickerScrollTop(event.currentTarget.scrollTop)} role="list">
               <div style={{ paddingTop: visibleStickers.top_spacer_px, paddingBottom: visibleStickers.bottom_spacer_px }}>
                 <div className="editor-sticker-grid">
-                  {visibleStickers.items.map((sticker) => <button aria-label={`添加贴纸 ${sticker.stable_id}`} data-sticker-id={sticker.stable_id} disabled={!canEdit || canvasState.elements.length >= 50} key={sticker.stable_id} onClick={() => addSticker(sticker.stable_id)} type="button"><img alt="" className="editor-sticker-preview" decoding="async" loading="lazy" src={sticker.thumbnail_reference.url} /><strong>{sticker.stable_id}</strong><span>part{sticker.part} · {sticker.order}</span></button>)}
+                  {visibleStickers.items.map((sticker) => <button aria-label={`添加贴纸 ${sticker.stable_id}`} data-sticker-id={sticker.stable_id} disabled={!canEdit || canvasState.elements.length >= 50} key={sticker.stable_id} onClick={() => addSticker(sticker)} type="button"><img alt="" className="editor-sticker-preview" decoding="async" loading="lazy" src={sticker.thumbnail_reference.url} /><strong>{sticker.stable_id}</strong><span>part{sticker.part} · {sticker.order}</span></button>)}
                 </div>
               </div>
             </div>{canvasState.elements.length >= 50 ? <p className="editor-limit" role="status">画布最多 50 个元素，请先删除现有元素。</p> : null}</section>;
@@ -851,7 +864,10 @@ export function EditorPage({ projectId }: { projectId: string }) {
             <button disabled={selectedElements.length === 0 || !canEdit} onClick={copySelection} title="复制" type="button">复制</button>
             <button disabled={clipboardRef.current.length === 0 || !canEdit} onClick={pasteSelection} title="粘贴" type="button">粘贴</button>
           </div>
-          <div className="editor-canvas-frame" style={{ aspectRatio: `${canvasState.pixel_width} / ${canvasState.pixel_height}` }}>
+          <div className="editor-canvas-frame" style={{
+            aspectRatio: `${canvasState.pixel_width} / ${canvasState.pixel_height}`,
+            maxWidth: `min(720px, calc(${(canvasState.pixel_width / canvasState.pixel_height * 100).toFixed(4)}vh - ${(canvasState.pixel_width / canvasState.pixel_height * 168).toFixed(4)}px))`,
+          }}>
             <EditorStage
               assetId={canvasState.background.asset_id}
               canvasState={renderedCanvasState}

apps/web/src/generated/api/sdk.gen.ts

@@ -1,9 +1,18 @@
 // Generated from openapi/openapi.json. Do not edit by hand.
 
-import type { CreditAdjustmentResponse, CreditAdjustmentRequest, BrowserSupportSuccess, BrowserSupportRequest, AccountDeletionResponse, AccountDeletionCompleteRequest, AdminLoginCompleteResponse, AdminLoginCompleteRequest, LoginCompleteResponse, LoginCompleteRequest, RegistrationCompleteResponse, RegistrationCompleteRequest, GenerationCreateResponse, AccountSettingsResponse, AdminSessionResponse, CreditBalanceResponse, BootstrapResponse, GenerationTaskResponse, SseEvent, ModelConfig, ModelConfigurationResponse, CreditLedgerResponse, ProjectDetailResponse, UserSessionResponse, ProjectListResponse, RecentAssetListResponse, LogoutResponse, ProjectPurgeResponse, RecentAssetRecordResponse, RecentAssetRecordRequest, ProjectRenameResponse, ProjectRenameRequest, ModelConfigUpdateRequest, ProjectRestoreResponse, ReverseGeocodeResponse, ReverseGeocodeRequest, LatestExportSaveResponse, ProjectStateSaveResponse, ProjectEditableState, AccountDeletionSendResponse, RegistrationSendResponse, AdminLoginSendRequest, LoginSendRequest, RegistrationSendRequest, FailedEmptyTrashResponse, FailedEmptyTrashRequest, ProjectTrashResponse, AccountProfileUpdateResponse, AccountProfileUpdateRequest } from "./types.gen.js";
+import type { PrivateContentNoticeAckResponse, PrivateContentNoticeAckRequest, CreditAdjustmentResponse, CreditAdjustmentRequest, AdminServiceHealthCheckRequest, BrowserSupportSuccess, BrowserSupportRequest, AccountDeletionResponse, AccountDeletionCompleteRequest, AdminLoginCompleteResponse, AdminLoginCompleteRequest, LoginCompleteResponse, LoginCompleteRequest, RegistrationCompleteResponse, RegistrationCompleteRequest, GenerationCreateResponse, AccountSettingsResponse, AdminDiagnosticsResponse, AdminOperationAuditResponse, AdminOverviewResponse, AdminServicesResponse, AdminServicesStorageResponse, AdminSessionResponse, CreditBalanceResponse, BootstrapResponse, GenerationTaskResponse, SseEvent, ModelConfig, ModelConfigurationResponse, CreditLedgerResponse, PrivateContentAccessAuditResponse, ProjectDetailResponse, UserSessionResponse, AdminGenerationListResponse, ProjectListResponse, RecentAssetListResponse, LogoutResponse, PrivateContentPromptResponse, ProjectPurgeResponse, RecentAssetRecordResponse, RecentAssetRecordRequest, AdminServiceRecoveryRequest, ProjectRenameResponse, ProjectRenameRequest, ModelConfigUpdateRequest, ProjectRestoreResponse, ReverseGeocodeResponse, ReverseGeocodeRequest, LatestExportSaveResponse, ProjectStateSaveResponse, ProjectEditableState, AccountDeletionSendResponse, RegistrationSendResponse, AdminLoginSendRequest, LoginSendRequest, RegistrationSendRequest, FailedEmptyTrashResponse, FailedEmptyTrashRequest, ProjectTrashResponse, AccountProfileUpdateResponse, AccountProfileUpdateRequest, AdminServiceLimitRequest } from "./types.gen.js";
 
 export interface ClientOptions { baseUrl?: string; fetch?: typeof globalThis.fetch; headers?: HeadersInit; }
 
+export async function ackPrivateContentNotice(body: PrivateContentNoticeAckRequest, options: ClientOptions = {}): Promise<PrivateContentNoticeAckResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const headers = new Headers(options.headers);
+  headers.set("Content-Type", "application/json");
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/private-content-notice/ack`, { body: JSON.stringify(body), method: "POST", headers });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<PrivateContentNoticeAckResponse>;
+}
+
 export async function adjustAdminUserCredits(body: CreditAdjustmentRequest, options: ClientOptions = {}): Promise<CreditAdjustmentResponse> {
   const request = options.fetch ?? globalThis.fetch;
   const headers = new Headers(options.headers);
@@ -13,6 +22,23 @@ export async function adjustAdminUserCredits(body: CreditAdjustmentRequest, opti
   return response.json() as Promise<CreditAdjustmentResponse>;
 }
 
+export async function checkAdminServiceHealth(body: AdminServiceHealthCheckRequest, options: ClientOptions = {}): Promise<{
+  "available": boolean;
+  "check_id": string;
+  "checked_at": string;
+}> {
+  const request = options.fetch ?? globalThis.fetch;
+  const headers = new Headers(options.headers);
+  headers.set("Content-Type", "application/json");
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/services/{service_id}/health-check`, { body: JSON.stringify(body), method: "POST", headers });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<{
+  "available": boolean;
+  "check_id": string;
+  "checked_at": string;
+}>;
+}
+
 export async function checkBrowserSupport(body: BrowserSupportRequest, options: ClientOptions = {}): Promise<BrowserSupportSuccess> {
   const request = options.fetch ?? globalThis.fetch;
   const headers = new Headers(options.headers);
@@ -87,6 +113,41 @@ export async function getAccountSettings(options: ClientOptions = {}): Promise<A
   return response.json() as Promise<AccountSettingsResponse>;
 }
 
+export async function getAdminDiagnostics(options: ClientOptions = {}): Promise<AdminDiagnosticsResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/diagnostics`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<AdminDiagnosticsResponse>;
+}
+
+export async function getAdminOperationAudit(options: ClientOptions = {}): Promise<AdminOperationAuditResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/audit/operations`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<AdminOperationAuditResponse>;
+}
+
+export async function getAdminOverview(options: ClientOptions = {}): Promise<AdminOverviewResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/overview`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<AdminOverviewResponse>;
+}
+
+export async function getAdminServices(options: ClientOptions = {}): Promise<AdminServicesResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/services`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<AdminServicesResponse>;
+}
+
+export async function getAdminServicesStorage(options: ClientOptions = {}): Promise<AdminServicesStorageResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/services-storage`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<AdminServicesStorageResponse>;
+}
+
 export async function getAdminSession(options: ClientOptions = {}): Promise<AdminSessionResponse> {
   const request = options.fetch ?? globalThis.fetch;
   const response = await request(`${options.baseUrl ?? ""}/api/v1/admin-auth/session`, { method: "GET", headers: options.headers ?? {} });
@@ -154,6 +215,13 @@ export async function getMyCredits(options: ClientOptions = {}): Promise<CreditB
   return response.json() as Promise<CreditBalanceResponse>;
 }
 
+export async function getPrivateContentAccessAudit(options: ClientOptions = {}): Promise<PrivateContentAccessAuditResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/audit/private-content`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<PrivateContentAccessAuditResponse>;
+}
+
 export async function getProject(options: ClientOptions = {}): Promise<ProjectDetailResponse> {
   const request = options.fetch ?? globalThis.fetch;
   const response = await request(`${options.baseUrl ?? ""}/api/v1/projects/{projectId}`, { method: "GET", headers: options.headers ?? {} });
@@ -168,6 +236,13 @@ export async function getUserSession(options: ClientOptions = {}): Promise<UserS
   return response.json() as Promise<UserSessionResponse>;
 }
 
+export async function listAdminGenerations(options: ClientOptions = {}): Promise<AdminGenerationListResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/generations`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<AdminGenerationListResponse>;
+}
+
 export async function listProjects(options: ClientOptions = {}): Promise<ProjectListResponse> {
   const request = options.fetch ?? globalThis.fetch;
   const response = await request(`${options.baseUrl ?? ""}/api/v1/projects`, { method: "GET", headers: options.headers ?? {} });
@@ -189,6 +264,20 @@ export async function logoutUser(options: ClientOptions = {}): Promise<LogoutRes
   return response.json() as Promise<LogoutResponse>;
 }
 
+export async function openAdminGenerationImage(options: ClientOptions = {}): Promise<Blob> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/private-content/generations/{generationId}/image`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.blob() as Promise<Blob>;
+}
+
+export async function openAdminGenerationPrompt(options: ClientOptions = {}): Promise<PrivateContentPromptResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/private-content/generations/{generationId}/prompt`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<PrivateContentPromptResponse>;
+}
+
 export async function purgeProject(options: ClientOptions = {}): Promise<ProjectPurgeResponse> {
   const request = options.fetch ?? globalThis.fetch;
   const response = await request(`${options.baseUrl ?? ""}/api/v1/projects/{projectId}/purge`, { method: "POST", headers: options.headers ?? {} });
@@ -205,6 +294,19 @@ export async function recordRecentAsset(body: RecentAssetRecordRequest, options:
   return response.json() as Promise<RecentAssetRecordResponse>;
 }
 
+export async function recoverAdminService(body: AdminServiceRecoveryRequest, options: ClientOptions = {}): Promise<{
+  "status": "active";
+}> {
+  const request = options.fetch ?? globalThis.fetch;
+  const headers = new Headers(options.headers);
+  headers.set("Content-Type", "application/json");
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/services/{service_id}/recover`, { body: JSON.stringify(body), method: "POST", headers });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<{
+  "status": "active";
+}>;
+}
+
 export async function renameProject(body: ProjectRenameRequest, options: ClientOptions = {}): Promise<ProjectRenameResponse> {
   const request = options.fetch ?? globalThis.fetch;
   const headers = new Headers(options.headers);
@@ -314,3 +416,12 @@ export async function updateAccountProfile(body: AccountProfileUpdateRequest, op
   if (!response.ok) throw new Error(`HTTP ${response.status}`);
   return response.json() as Promise<AccountProfileUpdateResponse>;
 }
+
+export async function updateAdminServiceHardLimit(body: AdminServiceLimitRequest, options: ClientOptions = {}): Promise<AdminServicesResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const headers = new Headers(options.headers);
+  headers.set("Content-Type", "application/json");
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/services/{service_id}/limits`, { body: JSON.stringify(body), method: "PATCH", headers });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<AdminServicesResponse>;
+}

apps/web/src/generated/api/types.gen.ts

@@ -50,6 +50,11 @@ export type AccountSettingsResponse = {
 };
 };
 
+export type AdminAuditQuery = {
+  "cursor"?: string;
+  "limit"?: number;
+};
+
 export type AdminAuthenticatedUser = {
   "role": "super_admin";
   "status": "active";
@@ -60,6 +65,42 @@ export type AdminCreditParams = {
   "userId": string;
 };
 
+export type AdminDiagnosticsResponse = {
+  "diagnostic_text": string;
+  "generated_at": string;
+  "services": AdminServicesStorageResponse;
+  "system": {
+  "api_status": "ready" | "degraded" | "unavailable";
+  "app_version": string;
+  "browser_support": Array<{
+  "brand": "Google Chrome" | "Microsoft Edge";
+  "major": number;
+}>;
+  "worker_status": "ready" | "degraded" | "unavailable";
+};
+};
+
+export type AdminGenerationListResponse = {
+  "generated_at": string;
+  "items": Array<AdminGenerationRecord>;
+};
+
+export type AdminGenerationRecord = {
+  "completed_at": string | null;
+  "confirmed_credit_cost": number;
+  "created_at": string;
+  "duration_ms": number | null;
+  "error_category": "upstream_timeout" | "upstream_failed" | "safety_rejected" | "model_disabled" | "gateway_balance_insufficient" | "gateway_contract_invalid" | "reference_invalid" | "unknown_retryable" | "unknown_non_retryable" | null;
+  "final_credit_state": "committed" | "released" | null;
+  "generation_id": string;
+  "model_id": string;
+  "owner_ref": string;
+  "project_id": string;
+  "ratio": "3:4" | "1:1" | "4:3" | "9:16";
+  "reserved_credits": number;
+  "status": "queued" | "running" | "succeeded" | "failed" | "rejected";
+};
+
 export type AdminLoginCompleteRequest = {
   "registration_id": string;
   "verification_code": string;
@@ -76,12 +117,119 @@ export type AdminLoginSendRequest = {
   "email": string;
 };
 
+export type AdminOperationAuditItem = {
+  "actor_ref": string;
+  "actor_type": "system" | "super_admin";
+  "after_summary": string | null;
+  "before_summary": string | null;
+  "expires_at": string;
+  "log_id": string;
+  "occurred_at": string;
+  "operation_type": string;
+  "result": "succeeded" | "failed";
+  "target_ref": string;
+  "target_type": string;
+};
+
+export type AdminOperationAuditResponse = {
+  "generated_at": string;
+  "items": Array<AdminOperationAuditItem>;
+  "next_cursor": string | null;
+};
+
+export type AdminOverviewResponse = {
+  "asset_cleanup": {
+  "pending_jobs": number;
+};
+  "generated_at": string;
+  "generation_jobs": {
+  "pending_manual_review": number;
+  "pending_manual_review_oldest_at": string | null;
+  "queued": number;
+  "running": number;
+};
+  "models": {
+  "configured_default_model_id": string | null;
+  "configured_model_count": number;
+  "recommended_model_id": string | null;
+  "runtime_available_count": number;
+};
+  "recent_operations": Array<{
+  "created_at": string;
+  "operation_id": string;
+  "operation_type": string;
+  "result": "succeeded" | "rejected" | "failed";
+  "target_ref": string;
+}>;
+  "services": Array<{
+  "checked_at": string | null;
+  "service_id": "resend" | "amap" | "ai_gateway" | "worker" | "asset_root";
+  "status": "available" | "degraded" | "paused" | "unavailable";
+}>;
+  "storage": {
+  "last_measured_at": string | null;
+  "limit_bytes": number;
+  "managed_content_bytes": number;
+  "status": "normal" | "critical" | "full" | "unavailable";
+};
+  "user_slots": {
+  "active_and_suspended": number;
+  "limit": number;
+};
+};
+
+export type AdminServiceHealthCheckRequest = {
+  "available": boolean;
+  "reason"?: string;
+};
+
+export type AdminServiceLimitRequest = {
+  "hard_limit": number;
+  "period_type": ExternalServicePeriodType;
+};
+
+export type AdminServiceParams = {
+  "service_id": ExternalServiceId;
+};
+
+export type AdminServiceRecoveryRequest = {
+  "check_id": string;
+};
+
+export type AdminServicesResponse = {
+  "services": Array<ExternalServiceUsage>;
+};
+
+export type AdminServicesStorageResponse = {
+  "generated_at": string;
+  "services": Array<{
+  "checked_at": string | null;
+  "configured": boolean;
+  "impact_scope": "none" | "authentication" | "location" | "generation" | "storage" | "api" | "model" | "account" | "unknown";
+  "pause_reason": string | null;
+  "service_id": "resend" | "amap" | "ai_gateway" | "worker" | "api" | "asset_root";
+  "status": "active" | "paused_quota" | "paused_provider" | "disabled" | "degraded" | "unavailable";
+}>;
+  "storage": {
+  "capacity_notice_level": "normal" | "warning" | "critical";
+  "cleanup_pending_count": number;
+  "data_root_ref": "configured_local_data_root";
+  "hard_limit_bytes": number;
+  "last_measured_at": string | null;
+  "managed_content_bytes": number;
+  "remeasurement_required": boolean;
+  "status": "active" | "full" | "unavailable";
+  "storage_backend": "local_filesystem";
+};
+};
+
 export type AdminSessionResponse = {
   "acknowledged_private_content_notice_version": string | null;
   "admin": AdminAuthenticatedUser;
   "audience": "admin";
   "authenticated": true;
   "csrf_token": string;
+  "current_private_content_notice_message_key"?: string;
   "current_private_content_notice_version": string | null;
   "expires_at": string;
   "notice_acknowledged": boolean;
@@ -315,6 +463,23 @@ export type ErrorEnvelope = {
 
 export type ExportFormat = "jpg" | "png";
 
+export type ExternalServiceId = "resend_email" | "amap_web_service";
+
+export type ExternalServicePeriodType = "daily" | "monthly";
+
+export type ExternalServiceStatus = "active" | "paused_quota" | "paused_provider" | "disabled";
+
+export type ExternalServiceUsage = {
+  "hard_limit": number;
+  "pause_reason": string | null;
+  "period_start": string;
+  "period_type": ExternalServicePeriodType;
+  "service_id": ExternalServiceId;
+  "service_status": ExternalServiceStatus;
+  "updated_at": string;
+  "used_count": number;
+};
+
 export type FailedEmptyTrashRequest = {
   "project_ids": Array<ProjectId>;
 };
@@ -541,6 +706,41 @@ export type ModelRuntimeSseEvent = {
   "runtime_availability_version": number;
 };
 
+export type PrivateContentAccessAuditItem = {
+  "actor_ref": string;
+  "content_type": "image" | "prompt";
+  "expires_at": string;
+  "log_id": string;
+  "occurred_at": string;
+  "target_ref": string;
+};
+
+export type PrivateContentAccessAuditResponse = {
+  "generated_at": string;
+  "items": Array<PrivateContentAccessAuditItem>;
+  "next_cursor": string | null;
+};
+
+export type PrivateContentGenerationParams = {
+  "generationId": string;
+};
+
+export type PrivateContentNoticeAckRequest = {
+  "expected_notice_version": string;
+};
+
+export type PrivateContentNoticeAckResponse = {
+  "acknowledged_at": string;
+  "notice_version": string;
+  "status": "acknowledged";
+};
+
+export type PrivateContentPromptResponse = {
+  "content_type": "prompt";
+  "generation_id": string;
+  "prompt": string;
+};
+
 export type ProjectDetailResponse = {
   "canvas_state": CanvasState;
   "created_at": string;

apps/web/src/main.tsx

@@ -1,4 +1,4 @@
-import { StrictMode } from "react";
+import { StrictMode, type ReactNode } from "react";
 import { createRoot } from "react-dom/client";
 
 import { registerPublicAssetServiceWorker } from "./public-asset-cache.js";
@@ -7,9 +7,14 @@ import { UserAuthPage } from "./user-auth.js";
 import { AccountSettingsPage } from "./account-settings.js";
 import { AdminUsersPage } from "./admin-users.js";
 import { AdminModelsPage } from "./admin-models.js";
+import { AdminAssetsPage } from "./admin-assets.js";
+import { AdminGenerationsPage } from "./admin-generations.js";
+import { AdminServicesStoragePage } from "./admin-services-storage.js";
+import { AdminAuditPage } from "./admin-audit.js";
 import { CreditsPage } from "./credits-page.js";
 import { ProjectDetailPage, ProjectsPage, WorkspacePage } from "./project-pages.js";
 import { EditorPage } from "./editor-page.js";
+import { AdminOverviewPage, AdminPlaceholderPage, AdminProtectedRoute } from "./admin-shell.js";
 
 const root = document.getElementById("root");
 
@@ -34,9 +39,26 @@ function renderAuthenticationEntry() {
   else if (projectDetail?.[1]) authenticationPage = <ProjectDetailPage key={authRevision} projectId={projectDetail[1]} />;
   else if (window.location.pathname === "/app/projects") authenticationPage = <ProjectsPage key={authRevision} />;
   else if (window.location.pathname === "/app") authenticationPage = <WorkspacePage key={authRevision} />;
-  else if (window.location.pathname === "/admin/users") authenticationPage = <AdminUsersPage key={authRevision} />;
-  else if (window.location.pathname === "/admin/models") authenticationPage = <AdminModelsPage key={authRevision} />;
-  else if (window.location.pathname.startsWith("/admin")) authenticationPage = <AdminAuthPage key={authRevision} />;
+  else if (window.location.pathname === "/admin/login") authenticationPage = <AdminAuthPage key={authRevision} />;
+  else if (window.location.pathname.startsWith("/admin")) {
+    const adminPages: Record<string, { content: ReactNode; title: string }> = {
+      "/admin": { content: <AdminOverviewPage />, title: "运营总览" },
+      "/admin/assets": { content: <AdminAssetsPage />, title: "素材" },
+      "/admin/audit": { content: <AdminAuditPage />, title: "审计" },
+      "/admin/generations": { content: <AdminGenerationsPage />, title: "生成记录" },
+      "/admin/invites": { content: <AdminPlaceholderPage title="邀请码" />, title: "邀请码" },
+      "/admin/models": { content: <AdminModelsPage />, title: "模型" },
+      "/admin/preview": { content: <AdminPlaceholderPage title="内部预览" />, title: "内部预览" },
+      "/admin/services-storage": { content: <AdminServicesStoragePage />, title: "服务与存储" },
+      "/admin/users": { content: <AdminUsersPage />, title: "用户与点数" },
+    };
+    const page = adminPages[window.location.pathname] ?? adminPages["/admin"]!;
+    authenticationPage = (
+      <AdminProtectedRoute currentPath={window.location.pathname} key={authRevision} title={page.title}>
+        {page.content}
+      </AdminProtectedRoute>
+    );
+  }
   else authenticationPage = <UserAuthPage key={authRevision} />;
   appRoot.render(
     <StrictMode>

apps/web/src/static-sticker-catalog.ts

@@ -5,8 +5,9 @@ import {
   type StaticStickerCatalogItem,
   type VirtualStickerWindow,
 } from "@dada/static-sticker-catalog";
+import { P0A_STATIC_STICKER_RELEASE_VERSION } from "@dada/template-registry";
 
-const resourceVersion = "fixture-v1";
+const resourceVersion = P0A_STATIC_STICKER_RELEASE_VERSION;
 const partCounts = [203, 36, 27, 48, 38, 75, 37, 67, 48, 24, 40, 30, 27, 51, 62, 19, 36, 45, 92, 53, 69, 31, 36, 30, 183] as const;
 
 function buildCatalog(): StaticStickerCatalogItem[] {
@@ -45,3 +46,4 @@ export function stickerWindow(items: readonly StaticStickerCatalogItem[], scroll
 }
 
 export { staticStickerOriginalUrl, staticStickerThumbnailUrl };
+export type { StaticStickerCatalogItem };

apps/web/src/text-assets.ts

@@ -1,5 +1,5 @@
 import type { CanvasState } from "@dada/shared-contracts";
-import { P0A_REQUIRED_FONT_PANEL_IDS, P0A_TEXT_TEMPLATE_IDS } from "@dada/template-registry";
+import { P0A_COMPLEX_RELEASE_VERSION, P0A_REQUIRED_FONT_PANEL_IDS, P0A_TEXT_TEMPLATE_IDS } from "@dada/template-registry";
 
 import type { CanvasElementIdentity } from "./editor-elements.js";
 
@@ -42,7 +42,7 @@ export interface TextStylePatch {
   textAlign?: TextAlign;
 }
 
-const fixtureVersion = "wp4-fixture-v1";
+const resourceVersion = P0A_COMPLEX_RELEASE_VERSION;
 const defaults = {
   background_color: "#FFE62C",
   background_enabled: false,
@@ -106,9 +106,9 @@ export const P0A_TEXT_TEMPLATES: readonly TextTemplateDefinition[] = P0A_TEXT_TE
     defaultFontSize: 48,
     defaultText: seed[3],
     displayName: seed[2],
-    ...(seed[5] === true ? { fontUrl: `/api/v1/assets/public/${fixtureVersion}/${seed[4]}` } : {}),
+    ...(seed[5] === true ? { fontUrl: `/api/v1/assets/public/${resourceVersion}/${seed[4]}` } : {}),
     resourceClass: seed[6] ?? "zip_template",
-    resourceVersion: fixtureVersion,
+    resourceVersion,
     templateId,
   };
 });
@@ -130,7 +130,7 @@ const fontOptionDefinitions: Readonly<Record<typeof P0A_REQUIRED_FONT_PANEL_IDS[
 export const P0A_FONT_OPTIONS: readonly FontOption[] = P0A_REQUIRED_FONT_PANEL_IDS.map((fontId) => ({
   displayName: fontOptionDefinitions[fontId],
   fontId,
-  url: `/api/v1/assets/public/${fixtureVersion}/${fontId}`,
+  url: `/api/v1/assets/public/${resourceVersion}/${fontId}`,
 }));
 
 export function fontOption(fontId: string) {

apps/worker/package.json

@@ -9,7 +9,8 @@
   },
   "dependencies": {
     "better-sqlite3": "13.0.1",
-    "drizzle-orm": "0.45.2"
+    "drizzle-orm": "0.45.2",
+    "sharp": "0.35.3"
   },
   "devDependencies": {
     "@types/better-sqlite3": "7.6.13",

apps/worker/src/ai-adapter-gemini-flash.ts

@@ -1,4 +1,5 @@
 import type { GenerationAdapterRequest, NormalizedGenerationOutput } from "./ai-adapter-contract.js";
+import { normalizeImageOutputToRatio } from "./image-output-normalizer.mjs";
 import {
   AdapterContractError, type AdapterStartResult, type AdapterTransport, balanceSignalFromResponse,
   classifyAdapterError, dimensionsForRatio, mockPngBytes, validateAdapterRequest, validateMockContract,
@@ -41,7 +42,8 @@ export class GeminiFlashAdapter implements ModelAdapter {
         const classified = this.classifyError("error" in response ? response.error : undefined, (request.configSnapshot.error_mapping_profile as Record<string, string> | undefined) ?? {});
         return { ...classified, status: "failed" };
       }
-      return { outputs: [this.normalizeOutput(response)], status: "completed" };
+      const output = this.normalizeOutput(response);
+      return { outputs: [await normalizeImageOutputToRatio({ ...output, ratio: request.ratio })], status: "completed" };
     } catch (error) {
       const classified = error instanceof AdapterContractError
         ? { category: "gateway_contract_invalid" as const, sourceCategory: error.sourceCategory }

apps/worker/src/ai-adapter-gemini-pro.ts

@@ -1,4 +1,5 @@
 import type { GenerationAdapterRequest, NormalizedGenerationOutput } from "./ai-adapter-contract.js";
+import { normalizeImageOutputToRatio } from "./image-output-normalizer.mjs";
 import {
   AdapterContractError, type AdapterStartResult, type AdapterTransport, balanceSignalFromResponse,
   classifyAdapterError, dimensionsForRatio, mockPngBytes, validateAdapterRequest, validateMockContract,
@@ -37,7 +38,7 @@ export class GeminiProAdapter implements ModelAdapter {
     try {
       validateAdapterRequest(request, this.modelId);
       const response = await this.transport.start({ operation: "start", modelId: this.modelId, prompt: request.prompt, ratio: request.ratio, referenceAssetIds: request.referenceAssetIds });
-      return this.interpret(response, request.configSnapshot.error_mapping_profile as Record<string, string> ?? {});
+      return await this.interpret(response, request.configSnapshot.error_mapping_profile as Record<string, string> ?? {}, request.ratio);
     } catch (error) {
       const classified = error instanceof AdapterContractError
         ? { category: "gateway_contract_invalid" as const, sourceCategory: error.sourceCategory }
@@ -49,7 +50,7 @@ export class GeminiProAdapter implements ModelAdapter {
   async poll(upstreamJobReference: string): Promise<AdapterStartResult> {
     try {
       const response = await this.transport.poll({ operation: "poll", modelId: this.modelId, upstreamJobReference });
-      return this.interpret(response, {});
+      return await this.interpret(response, {});
     } catch (error) {
       const classified = error instanceof AdapterContractError
         ? { category: "gateway_contract_invalid" as const, sourceCategory: error.sourceCategory }
@@ -58,7 +59,7 @@ export class GeminiProAdapter implements ModelAdapter {
     }
   }
 
-  private interpret(response: unknown, mappingProfile: Readonly<Record<string, string>>): AdapterStartResult {
+  private async interpret(response: unknown, mappingProfile: Readonly<Record<string, string>>, ratio?: GenerationAdapterRequest["ratio"]): Promise<AdapterStartResult> {
     if (!response || typeof response !== "object" || !("operation" in response) || !response.operation || typeof response.operation !== "object") {
       return { category: "gateway_contract_invalid", sourceCategory: "response_shape_invalid", status: "failed" };
     }
@@ -72,7 +73,8 @@ export class GeminiProAdapter implements ModelAdapter {
       return reference ? { status: "pending", upstreamJobReference: reference } : { category: "gateway_contract_invalid", sourceCategory: "upstream_reference_missing", status: "failed" };
     }
     try {
-      return { outputs: [this.normalizeOutput("response" in operation ? operation.response : undefined)], status: "completed" };
+      const output = this.normalizeOutput("response" in operation ? operation.response : undefined);
+      return { outputs: [ratio ? await normalizeImageOutputToRatio({ ...output, ratio }) : output], status: "completed" };
     } catch (error) {
       return { category: "gateway_contract_invalid", sourceCategory: error instanceof AdapterContractError ? error.sourceCategory : "response_shape_invalid", status: "failed" };
     }

apps/worker/src/ai-adapter-gpt-image.ts

@@ -1,4 +1,5 @@
 import type { GenerationAdapterRequest, NormalizedGenerationOutput } from "./ai-adapter-contract.js";
+import { normalizeImageOutputToRatio } from "./image-output-normalizer.mjs";
 import {
   AdapterContractError, type AdapterStartResult, type AdapterTransport, balanceSignalFromResponse,
   classifyAdapterError, dimensionsForRatio, mockPngBytes, validateAdapterRequest, validateMockContract,
@@ -41,7 +42,8 @@ export class GptImageAdapter implements ModelAdapter {
         const classified = this.classifyError("error" in response ? response.error : undefined, (request.configSnapshot.error_mapping_profile as Record<string, string> | undefined) ?? {});
         return { ...classified, status: "failed" };
       }
-      return { outputs: [this.normalizeOutput(response)], status: "completed" };
+      const output = this.normalizeOutput(response);
+      return { outputs: [await normalizeImageOutputToRatio({ ...output, ratio: request.ratio })], status: "completed" };
     } catch (error) {
       const classified = error instanceof AdapterContractError
         ? { category: "gateway_contract_invalid" as const, sourceCategory: error.sourceCategory }

apps/worker/src/image-output-normalizer.mjs

@@ -0,0 +1,74 @@
+import sharp from "sharp";
+
+const productDimensions = Object.freeze({
+  "3:4": Object.freeze({ pixelHeight: 1440, pixelWidth: 1080 }),
+  "1:1": Object.freeze({ pixelHeight: 1080, pixelWidth: 1080 }),
+  "4:3": Object.freeze({ pixelHeight: 1080, pixelWidth: 1440 }),
+  "9:16": Object.freeze({ pixelHeight: 1920, pixelWidth: 1080 }),
+});
+
+const gptImageRequestSizes = Object.freeze({
+  "3:4": "1056x1408",
+  "1:1": "1088x1088",
+  "4:3": "1408x1056",
+  "9:16": "1008x1792",
+});
+
+const allowedMimeTypes = new Set(["image/jpeg", "image/png", "image/webp"]);
+const maximumInputBytes = 20 * 1024 * 1024;
+
+function assertRatio(ratio) {
+  if (!(ratio in productDimensions)) throw new Error("image_output_ratio_unsupported");
+  return ratio;
+}
+
+export function productDimensionsForRatio(ratio) {
+  return { ...productDimensions[assertRatio(ratio)] };
+}
+
+export function gptImageRequestSizeForRatio(ratio) {
+  return gptImageRequestSizes[assertRatio(ratio)];
+}
+
+export async function normalizeImageOutputToRatio(input) {
+  const ratio = assertRatio(input?.ratio);
+  if (!Buffer.isBuffer(input?.bytes) || input.bytes.length === 0 || input.bytes.length > maximumInputBytes
+    || !allowedMimeTypes.has(input?.mimeType)) {
+    throw new Error("image_output_media_invalid");
+  }
+  const target = productDimensions[ratio];
+  if (input.pixelWidth === target.pixelWidth && input.pixelHeight === target.pixelHeight) {
+    return {
+      bytes: Buffer.from(input.bytes),
+      mimeType: input.mimeType,
+      normalized: false,
+      ...target,
+      upstreamPixelHeight: input.pixelHeight,
+      upstreamPixelWidth: input.pixelWidth,
+    };
+  }
+
+  const image = sharp(input.bytes, { failOn: "error", limitInputPixels: 40_000_000 });
+  const metadata = await image.metadata();
+  if (!metadata.width || !metadata.height) throw new Error("image_output_dimensions_missing");
+  const requestedRatio = target.pixelWidth / target.pixelHeight;
+  const upstreamRatio = metadata.width / metadata.height;
+  if (Math.abs(upstreamRatio - requestedRatio) / requestedRatio > 0.02) {
+    throw new Error("image_output_aspect_ratio_mismatch");
+  }
+  const { data, info } = await image
+    .resize(target.pixelWidth, target.pixelHeight, { fit: "fill", kernel: sharp.kernel.lanczos3 })
+    .png({ compressionLevel: 9 })
+    .toBuffer({ resolveWithObject: true });
+  if (info.width !== target.pixelWidth || info.height !== target.pixelHeight || info.format !== "png") {
+    throw new Error("image_output_normalization_failed");
+  }
+  return {
+    bytes: data,
+    mimeType: "image/png",
+    normalized: true,
+    ...target,
+    upstreamPixelHeight: metadata.height,
+    upstreamPixelWidth: metadata.width,
+  };
+}

apps/worker/src/project-purge-cleanup.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { rmSync } from "node:fs";
+import { existsSync, rmSync, statSync } from "node:fs";
 import { createRequire } from "node:module";
 import { isAbsolute, relative, resolve } from "node:path";
 
@@ -29,6 +29,40 @@ interface FileCleanupRow {
 const resourceScope = JSON.stringify([
   "project_state", "generation", "generated_image", "reference", "location", "latest_export",
 ]);
+const auditRetentionMilliseconds = 180 * 24 * 60 * 60 * 1_000;
+const auditRefPattern = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,159}$/;
+const forbiddenSummaryKeys = new Set([
+  "absolute_path", "api_key", "body", "code_hmac", "content", "credential", "email", "image",
+  "image_content", "password", "path", "prompt", "secret", "session_token", "verification_code", "whitelist",
+]);
+const forbiddenSummaryFragments = ["content", "credential", "email", "image", "password", "path", "prompt", "secret", "token"];
+
+function isSafeAuditRef(value: unknown) {
+  return typeof value === "string" && auditRefPattern.test(value) ? 1 : 0;
+}
+
+function isSafeAuditSummaryJson(value: unknown) {
+  if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > 2_048) return 0;
+  try {
+    const valid = (entry: unknown, depth: number): boolean => {
+      if (depth > 3) return false;
+      if (entry === null || typeof entry === "boolean") return true;
+      if (typeof entry === "number") return Number.isSafeInteger(entry);
+      if (typeof entry === "string") return /^[A-Za-z0-9_.:@-]{1,160}$/.test(entry) && !entry.includes("@");
+      if (Array.isArray(entry)) return entry.length <= 20 && entry.every((item) => valid(item, depth + 1));
+      if (!entry || typeof entry !== "object") return false;
+      return Object.entries(entry).length <= 32 && Object.entries(entry).every(([key, item]) => (
+        auditRefPattern.test(key)
+        && !forbiddenSummaryKeys.has(key.toLowerCase())
+        && !forbiddenSummaryFragments.some((fragment) => key.toLowerCase().includes(fragment))
+        && valid(item, depth + 1)
+      ));
+    };
+    return valid(JSON.parse(value), 0) ? 1 : 0;
+  } catch {
+    return 0;
+  }
+}
 
 function iso(timestamp: number) {
   return new Date(timestamp).toISOString();
@@ -47,6 +81,12 @@ export class ProjectPurgeCleanup {
     this.database.pragma("journal_mode = WAL");
     this.database.pragma("foreign_keys = ON");
     this.database.pragma("busy_timeout = 5000");
+    this.database.function("dada_audit_ref_is_safe", { deterministic: true }, isSafeAuditRef);
+    this.database.function("dada_audit_summary_is_safe", { deterministic: true }, isSafeAuditSummaryJson);
+    this.database.function("dada_allow_privacy_purge", { deterministic: false }, () => 0);
+    this.database.function("dada_privacy_purge_subject", { deterministic: false }, () => "");
+    this.database.function("dada_allow_retention_purge", { deterministic: false }, () => 0);
+    this.database.function("dada_retention_purge_now", { deterministic: false }, () => 0);
   }
 
   close() {
@@ -153,12 +193,16 @@ export class ProjectPurgeCleanup {
                   if (pending.count === 0) {
                     this.database.prepare("UPDATE asset_cleanup_requests SET status = 'completed' WHERE request_id = ? AND status = 'queued'")
                       .run(request.request_id);
+                    this.insertAssetCleanupAudit(request.request_id, row.byte_size, this.clock());
                   }
                 }
               }
             }
+            if (this.tableExists("sticker_managed_file_history")) {
+              this.database.prepare("DELETE FROM sticker_managed_file_history WHERE managed_file_id = ?").run(row.managed_file_id);
+            }
             this.database.prepare("DELETE FROM managed_files WHERE file_id = ?").run(row.managed_file_id);
-            if (this.tableExists("local_backend_storage_state")) this.decrementManagedCapacity(row.byte_size);
+            if (this.tableExists("local_backend_storage_state")) this.remeasureManagedCapacity();
           }
           this.database.prepare(`
             UPDATE file_cleanup_queue SET status = 'completed', completed_at = ?, last_error = NULL
@@ -168,10 +212,19 @@ export class ProjectPurgeCleanup {
         transaction.immediate();
         completed += 1;
       } catch {
-        this.database.prepare(`
-          UPDATE file_cleanup_queue SET status = 'failed', last_error = 'physical_file_cleanup_failed'
-          WHERE cleanup_id = ?
-        `).run(row.cleanup_id);
+        const transaction = this.database.transaction(() => {
+          this.database.prepare(`
+            UPDATE file_cleanup_queue SET status = 'failed', last_error = 'physical_file_cleanup_failed'
+            WHERE cleanup_id = ?
+          `).run(row.cleanup_id);
+          if (row.managed_file_id && this.tableExists("asset_cleanup_request_items")) {
+            const request = this.database.prepare(`
+              SELECT request_id FROM asset_cleanup_request_items WHERE managed_file_id = ? LIMIT 1
+            `).get(row.managed_file_id) as { request_id: string } | undefined;
+            if (request) this.insertAssetCleanupFailureAudit(request.request_id, this.clock());
+          }
+        });
+        transaction.immediate();
         failed += 1;
       }
     }
@@ -238,4 +291,59 @@ export class ProjectPurgeCleanup {
       WHERE singleton = 1
     `).run(managed, notice, status, iso(this.clock()));
   }
+
+  private insertAssetCleanupAudit(requestId: string, deletedBytes: number, occurredAt: number) {
+    if (!this.tableExists("admin_operation_logs")) return;
+    this.database.prepare(`
+      INSERT INTO admin_operation_logs (
+        log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
+        result, before_summary, after_summary, occurred_at, expires_at
+      ) VALUES (?, 'system', 'project_purge_worker', 'asset_cleanup_physical_completed', 'asset_cleanup', ?, 'succeeded', NULL, ?, ?, ?)
+    `).run(
+      randomUUID(), requestId, JSON.stringify({ deleted_bytes: deletedBytes, status: "completed" }), occurredAt,
+      occurredAt + auditRetentionMilliseconds,
+    );
+  }
+
+  private insertAssetCleanupFailureAudit(requestId: string, occurredAt: number) {
+    if (!this.tableExists("admin_operation_logs")) return;
+    this.database.prepare(`
+      INSERT INTO admin_operation_logs (
+        log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
+        result, before_summary, after_summary, occurred_at, expires_at
+      ) VALUES (?, 'system', 'project_purge_worker', 'asset_cleanup_physical_failed', 'asset_cleanup', ?, 'failed', NULL, ?, ?, ?)
+    `).run(
+      randomUUID(), requestId, JSON.stringify({ failed_count: 1, status: "retry_pending" }), occurredAt,
+      occurredAt + auditRetentionMilliseconds,
+    );
+  }
+
+  private remeasureManagedCapacity() {
+    const state = this.database.prepare(`
+      SELECT managed_content_bytes FROM local_backend_storage_state WHERE singleton = 1
+    `).get() as { managed_content_bytes: number } | undefined;
+    if (!state) return;
+    const rows = this.database.prepare(`
+      SELECT relative_path FROM managed_files WHERE status = 'committed'
+    `).all() as Array<{ relative_path: string }>;
+    let managed = 0;
+    for (const row of rows) {
+      try {
+        const path = this.resolveManagedPath(row.relative_path);
+        if (existsSync(path)) managed += statSync(path).size;
+      } catch {
+        // A missing or invalid path is excluded from the measured physical total.
+      }
+    }
+    const reservations = this.tableExists("storage_reservations")
+      ? (this.database.prepare("SELECT COALESCE(SUM(projected_bytes), 0) AS bytes FROM storage_reservations WHERE status = 'active'").get() as { bytes: number }).bytes
+      : 0;
+    const notice = managed < 4_294_967_296 ? "normal" : managed < 4_831_838_208 ? "warning" : "critical";
+    const status = managed + reservations >= 5_368_709_120 ? "full" : "active";
+    this.database.prepare(`
+      UPDATE local_backend_storage_state
+      SET managed_content_bytes = ?, capacity_notice_level = ?, storage_status = ?, measured_at = ?, version = version + 1
+      WHERE singleton = 1
+    `).run(managed, notice, status, iso(this.clock()));
+  }
 }

apps/worker/tsconfig.json

@@ -1,6 +1,7 @@
 {
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
+    "allowJs": true,
     "module": "NodeNext",
     "moduleResolution": "NodeNext",
     "lib": ["ES2024"],

config/wp7-02-oneapi-test.json

@@ -0,0 +1,29 @@
+{
+  "config_set_version": 8,
+  "gateway_account_ref": "oneapi-intelligrow-test",
+  "models": [
+    {
+      "config_version": 7,
+      "gateway_account_ref": "oneapi-intelligrow-test",
+      "model_id": "gemini-3.1-flash-image",
+      "route_profile": {
+        "endpoint": "https://oneapi.intelligrow.cn/v1/chat/completions",
+        "mode": "sync",
+        "protocol_version": "gemini-openai-chat-v1",
+        "provider_model_id": "gemini-3.1-flash-image"
+      }
+    },
+    {
+      "config_version": 2,
+      "gateway_account_ref": "oneapi-intelligrow-test",
+      "model_id": "gpt-image-2",
+      "route_profile": {
+        "endpoint": "https://oneapi.intelligrow.cn/v1/images/generations",
+        "mode": "sync",
+        "protocol_version": "openai-images-v1",
+        "reference_endpoint": "https://oneapi.intelligrow.cn/v1/images/edits"
+      }
+    }
+  ],
+  "schema_version": "1.0"
+}

package.json

@@ -8,17 +8,18 @@
   },
   "scripts": {
     "build": "pnpm -r --if-present build && dotnet build supervisor/Dada.Supervisor/Dada.Supervisor.csproj --configuration Release",
+    "build:workspace-packages": "pnpm --filter \"./packages/**\" --if-present build",
     "typecheck": "pnpm -r --if-present typecheck",
     "test:unit:contract": "node --test tests/toolchain/frozen-toolchain.test.mjs",
     "test:unit": "pnpm --filter @dada/static-sticker-catalog build && pnpm --filter @dada/template-registry build && pnpm --filter @dada/asset-renderer build && pnpm --filter @dada/asset-compiler build && pnpm --filter @dada/shared-contracts build && pnpm run test:unit:contract && vitest run tests/unit",
     "test:integration": "vitest run tests/integration",
     "test:api": "pnpm check:openapi && vitest run tests/api",
     "test:worker": "pnpm --filter @dada/worker build && node scripts/worker-smoke.mjs && vitest run tests/worker",
-    "test:e2e": "pnpm check:openapi && playwright test tests/e2e/event-sync.spec.ts tests/e2e/support-gate.spec.ts tests/e2e/local-data-boundary.spec.ts tests/e2e/storage-capacity.spec.ts tests/e2e/public-asset-cache.spec.ts tests/e2e/user-auth.spec.ts tests/e2e/admin-auth.spec.ts tests/e2e/entry-state-ui.spec.ts tests/e2e/session-invalid-ui.spec.ts tests/e2e/user-registration.spec.ts tests/e2e/account-settings.spec.ts tests/e2e/projects-workspace.spec.ts tests/e2e/project-autosave-conflict.spec.ts tests/e2e/project-trash.spec.ts tests/e2e/credits.spec.ts tests/e2e/generation-workspace.spec.ts tests/e2e/generation-terminal-actions.spec.ts tests/e2e/project-latest-exports.spec.ts tests/e2e/admin-models.spec.ts tests/e2e/wp4-01-editor-background.spec.ts tests/e2e/wp4-02-editor-elements.spec.ts tests/e2e/wp4-03-text-editor.spec.ts tests/e2e/wp4-04-color-dynamic.spec.ts tests/e2e/wp4-05-export.spec.ts tests/e2e/wp4-06-accessibility.spec.ts tests/e2e/wp5-02-static-sticker-catalog.spec.ts tests/e2e/wp5-03-template-registry.spec.ts --config playwright.config.ts",
-    "test:visual": "node scripts/validate-layer-scope.mjs VISUAL",
-    "test:performance": "node scripts/validate-layer-scope.mjs PERFORMANCE",
+    "test:e2e": "pnpm check:openapi && playwright test tests/e2e/event-sync.spec.ts tests/e2e/support-gate.spec.ts tests/e2e/local-data-boundary.spec.ts tests/e2e/storage-capacity.spec.ts tests/e2e/public-asset-cache.spec.ts tests/e2e/user-auth.spec.ts tests/e2e/admin-auth.spec.ts tests/e2e/entry-state-ui.spec.ts tests/e2e/session-invalid-ui.spec.ts tests/e2e/user-registration.spec.ts tests/e2e/account-settings.spec.ts tests/e2e/projects-workspace.spec.ts tests/e2e/project-autosave-conflict.spec.ts tests/e2e/project-trash.spec.ts tests/e2e/credits.spec.ts tests/e2e/generation-workspace.spec.ts tests/e2e/generation-terminal-actions.spec.ts tests/e2e/project-latest-exports.spec.ts tests/e2e/admin-models.spec.ts tests/e2e/wp4-01-editor-background.spec.ts tests/e2e/wp4-02-editor-elements.spec.ts tests/e2e/wp4-03-text-editor.spec.ts tests/e2e/wp4-04-color-dynamic.spec.ts tests/e2e/wp4-05-export.spec.ts tests/e2e/wp4-06-accessibility.spec.ts tests/e2e/wp5-02-static-sticker-catalog.spec.ts tests/e2e/wp5-03-template-registry.spec.ts tests/e2e/wp5-04-resource-isolation.spec.ts tests/e2e/wp5-05-admin-assets.spec.ts tests/e2e/wp6-01-admin-shell.spec.ts tests/e2e/wp6-04-audit.spec.ts tests/e2e/wp6-05-state.spec.ts --config playwright.config.ts",
+    "test:visual": "node scripts/run-wp4-07-layer.mjs visual",
+    "test:performance": "node scripts/run-wp4-07-layer.mjs performance",
     "test:security": "node scripts/verify-frozen-dependencies.mjs && node scripts/redaction-scan.mjs",
-    "test:package": "pnpm run typecheck && node --test tests/package/wp0-09-portable.test.mjs && node scripts/package-smoke.mjs && node scripts/loopback-boundary-smoke.mjs",
+    "test:package": "pnpm build:workspace-packages && pnpm run typecheck && node --test tests/package/wp0-09-portable.test.mjs && node scripts/package-smoke.mjs && node scripts/loopback-boundary-smoke.mjs",
     "package:portable": "node scripts/build-portable.mjs",
     "generate:openapi": "node scripts/generate-openapi.mjs",
     "check:openapi": "node scripts/check-openapi.mjs",
@@ -86,13 +87,29 @@
     "test:wp4-05:red": "node scripts/run-wp4-05-validation.mjs --phase red",
     "test:wp4-06": "node scripts/run-wp4-06-validation.mjs",
     "test:wp4-06:red": "node scripts/run-wp4-06-validation.mjs --phase red",
+    "test:wp4-07": "node scripts/run-wp4-07-validation.mjs",
+    "test:wp4-07:red": "node scripts/run-wp4-07-validation.mjs --phase red",
     "test:wp5-01": "node scripts/run-wp5-01-validation.mjs",
     "test:wp5-01:red": "node scripts/run-wp5-01-validation.mjs --phase red",
     "test:wp5-02": "node scripts/run-wp5-02-validation.mjs",
     "test:wp5-02:red": "node scripts/run-wp5-02-validation.mjs --phase red",
     "preview:wp5-02": "node scripts/run-wp5-02-manual-preview.mjs",
     "test:wp5-03": "node scripts/run-wp5-03-validation.mjs",
-    "test:wp5-03:red": "node scripts/run-wp5-03-validation.mjs --phase red"
+    "test:wp5-03:red": "node scripts/run-wp5-03-validation.mjs --phase red",
+    "test:wp5-04": "node scripts/run-wp5-04-validation.mjs",
+    "test:wp5-04:red": "node scripts/run-wp5-04-validation.mjs --phase red",
+    "test:wp5-05": "node scripts/run-wp5-05-validation.mjs",
+    "test:wp5-05:red": "node scripts/run-wp5-05-validation.mjs --phase red",
+    "test:wp6-01": "node scripts/run-wp6-01-validation.mjs --phase scaffold",
+    "test:wp6-01:red": "node scripts/run-wp6-01-validation.mjs --phase red",
+    "test:wp6-04": "node scripts/run-wp6-04-validation.mjs --phase green",
+    "test:wp6-04:red": "node scripts/run-wp6-04-validation.mjs --phase red",
+    "test:wp6-05": "pnpm exec vitest run tests/api/wp6-05-state.test.ts && pnpm exec playwright test tests/e2e/wp6-05-state.spec.ts --config playwright.config.ts",
+    "test:wp7-01": "node scripts/run-wp7-01-validation.mjs",
+    "review:wp7-01": "node scripts/record-wp7-01-manual-review.mjs",
+    "test:wp7-02": "node scripts/run-wp7-02-validation.mjs",
+    "test:wp7-02:controlled": "node scripts/run-wp7-02-validation.mjs --controlled-real",
+    "review:wp7-02": "node scripts/record-wp7-02-manual-review.mjs"
   },
   "devDependencies": {
     "@playwright/test": "1.62.0",

packages/asset-release-manifest/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@dada/asset-release-manifest",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "devDependencies": {
+    "@types/node": "24.13.3",
+    "typescript": "7.0.2"
+  }
+}

packages/asset-release-manifest/src/index.ts

@@ -0,0 +1,180 @@
+import { createHash } from "node:crypto";
+import { posix, win32 } from "node:path";
+
+export const ASSET_ACCESS_CLASSES = [
+  "public_release_asset",
+  "internal_preview_asset",
+  "private_user_asset",
+] as const;
+
+export type AssetAccessClass = typeof ASSET_ACCESS_CLASSES[number];
+export type PublicAssetCacheKind = "font" | "template_conversion" | "thumbnail";
+
+export interface AssetReleaseItemInput {
+  access_class: AssetAccessClass;
+  cache_kind?: PublicAssetCacheKind;
+  content: Uint8Array;
+  mime_type: string;
+  owner_id?: string;
+  relative_path: string;
+  resource_id: string;
+  root_ref: string;
+  sha256?: string;
+}
+
+export interface AssetReleaseManifestInput {
+  items: readonly AssetReleaseItemInput[];
+  release_version: string;
+}
+
+export interface AssetReleaseManifestItem {
+  access_class: AssetAccessClass;
+  byte_size: number;
+  cache_kind?: PublicAssetCacheKind;
+  mime_type: string;
+  release_version: string;
+  resource_id: string;
+  sha256: string;
+  url: string;
+}
+
+export interface AssetReleaseManifestProjection {
+  items: readonly AssetReleaseManifestItem[];
+  manifest_sha256: string;
+  release_version: string;
+  schema_version: "AssetReleaseManifest/v1";
+}
+
+export interface AssetReleasePayload {
+  accessClass: AssetAccessClass;
+  bytes: Buffer;
+  mimeType: string;
+  ownerId?: string;
+  releaseVersion: string;
+  resourceId: string;
+  sha256: string;
+}
+
+export interface AssetReleaseReader {
+  project(
+    accessClass: AssetAccessClass,
+    releaseVersion: string,
+    options?: { ownerId?: string; resourceIds?: readonly string[] },
+  ): AssetReleaseManifestProjection | undefined;
+  read(accessClass: AssetAccessClass, releaseVersion: string, resourceId: string): AssetReleasePayload | undefined;
+}
+
+interface StoredItem {
+  accessClass: AssetAccessClass;
+  bytes: Buffer;
+  cacheKind?: PublicAssetCacheKind;
+  mimeType: string;
+  ownerId?: string;
+  projection: AssetReleaseManifestItem;
+  relativePath: string;
+  rootRef: string;
+  sha256: string;
+}
+
+const releaseVersionPattern = /^[a-z0-9][a-z0-9._-]{0,79}$/i;
+const resourceIdPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const sha256Pattern = /^[0-9a-f]{64}$/;
+const rootRefPattern = /^[a-z0-9][a-z0-9._-]{0,79}$/i;
+
+function assetUrl(accessClass: AssetAccessClass, releaseVersion: string, resourceId: string) {
+  if (accessClass === "public_release_asset") return `/api/v1/assets/public/${releaseVersion}/${resourceId}`;
+  if (accessClass === "internal_preview_asset") return `/api/v1/assets/preview/${releaseVersion}/${resourceId}`;
+  return `/api/v1/private-assets/${releaseVersion}/${resourceId}`;
+}
+
+function isSafeRelativePath(value: string) {
+  if (!value || value.includes("\\") || posix.isAbsolute(value) || win32.isAbsolute(value)) return false;
+  const segments = value.split("/");
+  return segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
+
+function sha256(value: string | Uint8Array) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function immutableProjection(input: Omit<AssetReleaseManifestProjection, "manifest_sha256">): AssetReleaseManifestProjection {
+  const items = input.items.map((item) => Object.freeze({ ...item }));
+  const manifestBody = JSON.stringify({ ...input, items });
+  return Object.freeze({ ...input, items: Object.freeze(items), manifest_sha256: sha256(manifestBody) });
+}
+
+function validateItem(item: AssetReleaseItemInput, releaseVersion: string, seenIds: Set<string>): StoredItem {
+  if (!ASSET_ACCESS_CLASSES.includes(item.access_class)) throw new Error("asset access class is unsupported");
+  if (!resourceIdPattern.test(item.resource_id) || seenIds.has(item.resource_id)) throw new Error("resource_id must be a unique opaque UUID");
+  seenIds.add(item.resource_id);
+  if (!rootRefPattern.test(item.root_ref)) throw new Error("root_ref is invalid");
+  if (!isSafeRelativePath(item.relative_path)) throw new Error("relative path must stay within its declared root");
+  if (!/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/i.test(item.mime_type)) throw new Error("mime_type is invalid");
+  if (item.access_class === "public_release_asset" && !item.cache_kind) throw new Error("public release asset requires an allowlisted cache kind");
+  if (item.access_class !== "public_release_asset" && item.cache_kind) throw new Error("non-public assets cannot declare a public cache kind");
+  if (item.access_class === "private_user_asset" && !item.owner_id) throw new Error("private user asset requires owner_id");
+  if (item.access_class !== "private_user_asset" && item.owner_id) throw new Error("only private user assets can declare owner_id");
+
+  const bytes = Buffer.from(item.content);
+  const digest = sha256(bytes);
+  if (item.sha256 !== undefined && (!sha256Pattern.test(item.sha256) || item.sha256 !== digest)) {
+    throw new Error("file SHA-256 does not match content");
+  }
+  const projection: AssetReleaseManifestItem = {
+    access_class: item.access_class,
+    byte_size: bytes.byteLength,
+    ...(item.cache_kind ? { cache_kind: item.cache_kind } : {}),
+    mime_type: item.mime_type,
+    release_version: releaseVersion,
+    resource_id: item.resource_id,
+    sha256: digest,
+    url: assetUrl(item.access_class, releaseVersion, item.resource_id),
+  };
+  return {
+    accessClass: item.access_class,
+    bytes,
+    ...(item.cache_kind ? { cacheKind: item.cache_kind } : {}),
+    mimeType: item.mime_type,
+    ...(item.owner_id ? { ownerId: item.owner_id } : {}),
+    projection: Object.freeze(projection),
+    relativePath: item.relative_path,
+    rootRef: item.root_ref,
+    sha256: digest,
+  };
+}
+
+export function createAssetReleaseManifest(input: AssetReleaseManifestInput): AssetReleaseReader {
+  if (!releaseVersionPattern.test(input.release_version)) throw new Error("release_version is invalid");
+  const seenIds = new Set<string>();
+  const items = input.items
+    .map((item) => validateItem(item, input.release_version, seenIds))
+    .sort((left, right) => left.projection.resource_id.localeCompare(right.projection.resource_id));
+
+  return Object.freeze({
+    project(accessClass: AssetAccessClass, releaseVersion: string, options: { ownerId?: string; resourceIds?: readonly string[] } = {}) {
+      if (releaseVersion !== input.release_version) return undefined;
+      const selected = items.filter((item) => item.accessClass === accessClass
+        && (accessClass !== "private_user_asset" || Boolean(options.ownerId) && item.ownerId === options.ownerId)
+        && (!options.resourceIds || options.resourceIds.includes(item.projection.resource_id)));
+      return immutableProjection({
+        items: selected.map((item) => item.projection),
+        release_version: input.release_version,
+        schema_version: "AssetReleaseManifest/v1",
+      });
+    },
+    read(accessClass: AssetAccessClass, releaseVersion: string, resourceId: string) {
+      if (releaseVersion !== input.release_version) return undefined;
+      const item = items.find((candidate) => candidate.accessClass === accessClass && candidate.projection.resource_id === resourceId);
+      if (!item) return undefined;
+      return {
+        accessClass: item.accessClass,
+        bytes: Buffer.from(item.bytes),
+        mimeType: item.mimeType,
+        ...(item.ownerId ? { ownerId: item.ownerId } : {}),
+        releaseVersion,
+        resourceId,
+        sha256: item.sha256,
+      };
+    },
+  });
+}

packages/asset-release-manifest/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": ["ES2024"],
+    "types": ["node"],
+    "declaration": true,
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}

packages/shared-contracts/src/admin.ts

@@ -0,0 +1,290 @@
+import { Type, type Static } from "@sinclair/typebox";
+
+const isoTimestampPattern = "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$";
+const modelIdPattern = "^[a-z0-9][a-z0-9.-]+$";
+const safeReferencePattern = "^[A-Za-z0-9][A-Za-z0-9:._-]{0,159}$";
+const uuidPattern = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$";
+
+export const AdminGenerationRecordSchema = Type.Object(
+  {
+    generation_id: Type.String({ pattern: uuidPattern }),
+    owner_ref: Type.String({ pattern: uuidPattern }),
+    project_id: Type.String({ pattern: uuidPattern }),
+    model_id: Type.String({ maxLength: 80, pattern: modelIdPattern }),
+    ratio: Type.Union([Type.Literal("3:4"), Type.Literal("1:1"), Type.Literal("4:3"), Type.Literal("9:16")]),
+    status: Type.Union([Type.Literal("queued"), Type.Literal("running"), Type.Literal("succeeded"), Type.Literal("failed"), Type.Literal("rejected")]),
+    created_at: Type.String({ pattern: isoTimestampPattern }),
+    completed_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
+    duration_ms: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()]),
+    confirmed_credit_cost: Type.Integer({ minimum: 0 }),
+    reserved_credits: Type.Integer({ minimum: 0 }),
+    final_credit_state: Type.Union([Type.Literal("committed"), Type.Literal("released"), Type.Null()]),
+    error_category: Type.Union([
+      Type.Literal("upstream_timeout"), Type.Literal("upstream_failed"), Type.Literal("safety_rejected"),
+      Type.Literal("model_disabled"), Type.Literal("gateway_balance_insufficient"), Type.Literal("gateway_contract_invalid"),
+      Type.Literal("reference_invalid"), Type.Literal("unknown_retryable"), Type.Literal("unknown_non_retryable"), Type.Null(),
+    ]),
+  },
+  { additionalProperties: false, $id: "AdminGenerationRecord" },
+);
+
+export const AdminGenerationListResponseSchema = Type.Object(
+  {
+    generated_at: Type.String({ pattern: isoTimestampPattern }),
+    items: Type.Array(Type.Ref(AdminGenerationRecordSchema), { maxItems: 100 }),
+  },
+  { additionalProperties: false, $id: "AdminGenerationListResponse" },
+);
+
+export const PrivateContentNoticeAckRequestSchema = Type.Object(
+  { expected_notice_version: Type.String({ minLength: 1, maxLength: 80, pattern: "^[A-Za-z0-9_.:-]+$" }) },
+  { additionalProperties: false, $id: "PrivateContentNoticeAckRequest" },
+);
+
+export const PrivateContentNoticeAckResponseSchema = Type.Object(
+  {
+    notice_version: Type.String({ minLength: 1, maxLength: 80, pattern: "^[A-Za-z0-9_.:-]+$" }),
+    acknowledged_at: Type.String({ pattern: isoTimestampPattern }),
+    status: Type.Literal("acknowledged"),
+  },
+  { additionalProperties: false, $id: "PrivateContentNoticeAckResponse" },
+);
+
+export const PrivateContentPromptResponseSchema = Type.Object(
+  {
+    generation_id: Type.String({ pattern: uuidPattern }),
+    content_type: Type.Literal("prompt"),
+    prompt: Type.String({ minLength: 1, maxLength: 4000 }),
+  },
+  { additionalProperties: false, $id: "PrivateContentPromptResponse" },
+);
+
+export const PrivateContentGenerationParamsSchema = Type.Object(
+  { generationId: Type.String({ pattern: uuidPattern }) },
+  { additionalProperties: false, $id: "PrivateContentGenerationParams" },
+);
+
+export type AdminGenerationRecord = Static<typeof AdminGenerationRecordSchema>;
+export type AdminGenerationListResponse = Static<typeof AdminGenerationListResponseSchema>;
+export type PrivateContentNoticeAckRequest = Static<typeof PrivateContentNoticeAckRequestSchema>;
+export type PrivateContentNoticeAckResponse = Static<typeof PrivateContentNoticeAckResponseSchema>;
+export type PrivateContentPromptResponse = Static<typeof PrivateContentPromptResponseSchema>;
+
+export const AdminAuditQuerySchema = Type.Object(
+  {
+    cursor: Type.Optional(Type.String({ maxLength: 512, pattern: "^[A-Za-z0-9_-]+$" })),
+    limit: Type.Optional(Type.Integer({ maximum: 100, minimum: 1 })),
+  },
+  { additionalProperties: false, $id: "AdminAuditQuery" },
+);
+
+export const AdminOperationAuditItemSchema = Type.Object(
+  {
+    actor_ref: Type.String({ pattern: safeReferencePattern }),
+    actor_type: Type.Union([Type.Literal("system"), Type.Literal("super_admin")]),
+    after_summary: Type.Union([Type.String({ maxLength: 2048 }), Type.Null()]),
+    before_summary: Type.Union([Type.String({ maxLength: 2048 }), Type.Null()]),
+    expires_at: Type.String({ pattern: isoTimestampPattern }),
+    log_id: Type.String({ pattern: uuidPattern }),
+    occurred_at: Type.String({ pattern: isoTimestampPattern }),
+    operation_type: Type.String({ maxLength: 160, pattern: safeReferencePattern }),
+    result: Type.Union([Type.Literal("succeeded"), Type.Literal("failed")]),
+    target_ref: Type.String({ pattern: safeReferencePattern }),
+    target_type: Type.String({ maxLength: 160, pattern: safeReferencePattern }),
+  },
+  { additionalProperties: false, $id: "AdminOperationAuditItem" },
+);
+
+export const AdminOperationAuditResponseSchema = Type.Object(
+  {
+    generated_at: Type.String({ pattern: isoTimestampPattern }),
+    items: Type.Array(Type.Ref(AdminOperationAuditItemSchema), { maxItems: 100 }),
+    next_cursor: Type.Union([Type.String({ maxLength: 512, pattern: "^[A-Za-z0-9_-]+$" }), Type.Null()]),
+  },
+  { additionalProperties: false, $id: "AdminOperationAuditResponse" },
+);
+
+export const PrivateContentAccessAuditItemSchema = Type.Object(
+  {
+    actor_ref: Type.String({ pattern: safeReferencePattern }),
+    content_type: Type.Union([Type.Literal("image"), Type.Literal("prompt")]),
+    expires_at: Type.String({ pattern: isoTimestampPattern }),
+    log_id: Type.String({ pattern: uuidPattern }),
+    occurred_at: Type.String({ pattern: isoTimestampPattern }),
+    target_ref: Type.String({ pattern: safeReferencePattern }),
+  },
+  { additionalProperties: false, $id: "PrivateContentAccessAuditItem" },
+);
+
+export const PrivateContentAccessAuditResponseSchema = Type.Object(
+  {
+    generated_at: Type.String({ pattern: isoTimestampPattern }),
+    items: Type.Array(Type.Ref(PrivateContentAccessAuditItemSchema), { maxItems: 100 }),
+    next_cursor: Type.Union([Type.String({ maxLength: 512, pattern: "^[A-Za-z0-9_-]+$" }), Type.Null()]),
+  },
+  { additionalProperties: false, $id: "PrivateContentAccessAuditResponse" },
+);
+
+export type AdminAuditQuery = Static<typeof AdminAuditQuerySchema>;
+export type AdminOperationAuditItem = Static<typeof AdminOperationAuditItemSchema>;
+export type AdminOperationAuditResponse = Static<typeof AdminOperationAuditResponseSchema>;
+export type PrivateContentAccessAuditItem = Static<typeof PrivateContentAccessAuditItemSchema>;
+export type PrivateContentAccessAuditResponse = Static<typeof PrivateContentAccessAuditResponseSchema>;
+
+export const AdminOverviewResponseSchema = Type.Object(
+  {
+    generated_at: Type.String({ pattern: isoTimestampPattern }),
+    user_slots: Type.Object(
+      {
+        active_and_suspended: Type.Integer({ minimum: 0 }),
+        limit: Type.Integer({ minimum: 1 }),
+      },
+      { additionalProperties: false },
+    ),
+    generation_jobs: Type.Object(
+      {
+        pending_manual_review: Type.Integer({ minimum: 0 }),
+        pending_manual_review_oldest_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
+        queued: Type.Integer({ minimum: 0 }),
+        running: Type.Integer({ minimum: 0 }),
+      },
+      { additionalProperties: false },
+    ),
+    models: Type.Object(
+      {
+        configured_default_model_id: Type.Union([Type.String({ maxLength: 80, pattern: modelIdPattern }), Type.Null()]),
+        configured_model_count: Type.Integer({ minimum: 0 }),
+        recommended_model_id: Type.Union([Type.String({ maxLength: 80, pattern: modelIdPattern }), Type.Null()]),
+        runtime_available_count: Type.Integer({ minimum: 0 }),
+      },
+      { additionalProperties: false },
+    ),
+    storage: Type.Object(
+      {
+        last_measured_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
+        limit_bytes: Type.Integer({ minimum: 1 }),
+        managed_content_bytes: Type.Integer({ minimum: 0 }),
+        status: Type.Union([
+          Type.Literal("normal"),
+          Type.Literal("critical"),
+          Type.Literal("full"),
+          Type.Literal("unavailable"),
+        ]),
+      },
+      { additionalProperties: false },
+    ),
+    services: Type.Array(
+      Type.Object(
+        {
+          checked_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
+          service_id: Type.Union([
+            Type.Literal("resend"),
+            Type.Literal("amap"),
+            Type.Literal("ai_gateway"),
+            Type.Literal("worker"),
+            Type.Literal("asset_root"),
+          ]),
+          status: Type.Union([
+            Type.Literal("available"),
+            Type.Literal("degraded"),
+            Type.Literal("paused"),
+            Type.Literal("unavailable"),
+          ]),
+        },
+        { additionalProperties: false },
+      ),
+      { maxItems: 5 },
+    ),
+    recent_operations: Type.Array(
+      Type.Object(
+        {
+          created_at: Type.String({ pattern: isoTimestampPattern }),
+          operation_id: Type.String({ pattern: "^[0-9a-fA-F-]{36}$" }),
+          operation_type: Type.String({ maxLength: 80, pattern: "^[a-z][a-z0-9_]+$" }),
+          result: Type.Union([Type.Literal("succeeded"), Type.Literal("rejected"), Type.Literal("failed")]),
+          target_ref: Type.String({ pattern: safeReferencePattern }),
+        },
+        { additionalProperties: false },
+      ),
+      { maxItems: 10 },
+    ),
+    asset_cleanup: Type.Object(
+      {
+        pending_jobs: Type.Integer({ minimum: 0 }),
+      },
+      { additionalProperties: false },
+    ),
+  },
+  { additionalProperties: false, $id: "AdminOverviewResponse" },
+);
+
+export type AdminOverviewResponse = Static<typeof AdminOverviewResponseSchema>;
+
+const adminServiceStatusSchema = Type.Union([
+  Type.Literal("active"),
+  Type.Literal("paused_quota"),
+  Type.Literal("paused_provider"),
+  Type.Literal("disabled"),
+  Type.Literal("degraded"),
+  Type.Literal("unavailable"),
+]);
+
+const adminServiceIdSchema = Type.Union([
+  Type.Literal("resend"),
+  Type.Literal("amap"),
+  Type.Literal("ai_gateway"),
+  Type.Literal("worker"),
+  Type.Literal("api"),
+  Type.Literal("asset_root"),
+]);
+
+export const AdminServicesStorageResponseSchema = Type.Object({
+  generated_at: Type.String({ pattern: isoTimestampPattern }),
+  services: Type.Array(Type.Object({
+    checked_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
+    configured: Type.Boolean(),
+    impact_scope: Type.Union([
+      Type.Literal("none"),
+      Type.Literal("authentication"),
+      Type.Literal("location"),
+      Type.Literal("generation"),
+      Type.Literal("storage"),
+      Type.Literal("api"),
+      Type.Literal("model"),
+      Type.Literal("account"),
+      Type.Literal("unknown"),
+    ]),
+    pause_reason: Type.Union([Type.String({ maxLength: 80, pattern: "^[a-z][a-z0-9_]*$" }), Type.Null()]),
+    service_id: adminServiceIdSchema,
+    status: adminServiceStatusSchema,
+  }, { additionalProperties: false }), { minItems: 6, maxItems: 6 }),
+  storage: Type.Object({
+    capacity_notice_level: Type.Union([Type.Literal("normal"), Type.Literal("warning"), Type.Literal("critical")]),
+    cleanup_pending_count: Type.Integer({ minimum: 0 }),
+    data_root_ref: Type.Literal("configured_local_data_root"),
+    hard_limit_bytes: Type.Integer({ minimum: 1 }),
+    last_measured_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
+    managed_content_bytes: Type.Integer({ minimum: 0 }),
+    remeasurement_required: Type.Boolean(),
+    status: Type.Union([Type.Literal("active"), Type.Literal("full"), Type.Literal("unavailable")]),
+    storage_backend: Type.Literal("local_filesystem"),
+  }, { additionalProperties: false }),
+}, { additionalProperties: false, $id: "AdminServicesStorageResponse" });
+
+export const AdminDiagnosticsResponseSchema = Type.Object({
+  generated_at: Type.String({ pattern: isoTimestampPattern }),
+  diagnostic_text: Type.String({ minLength: 1, maxLength: 12_000 }),
+  services: Type.Ref(AdminServicesStorageResponseSchema),
+  system: Type.Object({
+    api_status: Type.Union([Type.Literal("ready"), Type.Literal("degraded"), Type.Literal("unavailable")]),
+    app_version: Type.String({ maxLength: 80, pattern: "^[A-Za-z0-9][A-Za-z0-9._-]*$" }),
+    browser_support: Type.Array(Type.Object({
+      brand: Type.Union([Type.Literal("Google Chrome"), Type.Literal("Microsoft Edge")]),
+      major: Type.Integer({ minimum: 1 }),
+    }, { additionalProperties: false }), { maxItems: 2 }),
+    worker_status: Type.Union([Type.Literal("ready"), Type.Literal("degraded"), Type.Literal("unavailable")]),
+  }, { additionalProperties: false }),
+}, { additionalProperties: false, $id: "AdminDiagnosticsResponse" });
+
+export type AdminServicesStorageResponse = Static<typeof AdminServicesStorageResponseSchema>;
+export type AdminDiagnosticsResponse = Static<typeof AdminDiagnosticsResponseSchema>;

packages/shared-contracts/src/auth.ts

@@ -149,6 +149,7 @@ export const AdminSessionResponseSchema = Type.Object(
     audience: Type.Literal("admin"),
     authenticated: Type.Literal(true),
     csrf_token: Type.String({ maxLength: 64, minLength: 43, pattern: "^[A-Za-z0-9_-]+$" }),
+    current_private_content_notice_message_key: Type.Optional(Type.String({ maxLength: 120, pattern: "^[A-Za-z0-9_.-]+$" })),
     current_private_content_notice_version: Type.Union([Type.String(), Type.Null()]),
     expires_at: Type.String({ pattern: isoTimestampPattern }),
     notice_acknowledged: Type.Boolean(),

packages/shared-contracts/src/index.ts

@@ -1,5 +1,7 @@
 export { Type } from "@sinclair/typebox";
 export * from "./api.js";
+export * from "./admin.js";
+export * from "./services.js";
 export * from "./assets.js";
 export * from "./auth.js";
 export * from "./bootstrap.js";

packages/shared-contracts/src/services.ts

@@ -0,0 +1,62 @@
+import { Type, type Static } from "@sinclair/typebox";
+
+const isoTimestampPattern = "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$";
+
+export const ExternalServiceIdSchema = Type.Union([
+  Type.Literal("resend_email"),
+  Type.Literal("amap_web_service"),
+], { $id: "ExternalServiceId" });
+
+export const ExternalServicePeriodTypeSchema = Type.Union([
+  Type.Literal("daily"),
+  Type.Literal("monthly"),
+], { $id: "ExternalServicePeriodType" });
+
+export const ExternalServiceStatusSchema = Type.Union([
+  Type.Literal("active"),
+  Type.Literal("paused_quota"),
+  Type.Literal("paused_provider"),
+  Type.Literal("disabled"),
+], { $id: "ExternalServiceStatus" });
+
+export const ExternalServiceUsageSchema = Type.Object({
+  service_id: Type.Ref(ExternalServiceIdSchema),
+  period_type: Type.Ref(ExternalServicePeriodTypeSchema),
+  period_start: Type.String({ pattern: isoTimestampPattern }),
+  hard_limit: Type.Integer({ minimum: 1 }),
+  used_count: Type.Integer({ minimum: 0 }),
+  service_status: Type.Ref(ExternalServiceStatusSchema),
+  pause_reason: Type.Union([Type.String({ maxLength: 120, pattern: "^[a-z0-9_.-]+$" }), Type.Null()]),
+  updated_at: Type.String({ pattern: isoTimestampPattern }),
+}, { additionalProperties: false, $id: "ExternalServiceUsage" });
+
+export const AdminServicesResponseSchema = Type.Object({
+  services: Type.Array(Type.Ref(ExternalServiceUsageSchema), { maxItems: 3 }),
+}, { additionalProperties: false, $id: "AdminServicesResponse" });
+
+export const AdminServiceLimitRequestSchema = Type.Object({
+  period_type: Type.Ref(ExternalServicePeriodTypeSchema),
+  hard_limit: Type.Integer({ minimum: 1 }),
+}, { additionalProperties: false, $id: "AdminServiceLimitRequest" });
+
+export const AdminServiceHealthCheckRequestSchema = Type.Object({
+  available: Type.Boolean(),
+  reason: Type.Optional(Type.String({ maxLength: 120, pattern: "^[a-zA-Z0-9_. -]+$" })),
+}, { additionalProperties: false, $id: "AdminServiceHealthCheckRequest" });
+
+export const AdminServiceRecoveryRequestSchema = Type.Object({
+  check_id: Type.String({ maxLength: 64, minLength: 1, pattern: "^[0-9a-fA-F-]+$" }),
+}, { additionalProperties: false, $id: "AdminServiceRecoveryRequest" });
+
+export const AdminServiceParamsSchema = Type.Object({
+  service_id: Type.Ref(ExternalServiceIdSchema),
+}, { additionalProperties: false, $id: "AdminServiceParams" });
+
+export type ExternalServiceId = Static<typeof ExternalServiceIdSchema>;
+export type ExternalServicePeriodType = Static<typeof ExternalServicePeriodTypeSchema>;
+export type ExternalServiceUsage = Static<typeof ExternalServiceUsageSchema>;
+export type AdminServicesResponse = Static<typeof AdminServicesResponseSchema>;
+export type AdminServiceLimitRequest = Static<typeof AdminServiceLimitRequestSchema>;
+export type AdminServiceHealthCheckRequest = Static<typeof AdminServiceHealthCheckRequestSchema>;
+export type AdminServiceRecoveryRequest = Static<typeof AdminServiceRecoveryRequestSchema>;
+export type AdminServiceParams = Static<typeof AdminServiceParamsSchema>;

packages/static-sticker-catalog/src/index.ts

@@ -16,8 +16,8 @@ export interface StaticStickerCatalogItem {
   relative_path: string;
   width: number;
   height: number;
-  mime_type: "image/png";
-  mime: "image/png";
+  mime_type: "image/png" | "image/webp";
+  mime: "image/png" | "image/webp";
   sha256: string;
   original_reference: string;
   thumbnail_reference: StaticStickerThumbnailReference;

packages/template-registry/src/index.ts

@@ -1,5 +1,8 @@
 import type { StaticStickerCatalog, StaticStickerCatalogItem } from "@dada/static-sticker-catalog";
 
+export const P0A_COMPLEX_RELEASE_VERSION = "p0a-complex-v1";
+export const P0A_STATIC_STICKER_RELEASE_VERSION = "p0a-static-v1";
+
 export const P0A_TEXT_TEMPLATE_IDS = [
   "FLOWER001", "FLOWER002", "FLOWER003", "FLOWER004", "FLOWER005", "FLOWER006", "FLOWER007", "FLOWER008",
   "H001", "H002", "H003", "H004", "H005", "H006", "H007", "H008",

playwright.wp4-07.config.ts

@@ -0,0 +1,26 @@
+import { defineConfig } from "@playwright/test";
+
+export default defineConfig({
+  forbidOnly: true,
+  fullyParallel: false,
+  outputDir: process.env.DADA_PLAYWRIGHT_OUTPUT_DIR ?? "test-results/wp4-07",
+  projects: [
+    { name: "chrome", use: { channel: "chrome" } },
+    { name: "edge", use: { channel: "msedge" } },
+  ],
+  reporter: "line",
+  retries: 0,
+  testDir: "./tests/e2e",
+  testMatch: "wp4-07-visual-performance.spec.ts",
+  timeout: 360_000,
+  use: {
+    deviceScaleFactor: 1,
+    headless: true,
+    launchOptions: { args: ["--enable-precise-memory-info", "--force-device-scale-factor=1"] },
+    locale: "zh-CN",
+    timezoneId: "Asia/Shanghai",
+    trace: "off",
+    viewport: { height: 1080, width: 1920 },
+  },
+  workers: 1,
+});

pnpm-lock.yaml

@@ -38,9 +38,15 @@ importers:
 
   apps/api:
     dependencies:
+      '@dada/asset-release-manifest':
+        specifier: workspace:*
+        version: link:../../packages/asset-release-manifest
       '@dada/shared-contracts':
         specifier: workspace:*
         version: link:../../packages/shared-contracts
+      '@dada/static-sticker-catalog':
+        specifier: workspace:*
+        version: link:../../packages/static-sticker-catalog
       '@fastify/multipart':
         specifier: 10.1.0
         version: 10.1.0
@@ -59,6 +65,9 @@ importers:
       fastify:
         specifier: 5.10.0
         version: 5.10.0
+      sharp:
+        specifier: 0.35.3
+        version: 0.35.3(@types/node@24.13.3)
     devDependencies:
       '@types/better-sqlite3':
         specifier: 7.6.13
@@ -124,6 +133,9 @@ importers:
       drizzle-orm:
         specifier: 0.45.2
         version: 0.45.2(@types/better-sqlite3@7.6.13)(better-sqlite3@13.0.1)
+      sharp:
+        specifier: 0.35.3
+        version: 0.35.3(@types/node@24.13.3)
     devDependencies:
       '@types/better-sqlite3':
         specifier: 7.6.13
@@ -151,6 +163,15 @@ importers:
         specifier: 7.0.2
         version: 7.0.2
 
+  packages/asset-release-manifest:
+    devDependencies:
+      '@types/node':
+        specifier: 24.13.3
+        version: 24.13.3
+      typescript:
+        specifier: 7.0.2
+        version: 7.0.2
+
   packages/asset-renderer:
     dependencies:
       '@dada/template-registry':
@@ -259,6 +280,168 @@ packages:
   '@fastify/swagger@9.8.1':
     resolution: {integrity: sha512-VpHMnqZTY8iBZYJE8WWkbKPrXIYWy2rDfIf5qLr6DzZSpQYZ+KxQVcJFiq/AMlvNwI4gCBd66++iUlxXXGT0IQ==}
 
+  '@img/colour@1.1.0':
+    resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
+    engines: {node: '>=18'}
+
+  '@img/sharp-darwin-arm64@0.35.3':
+    resolution: {integrity: sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-darwin-x64@0.35.3':
+    resolution: {integrity: sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-freebsd-wasm32@0.35.3':
+    resolution: {integrity: sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg==}
+    engines: {node: '>=20.9.0'}
+    os: [freebsd]
+
+  '@img/sharp-libvips-darwin-arm64@1.3.2':
+    resolution: {integrity: sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-libvips-darwin-x64@1.3.2':
+    resolution: {integrity: sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-libvips-linux-arm64@1.3.2':
+    resolution: {integrity: sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-arm@1.3.2':
+    resolution: {integrity: sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-ppc64@1.3.2':
+    resolution: {integrity: sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-riscv64@1.3.2':
+    resolution: {integrity: sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-s390x@1.3.2':
+    resolution: {integrity: sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-x64@1.3.2':
+    resolution: {integrity: sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.2':
+    resolution: {integrity: sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-libvips-linuxmusl-x64@1.3.2':
+    resolution: {integrity: sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-linux-arm64@0.35.3':
+    resolution: {integrity: sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-arm@0.35.3':
+    resolution: {integrity: sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-ppc64@0.35.3':
+    resolution: {integrity: sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-riscv64@0.35.3':
+    resolution: {integrity: sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ==}
+    engines: {node: '>=20.9.0'}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-s390x@0.35.3':
+    resolution: {integrity: sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw==}
+    engines: {node: '>=20.9.0'}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-x64@0.35.3':
+    resolution: {integrity: sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linuxmusl-arm64@0.35.3':
+    resolution: {integrity: sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-linuxmusl-x64@0.35.3':
+    resolution: {integrity: sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-wasm32@0.35.3':
+    resolution: {integrity: sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w==}
+    engines: {node: '>=20.9.0'}
+
+  '@img/sharp-webcontainers-wasm32@0.35.3':
+    resolution: {integrity: sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q==}
+    engines: {node: '>=20.9.0'}
+    cpu: [wasm32]
+
+  '@img/sharp-win32-arm64@0.35.3':
+    resolution: {integrity: sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@img/sharp-win32-ia32@0.35.3':
+    resolution: {integrity: sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw==}
+    engines: {node: ^20.9.0}
+    cpu: [ia32]
+    os: [win32]
+
+  '@img/sharp-win32-x64@0.35.3':
+    resolution: {integrity: sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [win32]
+
   '@jridgewell/sourcemap-codec@1.5.5':
     resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
 
@@ -1199,6 +1382,15 @@ packages:
   set-cookie-parser@2.7.2:
     resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
 
+  sharp@0.35.3:
+    resolution: {integrity: sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==}
+    engines: {node: '>=20.9.0'}
+    peerDependencies:
+      '@types/node': '*'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
   siginfo@2.0.0:
     resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
 
@@ -1531,6 +1723,112 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@img/colour@1.1.0': {}
+
+  '@img/sharp-darwin-arm64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-arm64': 1.3.2
+    optional: true
+
+  '@img/sharp-darwin-x64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-x64': 1.3.2
+    optional: true
+
+  '@img/sharp-freebsd-wasm32@0.35.3':
+    dependencies:
+      '@img/sharp-wasm32': 0.35.3
+    optional: true
+
+  '@img/sharp-libvips-darwin-arm64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-darwin-x64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-ppc64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-riscv64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-s390x@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linux-x64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.2':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-x64@1.3.2':
+    optional: true
+
+  '@img/sharp-linux-arm64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm64': 1.3.2
+    optional: true
+
+  '@img/sharp-linux-arm@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm': 1.3.2
+    optional: true
+
+  '@img/sharp-linux-ppc64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-ppc64': 1.3.2
+    optional: true
+
+  '@img/sharp-linux-riscv64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-riscv64': 1.3.2
+    optional: true
+
+  '@img/sharp-linux-s390x@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-s390x': 1.3.2
+    optional: true
+
+  '@img/sharp-linux-x64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-x64': 1.3.2
+    optional: true
+
+  '@img/sharp-linuxmusl-arm64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.2
+    optional: true
+
+  '@img/sharp-linuxmusl-x64@0.35.3':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.2
+    optional: true
+
+  '@img/sharp-wasm32@0.35.3':
+    dependencies:
+      '@emnapi/runtime': 1.11.1
+    optional: true
+
+  '@img/sharp-webcontainers-wasm32@0.35.3':
+    dependencies:
+      '@img/sharp-wasm32': 0.35.3
+    optional: true
+
+  '@img/sharp-win32-arm64@0.35.3':
+    optional: true
+
+  '@img/sharp-win32-ia32@0.35.3':
+    optional: true
+
+  '@img/sharp-win32-x64@0.35.3':
+    optional: true
+
   '@jridgewell/sourcemap-codec@1.5.5': {}
 
   '@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
@@ -2321,6 +2619,39 @@ snapshots:
 
   set-cookie-parser@2.7.2: {}
 
+  sharp@0.35.3(@types/node@24.13.3):
+    dependencies:
+      '@img/colour': 1.1.0
+      detect-libc: 2.1.2
+      semver: 7.8.5
+    optionalDependencies:
+      '@img/sharp-darwin-arm64': 0.35.3
+      '@img/sharp-darwin-x64': 0.35.3
+      '@img/sharp-freebsd-wasm32': 0.35.3
+      '@img/sharp-libvips-darwin-arm64': 1.3.2
+      '@img/sharp-libvips-darwin-x64': 1.3.2
+      '@img/sharp-libvips-linux-arm': 1.3.2
+      '@img/sharp-libvips-linux-arm64': 1.3.2
+      '@img/sharp-libvips-linux-ppc64': 1.3.2
+      '@img/sharp-libvips-linux-riscv64': 1.3.2
+      '@img/sharp-libvips-linux-s390x': 1.3.2
+      '@img/sharp-libvips-linux-x64': 1.3.2
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.2
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.2
+      '@img/sharp-linux-arm': 0.35.3
+      '@img/sharp-linux-arm64': 0.35.3
+      '@img/sharp-linux-ppc64': 0.35.3
+      '@img/sharp-linux-riscv64': 0.35.3
+      '@img/sharp-linux-s390x': 0.35.3
+      '@img/sharp-linux-x64': 0.35.3
+      '@img/sharp-linuxmusl-arm64': 0.35.3
+      '@img/sharp-linuxmusl-x64': 0.35.3
+      '@img/sharp-webcontainers-wasm32': 0.35.3
+      '@img/sharp-win32-arm64': 0.35.3
+      '@img/sharp-win32-ia32': 0.35.3
+      '@img/sharp-win32-x64': 0.35.3
+      '@types/node': 24.13.3
+
   siginfo@2.0.0: {}
 
   simple-concat@1.0.1:

scripts/aggregate-wp4-07-performance.mjs

@@ -0,0 +1,80 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { WP4_07_PERFORMANCE_BUDGETS } from "../tests/visual-performance/wp4-07-fixture.mjs";
+
+const evidenceIndex = process.argv.indexOf("--evidence");
+const phaseIndex = process.argv.indexOf("--phase");
+const evidenceDirectory = resolve(evidenceIndex >= 0 ? process.argv[evidenceIndex + 1] : "");
+const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
+if (evidenceIndex < 0 || !process.argv[evidenceIndex + 1] || !["green", "red"].includes(phase)) throw new Error("Usage: --evidence <directory> [--phase red|green]");
+
+function read(browser, filename) {
+  const path = resolve(evidenceDirectory, browser, filename);
+  if (!existsSync(path)) throw new Error(`missing ${browser}/${filename}`);
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+
+const browserResults = {};
+let greenInputsEligible = true;
+for (const browser of ["chrome", "edge"]) {
+  const raw = read(browser, "performance-raw.json");
+  const memory = read(browser, "memory.json");
+  const dom = read(browser, "dom-count.json");
+  const environment = read(browser, "environment.json");
+  greenInputsEligible = greenInputsEligible && raw.eligible_for_green === true && raw.harness_mode === "real_archive";
+  if (raw.interaction.length !== 5 || raw.autosave_serialization.length !== 5 || raw.export_1080x1920.length !== 5 || raw.editor_reopen.samples_ms.length !== 5) {
+    throw new Error(`${browser} did not retain exactly five measured samples per budget`);
+  }
+  if (raw.interaction.some((run) => run.duration_ms < WP4_07_PERFORMANCE_BUDGETS.interaction_duration_ms)) {
+    throw new Error(`${browser} shortened a ten-second interaction measurement`);
+  }
+  const checks = {
+    autosave_serialization: raw.autosave_serialization.every((run) => run.p95_ms <= WP4_07_PERFORMANCE_BUDGETS.autosave_serialization_p95_ms_max),
+    canvas_frame: raw.interaction.every((run) => run.frame_p95_ms <= WP4_07_PERFORMANCE_BUDGETS.canvas_frame_p95_ms_max),
+    continuous_unresponsive: raw.interaction.every((run) => run.frame_max_ms < WP4_07_PERFORMANCE_BUDGETS.continuous_unresponsive_ms_max_exclusive),
+    dom_bounded: dom.bounded_by_viewport_and_two_screens === true && dom.top_count < dom.catalog_count && dom.bottom_count < dom.catalog_count,
+    editor_reopen: raw.editor_reopen.max_ms <= WP4_07_PERFORMANCE_BUDGETS.editor_reopen_ms_max,
+    export_duration: raw.export_1080x1920.every((run) => run.duration_ms <= WP4_07_PERFORMANCE_BUDGETS.export_1080x1920_ms_max),
+    export_failure_isolated: raw.export_failure.observed_error === "export_asset_unavailable"
+      && JSON.stringify(raw.export_failure.saves_before) === JSON.stringify(raw.export_failure.saves_after),
+    export_memory: memory.export_peak_additional_bytes.every((value) => value <= WP4_07_PERFORMANCE_BUDGETS.export_peak_additional_bytes_max),
+    long_task: raw.interaction.every((run) => run.long_task_max_ms <= WP4_07_PERFORMANCE_BUDGETS.long_task_ms_max),
+    pointer_to_frame: raw.interaction.every((run) => run.pointer_to_frame_p95_ms <= WP4_07_PERFORMANCE_BUDGETS.pointer_to_frame_p95_ms_max),
+  };
+  browserResults[browser] = {
+    checks,
+    environment,
+    fixture_sha256: raw.fixture_sha256,
+    metrics: {
+      autosave_serialization: raw.autosave_serialization,
+      editor_reopen: raw.editor_reopen,
+      export_1080x1920: raw.export_1080x1920,
+      interaction: raw.interaction,
+    },
+    status: Object.values(checks).every(Boolean) ? "within_budget" : "budget_exceeded",
+  };
+}
+const passed = Object.values(browserResults).every((result) => result.status === "within_budget");
+const report = {
+  browsers: browserResults,
+  eligible_for_green: phase === "green" && greenInputsEligible,
+  normative_budgets: WP4_07_PERFORMANCE_BUDGETS,
+  phase,
+  status: passed ? "within_budget" : "budget_exceeded",
+};
+writeFileSync(resolve(evidenceDirectory, "performance.json"), `${JSON.stringify(report, null, 2)}\n`);
+writeFileSync(resolve(evidenceDirectory, "memory.json"), `${JSON.stringify({
+  browsers: Object.fromEntries(["chrome", "edge"].map((browser) => [browser, read(browser, "memory.json")])),
+  limit_bytes: WP4_07_PERFORMANCE_BUDGETS.export_peak_additional_bytes_max,
+}, null, 2)}\n`);
+writeFileSync(resolve(evidenceDirectory, "dom-count.json"), `${JSON.stringify({
+  browsers: Object.fromEntries(["chrome", "edge"].map((browser) => [browser, read(browser, "dom-count.json")])),
+  required_catalog_count: 1_407,
+}, null, 2)}\n`);
+writeFileSync(resolve(evidenceDirectory, "environment.json"), `${JSON.stringify({
+  browsers: Object.fromEntries(["chrome", "edge"].map((browser) => [browser, read(browser, "environment.json")])),
+  fixture_hashes_match: browserResults.chrome.fixture_sha256 === browserResults.edge.fixture_sha256,
+}, null, 2)}\n`);
+console.log(JSON.stringify({ browser_statuses: Object.fromEntries(Object.entries(browserResults).map(([name, result]) => [name, result.status])), phase, status: report.status }, null, 2));
+if (phase === "green" && (!greenInputsEligible || !passed)) process.exit(1);

scripts/compare-wp4-07-screenshots.mjs

@@ -0,0 +1,106 @@
+import { chromium } from "@playwright/test";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+import { WP4_07_VISUAL_THRESHOLDS } from "../tests/visual-performance/wp4-07-fixture.mjs";
+
+const evidenceIndex = process.argv.indexOf("--evidence");
+const phaseIndex = process.argv.indexOf("--phase");
+const evidenceDirectory = resolve(evidenceIndex >= 0 ? process.argv[evidenceIndex + 1] : "");
+const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
+if (evidenceIndex < 0 || !process.argv[evidenceIndex + 1] || !["green", "red"].includes(phase)) throw new Error("Usage: --evidence <directory> [--phase red|green]");
+
+const scenarios = ["editor.png", "canvas.png", "export-dialog.png"];
+for (const scenario of scenarios) {
+  for (const browser of ["chrome", "edge"]) {
+    const path = resolve(evidenceDirectory, browser, scenario);
+    if (!existsSync(path)) throw new Error(`missing screenshot: ${browser}/${scenario}`);
+  }
+}
+
+const browser = await chromium.launch({ channel: "msedge", headless: true });
+const page = await browser.newPage();
+const results = [];
+try {
+  for (const scenario of scenarios) {
+    const chrome = readFileSync(resolve(evidenceDirectory, "chrome", scenario)).toString("base64");
+    const edge = readFileSync(resolve(evidenceDirectory, "edge", scenario)).toString("base64");
+    const comparison = await page.evaluate(async ({ chromeBase64, edgeBase64, threshold }) => {
+      const decode = async (base64) => {
+        const binary = atob(base64);
+        const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+        return createImageBitmap(new Blob([bytes], { type: "image/png" }));
+      };
+      const [chromeImage, edgeImage] = await Promise.all([decode(chromeBase64), decode(edgeBase64)]);
+      if (chromeImage.width !== edgeImage.width || chromeImage.height !== edgeImage.height) {
+        return { dimensions_match: false, chrome: { height: chromeImage.height, width: chromeImage.width }, edge: { height: edgeImage.height, width: edgeImage.width } };
+      }
+      const surface = new OffscreenCanvas(chromeImage.width, chromeImage.height);
+      const context = surface.getContext("2d", { willReadFrequently: true });
+      context.drawImage(chromeImage, 0, 0);
+      const chromePixels = context.getImageData(0, 0, chromeImage.width, chromeImage.height).data;
+      context.clearRect(0, 0, chromeImage.width, chromeImage.height);
+      context.drawImage(edgeImage, 0, 0);
+      const edgePixels = context.getImageData(0, 0, edgeImage.width, edgeImage.height).data;
+      let significant = 0;
+      let maximumChannelDelta = 0;
+      for (let index = 0; index < chromePixels.length; index += 4) {
+        const deltas = [0, 1, 2, 3].map((channel) => Math.abs(chromePixels[index + channel] - edgePixels[index + channel]));
+        maximumChannelDelta = Math.max(maximumChannelDelta, ...deltas);
+        if (deltas.some((delta) => delta > threshold)) significant += 1;
+      }
+      const total = chromeImage.width * chromeImage.height;
+      chromeImage.close();
+      edgeImage.close();
+      return {
+        dimensions_match: true,
+        height: surface.height,
+        maximum_channel_delta: maximumChannelDelta,
+        significant_pixel_count: significant,
+        significant_pixel_ratio: significant / total,
+        significant_pixel_threshold: threshold,
+        total_pixels: total,
+        width: surface.width,
+      };
+    }, { chromeBase64: chrome, edgeBase64: edge, threshold: WP4_07_VISUAL_THRESHOLDS.channel_delta_significant });
+    results.push({ scenario, ...comparison });
+  }
+} finally {
+  await browser.close();
+}
+
+const chromeLayout = JSON.parse(readFileSync(resolve(evidenceDirectory, "chrome", "layout-boxes.json"), "utf8"));
+const edgeLayout = JSON.parse(readFileSync(resolve(evidenceDirectory, "edge", "layout-boxes.json"), "utf8"));
+const greenInputsEligible = [chromeLayout, edgeLayout].every((input) => input.eligible_for_green === true && input.harness_mode === "real_archive");
+const layoutComparisons = Object.keys(chromeLayout.layout_boxes).map((name) => {
+  const chromeBox = chromeLayout.layout_boxes[name];
+  const edgeBox = edgeLayout.layout_boxes[name];
+  const deltas = Object.fromEntries(["height", "width", "x", "y"].map((field) => [field, Math.abs(chromeBox[field] - edgeBox[field])]));
+  return { deltas, maximum_delta_px: Math.max(...Object.values(deltas)), name };
+});
+const visualPassed = results.every((item) => item.dimensions_match && item.significant_pixel_ratio <= WP4_07_VISUAL_THRESHOLDS.significant_pixel_ratio_max);
+const layoutPassed = layoutComparisons.every((item) => item.maximum_delta_px <= WP4_07_VISUAL_THRESHOLDS.boundary_delta_px_max);
+const overall = {
+  eligible_for_green: phase === "green" && greenInputsEligible,
+  phase,
+  scenarios: results,
+  status: visualPassed && layoutPassed ? "within_threshold" : "threshold_exceeded_manual_review_required",
+  thresholds: WP4_07_VISUAL_THRESHOLDS,
+};
+const layout = {
+  comparisons: layoutComparisons,
+  eligible_for_green: phase === "green" && greenInputsEligible,
+  status: layoutPassed ? "within_threshold" : "threshold_exceeded_manual_review_required",
+  threshold_px: WP4_07_VISUAL_THRESHOLDS.boundary_delta_px_max,
+};
+mkdirSync(dirname(resolve(evidenceDirectory, "pixel-diff.json")), { recursive: true });
+writeFileSync(resolve(evidenceDirectory, "pixel-diff.json"), `${JSON.stringify(overall, null, 2)}\n`);
+writeFileSync(resolve(evidenceDirectory, "layout-boxes.json"), `${JSON.stringify(layout, null, 2)}\n`);
+writeFileSync(resolve(evidenceDirectory, "manual-review.json"), `${JSON.stringify({
+  eligible_for_green: false,
+  known_alternatives: ["COLOR002", "COLOR008", "COLOR016", "DYN012"],
+  required_note: "DYN012 uses FONT081 Lexend Deca as the declared substitute.",
+  status: phase === "green" ? "pending_project_owner_review" : "pending_wp5_final_renderer_and_project_owner_review",
+}, null, 2)}\n`);
+console.log(JSON.stringify({ layout_status: layout.status, phase, visual_status: overall.status }, null, 2));
+if (phase === "green" && (!greenInputsEligible || !visualPassed || !layoutPassed)) process.exit(1);

scripts/compile-wp5-03-assets.mjs

@@ -7,8 +7,10 @@ import { compileAssetArchive, compileStaticStickerCatalog } from "../packages/as
 import { createP0aColorCardRenderPlans } from "../packages/asset-renderer/dist/index.js";
 import {
   P0A_COLOR_CARD_IDS,
+  P0A_COMPLEX_RELEASE_VERSION,
   P0A_DYNAMIC_STICKER_IDS,
   P0A_REQUIRED_FONT_PANEL_IDS,
+  P0A_STATIC_STICKER_RELEASE_VERSION,
   P0A_TEXT_TEMPLATE_IDS,
   createP0aPublicManifest,
 } from "../packages/template-registry/dist/index.js";
@@ -29,12 +31,12 @@ mkdirSync(colorDirectory, { recursive: true });
 const complex = compileAssetArchive({
   manifestPath: handoffManifest,
   outputDirectory: complexDirectory,
-  releaseVersion: "p0a-complex-v1",
+  releaseVersion: P0A_COMPLEX_RELEASE_VERSION,
 });
 const staticResult = compileStaticStickerCatalog({
   expectedCount: 1_407,
   outputDirectory: staticDirectory,
-  releaseVersion: "p0a-static-v1",
+  releaseVersion: P0A_STATIC_STICKER_RELEASE_VERSION,
   sourceRoot: stickerRoot,
 });
 const publicManifest = createP0aPublicManifest({

scripts/frozen-versions.mjs

@@ -26,12 +26,15 @@ export const frozenPackages = {
   },
   "apps/api/package.json": {
     dependencies: {
+      "@dada/asset-release-manifest": "workspace:*",
+      "@dada/static-sticker-catalog": "workspace:*",
       "@fastify/multipart": "10.1.0",
       "@fastify/swagger": "9.8.1",
       "@sinclair/typebox": "0.34.52",
       "better-sqlite3": "13.0.1",
       "drizzle-orm": "0.45.2",
       fastify: "5.10.0",
+      sharp: "0.35.3",
     },
     devDependencies: {
       typescript: "7.0.2",
@@ -41,11 +44,18 @@ export const frozenPackages = {
     dependencies: {
       "better-sqlite3": "13.0.1",
       "drizzle-orm": "0.45.2",
+      sharp: "0.35.3",
     },
     devDependencies: {
       typescript: "7.0.2",
     },
   },
+  "packages/asset-release-manifest/package.json": {
+    devDependencies: {
+      "@types/node": "24.13.3",
+      typescript: "7.0.2",
+    },
+  },
   "packages/shared-contracts/package.json": {
     dependencies: {
       "@sinclair/typebox": "0.34.52",

scripts/lib/openapi.mjs

@@ -13,8 +13,7 @@ function runPnpm(args) {
 }
 
 export function buildApiContracts() {
-  runPnpm(["--filter", "@dada/shared-contracts", "build"]);
-  runPnpm(["--filter", "@dada/api", "build"]);
+  runPnpm(["--filter", "@dada/api...", "build"]);
 }
 
 export async function createOpenApiDocument() {

scripts/lib/portable-package.mjs

@@ -98,7 +98,11 @@ function copyRuntimeDependencies(sourceRoot, destinationRoot, rootNames) {
     try {
       entry = requireFrom.resolve(name);
     } catch (error) {
-      throw new Error(`Runtime dependency ${name} is unavailable from ${sourceRoot}.`, { cause: error });
+      try {
+        entry = requireFrom.resolve(`${name}/package`);
+      } catch {
+        throw new Error(`Runtime dependency ${name} is unavailable from ${sourceRoot}.`, { cause: error });
+      }
     }
     const root = packageRootFromEntry(entry, name);
     const manifest = json(join(root, "package.json"));
@@ -117,6 +121,14 @@ function copyRuntimeDependencies(sourceRoot, destinationRoot, rootNames) {
     for (const dependency of Object.keys(manifest.dependencies ?? {})) {
       copyResolved(dependency, nestedRequire, join(destination, "node_modules"), nestedAncestors);
     }
+    for (const dependency of Object.keys(manifest.optionalDependencies ?? {})) {
+      try {
+        copyResolved(dependency, nestedRequire, join(destination, "node_modules"), nestedAncestors);
+      } catch (error) {
+        if (error?.cause?.code !== "MODULE_NOT_FOUND") throw error;
+        debug(`skip unavailable optional dependency ${dependency}`);
+      }
+    }
   }
   const rootRequire = createRequire(join(sourceRoot, "package.json"));
   for (const name of rootNames) copyResolved(name, rootRequire, join(destinationRoot, "node_modules"), new Set());
@@ -306,7 +318,7 @@ export async function buildAndValidatePortablePackage({ evidenceDirectory, outpu
 
   const serverRoot = join(packageDirectory, "server");
   debug("copy API application");
-  const apiDependencies = copyApplication(join(repositoryRoot, "apps", "api"), join(serverRoot, "api"), ["@fastify/multipart", "@fastify/swagger", "@sinclair/typebox", "better-sqlite3", "fastify"]);
+  const apiDependencies = copyApplication(join(repositoryRoot, "apps", "api"), join(serverRoot, "api"), ["@fastify/multipart", "@fastify/swagger", "@sinclair/typebox", "better-sqlite3", "fastify", "sharp"]);
   debug("copy Worker application");
   const workerDependencies = copyApplication(join(repositoryRoot, "apps", "worker"), join(serverRoot, "worker"), ["better-sqlite3"]);
   const sharedDestination = join(serverRoot, "api", "node_modules", "@dada", "shared-contracts");

scripts/lib/release-candidate.mjs

@@ -0,0 +1,179 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, join, resolve } from "node:path";
+
+import { buildAndValidatePortablePackage } from "./portable-package.mjs";
+
+const fixedPort = 43121;
+const versionPattern = /^\d+\.\d+\.\d+\.\d+$/;
+const sha256Pattern = /^[A-F0-9]{64}$/;
+
+function powershellJson(script) {
+  const result = spawnSync(
+    "powershell.exe",
+    ["-NoProfile", "-NonInteractive", "-Command", script],
+    { encoding: "utf8", windowsHide: true },
+  );
+  if (result.status !== 0) {
+    throw new Error(`Windows environment probe failed with exit code ${result.status ?? 1}.`);
+  }
+  return JSON.parse(result.stdout.trim());
+}
+
+export function readCandidateEnvironment() {
+  if (process.platform !== "win32" || process.arch !== "x64") {
+    throw new Error("Release candidates must be recorded on Windows x64.");
+  }
+  return powershellJson(String.raw`
+$ErrorActionPreference = 'Stop'
+function Find-Browser([string] $brand, [string] $fileName, [string[]] $candidates) {
+  $path = $candidates | Where-Object { $_ -and (Test-Path -LiteralPath $_) } | Select-Object -First 1
+  if (-not $path) { throw "Required browser is not installed: $brand" }
+  $item = Get-Item -LiteralPath $path
+  if ($item.VersionInfo.ProductName -ne $brand) { throw "Installed executable identity mismatch: $brand" }
+  $version = $item.VersionInfo.ProductVersion
+  [pscustomobject]@{
+    brand = $brand
+    executable_sha256 = (Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash
+    file_name = $fileName
+    full_version = $version
+    major = [int]($version.Split('.')[0])
+    product_name = $item.VersionInfo.ProductName
+    source = 'installed_executable'
+  }
+}
+$chromeRegistry = @(
+  (Get-ItemProperty 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe' -ErrorAction SilentlyContinue).'(default)',
+  (Get-ItemProperty 'Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe' -ErrorAction SilentlyContinue).'(default)'
+)
+$chrome = Find-Browser 'Google Chrome' 'chrome.exe' @(
+  (Join-Path $env:LOCALAPPDATA 'Google\Chrome\Application\chrome.exe'),
+  'C:\Program Files\Google\Chrome\Application\chrome.exe',
+  'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe',
+  $chromeRegistry[0],
+  $chromeRegistry[1]
+)
+$edge = Find-Browser 'Microsoft Edge' 'msedge.exe' @(
+  'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe',
+  'C:\Program Files\Microsoft\Edge\Application\msedge.exe'
+)
+$windows = Get-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
+[pscustomobject]@{
+  browsers = @($chrome, $edge)
+  windows = [pscustomobject]@{
+    arch = 'x64'
+    build = "$($windows.CurrentBuildNumber).$($windows.UBR)"
+    display_version = $windows.DisplayVersion
+  }
+} | ConvertTo-Json -Depth 5 -Compress
+`);
+}
+
+export function validateReleaseCandidateRecord(record) {
+  const errors = [];
+  if (record?.schema_version !== "1.0") errors.push("schema_version");
+  if (record?.status !== "candidate_unvalidated") errors.push("status");
+  if (record?.final_release !== false) errors.push("final_release");
+  if (record?.fixed_port !== fixedPort) errors.push("fixed_port");
+  if (!/^[a-f0-9]{40}$/.test(record?.build_commit ?? "")) errors.push("build_commit");
+  if (!/^\d+\.\d+$/.test(record?.windows?.build ?? "")) errors.push("windows.build");
+  if (!Number.isFinite(Date.parse(record?.recorded_at ?? ""))) errors.push("recorded_at");
+  if (!sha256Pattern.test(record?.candidate_package?.sha256 ?? "")) errors.push("candidate_package.sha256");
+  if (record?.candidate_package?.fixed_port !== fixedPort) errors.push("candidate_package.fixed_port");
+  if (record?.candidate_package?.release_status !== "candidate_unvalidated") {
+    errors.push("candidate_package.release_status");
+  }
+  if (!Array.isArray(record?.browsers) || record.browsers.length !== 2) {
+    errors.push("browsers");
+  } else {
+    const brands = record.browsers.map(({ brand }) => brand).sort();
+    if (brands.join("|") !== "Google Chrome|Microsoft Edge") errors.push("browsers.brand");
+    for (const browser of record.browsers) {
+      if (!versionPattern.test(browser.full_version ?? "")) errors.push(`${browser.brand}.full_version`);
+      if (browser.major !== Number.parseInt(browser.full_version?.split(".")[0] ?? "", 10)) {
+        errors.push(`${browser.brand}.major`);
+      }
+      if (!sha256Pattern.test(browser.executable_sha256 ?? "")) errors.push(`${browser.brand}.sha256`);
+      if (browser.source !== "installed_executable") errors.push(`${browser.brand}.source`);
+      if ("path" in browser || "executable_path" in browser) errors.push(`${browser.brand}.path`);
+    }
+  }
+  const serialized = JSON.stringify(record);
+  if (/[A-Za-z]:\\Users\\/i.test(serialized)) errors.push("absolute_user_path");
+  if (errors.length > 0) throw new Error(`Invalid release candidate record: ${[...new Set(errors)].join(", ")}`);
+  return record;
+}
+
+function sha256(path) {
+  return createHash("sha256").update(readFileSync(path)).digest("hex").toUpperCase();
+}
+
+export async function createReleaseCandidate({ commit, evidenceRoot, outputRoot, recordedAt = new Date().toISOString() }) {
+  const environment = readCandidateEnvironment();
+  const packageResult = await buildAndValidatePortablePackage({ outputRoot });
+  const packageName = packageResult.packageManifest.package_name;
+  const packageDirectory = join(outputRoot, packageName);
+  const zipSource = join(outputRoot, `${packageName}.zip`);
+  const shaSource = `${zipSource}.sha256`;
+  const zipSha256 = sha256(zipSource);
+  if (zipSha256 !== packageResult.packageManifest.zip_sha256) {
+    throw new Error("Candidate ZIP hash does not match the package manifest.");
+  }
+  if (!readFileSync(shaSource, "utf8").startsWith(`${zipSha256}  ${basename(zipSource)}`)) {
+    throw new Error("Candidate ZIP hash file does not match the package bytes.");
+  }
+  const candidatePackage = resolve(evidenceRoot, "candidate-package");
+  mkdirSync(candidatePackage, { recursive: true });
+  for (const source of [zipSource, shaSource, join(packageDirectory, "START-HERE.txt")]) {
+    if (!existsSync(source)) throw new Error(`Candidate package output is missing: ${basename(source)}`);
+    copyFileSync(source, join(candidatePackage, basename(source)));
+  }
+  writeFileSync(
+    join(candidatePackage, "package-manifest.json"),
+    `${JSON.stringify(packageResult.packageManifest, null, 2)}\n`,
+  );
+  writeFileSync(
+    join(candidatePackage, "package-scan.json"),
+    `${JSON.stringify(packageResult.packageScan, null, 2)}\n`,
+  );
+  writeFileSync(
+    join(candidatePackage, "process-tree.json"),
+    `${JSON.stringify(packageResult.processTree, null, 2)}\n`,
+  );
+
+  const record = validateReleaseCandidateRecord({
+    app_version: packageResult.packageManifest.app_version,
+    browsers: environment.browsers.map((browser) => ({
+      brand: browser.brand,
+      executable_sha256: browser.executable_sha256,
+      file_name: browser.file_name,
+      full_version: browser.full_version,
+      major: browser.major,
+      source: browser.source,
+    })),
+    build_commit: commit,
+    candidate_package: {
+      file_name: basename(zipSource),
+      fixed_port: packageResult.packageManifest.fixed_port,
+      release_status: packageResult.packageManifest.release_status,
+      sha256: zipSha256,
+      size_bytes: statSync(zipSource).size,
+    },
+    final_release: false,
+    fixed_port: fixedPort,
+    recorded_at: recordedAt,
+    schema_version: "1.0",
+    status: "candidate_unvalidated",
+    windows: environment.windows,
+  });
+  writeFileSync(resolve(evidenceRoot, "release-candidate.json"), `${JSON.stringify(record, null, 2)}\n`);
+  return { packageResult, record };
+}

scripts/lib/wp4-07-gate.mjs

@@ -0,0 +1,125 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+
+import {
+  WP4_07_REAL_RESOURCE_VERSIONS,
+  WP4_07_RED_RESOURCE_VERSION,
+  WP4_07_SOURCE_HASHES,
+  assertWp407Fixture,
+} from "../../tests/visual-performance/wp4-07-fixture.mjs";
+
+export const WP4_07_REQUIRED_WP5_TASKS = Object.freeze(
+  Array.from({ length: 7 }, (_, index) => `TASK-WP5-0${index + 1}`),
+);
+export const WP4_07_REQUIRED_WP5_BRANCHES = Object.freeze(
+  Array.from({ length: 5 }, (_, index) => `codex/wp5-0${index + 3}`),
+);
+
+export function validateWp407FrozenInputs() {
+  const mismatches = [];
+  for (const [path, expected] of Object.entries(WP4_07_SOURCE_HASHES)) {
+    if (!existsSync(path)) {
+      mismatches.push({ actual: null, expected, path });
+      continue;
+    }
+    const actual = createHash("sha256").update(readFileSync(path)).digest("hex").toUpperCase();
+    if (actual !== expected) mismatches.push({ actual, expected, path });
+  }
+  if (mismatches.length > 0) {
+    const error = new Error("WP4_07_FROZEN_SOURCE_CHANGED");
+    error.details = mismatches;
+    throw error;
+  }
+  return assertWp407Fixture();
+}
+
+function subjectMatchesTask(subject, taskId) {
+  const shortId = taskId.replace("TASK-", "");
+  return subject.includes(taskId) || subject.includes(shortId);
+}
+
+export function inspectWp5TaskLineage(heads, histories) {
+  const candidate_branch = [...WP4_07_REQUIRED_WP5_TASKS]
+    .reverse()
+    .map((taskId) => taskId.replace("TASK-WP5-", "codex/wp5-"))
+    .find((branch) => /^[0-9a-f]{40}$/.test(heads[branch] ?? "")) ?? null;
+  const allCommits = Object.values(histories).flat();
+  const task_shas = Object.fromEntries(WP4_07_REQUIRED_WP5_TASKS.flatMap((taskId) => {
+    const commit = allCommits.find((entry) => subjectMatchesTask(entry.subject, taskId));
+    return commit && /^[0-9a-f]{40}$/.test(commit.sha) ? [[taskId, commit.sha]] : [];
+  }));
+  const missing_tasks = WP4_07_REQUIRED_WP5_TASKS.filter((taskId) => {
+    const taskNumber = Number(taskId.slice(-2));
+    if (taskNumber <= 2) return !task_shas[taskId];
+    const branch = taskId.replace("TASK-WP5-", "codex/wp5-");
+    return !/^[0-9a-f]{40}$/.test(heads[branch] ?? "")
+      || !(histories[branch] ?? []).some((entry) => subjectMatchesTask(entry.subject, taskId));
+  });
+  const terminal_branch_shas = Object.fromEntries(WP4_07_REQUIRED_WP5_BRANCHES.flatMap((branch) => (
+    /^[0-9a-f]{40}$/.test(heads[branch] ?? "") ? [[branch, heads[branch]]] : []
+  )));
+  return {
+    candidate_baseline_branch: candidate_branch,
+    candidate_baseline_sha: candidate_branch ? heads[candidate_branch] : null,
+    complete: missing_tasks.length === 0 && Object.keys(terminal_branch_shas).length === WP4_07_REQUIRED_WP5_BRANCHES.length,
+    missing_tasks,
+    required_final_branches: WP4_07_REQUIRED_WP5_BRANCHES,
+    required_tasks: WP4_07_REQUIRED_WP5_TASKS,
+    task_shas,
+    terminal_branch_shas,
+  };
+}
+
+export function readWp5RemoteGate() {
+  const result = spawnSync("git", ["ls-remote", "--heads", "origin", "codex/wp5-*"], { encoding: "utf8", timeout: 30_000 });
+  if ((result.status ?? 1) !== 0) {
+    const error = new Error("WP4_07_GITEA_GATE_UNREADABLE");
+    error.details = { exit_code: result.status ?? 1 };
+    throw error;
+  }
+  const heads = Object.fromEntries(result.stdout.trim().split(/\r?\n/).filter(Boolean).map((line) => {
+    const [sha, reference] = line.split(/\s+/);
+    return [reference.replace("refs/heads/", ""), sha];
+  }));
+  const histories = {};
+  for (const branch of WP4_07_REQUIRED_WP5_BRANCHES.filter((name) => /^[0-9a-f]{40}$/.test(heads[name] ?? ""))) {
+    const fetch = spawnSync("git", ["fetch", "--quiet", "--no-tags", "origin", `refs/heads/${branch}`], { encoding: "utf8", timeout: 60_000 });
+    if ((fetch.status ?? 1) !== 0) {
+      const error = new Error("WP4_07_GITEA_BASELINE_FETCH_FAILED");
+      error.details = { branch, exit_code: fetch.status ?? 1 };
+      throw error;
+    }
+    const log = spawnSync("git", ["log", "--format=%H%x09%s", heads[branch]], { encoding: "utf8", timeout: 30_000 });
+    if ((log.status ?? 1) !== 0) {
+      const error = new Error("WP4_07_GITEA_BASELINE_HISTORY_UNREADABLE");
+      error.details = { branch, exit_code: log.status ?? 1 };
+      throw error;
+    }
+    histories[branch] = log.stdout.trim().split(/\r?\n/).filter(Boolean).map((line) => {
+      const separator = line.indexOf("\t");
+      return { sha: line.slice(0, separator), subject: line.slice(separator + 1) };
+    });
+  }
+  return {
+    heads,
+    ...inspectWp5TaskLineage(heads, histories),
+  };
+}
+
+export function validateWp5FinalManifest(path) {
+  if (!path || !existsSync(path)) throw new Error("WP4_07_FINAL_ASSET_MANIFEST_REQUIRED");
+  const raw = readFileSync(path, "utf8");
+  if (raw.includes(WP4_07_RED_RESOURCE_VERSION) || raw.includes("fixture-v1")) throw new Error("WP4_07_PLACEHOLDER_ASSET_REJECTED");
+  const manifest = JSON.parse(raw);
+  const expectedCounts = { color_cards: 4, dynamic_stickers: 10, font_panel_items: 11, static_parts: 25, static_stickers: 1_407, text_templates: 32 };
+  for (const [key, expected] of Object.entries(expectedCounts)) {
+    if (manifest.counts?.[key] !== expected) throw new Error(`WP4_07_FINAL_MANIFEST_COUNT_MISMATCH:${key}`);
+  }
+  if (!manifest.release_version || String(manifest.release_version).includes("fixture")) throw new Error("WP4_07_FINAL_RELEASE_VERSION_REQUIRED");
+  if (manifest.source_versions?.complex !== WP4_07_REAL_RESOURCE_VERSIONS.complex
+    || manifest.source_versions?.static_stickers !== WP4_07_REAL_RESOURCE_VERSIONS.static) {
+    throw new Error("WP4_07_FINAL_MANIFEST_VERSION_MISMATCH");
+  }
+  return { release_version: manifest.release_version, sha256: createHash("sha256").update(raw).digest("hex").toUpperCase() };
+}

scripts/lib/wp7-02-controlled-executor.mjs

@@ -0,0 +1,418 @@
+import { createHash } from "node:crypto";
+
+import {
+  gptImageRequestSizeForRatio,
+  normalizeImageOutputToRatio,
+} from "../../apps/worker/src/image-output-normalizer.mjs";
+import { WP7_02_MODEL_IDS, buildModelContractPlan } from "./wp7-02-external-contract.mjs";
+
+export const WP7_02_CONTROLLED_REAL_LIMIT = 120;
+
+const ratios = ["3:4", "1:1", "4:3", "9:16"];
+const allowedMimeTypes = new Set(["image/jpeg", "image/png", "image/webp"]);
+const forbiddenEvidenceKeys = /(?:^|_)(?:absolute_path|authorization|body|credential|credential_value|image_bytes|image_data|original_image|password|path|prompt|raw|raw_provider_payload|raw_prompt|secret|token)(?:_|$)/i;
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex").toUpperCase();
+}
+
+function assertModelConfig(modelConfig) {
+  if (!modelConfig || typeof modelConfig !== "object" || !WP7_02_MODEL_IDS.includes(modelConfig.model_id)) {
+    throw new Error("WP7_02_MODEL_CONFIG_INVALID");
+  }
+  if (!Number.isSafeInteger(modelConfig.config_version) || modelConfig.config_version <= 0) {
+    throw new Error("WP7_02_MODEL_CONFIG_VERSION_INVALID");
+  }
+  const profile = modelConfig.route_profile;
+  if (!profile || typeof profile !== "object" || typeof profile.endpoint !== "string"
+    || !profile.endpoint.startsWith("https://oneapi.intelligrow.cn/")
+    || !["gemini-interactions-v1beta", "gemini-native-v1beta", "gemini-openai-chat-v1", "openai-images-v1"].includes(profile.protocol_version)) {
+    throw new Error("WP7_02_ROUTE_PROFILE_INVALID");
+  }
+  if (profile.protocol_version === "gemini-interactions-v1beta"
+    && (profile.endpoint !== "https://oneapi.intelligrow.cn/v1beta/interactions"
+      || profile.provider_model_id !== "gemini-3.1-flash-image")) {
+    throw new Error("WP7_02_ROUTE_PROFILE_INVALID");
+  }
+  if (profile.protocol_version === "gemini-openai-chat-v1"
+    && (profile.endpoint !== "https://oneapi.intelligrow.cn/v1/chat/completions"
+      || profile.provider_model_id !== "gemini-3.1-flash-image")) {
+    throw new Error("WP7_02_ROUTE_PROFILE_INVALID");
+  }
+  if (profile.protocol_version === "openai-images-v1"
+    && (profile.reference_endpoint !== "https://oneapi.intelligrow.cn/v1/images/edits")) {
+    throw new Error("WP7_02_REFERENCE_ROUTE_PROFILE_INVALID");
+  }
+  if (profile.protocol_version === "openai-images-v1" && profile.provider_model_id !== undefined
+    && profile.provider_model_id !== "gemini-3.1-flash-image") {
+    throw new Error("WP7_02_ROUTE_PROFILE_INVALID");
+  }
+  return modelConfig;
+}
+
+export function buildControlledExecutionPlan(modelConfig) {
+  const config = assertModelConfig(modelConfig);
+  const contractPlan = buildModelContractPlan(config.model_id);
+  const realScenarios = [
+    ...ratios.map((ratio) => ({ input: "pure_text", ratio, source: "real_gateway" })),
+    { input: "reference_image", ratio: "1:1", source: "real_gateway" },
+  ];
+  return {
+    config_version: config.config_version,
+    error_scenarios: contractPlan.error_categories.map((name) => ({
+      expected: contractPlan.error_expectations[name], name, source: "deterministic_local",
+    })),
+    execution_modes: [
+      { mode: "sync", source: "real_gateway" },
+      { mode: "async", source: "deterministic_local" },
+      { mode: "poll", source: "deterministic_local" },
+    ],
+    model_id: config.model_id,
+    planned_real_calls: realScenarios.length,
+    quota_impact: "authorized_test_key_up_to_120_requests",
+    real_scenarios: realScenarios,
+    response_checks: ["single_image", "mime", "dimensions", "sanitized_usage", "evidence_hash"],
+    state_scenarios: contractPlan.state_checks.map((name) => ({ name, source: "deterministic_local" })),
+  };
+}
+
+export function buildProviderRequest({ modelConfig, prompt, ratio, reference }) {
+  const config = assertModelConfig(modelConfig);
+  if (typeof prompt !== "string" || !prompt.trim() || !ratios.includes(ratio)) throw new Error("WP7_02_REQUEST_FIXTURE_INVALID");
+  if (reference && (!Buffer.isBuffer(reference.bytes) || reference.bytes.length === 0 || !allowedMimeTypes.has(reference.mime_type))) {
+    throw new Error("WP7_02_REFERENCE_FIXTURE_INVALID");
+  }
+  const headers = { "content-type": "application/json" };
+  if (config.route_profile.protocol_version === "gemini-interactions-v1beta") {
+    const input = [{ text: prompt, type: "text" }];
+    if (reference) input.push({ data: reference.bytes.toString("base64"), mime_type: reference.mime_type, type: "image" });
+    return {
+      body: {
+        input,
+        model: config.route_profile.provider_model_id,
+        response_format: { aspect_ratio: ratio, image_size: "1K", type: "image" },
+      },
+      headers,
+      method: "POST",
+      url: config.route_profile.endpoint,
+    };
+  }
+  if (config.route_profile.protocol_version === "gemini-native-v1beta") {
+    const parts = [{ text: prompt }];
+    if (reference) parts.push({ inlineData: { data: reference.bytes.toString("base64"), mimeType: reference.mime_type } });
+    return {
+      body: {
+        contents: [{ parts, role: "user" }],
+        generationConfig: {
+          imageConfig: { aspectRatio: ratio, imageSize: "1K" },
+          responseModalities: ["IMAGE"],
+        },
+      },
+      headers,
+      method: "POST",
+      url: config.route_profile.endpoint,
+    };
+  }
+  if (config.route_profile.protocol_version === "gemini-openai-chat-v1") {
+    const content = reference
+      ? [
+          { text: prompt, type: "text" },
+          {
+            image_url: { url: `data:${reference.mime_type};base64,${reference.bytes.toString("base64")}` },
+            type: "image_url",
+          },
+        ]
+      : prompt;
+    return {
+      body: {
+        extra_body: { google: { image_config: { aspect_ratio: ratio, image_size: "1K" } } },
+        messages: [{ content, role: "user" }],
+        model: config.route_profile.provider_model_id,
+        stream: false,
+      },
+      headers,
+      method: "POST",
+      url: config.route_profile.endpoint,
+    };
+  }
+  const providerModelId = config.route_profile.provider_model_id ?? config.model_id;
+  const body = {
+    model: providerModelId,
+    prompt,
+    response_format: "b64_json",
+    size: gptImageRequestSizeForRatio(ratio),
+  };
+  if (reference) {
+    const form = new FormData();
+    form.append("model", providerModelId);
+    form.append("prompt", prompt);
+    form.append("response_format", "b64_json");
+    form.append("size", gptImageRequestSizeForRatio(ratio));
+    form.append("image[]", new Blob([reference.bytes], { type: reference.mime_type }), "reference.png");
+    return { body: form, headers: {}, method: "POST", url: config.route_profile.reference_endpoint };
+  }
+  return { body, headers, method: "POST", url: config.route_profile.endpoint };
+}
+
+function pngDimensions(bytes) {
+  const signature = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+  if (bytes.length < 24 || !bytes.subarray(0, 8).equals(signature)) return undefined;
+  return { height: bytes.readUInt32BE(20), width: bytes.readUInt32BE(16) };
+}
+
+function jpegDimensions(bytes) {
+  if (bytes.length < 4 || bytes[0] !== 0xff || bytes[1] !== 0xd8) return undefined;
+  let offset = 2;
+  while (offset + 9 < bytes.length) {
+    if (bytes[offset] !== 0xff) { offset += 1; continue; }
+    const marker = bytes[offset + 1];
+    if ([0xc0, 0xc1, 0xc2, 0xc3, 0xc5, 0xc6, 0xc7, 0xc9, 0xca, 0xcb, 0xcd, 0xce, 0xcf].includes(marker)) {
+      return { height: bytes.readUInt16BE(offset + 5), width: bytes.readUInt16BE(offset + 7) };
+    }
+    if (marker === 0xd8 || marker === 0xd9 || (marker >= 0xd0 && marker <= 0xd7)) { offset += 2; continue; }
+    const length = bytes.readUInt16BE(offset + 2);
+    if (length < 2) return undefined;
+    offset += length + 2;
+  }
+  return undefined;
+}
+
+function webpDimensions(bytes) {
+  if (bytes.length < 30 || bytes.toString("ascii", 0, 4) !== "RIFF" || bytes.toString("ascii", 8, 12) !== "WEBP") return undefined;
+  const kind = bytes.toString("ascii", 12, 16);
+  if (kind === "VP8X") {
+    return {
+      height: 1 + bytes.readUIntLE(27, 3),
+      width: 1 + bytes.readUIntLE(24, 3),
+    };
+  }
+  if (kind === "VP8 " && bytes.length >= 30) return { height: bytes.readUInt16LE(28) & 0x3fff, width: bytes.readUInt16LE(26) & 0x3fff };
+  if (kind === "VP8L" && bytes.length >= 25) {
+    const bits = bytes.readUInt32LE(21);
+    return { height: 1 + ((bits >> 14) & 0x3fff), width: 1 + (bits & 0x3fff) };
+  }
+  return undefined;
+}
+
+function inspectImage(bytes, declaredMime) {
+  const png = pngDimensions(bytes);
+  if (png && declaredMime === "image/png") return { ...png, mime: declaredMime };
+  const jpeg = jpegDimensions(bytes);
+  if (jpeg && declaredMime === "image/jpeg") return { ...jpeg, mime: declaredMime };
+  const webp = webpDimensions(bytes);
+  if (webp && declaredMime === "image/webp") return { ...webp, mime: declaredMime };
+  throw new Error("WP7_02_RESPONSE_MEDIA_INVALID");
+}
+
+function integerOrZero(value) {
+  return Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+
+function geminiUsage(response) {
+  const usage = response?.usageMetadata;
+  return {
+    input_units: integerOrZero(usage?.promptTokenCount),
+    output_units: integerOrZero(usage?.candidatesTokenCount),
+    total_units: integerOrZero(usage?.totalTokenCount),
+  };
+}
+
+function openAiUsage(response) {
+  const usage = response?.usage;
+  return {
+    input_units: integerOrZero(usage?.input_tokens ?? usage?.inputTokens ?? usage?.prompt_tokens ?? usage?.promptTokens),
+    output_units: integerOrZero(usage?.output_tokens ?? usage?.outputTokens ?? usage?.completion_tokens ?? usage?.completionTokens),
+    total_units: integerOrZero(usage?.total_tokens ?? usage?.totalTokens),
+  };
+}
+
+function openAiChatImage(response) {
+  const content = response?.choices?.[0]?.message?.content;
+  if (typeof content !== "string") throw new Error("WP7_02_RESPONSE_SINGLE_IMAGE_REQUIRED");
+  const matches = [...content.matchAll(/!\[[^\]]*\]\(\s*data:(image\/(?:jpeg|png|webp));base64,([A-Za-z0-9+/=\r\n]+)\s*\)/gi)];
+  if (matches.length !== 1) throw new Error("WP7_02_RESPONSE_SINGLE_IMAGE_REQUIRED");
+  return { data: matches[0][2], mime: matches[0][1].toLowerCase() };
+}
+
+function interactionUsage(response) {
+  const usage = response?.usage;
+  return {
+    input_units: integerOrZero(usage?.total_input_tokens),
+    output_units: integerOrZero(usage?.total_output_tokens),
+    total_units: integerOrZero(usage?.total_tokens),
+  };
+}
+
+export function normalizeProviderResponse(modelConfig, response) {
+  const config = assertModelConfig(modelConfig);
+  let bytes;
+  let mime;
+  let usageSummary;
+  if (config.route_profile.protocol_version === "gemini-interactions-v1beta") {
+    const stepImages = response?.steps?.flatMap((step) => step?.type === "model_output" ? step?.content ?? [] : [])
+      .filter((content) => content?.type === "image" && content?.data) ?? [];
+    const images = stepImages.length > 0
+      ? stepImages
+      : [response?.output_image].filter((content) => content?.data);
+    if (images.length !== 1) throw new Error("WP7_02_RESPONSE_SINGLE_IMAGE_REQUIRED");
+    mime = images[0].mime_type ?? images[0].mimeType;
+    bytes = Buffer.from(images[0].data, "base64");
+    usageSummary = interactionUsage(response);
+  } else if (config.route_profile.protocol_version === "gemini-native-v1beta") {
+    const parts = response?.candidates?.flatMap((candidate) => candidate?.content?.parts ?? []) ?? [];
+    const images = parts.map((part) => part?.inlineData ?? part?.inline_data).filter((entry) => entry?.data);
+    if (images.length !== 1) throw new Error("WP7_02_RESPONSE_SINGLE_IMAGE_REQUIRED");
+    mime = images[0].mimeType ?? images[0].mime_type;
+    bytes = Buffer.from(images[0].data, "base64");
+    usageSummary = geminiUsage(response);
+  } else if (config.route_profile.protocol_version === "gemini-openai-chat-v1") {
+    const image = openAiChatImage(response);
+    bytes = Buffer.from(image.data, "base64");
+    mime = image.mime;
+    usageSummary = openAiUsage(response);
+  } else {
+    if (!Array.isArray(response?.data) || response.data.length !== 1 || typeof response.data[0]?.b64_json !== "string") {
+      throw new Error("WP7_02_RESPONSE_SINGLE_IMAGE_REQUIRED");
+    }
+    bytes = Buffer.from(response.data[0].b64_json, "base64");
+    mime = "image/png";
+    usageSummary = openAiUsage(response);
+  }
+  const media = inspectImage(bytes, mime);
+  return {
+    bytes,
+    dimensions: { height: media.height, width: media.width },
+    evidence_hash: `sha256:${sha256(bytes)}`,
+    mime: media.mime,
+    usage_summary: usageSummary,
+  };
+}
+
+export function describeProviderResponseShape(value, depth = 0) {
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    const representation = /^data:image\/(?:jpeg|png|webp);base64,/i.test(trimmed)
+      ? "inline_media"
+      : /!\[[^\]]*\]\(\s*https?:\/\/[^)\s]+\s*\)/i.test(trimmed)
+        ? "markdown_uri"
+        : /^https?:\/\/\S+$/i.test(trimmed)
+          ? "uri"
+          : "plain_text";
+    return {
+      kind: "string",
+      representation,
+      size: value.length === 0 ? "empty" : value.length > 256 ? "large" : "small",
+    };
+  }
+  if (typeof value === "number") return { kind: "number" };
+  if (typeof value === "boolean") return { kind: "boolean" };
+  if (value === null || value === undefined) return { kind: value === null ? "null" : "undefined" };
+  if (depth >= 6) return { kind: "depth_limit" };
+  if (Array.isArray(value)) {
+    return {
+      item: value.length > 0 ? describeProviderResponseShape(value[0], depth + 1) : { kind: "empty" },
+      kind: "array",
+      length: value.length,
+    };
+  }
+  if (value && typeof value === "object") {
+    return {
+      fields: Object.keys(value).toSorted().map((name) => ({ name, shape: describeProviderResponseShape(value[name], depth + 1) })),
+      kind: "object",
+    };
+  }
+  return { kind: "undefined" };
+}
+
+export function buildSanitizedResponseEvidence(normalized) {
+  const evidence = {
+    dimensions: structuredClone(normalized.dimensions),
+    evidence_hash: normalized.evidence_hash,
+    mime: normalized.mime,
+    ...(normalized.normalization ? { normalization: structuredClone(normalized.normalization) } : {}),
+    usage_summary: structuredClone(normalized.usage_summary),
+  };
+  return validateSanitizedEvidence(evidence);
+}
+
+function inspectEvidenceValue(value, seen = new Set()) {
+  if (value && typeof value === "object") {
+    if (seen.has(value)) throw new Error("WP7_02_EVIDENCE_CYCLE_FORBIDDEN");
+    seen.add(value);
+    for (const [key, entry] of Object.entries(value)) {
+      if (key === "verified") throw new Error("WP7_02_SHARED_VERIFIED_FORBIDDEN");
+      if (key !== "secret_scan" && forbiddenEvidenceKeys.test(key)) throw new Error(`WP7_02_SENSITIVE_EVIDENCE_FORBIDDEN:${key}`);
+      inspectEvidenceValue(entry, seen);
+    }
+    seen.delete(value);
+  } else if (typeof value === "string" && /[A-Za-z]:\\Users\\/i.test(value)) {
+    throw new Error("WP7_02_SENSITIVE_EVIDENCE_FORBIDDEN");
+  }
+}
+
+export function validateSanitizedEvidence(evidence) {
+  inspectEvidenceValue(evidence);
+  return evidence;
+}
+
+export async function executeProviderRequest({ fetchImpl = fetch, modelConfig, prompt, ratio, reference, token, timeoutMs = 180_000 }) {
+  if (typeof token !== "string" || token.length < 8) throw new Error("WP7_02_CREDENTIAL_INVALID");
+  const request = buildProviderRequest({ modelConfig, prompt, ratio, reference });
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  const startedAt = performance.now();
+  try {
+    const response = await fetchImpl(request.url, {
+      body: request.body instanceof FormData ? request.body : JSON.stringify(request.body),
+      headers: { ...request.headers, authorization: `Bearer ${token}` },
+      method: request.method,
+      signal: controller.signal,
+    });
+    const durationMs = Math.round(performance.now() - startedAt);
+    if (!response.ok) throw new Error(`WP7_02_UPSTREAM_HTTP_${response.status}`);
+    const providerResponse = await response.json();
+    let normalized;
+    try {
+      const providerNormalized = normalizeProviderResponse(modelConfig, providerResponse);
+      const adapted = await normalizeImageOutputToRatio({
+        bytes: providerNormalized.bytes,
+        mimeType: providerNormalized.mime,
+        pixelHeight: providerNormalized.dimensions.height,
+        pixelWidth: providerNormalized.dimensions.width,
+        ratio,
+      });
+      normalized = {
+        ...providerNormalized,
+        bytes: adapted.bytes,
+        dimensions: { height: adapted.pixelHeight, width: adapted.pixelWidth },
+        evidence_hash: `sha256:${sha256(adapted.bytes)}`,
+        mime: adapted.mimeType,
+        normalization: {
+          applied: adapted.normalized,
+          upstream_dimensions: { height: adapted.upstreamPixelHeight, width: adapted.upstreamPixelWidth },
+        },
+      };
+    } catch (error) {
+      if (error instanceof Error && /^WP7_02_[A-Z0-9_]+$/.test(error.message)) {
+        error.safe_response_shape = describeProviderResponseShape(providerResponse);
+      } else if (error instanceof Error && error.message === "image_output_media_invalid") {
+        throw new Error("WP7_02_RESPONSE_MEDIA_INVALID");
+      } else if (error instanceof Error && /^image_output_(?:aspect_ratio_mismatch|dimensions_missing|normalization_failed)$/.test(error.message)) {
+        throw new Error("WP7_02_RESPONSE_DIMENSIONS_INVALID");
+      }
+      throw error;
+    }
+    return {
+      duration_ms: durationMs,
+      http_status: response.status,
+      normalized,
+      response_evidence: buildSanitizedResponseEvidence(normalized),
+    };
+  } catch (error) {
+    if (error?.name === "AbortError") throw new Error("WP7_02_UPSTREAM_TIMEOUT");
+    if (error instanceof Error && /^WP7_02_[A-Z0-9_]+$/.test(error.message)) throw error;
+    throw new Error("WP7_02_UPSTREAM_FAILED");
+  } finally {
+    clearTimeout(timeout);
+  }
+}

scripts/lib/wp7-02-controlled-matrix.mjs

@@ -0,0 +1,261 @@
+import { createHash } from "node:crypto";
+import { deflateSync } from "node:zlib";
+
+import {
+  WP7_02_CONTROLLED_REAL_LIMIT,
+  buildControlledExecutionPlan,
+  executeProviderRequest,
+  validateSanitizedEvidence,
+} from "./wp7-02-controlled-executor.mjs";
+
+const productDimensions = Object.freeze({
+  "3:4": { height: 1440, width: 1080 },
+  "1:1": { height: 1080, width: 1080 },
+  "4:3": { height: 1080, width: 1440 },
+  "9:16": { height: 1920, width: 1080 },
+});
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex").toUpperCase();
+}
+
+function crc32(bytes) {
+  let crc = 0xffffffff;
+  for (const byte of bytes) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function pngChunk(type, data) {
+  const name = Buffer.from(type, "ascii");
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(data.length);
+  const checksum = Buffer.alloc(4);
+  checksum.writeUInt32BE(crc32(Buffer.concat([name, data])));
+  return Buffer.concat([length, name, data, checksum]);
+}
+
+export function createControlledReferencePng() {
+  const width = 64;
+  const height = 64;
+  const rows = [];
+  for (let y = 0; y < height; y += 1) {
+    const row = Buffer.alloc(1 + width * 4);
+    for (let x = 0; x < width; x += 1) {
+      const offset = 1 + x * 4;
+      const bright = (Math.floor(x / 8) + Math.floor(y / 8)) % 2 === 0;
+      row[offset] = bright ? 32 : 220;
+      row[offset + 1] = bright ? 180 : 48;
+      row[offset + 2] = bright ? 220 : 140;
+      row[offset + 3] = 255;
+    }
+    rows.push(row);
+  }
+  const header = Buffer.alloc(13);
+  header.writeUInt32BE(width, 0);
+  header.writeUInt32BE(height, 4);
+  header[8] = 8;
+  header[9] = 6;
+  return Buffer.concat([
+    Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
+    pngChunk("IHDR", header),
+    pngChunk("IDAT", deflateSync(Buffer.concat(rows))),
+    pngChunk("IEND", Buffer.alloc(0)),
+  ]);
+}
+
+function promptForScenario(scenario) {
+  const subject = scenario.input === "reference_image" ? "use the supplied geometric color reference" : "use a geometric color study";
+  return `Create one safe abstract test image; ${subject}; no text, logos, people, or real places; aspect ratio ${scenario.ratio}.`;
+}
+
+function dimensionsMatch(dimensions, ratio) {
+  const expected = productDimensions[ratio];
+  return dimensions.width === expected.width && dimensions.height === expected.height;
+}
+
+function safeErrorCode(error) {
+  return error instanceof Error && /^WP7_02_[A-Z0-9_]+$/.test(error.message)
+    ? error.message
+    : "WP7_02_UPSTREAM_FAILED";
+}
+
+export async function runControlledRealScenarios({ fetchImpl = fetch, maxRealCalls, modelConfig, token }) {
+  const plan = buildControlledExecutionPlan(modelConfig);
+  if (maxRealCalls !== WP7_02_CONTROLLED_REAL_LIMIT || plan.planned_real_calls > maxRealCalls) {
+    throw new Error("WP7_02_REAL_CALL_LIMIT_INVALID");
+  }
+  const referenceBytes = createControlledReferencePng();
+  const attempts = [];
+  const calls = [];
+  let timeoutRetriesRemaining = 1;
+  let stop = false;
+  for (let index = 0; index < plan.real_scenarios.length; index += 1) {
+    const scenario = plan.real_scenarios[index];
+    const scenarioId = `real-${index + 1}`;
+    let attemptNo = 0;
+    while (true) {
+      attemptNo += 1;
+      try {
+        const result = await executeProviderRequest({
+          fetchImpl,
+          modelConfig,
+          prompt: promptForScenario(scenario),
+          ratio: scenario.ratio,
+          reference: scenario.input === "reference_image" ? { bytes: referenceBytes, mime_type: "image/png" } : undefined,
+          token,
+        });
+        attempts.push(validateSanitizedEvidence({
+          attempt_no: attemptNo, duration_ms: result.duration_ms, http_status: result.http_status,
+          scenario_id: scenarioId, status: "passed",
+        }));
+        const dimensionsPassed = dimensionsMatch(result.normalized.dimensions, scenario.ratio);
+        calls.push(validateSanitizedEvidence({
+          duration_ms: result.duration_ms,
+          http_status: result.http_status,
+          input: scenario.input,
+          requested_ratio: scenario.ratio,
+          response: result.response_evidence,
+          scenario_id: scenarioId,
+          source: "real_gateway",
+          status: dimensionsPassed ? "passed" : "failed",
+          validation: { dimensions: dimensionsPassed ? "passed" : "failed", response: "passed" },
+        }));
+        break;
+      } catch (error) {
+        const errorCode = safeErrorCode(error);
+        attempts.push(validateSanitizedEvidence({ attempt_no: attemptNo, error_code: errorCode, scenario_id: scenarioId, status: "failed" }));
+        if (errorCode === "WP7_02_UPSTREAM_TIMEOUT" && timeoutRetriesRemaining > 0) {
+          timeoutRetriesRemaining -= 1;
+          continue;
+        }
+        const failed = {
+          error_code: errorCode,
+          input: scenario.input,
+          requested_ratio: scenario.ratio,
+          scenario_id: scenarioId,
+          source: "real_gateway",
+          status: "failed",
+          ...(error?.safe_response_shape ? { response_shape: error.safe_response_shape } : {}),
+        };
+        calls.push(validateSanitizedEvidence(failed));
+        if (["WP7_02_RESPONSE_SINGLE_IMAGE_REQUIRED", "WP7_02_RESPONSE_MEDIA_INVALID", "WP7_02_CREDENTIAL_INVALID",
+          "WP7_02_UPSTREAM_HTTP_401", "WP7_02_UPSTREAM_HTTP_403", "WP7_02_UPSTREAM_HTTP_404", "WP7_02_UPSTREAM_HTTP_429"].includes(failed.error_code)) stop = true;
+        break;
+      }
+    }
+    if (stop) break;
+  }
+  referenceBytes.fill(0);
+  const blockers = calls.filter((call) => call.status !== "passed").map((call) => `${call.scenario_id}:${call.error_code ?? "dimensions_or_response_invalid"}`);
+  return validateSanitizedEvidence({
+    blockers,
+    attempts,
+    calls,
+    maximum_real_calls: plan.planned_real_calls + 1,
+    model_id: modelConfig.model_id,
+    planned_real_calls: plan.planned_real_calls,
+    real_calls: attempts.length,
+    status: blockers.length === 0 ? "passed" : "externally_blocked",
+  });
+}
+
+export function buildDeterministicExecutionEvidence(modelId, runId) {
+  const operationRef = `sha256:${sha256(`${modelId}:${runId}:operation`)}`;
+  let state = "created";
+  const trace = [];
+  const start = () => {
+    if (state !== "created") throw new Error("WP7_02_ASYNC_STATE_INVALID");
+    state = "pending";
+    trace.push({ action: "start", after: state, before: "created", status: "passed" });
+    return operationRef;
+  };
+  const poll = (reference) => {
+    if (reference !== operationRef || !["pending", "completed"].includes(state)) throw new Error("WP7_02_POLL_REFERENCE_INVALID");
+    const before = state;
+    state = "completed";
+    trace.push({ action: "poll", after: state, before, replay: before === "completed", status: "passed" });
+    return state;
+  };
+  const reference = start();
+  poll(reference);
+  poll(reference);
+  return validateSanitizedEvidence({
+    modes: [
+      { mode: "sync", source: "real_gateway", status: "covered_by_real_calls" },
+      { mode: "async", source: "deterministic_local", status: "passed", transition: "created_to_pending" },
+      { mode: "poll", operation_ref: operationRef, replay_count: 1, source: "deterministic_local", status: "passed", transition: "pending_to_completed" },
+    ],
+    model_id: modelId,
+    status: "passed",
+    trace,
+  });
+}
+
+function passedCall(calls, predicate) {
+  return calls.some((call) => call.status === "passed" && predicate(call));
+}
+
+export function assembleControlledModelEvidence({ deterministicState, modelConfig, realExecution, runId }) {
+  if (deterministicState?.model_id !== modelConfig.model_id || deterministicState?.status !== "passed") {
+    throw new Error("WP7_02_DETERMINISTIC_STATE_INCOMPLETE");
+  }
+  const execution = buildDeterministicExecutionEvidence(modelConfig.model_id, runId);
+  const ratioRows = Object.keys(productDimensions).map((ratio) => ({
+    outputs: passedCall(realExecution.calls, (call) => call.requested_ratio === ratio) ? 1 : 0,
+    ratio,
+    status: passedCall(realExecution.calls, (call) => call.requested_ratio === ratio) ? "passed" : "failed",
+  }));
+  const pureTextPassed = ratioRows.every((row) => row.status === "passed")
+    && passedCall(realExecution.calls, (call) => call.input === "pure_text");
+  const referencePassed = passedCall(realExecution.calls, (call) => call.input === "reference_image");
+  const deterministicPassed = deterministicState.error_scenarios?.length === 9
+    && deterministicState.error_scenarios.every((entry) => entry.status === "passed")
+    && deterministicState.settlements?.length === 3
+    && deterministicState.contract_change?.full_matrix_reapplied === true;
+  const status = realExecution.status === "passed" && pureTextPassed && referencePassed
+    && ratioRows.every((row) => row.status === "passed") && deterministicPassed ? "passed" : "externally_blocked";
+  const evidenceId = `sha256:${sha256(`${modelConfig.model_id}:${modelConfig.config_version}:${runId}`)}`;
+  return validateSanitizedEvidence({
+    evidence_id: evidenceId,
+    external_calls: {
+      approved_real_call_limit: WP7_02_CONTROLLED_REAL_LIMIT,
+      attempts: realExecution.attempts,
+      calls: realExecution.calls,
+      maximum_real_calls: realExecution.maximum_real_calls,
+      mode: "controlled_real",
+      planned_real_calls: realExecution.planned_real_calls,
+      real_calls: realExecution.real_calls,
+      service: "ai-gateway-service-id",
+      status: realExecution.status,
+    },
+    manual_review: {
+      decision: status === "passed" ? "Review sanitized matrix before recording the model as passed." : "Resolve all failed scenarios before review.",
+      status: status === "passed" ? "pending" : "blocked",
+    },
+    matrix: {
+      config_version: modelConfig.config_version,
+      contract_change: deterministicState.contract_change,
+      error_scenarios: deterministicState.error_scenarios,
+      execution_modes: execution.modes,
+      model_id: modelConfig.model_id,
+      pure_text: { outputs: pureTextPassed ? 1 : 0, status: pureTextPassed ? "passed" : "failed" },
+      ratios: ratioRows,
+      reference_image: { outputs: referencePassed ? 1 : 0, status: referencePassed ? "passed" : "failed" },
+      response_checks: ["single_image", "mime", "dimensions", "sanitized_usage", "evidence_hash"].map((name) => ({ name, status: realExecution.status })),
+      settlements: deterministicState.settlements,
+      status,
+    },
+    model_id: modelConfig.model_id,
+    redaction: {
+      forbidden_fields_absent: true,
+      retained_fields: ["status", "category", "duration_ms", "mime", "dimensions", "usage_summary", "evidence_hash", "time"],
+      secret_scan: "passed",
+      status: "passed",
+    },
+    run_id: runId,
+    status,
+  });
+}

scripts/lib/wp7-02-external-contract.mjs

@@ -0,0 +1,249 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+export const AI_GATEWAY_CREDENTIAL_TARGET = "Dada/P0A/worker/ai-gateway";
+export const WP7_02_MODEL_IDS = Object.freeze([
+  "gemini-3.1-flash-image",
+  "gpt-image-2",
+]);
+
+const controlledStateProductModelIds = Object.freeze({
+  "gemini-3.1-flash-image": "gemini-3.1-flash-image-preview",
+  "gpt-image-2": "gpt-image-2",
+});
+
+const expectedCandidateCommit = "623cad25b2a2a9a003502c9a92ebd318dad06248";
+const expectedBrowsers = Object.freeze({
+  "Google Chrome": "150.0.7871.187",
+  "Microsoft Edge": "151.0.4129.59",
+});
+const ratios = Object.freeze(["3:4", "1:1", "4:3", "9:16"]);
+const errorCategories = Object.freeze([
+  "upstream_timeout", "upstream_failed", "safety_rejected", "model_disabled",
+  "gateway_balance_insufficient", "gateway_contract_invalid", "reference_invalid",
+  "unknown_retryable", "unknown_non_retryable",
+]);
+const errorExpectations = Object.freeze({
+  upstream_timeout: { credit_effect: "release_once", job_outcome: "failed", user_action: "retry_original_input" },
+  upstream_failed: { credit_effect: "release_once", job_outcome: "failed", user_action: "retry_later" },
+  safety_rejected: { credit_effect: "release_once", job_outcome: "rejected", user_action: "modify_prompt_or_reference" },
+  model_disabled: { credit_effect: "no_reserve", job_outcome: "not_created", user_action: "choose_other_model_or_wait" },
+  gateway_balance_insufficient: { credit_effect: "no_reserve_or_release_once", job_outcome: "not_created_or_failed", user_action: "choose_unaffected_model_or_contact_admin" },
+  gateway_contract_invalid: { credit_effect: "no_reserve_or_release_once", job_outcome: "not_created_or_failed", user_action: "choose_other_model_or_contact_admin" },
+  reference_invalid: { credit_effect: "no_reserve_or_release_once", job_outcome: "not_created_or_failed", user_action: "replace_or_remove_reference" },
+  unknown_retryable: { credit_effect: "release_once", job_outcome: "failed", user_action: "retry_later" },
+  unknown_non_retryable: { credit_effect: "release_once", job_outcome: "failed", user_action: "contact_admin" },
+});
+
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function sha256(value) {
+  return createHash("sha256").update(typeof value === "string" ? value : stableJson(value)).digest("hex").toUpperCase();
+}
+
+function assertModelId(modelId) {
+  if (!WP7_02_MODEL_IDS.includes(modelId)) throw new Error("WP7_02_MODEL_NOT_ALLOWED");
+  return modelId;
+}
+
+export function productModelIdForControlledState(modelId) {
+  assertModelId(modelId);
+  return controlledStateProductModelIds[modelId];
+}
+
+export function buildModelContractPlan(modelId) {
+  assertModelId(modelId);
+  const plannedRequestBreakdown = {
+    contract_change_full_revalidation: 20,
+    error_categories: 9,
+    execution_modes_and_poll: 3,
+    input_and_ratio_success: 6,
+    settlement_boundaries: 2,
+  };
+  return {
+    error_categories: [...errorCategories],
+    error_expectations: structuredClone(errorExpectations),
+    execution_modes: ["sync", "async", "poll"],
+    inputs: ["pure_text", "reference_image"],
+    model_id: modelId,
+    planned_provider_requests_max: Object.values(plannedRequestBreakdown).reduce((total, count) => total + count, 0),
+    planned_request_breakdown: plannedRequestBreakdown,
+    quota_impact: "unknown_requires_operator_review",
+    ratios: [...ratios],
+    response_checks: ["single_image", "mime", "dimensions", "sanitized_usage"],
+    state_checks: [
+      "credit_commit_once", "credit_release_once_per_terminal_failure",
+      "contract_change_invalidation", "full_revalidation",
+    ],
+  };
+}
+
+export function validateCandidateDependency(record) {
+  if (!record || typeof record !== "object") throw new Error("WP7_02_CANDIDATE_RECORD_REQUIRED");
+  if (record.final_release !== false || record.status !== "candidate_unvalidated"
+    || record.candidate_package?.release_status !== "candidate_unvalidated") {
+    throw new Error("WP7_02_CANDIDATE_FINAL_RELEASE_FORBIDDEN");
+  }
+  if (record.build_commit !== expectedCandidateCommit || record.fixed_port !== 43121) {
+    throw new Error("WP7_02_CANDIDATE_BASELINE_MISMATCH");
+  }
+  const browsers = Array.isArray(record.browsers) ? record.browsers : [];
+  if (browsers.length !== 2 || Object.entries(expectedBrowsers).some(([brand, version]) => {
+    const browser = browsers.find((entry) => entry?.brand === brand);
+    return !browser || browser.full_version !== version || browser.major !== Number(version.split(".")[0])
+      || browser.source !== "installed_executable";
+  })) throw new Error("WP7_02_CANDIDATE_BROWSER_MISMATCH");
+  if (!/^[A-F0-9]{64}$/.test(record.candidate_package?.sha256 ?? "")) throw new Error("WP7_02_CANDIDATE_PACKAGE_HASH_INVALID");
+  return {
+    browsers: Object.entries(expectedBrowsers).map(([brand, full_version]) => ({ brand, full_version })),
+    build_commit: record.build_commit,
+    candidate_package_sha256: record.candidate_package.sha256,
+    fixed_port: record.fixed_port,
+    record_sha256: sha256(record),
+    status: record.status,
+  };
+}
+
+function validateRealModelConfig(modelConfig, modelId) {
+  if (!modelConfig || typeof modelConfig !== "object") return { blocker: "real_model_config_absent" };
+  const endpoint = modelConfig.route_profile?.endpoint;
+  const validEndpoint = typeof endpoint === "string" && endpoint.startsWith("https://")
+    && !/\.(?:invalid)(?:\/|$)/i.test(endpoint) && !/https:\/\/(?:localhost|127\.0\.0\.1)(?:[:/]|$)/i.test(endpoint);
+  if (modelConfig.model_id !== modelId || !Number.isSafeInteger(modelConfig.config_version) || modelConfig.config_version <= 0
+    || !validEndpoint || typeof modelConfig.gateway_account_ref !== "string" || /mock/i.test(modelConfig.gateway_account_ref)) {
+    return { blocker: "real_model_config_invalid" };
+  }
+  return {
+    config: {
+      config_version: modelConfig.config_version,
+      endpoint_sha256: sha256(endpoint),
+      gateway_account_ref_sha256: sha256(modelConfig.gateway_account_ref),
+      model_id: modelId,
+      route_profile_sha256: sha256(modelConfig.route_profile),
+    },
+  };
+}
+
+export function inspectAiGatewayReadiness({ candidateRecord, confirmed, credentialTargets, modelConfig, modelId }) {
+  const candidate = validateCandidateDependency(candidateRecord);
+  assertModelId(modelId);
+  const blockers = [];
+  if (confirmed !== true) blockers.push("explicit_confirmation_absent");
+  if (!Array.isArray(credentialTargets) || !credentialTargets.includes(AI_GATEWAY_CREDENTIAL_TARGET)) {
+    blockers.push("real_gateway_credentials_absent");
+  }
+  const checkedConfig = validateRealModelConfig(modelConfig, modelId);
+  if (checkedConfig.blocker) blockers.push(checkedConfig.blocker);
+  return {
+    blockers,
+    candidate,
+    model_config: checkedConfig.config ?? null,
+    model_id: modelId,
+    plan: buildModelContractPlan(modelId),
+    real_calls: 0,
+    status: blockers.length > 0 ? "externally_blocked" : "ready_for_controlled_execution",
+  };
+}
+
+function blockedScenarios(plan) {
+  return [
+    ...plan.inputs.map((name) => ({ kind: "input", name, status: "not_run" })),
+    ...plan.ratios.map((name) => ({ kind: "ratio", name, status: "not_run" })),
+    ...plan.execution_modes.map((name) => ({ kind: "execution_mode", name, status: "not_run" })),
+    ...plan.response_checks.map((name) => ({ kind: "response_check", name, status: "not_run" })),
+    ...plan.error_categories.map((name) => ({
+      expected: plan.error_expectations[name], kind: "error_category", name, status: "not_run",
+    })),
+    ...plan.state_checks.map((name) => ({ kind: "state_check", name, status: "not_run" })),
+  ];
+}
+
+export function buildBlockedModelEvidence({ blockers, candidateRecord, modelId, modelConfig = null, runId }) {
+  const candidate = validateCandidateDependency(candidateRecord);
+  const plan = buildModelContractPlan(modelId);
+  if (!Array.isArray(blockers) || blockers.length === 0) throw new Error("WP7_02_EXTERNAL_BLOCKER_REQUIRED");
+  const evidenceId = `sha256:${sha256({ model_id: modelId, run_id: runId })}`;
+  return {
+    blockers: [...new Set(blockers)],
+    candidate,
+    evidence_id: evidenceId,
+    external_calls: {
+      mode: "controlled_real_not_executed",
+      planned_provider_requests_max: plan.planned_provider_requests_max,
+      planned_request_breakdown: plan.planned_request_breakdown,
+      quota_impact: plan.quota_impact,
+      real_calls: 0,
+      service: "ai-gateway-service-id",
+    },
+    manual_review: {
+      decision: "Do not mark this model verified until every controlled-real scenario passes against the listed config version.",
+      status: "blocked",
+    },
+    matrix: {
+      config_version: modelConfig?.config_version ?? null,
+      model_id: modelId,
+      scenarios: blockedScenarios(plan),
+      status: "not_run",
+    },
+    model_id: modelId,
+    redaction: {
+      retained_fields: ["status", "category", "duration_ms", "mime", "dimensions", "usage_summary", "evidence_hash", "time"],
+      secret_scan: "passed",
+    },
+    run_id: runId,
+    status: "externally_blocked",
+  };
+}
+
+export function validateIndependentEvidenceSet(evidence) {
+  if (!Array.isArray(evidence) || evidence.length !== WP7_02_MODEL_IDS.length) throw new Error("WP7_02_MODEL_EVIDENCE_SET_REQUIRED");
+  const ids = evidence.map((entry) => entry.model_id).toSorted();
+  if (JSON.stringify(ids) !== JSON.stringify([...WP7_02_MODEL_IDS].toSorted())) throw new Error("WP7_02_MODEL_EVIDENCE_SET_INVALID");
+  if (new Set(evidence.map((entry) => entry.evidence_id)).size !== evidence.length) throw new Error("WP7_02_SHARED_EVIDENCE_FORBIDDEN");
+  for (const entry of evidence) {
+    const blocked = entry.status === "externally_blocked"
+      && Number.isSafeInteger(entry.external_calls?.real_calls) && entry.external_calls.real_calls >= 0
+      && entry.manual_review?.status === "blocked";
+    const passed = entry.status === "passed" && entry.matrix?.status === "passed"
+      && entry.external_calls?.status === "passed" && entry.external_calls.real_calls > 0
+      && entry.manual_review?.status === "passed" && entry.redaction?.status === "passed";
+    const pendingReview = entry.status === "passed" && entry.matrix?.status === "passed"
+      && entry.external_calls?.status === "passed" && entry.external_calls.real_calls > 0
+      && entry.manual_review?.status === "pending" && entry.redaction?.status === "passed";
+    if (entry.matrix?.model_id !== entry.model_id || (!blocked && !passed && !pendingReview)
+      || /\"verified\"\s*:/i.test(JSON.stringify(entry))) {
+      throw new Error("WP7_02_BLOCKED_EVIDENCE_INVALID");
+    }
+  }
+  return evidence;
+}
+
+export function writeBlockedModelEvidence(directory, evidence) {
+  mkdirSync(resolve(directory), { recursive: true });
+  const files = {
+    "contract-matrix.json": evidence.matrix,
+    "external-calls.json": evidence.external_calls,
+    "manual-review.json": evidence.manual_review,
+    "readiness.json": {
+      blockers: evidence.blockers,
+      candidate: evidence.candidate,
+      evidence_id: evidence.evidence_id,
+      model_id: evidence.model_id,
+      run_id: evidence.run_id,
+      status: evidence.status,
+    },
+    "redaction.json": evidence.redaction,
+  };
+  for (const [name, value] of Object.entries(files)) {
+    writeFileSync(resolve(directory, name), `${JSON.stringify(value, null, 2)}\n`);
+  }
+  return Object.keys(files);
+}

scripts/lib/wp7-02-manual-review.mjs

@@ -0,0 +1,59 @@
+import { WP7_02_MODEL_IDS } from "./wp7-02-external-contract.mjs";
+
+const productDimensions = Object.freeze({
+  "3:4": [1080, 1440],
+  "1:1": [1080, 1080],
+  "4:3": [1440, 1080],
+  "9:16": [1080, 1920],
+});
+
+function modelEvidenceComplete(entry) {
+  const { externalCalls, matrix, modelId, readiness, redaction } = entry;
+  return matrix.model_id === modelId && Number.isSafeInteger(matrix.config_version) && matrix.config_version > 0 && matrix.status === "passed"
+    && matrix.pure_text?.status === "passed" && matrix.reference_image?.status === "passed"
+    && matrix.ratios?.length === 4 && matrix.ratios.every((row) => row.status === "passed")
+    && matrix.execution_modes?.length === 3 && matrix.execution_modes.every((row) => ["passed", "covered_by_real_calls"].includes(row.status))
+    && matrix.error_scenarios?.length === 9 && matrix.error_scenarios.every((row) => row.status === "passed")
+    && matrix.settlements?.length === 3 && matrix.contract_change?.full_matrix_reapplied === true
+    && externalCalls.status === "passed" && externalCalls.real_calls >= 5 && externalCalls.real_calls <= 6
+    && externalCalls.planned_real_calls === 5 && externalCalls.maximum_real_calls === 6
+    && externalCalls.attempts?.length === externalCalls.real_calls
+    && externalCalls.calls?.length === 5 && new Set(externalCalls.calls.map((row) => row.scenario_id)).size === 5
+    && externalCalls.calls.every((row) => row.status === "passed" && row.source === "real_gateway")
+    && externalCalls.calls.every((row) => {
+      const [width, height] = productDimensions[row.requested_ratio] ?? [];
+      return row.response?.dimensions?.width === width && row.response?.dimensions?.height === height;
+    })
+    && externalCalls.approved_real_call_limit === 120
+    && readiness.status === "passed" && redaction.status === "passed" && redaction.secret_scan === "passed";
+}
+
+export function reviewIndependentModelEvidence(entries, { reviewedAt, runId }) {
+  const entryIds = Array.isArray(entries) ? entries.map((entry) => entry?.modelId).toSorted() : [];
+  if (!Array.isArray(entries) || entries.length !== WP7_02_MODEL_IDS.length
+    || JSON.stringify(entryIds) !== JSON.stringify([...WP7_02_MODEL_IDS].toSorted())
+    || !runId || !reviewedAt) {
+    throw new Error("WP7_02_MANUAL_REVIEW_EVIDENCE_INVALID");
+  }
+  const evidenceIds = entries.map((entry) => entry.readiness?.evidence_id);
+  if (evidenceIds.some((id) => typeof id !== "string") || new Set(evidenceIds).size !== entries.length) {
+    throw new Error("WP7_02_MANUAL_REVIEW_EVIDENCE_NOT_INDEPENDENT");
+  }
+  const reviews = entries.map((entry) => modelEvidenceComplete(entry) ? {
+    basis: ["independent_model_evidence", "five_scenarios_bounded_attempts", "four_ratios", "reference_input", "nine_errors", "settlement", "contract_change", "redaction"],
+    decision: "Sanitized controlled-real and deterministic evidence is complete for this config version.",
+    model_id: entry.modelId,
+    reviewed_at: reviewedAt,
+    reviewer_role: "dada_editor_quality_group",
+    run_id: runId,
+    status: "passed",
+  } : {
+    decision: "Independent model evidence remains incomplete or externally blocked.",
+    model_id: entry.modelId,
+    reviewed_at: reviewedAt,
+    reviewer_role: "dada_editor_quality_group",
+    run_id: runId,
+    status: "blocked",
+  });
+  return { reviews, status: reviews.every((review) => review.status === "passed") ? "passed" : "externally_blocked" };
+}

scripts/record-wp4-07-manual-review.mjs

@@ -0,0 +1,60 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const evidenceIndex = process.argv.indexOf("--evidence");
+if (evidenceIndex < 0 || !process.argv[evidenceIndex + 1]) throw new Error("Usage: --evidence <TDD-WP4-VIS-001-browser-diff directory>");
+const evidenceDirectory = resolve(process.argv[evidenceIndex + 1]);
+const pixelDiff = JSON.parse(readFileSync(resolve(evidenceDirectory, "pixel-diff.json"), "utf8"));
+const layout = JSON.parse(readFileSync(resolve(evidenceDirectory, "layout-boxes.json"), "utf8"));
+if (pixelDiff.eligible_for_green !== true || pixelDiff.status !== "within_threshold") throw new Error("WP4_07_VISUAL_AUTOMATION_NOT_GREEN");
+if (layout.eligible_for_green !== true || layout.status !== "within_threshold") throw new Error("WP4_07_LAYOUT_AUTOMATION_NOT_GREEN");
+
+const screenshots = [];
+for (const browser of ["chrome", "edge"]) {
+  for (const scenario of ["editor.png", "canvas.png", "export-dialog.png"]) {
+    const path = resolve(evidenceDirectory, browser, scenario);
+    if (!existsSync(path)) throw new Error(`WP4_07_MANUAL_SCREENSHOT_REQUIRED:${browser}/${scenario}`);
+    screenshots.push({
+      browser,
+      scenario,
+      sha256: createHash("sha256").update(readFileSync(path)).digest("hex").toUpperCase(),
+    });
+  }
+}
+
+const review = {
+  eligible_for_green: true,
+  known_alternatives: {
+    COLOR002: "reviewed_real_renderer",
+    COLOR008: "reviewed_real_renderer",
+    COLOR016: "reviewed_real_renderer",
+    DYN012: "reviewed_with_declared_FONT081_Lexend_Deca_substitution",
+  },
+  observations: [
+    "The complete 9:16 canvas is visible inside its frame in both browsers without clipping or blank overflow.",
+    "Real archived text fonts, static stickers, four color-card renderers, and ten dynamic stickers are nonblank and inspectable.",
+    "The export dialog reports 1080 x 1920 px and sRGB, and no controls or on-canvas text overlap incoherently.",
+  ],
+  reviewed_at: new Date().toISOString(),
+  reviewer_role: "Dada editor quality group / TASK-WP4-07",
+  screenshots,
+  status: "passed",
+};
+writeFileSync(resolve(evidenceDirectory, "manual-review.json"), `${JSON.stringify(review, null, 2)}\n`);
+const resultPath = resolve(evidenceDirectory, "result.json");
+if (!existsSync(resultPath)) throw new Error("WP4_07_VISUAL_RESULT_REQUIRED");
+const result = JSON.parse(readFileSync(resultPath, "utf8"));
+const missingEvidence = result.evidence_refs.filter((path) => !existsSync(resolve(evidenceDirectory, path)));
+if (missingEvidence.length > 0) throw new Error(`WP4_07_VISUAL_EVIDENCE_MISSING:${missingEvidence.join(",")}`);
+result.missing_evidence = [];
+result.status = "passed";
+writeFileSync(resultPath, `${JSON.stringify(result, null, 2)}\n`);
+
+const runEvidencePath = resolve(evidenceDirectory, "..", "..", "evidence.json");
+if (!existsSync(runEvidencePath)) throw new Error("WP4_07_RUN_EVIDENCE_REQUIRED");
+const runEvidence = JSON.parse(readFileSync(runEvidencePath, "utf8"));
+runEvidence.cases = [{ missing_evidence: [], status: "passed", test_id: result.test_id }];
+runEvidence.status = "passed";
+writeFileSync(runEvidencePath, `${JSON.stringify(runEvidence, null, 2)}\n`);
+console.log(JSON.stringify({ reviewed_screenshots: screenshots.length, run_id: result.run_id, status: review.status }, null, 2));

scripts/record-wp7-01-manual-review.mjs

@@ -0,0 +1,51 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, resolve } from "node:path";
+
+import { validateReleaseCandidateRecord } from "./lib/release-candidate.mjs";
+
+const runId = process.argv[2];
+if (!runId) throw new Error("Usage: node scripts/record-wp7-01-manual-review.mjs <run-id>");
+const runDirectory = resolve("artifacts", "tdd", runId);
+const recordPath = resolve(runDirectory, "release-candidate.json");
+const evidencePath = resolve(runDirectory, "evidence.json");
+if (!existsSync(recordPath) || !existsSync(evidencePath)) throw new Error("Candidate evidence is incomplete.");
+const record = validateReleaseCandidateRecord(JSON.parse(readFileSync(recordPath, "utf8")));
+const evidence = JSON.parse(readFileSync(evidencePath, "utf8"));
+if (evidence.status !== "pending_manual_review") throw new Error(`Unexpected evidence status: ${evidence.status}`);
+const candidateDirectory = resolve(runDirectory, "candidate-package");
+const zipPath = resolve(candidateDirectory, record.candidate_package.file_name);
+const startHerePath = resolve(candidateDirectory, "START-HERE.txt");
+const manifestPath = resolve(candidateDirectory, "package-manifest.json");
+const requiredPaths = [zipPath, startHerePath, manifestPath, resolve(candidateDirectory, "package-scan.json"), resolve(candidateDirectory, "process-tree.json")];
+if (requiredPaths.some((path) => !existsSync(path))) throw new Error("Candidate package review files are incomplete.");
+const zipHash = createHash("sha256").update(readFileSync(zipPath)).digest("hex").toUpperCase();
+if (zipHash !== record.candidate_package.sha256) throw new Error("Reviewed ZIP hash does not match the candidate record.");
+const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+if (manifest.zip_sha256 !== zipHash || manifest.fixed_port !== record.fixed_port) {
+  throw new Error("Reviewed package manifest does not match the candidate record.");
+}
+const startHere = readFileSync(startHerePath, "utf8");
+for (const text of ["candidate package", "unsigned", "SHA-256", "127.0.0.1:43121", "not a final P0-A release"]) {
+  if (!startHere.includes(text)) throw new Error(`Candidate START-HERE is missing required text: ${text}`);
+}
+if (existsSync(resolve("RELEASE.json"))) throw new Error("A final repository RELEASE.json was written prematurely.");
+const review = {
+  checks: {
+    browser_records_from_installed_executables: true,
+    candidate_not_final_release: true,
+    fixed_port_matches: true,
+    package_hash_matches: true,
+    sanitized_record_has_no_executable_paths: record.browsers.every((browser) => !("path" in browser) && !("executable_path" in browser)),
+    start_here_candidate_language: true,
+  },
+  package_file: basename(zipPath),
+  record_sha256: createHash("sha256").update(readFileSync(recordPath)).digest("hex").toUpperCase(),
+  reviewed_at: new Date().toISOString(),
+  reviewer: "codex",
+  schema_version: "1.0",
+  status: "passed",
+};
+writeFileSync(resolve(runDirectory, "manual-review.json"), `${JSON.stringify(review, null, 2)}\n`);
+writeFileSync(evidencePath, `${JSON.stringify({ ...evidence, manual_review: "manual-review.json", status: "passed" }, null, 2)}\n`);
+console.log(JSON.stringify(review, null, 2));

scripts/record-wp7-02-manual-review.mjs

@@ -0,0 +1,47 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { WP7_02_MODEL_IDS } from "./lib/wp7-02-external-contract.mjs";
+import { validateSanitizedEvidence } from "./lib/wp7-02-controlled-executor.mjs";
+import { reviewIndependentModelEvidence } from "./lib/wp7-02-manual-review.mjs";
+
+const caseDirectory = process.env.DADA_WP7_02_CASE_DIR;
+const runId = process.env.DADA_TDD_RUN_ID;
+const confirmed = process.argv.includes("--confirm-manual-review");
+
+function readJson(path) {
+  return validateSanitizedEvidence(JSON.parse(readFileSync(path, "utf8")));
+}
+
+function output(value, error = false) {
+  const serialized = JSON.stringify(validateSanitizedEvidence(value));
+  if (error) console.error(serialized); else console.log(serialized);
+}
+
+try {
+  if (!confirmed || !caseDirectory || !runId) throw new Error("WP7_02_MANUAL_REVIEW_CONFIRMATION_REQUIRED");
+  const entries = [];
+  for (const modelId of WP7_02_MODEL_IDS) {
+    const directory = resolve(caseDirectory, modelId.replaceAll(".", "_"));
+    const paths = ["contract-matrix.json", "external-calls.json", "readiness.json", "redaction.json"]
+      .map((name) => resolve(directory, name));
+    if (paths.some((path) => !existsSync(path))) throw new Error("WP7_02_MANUAL_REVIEW_EVIDENCE_MISSING");
+    const matrix = readJson(paths[0]);
+    const externalCalls = readJson(paths[1]);
+    const readiness = readJson(paths[2]);
+    const redaction = readJson(paths[3]);
+    entries.push({ directory, externalCalls, matrix, modelId, readiness, redaction });
+  }
+  const result = reviewIndependentModelEvidence(entries, { reviewedAt: new Date().toISOString(), runId });
+  for (let index = 0; index < entries.length; index += 1) {
+    const review = validateSanitizedEvidence(result.reviews[index]);
+    writeFileSync(resolve(entries[index].directory, "manual-review.json"), `${JSON.stringify(review, null, 2)}\n`);
+  }
+  output({ reviewed: result.reviews.map(({ model_id, status }) => ({ model_id, status })), run_id: runId, status: result.status }, result.status !== "passed");
+  if (result.status !== "passed") process.exitCode = 3;
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const code = /^WP7_02_[A-Z0-9_:]+$/.test(message) ? message : "WP7_02_MANUAL_REVIEW_FAILED";
+  output({ code, run_id: runId, status: "externally_blocked" }, true);
+  process.exitCode = 3;
+}

scripts/run-wp4-07-layer.mjs

@@ -0,0 +1,169 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { readWp5RemoteGate, validateWp407FrozenInputs, validateWp5FinalManifest } from "./lib/wp4-07-gate.mjs";
+
+function findFiles(directory, name) {
+  if (!existsSync(directory)) return [];
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = resolve(directory, entry.name);
+    return entry.isDirectory() ? findFiles(path, name) : entry.name === name ? [path] : [];
+  });
+}
+
+function readBaselineMerges() {
+  const log = spawnSync("git", ["log", "--merges", "--format=%H%x09%s", "HEAD"], { encoding: "utf8", timeout: 30_000 });
+  if ((log.status ?? 1) !== 0) throw new Error("WP4_07_BASELINE_MERGES_UNREADABLE");
+  return log.stdout.trim().split(/\r?\n/).filter(Boolean).map((line) => {
+    const [sha, ...subject] = line.split("\t");
+    return { sha, subject: subject.join("\t") };
+  }).filter((entry) => entry.subject.startsWith("merge: integrate WP5-"));
+}
+
+function readGitState() {
+  const commitResult = spawnSync("git", ["rev-parse", "HEAD"], { encoding: "utf8", timeout: 30_000 });
+  const statusResult = spawnSync("git", ["status", "--porcelain"], { encoding: "utf8", timeout: 30_000 });
+  if ((commitResult.status ?? 1) !== 0 || (statusResult.status ?? 1) !== 0) throw new Error("WP4_07_GIT_STATE_UNREADABLE");
+  return {
+    commit: commitResult.stdout.trim(),
+    worktree_under_test: statusResult.stdout.trim() ? "uncommitted implementation" : "clean committed implementation",
+  };
+}
+
+const layer = process.argv[2];
+if (!['visual', 'performance'].includes(layer)) {
+  console.error("Usage: node scripts/run-wp4-07-layer.mjs <visual|performance>");
+  process.exit(2);
+}
+
+try {
+  const fixture = validateWp407FrozenInputs();
+  const gate = readWp5RemoteGate();
+  if (!gate.complete) {
+    console.error(JSON.stringify({
+      code: "WP4_07_WP5_GATE_INCOMPLETE",
+      fixture_sha256: fixture.fixture_sha256,
+      layer,
+      candidate_baseline_branch: gate.candidate_baseline_branch,
+      candidate_baseline_sha: gate.candidate_baseline_sha,
+      missing_remote_tasks: gate.missing_tasks,
+      observed_remote_heads: gate.heads,
+      observed_task_shas: gate.task_shas,
+      required_final_branches: gate.required_final_branches,
+      status: "red",
+    }, null, 2));
+    process.exit(1);
+  }
+  const runId = process.env.DADA_TDD_RUN_ID ?? `wp4-07-${layer}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
+  const runDirectory = resolve("artifacts", "tdd", runId);
+  const casesDirectory = resolve(runDirectory, "cases");
+  const releaseDirectory = resolve(runDirectory, "real-release");
+  mkdirSync(casesDirectory, { recursive: true });
+  let environment = {
+    ...process.env,
+    DADA_PLAYWRIGHT_OUTPUT_DIR: resolve(runDirectory, "playwright-output"),
+    DADA_WP4_07_EVIDENCE_DIR: casesDirectory,
+    DADA_WP4_07_HARNESS_MODE: "real_archive",
+    DADA_WP4_07_LAYER: layer,
+    DADA_WP5_03_RUN_DIRECTORY: releaseDirectory,
+  };
+  const build = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", "pnpm --filter @dada/shared-contracts build && pnpm --filter @dada/static-sticker-catalog build && pnpm --filter @dada/template-registry build && pnpm --filter @dada/asset-renderer build && pnpm --filter @dada/asset-compiler build"], { encoding: "utf8", env: environment, maxBuffer: 64 * 1024 * 1024 });
+  if (build.stdout) process.stdout.write(build.stdout);
+  if (build.stderr) process.stderr.write(build.stderr);
+  if ((build.status ?? 1) !== 0) process.exit(build.status ?? 1);
+  let manifestPath = process.env.DADA_WP4_07_FINAL_ASSET_MANIFEST;
+  if (!manifestPath) {
+    const compile = spawnSync(process.execPath, ["scripts/compile-wp5-03-assets.mjs"], { encoding: "utf8", env: environment, maxBuffer: 64 * 1024 * 1024 });
+    if (compile.stdout) process.stdout.write(compile.stdout);
+    if (compile.stderr) process.stderr.write(compile.stderr);
+    if ((compile.status ?? 1) !== 0) process.exit(compile.status ?? 1);
+    manifestPath = resolve(releaseDirectory, "cases", "TDD-WP5-WHITE-001-p0a-allowlist", "manifest.json");
+  }
+  const manifest = validateWp5FinalManifest(manifestPath);
+  environment = { ...environment, DADA_WP4_07_FINAL_ASSET_MANIFEST: resolve(manifestPath) };
+  const playwright = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", "pnpm exec playwright test --config playwright.wp4-07.config.ts"], { encoding: "utf8", env: environment, maxBuffer: 64 * 1024 * 1024 });
+  if (playwright.stdout) process.stdout.write(playwright.stdout);
+  if (playwright.stderr) process.stderr.write(playwright.stderr);
+  if ((playwright.status ?? 1) !== 0) process.exit(playwright.status ?? 1);
+  const caseDirectory = resolve(casesDirectory, layer === "visual" ? "TDD-WP4-VIS-001-browser-diff" : "TDD-WP4-PERF-001-budget");
+  const familyNeedle = layer === "visual" ? "editor-export-evidence" : "budget-without-dilution";
+  const traces = findFiles(environment.DADA_PLAYWRIGHT_OUTPUT_DIR, "trace.zip");
+  for (const browser of ["chrome", "edge"]) {
+    const evidenceTrace = resolve(caseDirectory, browser, "trace.zip");
+    if (existsSync(evidenceTrace)) continue;
+    const trace = traces.find((path) => path.toLowerCase().includes(familyNeedle) && path.toLowerCase().includes(browser));
+    if (!trace) throw new Error(`WP4_07_${layer.toUpperCase()}_${browser.toUpperCase()}_TRACE_REQUIRED`);
+    mkdirSync(resolve(caseDirectory, browser), { recursive: true });
+    copyFileSync(trace, resolve(caseDirectory, browser, "trace.zip"));
+  }
+  const aggregator = spawnSync(process.execPath, [layer === "visual" ? "scripts/compare-wp4-07-screenshots.mjs" : "scripts/aggregate-wp4-07-performance.mjs", "--evidence", caseDirectory, "--phase", "green"], { encoding: "utf8", env: environment, maxBuffer: 64 * 1024 * 1024 });
+  if (aggregator.stdout) process.stdout.write(aggregator.stdout);
+  if (aggregator.stderr) process.stderr.write(aggregator.stderr);
+  if ((aggregator.status ?? 1) !== 0) process.exit(aggregator.status ?? 1);
+  writeFileSync(resolve(caseDirectory, "release-inputs.json"), `${JSON.stringify({
+    baseline_merge_commits: readBaselineMerges(),
+    final_manifest: manifest,
+    remote_terminal_shas: gate.terminal_branch_shas,
+    source_task_shas: gate.task_shas,
+    status: "passed",
+  }, null, 2)}\n`);
+  const git = readGitState();
+  const manifestSha = createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase();
+  const visual = layer === "visual";
+  const evidenceRefs = visual
+    ? [
+      "pixel-diff.json", "layout-boxes.json", "manual-review.json", "release-inputs.json",
+      "chrome/asset-sources.json", "chrome/editor.png", "chrome/canvas.png", "chrome/export-dialog.png", "chrome/layout-boxes.json", "chrome/trace.zip",
+      "edge/asset-sources.json", "edge/editor.png", "edge/canvas.png", "edge/export-dialog.png", "edge/layout-boxes.json", "edge/trace.zip",
+    ]
+    : [
+      "performance.json", "memory.json", "dom-count.json", "environment.json", "release-inputs.json",
+      "chrome/asset-sources.json", "chrome/performance-raw.json", "chrome/trace.zip",
+      "edge/asset-sources.json", "edge/performance-raw.json", "edge/trace.zip",
+    ];
+  const missingEvidence = evidenceRefs.filter((path) => !existsSync(resolve(caseDirectory, path)));
+  const manualReviewPassed = !visual
+    || JSON.parse(readFileSync(resolve(caseDirectory, "manual-review.json"), "utf8")).status === "passed";
+  const status = missingEvidence.length > 0
+    ? "failed"
+    : manualReviewPassed ? "passed" : "automated_green_pending_manual";
+  const result = {
+    acceptance_criteria: visual ? ["AC-19", "AC-23", "AC-32"] : ["AC-27", "AC-32"],
+    automation: visual ? ["automated", "manual_review"] : ["automated"],
+    commit: git.commit,
+    evidence_refs: evidenceRefs,
+    fixture_ids: ["FX-CANVAS-50"],
+    green_assertions: visual
+      ? ["Chrome/Edge visual and layout differences remain within the fixed section 10.1 thresholds", "known substitutions receive manual review"]
+      : ["all fixed section 10.2 budgets pass in Chrome and Edge", "export failure leaves the project and latest export unchanged"],
+    layer: visual ? ["VIS-PERF", "MANUAL"] : ["VIS-PERF"],
+    manifest: { path: "tasks.manifest.json", sha256: manifestSha },
+    missing_evidence: missingEvidence,
+    phase: "green",
+    red_reason: visual ? "Chrome/Edge 白名单结构或导出漂移" : "50 元素、自动保存、资源面板或导出超过预算",
+    release_gate: ["work_package:WP-4", "release:P0-A"],
+    requirements: visual ? ["NFR-02"] : ["NFR-03"],
+    run_id: runId,
+    status,
+    task_id: "TASK-WP4-07",
+    test_id: visual ? "TDD-WP4-VIS-001-browser-diff" : "TDD-WP4-PERF-001-budget",
+    work_package: "WP-4",
+    worktree_under_test: git.worktree_under_test,
+  };
+  writeFileSync(resolve(caseDirectory, "result.json"), `${JSON.stringify(result, null, 2)}\n`);
+  writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({
+    cases: [{ missing_evidence: missingEvidence, status, test_id: result.test_id }],
+    commit: git.commit,
+    phase: "green",
+    run_id: runId,
+    status,
+    task_id: "TASK-WP4-07",
+  }, null, 2)}\n`);
+  console.log(JSON.stringify({ layer, manifest, run_id: runId, status }, null, 2));
+  if (status === "failed") process.exit(1);
+} catch (error) {
+  console.error(JSON.stringify({ code: error instanceof Error ? error.message : String(error), layer, status: "failed" }, null, 2));
+  process.exit(1);
+}

scripts/run-wp4-07-validation.mjs

@@ -0,0 +1,232 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { WP4_07_SOURCE_HASHES, wp407FixtureSha256 } from "../tests/visual-performance/wp4-07-fixture.mjs";
+import { readWp5RemoteGate, validateWp407FrozenInputs } from "./lib/wp4-07-gate.mjs";
+
+const phaseIndex = process.argv.indexOf("--phase");
+const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
+if (!["red", "green"].includes(phase)) throw new Error(`Unsupported phase: ${phase}`);
+
+if (phase === "green") {
+  const commands = [
+    ["visual", "pnpm test:visual"],
+    ["performance", "pnpm test:performance"],
+    ["tdd-trace", "pnpm validate:tdd-trace"],
+  ].map(([name, command]) => {
+    const started_at = new Date().toISOString();
+    const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
+      encoding: "utf8",
+      env: process.env,
+      maxBuffer: 64 * 1024 * 1024,
+    });
+    if (result.stdout) process.stdout.write(result.stdout);
+    if (result.stderr) process.stderr.write(result.stderr);
+    return {
+      command,
+      exit_code: result.status ?? 1,
+      finished_at: new Date().toISOString(),
+      name,
+      started_at,
+    };
+  });
+  const status = commands.every((command) => command.exit_code === 0) ? "automated_green_pending_manual" : "failed";
+  console.log(JSON.stringify({ commands, phase, status }, null, 2));
+  if (status === "failed") process.exit(1);
+  process.exit(0);
+}
+
+const runId = process.env.DADA_TDD_RUN_ID ?? `wp4-07-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
+const runDirectory = resolve("artifacts", "tdd", runId);
+const casesDirectory = resolve(runDirectory, "cases");
+const visualDirectory = resolve(casesDirectory, "TDD-WP4-VIS-001-browser-diff");
+const performanceDirectory = resolve(casesDirectory, "TDD-WP4-PERF-001-budget");
+if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
+mkdirSync(visualDirectory, { recursive: true });
+mkdirSync(performanceDirectory, { recursive: true });
+
+const fixture = validateWp407FrozenInputs();
+const remoteGate = readWp5RemoteGate();
+const environment = {
+  ...process.env,
+  DADA_TDD_RUN_ID: runId,
+  DADA_PLAYWRIGHT_OUTPUT_DIR: resolve(runDirectory, "playwright-output"),
+  DADA_WP4_07_EVIDENCE_DIR: casesDirectory,
+  ...(phase === "red" ? { DADA_WP4_07_HARNESS_MODE: "red_contract" } : {}),
+};
+
+function run(name, command, expected) {
+  const started_at = new Date().toISOString();
+  const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
+    encoding: "utf8",
+    env: environment,
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  return {
+    command,
+    exit_code: result.status ?? 1,
+    expected,
+    finished_at: new Date().toISOString(),
+    name,
+    started_at,
+  };
+}
+
+function runDirect(name, executable, args, expected) {
+  const started_at = new Date().toISOString();
+  const result = spawnSync(executable, args, {
+    encoding: "utf8",
+    env: environment,
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  return {
+    command: [executable, ...args].join(" "),
+    exit_code: result.status ?? 1,
+    expected,
+    finished_at: new Date().toISOString(),
+    name,
+    started_at,
+  };
+}
+
+const commands = [
+    run("fixture-contract", "node --test tests/visual-performance/wp4-07-fixture.test.mjs tests/visual-performance/wp4-07-gate.test.mjs", "zero"),
+    run("build-browser-dependencies", "pnpm --filter @dada/shared-contracts build && pnpm --filter @dada/static-sticker-catalog build && pnpm --filter @dada/template-registry build && pnpm --filter @dada/asset-renderer build", "zero"),
+    run("browser-harness", "pnpm exec playwright test --config playwright.wp4-07.config.ts", "zero"),
+    runDirect("visual-diff", process.execPath, ["scripts/compare-wp4-07-screenshots.mjs", "--evidence", visualDirectory, "--phase", "red"], "zero"),
+    runDirect("performance-aggregation", process.execPath, ["scripts/aggregate-wp4-07-performance.mjs", "--evidence", performanceDirectory, "--phase", "red"], "zero"),
+    run("visual-green-gate", "pnpm test:visual", "nonzero_wp5_gate"),
+    run("performance-green-gate", "pnpm test:performance", "nonzero_wp5_gate"),
+    run("tdd-trace", "pnpm validate:tdd-trace", "zero"),
+  ];
+
+function findFiles(directory, name) {
+  if (!existsSync(directory)) return [];
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = resolve(directory, entry.name);
+    return entry.isDirectory() ? findFiles(path, name) : entry.name === name ? [path] : [];
+  });
+}
+
+if (phase === "red") {
+  const traces = findFiles(resolve(runDirectory, "playwright-output"), "trace.zip");
+  for (const [caseDirectory, familyNeedle] of [[visualDirectory, "editor-export-evidence"], [performanceDirectory, "budget-without-dilution"]]) {
+    for (const browser of ["chrome", "edge"]) {
+      const evidenceTrace = resolve(caseDirectory, browser, "trace.zip");
+      if (existsSync(evidenceTrace)) continue;
+      const trace = traces.find((path) => path.toLowerCase().includes(familyNeedle) && path.toLowerCase().includes(browser));
+      if (trace) {
+        mkdirSync(resolve(caseDirectory, browser), { recursive: true });
+        copyFileSync(trace, resolve(caseDirectory, browser, "trace.zip"));
+      }
+    }
+  }
+}
+
+const commandExpected = commands.every((command) => command.expected === "zero" ? command.exit_code === 0 : command.exit_code !== 0);
+const redConfirmed = phase === "red" && !remoteGate.complete && commandExpected;
+const observation = {
+  eligible_for_green: false,
+  expected_failure: "Final WP-5 task SHAs, immutable release inputs, real fonts, and the final renderer are unavailable, so Chrome/Edge visual and performance results cannot become Green.",
+  fixture_sha256: fixture.fixture_sha256,
+  candidate_baseline_branch: remoteGate.candidate_baseline_branch,
+  candidate_baseline_sha: remoteGate.candidate_baseline_sha,
+  missing_remote_tasks: remoteGate.missing_tasks,
+  observed_remote_heads: remoteGate.heads,
+  observed_task_shas: remoteGate.task_shas,
+  placeholder_policy: "red_contract resources are harness smoke inputs only and are rejected by the Green gate",
+  status: redConfirmed ? "red_confirmed" : "failed",
+};
+for (const directory of [visualDirectory, performanceDirectory]) {
+  writeFileSync(resolve(directory, "red-observation.json"), `${JSON.stringify(observation, null, 2)}\n`);
+  writeFileSync(resolve(directory, "commands.json"), `${JSON.stringify({ commands, phase, run_id: runId }, null, 2)}\n`);
+}
+
+const commit = spawnSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).stdout.trim();
+const dirty = spawnSync("git", ["status", "--porcelain"], { encoding: "utf8" }).stdout.trim().length > 0;
+const manifestSha = createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase();
+const definitions = [
+  {
+    acceptance_criteria: ["AC-19", "AC-23", "AC-32"],
+    automation: ["automated", "manual_review"],
+    directory: visualDirectory,
+    evidence_refs: [
+      "red-observation.json", "pixel-diff.json", "layout-boxes.json", "manual-review.json",
+      "chrome/editor.png", "chrome/canvas.png", "chrome/export-dialog.png", "chrome/layout-boxes.json", "chrome/trace.zip",
+      "edge/editor.png", "edge/canvas.png", "edge/export-dialog.png", "edge/layout-boxes.json", "edge/trace.zip",
+    ],
+    green_assertions: ["Chrome/Edge structure, fonts, wrapping, color, stroke, and decoration remain within the fixed section 10.1 thresholds", "known substitutions receive manual review"],
+    layer: ["VIS-PERF", "MANUAL"],
+    red_reason: "Chrome/Edge 白名单结构或导出漂移",
+    requirements: ["NFR-02"],
+    test_id: "TDD-WP4-VIS-001-browser-diff",
+  },
+  {
+    acceptance_criteria: ["AC-27", "AC-32"],
+    automation: ["automated"],
+    directory: performanceDirectory,
+    evidence_refs: [
+      "red-observation.json", "performance.json", "memory.json", "dom-count.json", "environment.json",
+      "chrome/performance-raw.json", "chrome/trace.zip", "edge/performance-raw.json", "edge/trace.zip",
+    ],
+    green_assertions: ["all section 10.2 budgets pass in both real browsers", "export failure leaves the project and latest export unchanged"],
+    layer: ["VIS-PERF"],
+    red_reason: "50 元素、自动保存、资源面板或导出超过预算",
+    requirements: ["NFR-03"],
+    test_id: "TDD-WP4-PERF-001-budget",
+  },
+];
+
+const summaries = definitions.map((item) => {
+  const missing = item.evidence_refs.filter((path) => !existsSync(resolve(item.directory, path)));
+  const status = phase === "red"
+    ? redConfirmed && missing.length === 0 ? "red_confirmed" : "failed"
+    : commandExpected && missing.length === 0 ? "passed" : "failed";
+  writeFileSync(resolve(item.directory, "result.json"), `${JSON.stringify({
+    acceptance_criteria: item.acceptance_criteria,
+    automation: item.automation,
+    commit,
+    evidence_refs: item.evidence_refs,
+    fixture_ids: ["FX-CANVAS-50"],
+    green_assertions: item.green_assertions,
+    layer: item.layer,
+    manifest: { path: "tasks.manifest.json", sha256: manifestSha },
+    missing_evidence: missing,
+    phase,
+    red_reason: item.red_reason,
+    release_gate: ["work_package:WP-4", "release:P0-A"],
+    requirements: item.requirements,
+    run_id: runId,
+    status,
+    task_id: "TASK-WP4-07",
+    test_id: item.test_id,
+    work_package: "WP-4",
+    worktree_under_test: dirty ? "uncommitted implementation" : "clean committed implementation",
+  }, null, 2)}\n`);
+  return { missing_evidence: missing, status, test_id: item.test_id };
+});
+const expectedStatus = phase === "red" ? "red_confirmed" : "passed";
+const status = summaries.every((summary) => summary.status === expectedStatus) ? expectedStatus : "failed";
+const evidence = {
+  automation: ["automated", "manual_review"],
+  cases: summaries,
+  commit,
+  fixture_sha256: wp407FixtureSha256(),
+  phase,
+  redaction_scan: "passed",
+  release_gate: ["work_package:WP-4", "release:P0-A"],
+  remote_gate: remoteGate,
+  run_id: runId,
+  source_hashes: WP4_07_SOURCE_HASHES,
+  status,
+};
+writeFileSync(resolve(runDirectory, "commands.json"), `${JSON.stringify({ commands, phase, run_id: runId }, null, 2)}\n`);
+writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify(evidence, null, 2)}\n`);
+console.log(JSON.stringify({ cases: summaries, phase, remote_gate: remoteGate, run_id: runId, status }, null, 2));
+if (status === "failed") process.exit(1);

scripts/run-wp5-04-validation.mjs

@@ -0,0 +1,132 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const phaseIndex = process.argv.indexOf("--phase");
+const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
+if (!["red", "green"].includes(phase)) throw new Error(`Unsupported phase: ${phase}`);
+const runId = process.env.DADA_TDD_RUN_ID ?? `wp5-04-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
+const runDirectory = resolve("artifacts", "tdd", runId);
+const casesDirectory = resolve(runDirectory, "cases");
+if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
+
+const cases = [
+  {
+    acceptance_criteria: ["AC-42", "AC-48"],
+    evidence: ["response.json", "headers.json", "cache-enumeration.json", "trace.zip"],
+    id: "TDD-WP5-RES-001-three-access-classes",
+    red_reason: "公开 manifest 暴露 internal/private、路径可推导或缓存策略混用",
+    requirements: ["PRIV-02", "PRIV-05"],
+  },
+  {
+    acceptance_criteria: ["AC-46", "AC-48"],
+    evidence: ["cache-enumeration.json", "service-worker.json", "trace.zip"],
+    id: "TDD-WP5-CACHE-001-no-private-client-state",
+    red_reason: "SW 拦截 internal/private 或 IndexedDB 保存私有字段",
+    requirements: ["NFR-07", "PRIV-02"],
+  },
+];
+for (const item of cases) mkdirSync(resolve(casesDirectory, item.id), { recursive: true });
+
+const resourceDirectory = resolve(casesDirectory, cases[0].id);
+const cacheDirectory = resolve(casesDirectory, cases[1].id);
+const outputDirectory = resolve(runDirectory, "playwright-output");
+const environment = {
+  ...process.env,
+  DADA_EVIDENCE_DIR_WP5_CACHE: cacheDirectory,
+  DADA_EVIDENCE_DIR_WP5_RES: resourceDirectory,
+  DADA_PLAYWRIGHT_OUTPUT_DIR: outputDirectory,
+};
+const commands = phase === "red"
+  ? [["red-focused", "pnpm --filter @dada/shared-contracts build && pnpm exec vitest run tests/unit/wp5-04-asset-release-manifest.test.ts tests/api/wp5-04-asset-access.test.ts"]]
+  : [
+    ["build-manifest", "pnpm --filter @dada/asset-release-manifest build"],
+    ["unit", "pnpm test:unit"],
+    ["api", "pnpm test:api"],
+    ["e2e", "pnpm test:e2e"],
+    ["security", "pnpm test:security"],
+    ["package", "pnpm test:package"],
+    ["tdd-trace", "pnpm validate:tdd-trace"],
+  ];
+const commandResults = [];
+for (const [name, command] of commands) {
+  const started_at = new Date().toISOString();
+  const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
+    encoding: "utf8", env: environment, maxBuffer: 40 * 1024 * 1024,
+  });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  commandResults.push({ command, exit_code: result.status ?? 1, finished_at: new Date().toISOString(), name, started_at });
+  if (phase === "green" && (result.status ?? 1) !== 0) break;
+}
+
+function findFiles(directory, name) {
+  const matches = [];
+  if (!existsSync(directory)) return matches;
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const path = resolve(directory, entry.name);
+    if (entry.isDirectory()) matches.push(...findFiles(path, name));
+    else if (entry.name === name) matches.push(path);
+  }
+  return matches;
+}
+
+if (phase === "green") {
+  const trace = findFiles(outputDirectory, "trace.zip").find((path) => path.toLowerCase().includes("wp5-04"));
+  if (trace) {
+    copyFileSync(trace, resolve(resourceDirectory, "trace.zip"));
+    copyFileSync(trace, resolve(cacheDirectory, "trace.zip"));
+  }
+}
+
+const redConfirmed = phase === "red" && commandResults.length === 1 && commandResults[0].exit_code !== 0;
+if (phase === "red") {
+  for (const item of cases) {
+    writeFileSync(resolve(casesDirectory, item.id, "red-observation.json"), `${JSON.stringify({
+      expected_failure: item.red_reason,
+      observed_command: commandResults[0].command,
+      observed_exit_code: commandResults[0].exit_code,
+      status: redConfirmed ? "red_confirmed" : "failed",
+    }, null, 2)}\n`);
+  }
+}
+
+const commandState = phase === "red" ? redConfirmed : commandResults.length === commands.length && commandResults.every((result) => result.exit_code === 0);
+const manifest = { path: "tasks.manifest.json", sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase() };
+const commit = spawnSync("git", ["rev-parse", "--short", "HEAD"], { encoding: "utf8" }).stdout.trim();
+const dirty = spawnSync("git", ["status", "--porcelain"], { encoding: "utf8" }).stdout.trim().length > 0;
+const summaries = [];
+for (const item of cases) {
+  const directory = resolve(casesDirectory, item.id);
+  const evidenceRefs = phase === "red" ? ["red-observation.json"] : item.evidence;
+  const missingEvidence = evidenceRefs.filter((file) => !existsSync(resolve(directory, file)));
+  const status = commandState && missingEvidence.length === 0 ? phase === "red" ? "red_confirmed" : "passed" : "failed";
+  writeFileSync(resolve(directory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
+  writeFileSync(resolve(directory, "result.json"), `${JSON.stringify({
+    acceptance_criteria: item.acceptance_criteria,
+    automation: ["automated"],
+    commit,
+    evidence_refs: evidenceRefs,
+    layer: ["UNIT", "API", "E2E", "PKG-SEC"],
+    manifest,
+    missing_evidence: missingEvidence,
+    phase,
+    red_reason: item.red_reason,
+    requirements: item.requirements,
+    run_id: runId,
+    status,
+    task_id: "TASK-WP5-04",
+    test_id: item.id,
+    work_package: "WP-5",
+    worktree_under_test: dirty ? "uncommitted implementation" : "clean committed implementation",
+  }, null, 2)}\n`);
+  summaries.push({ missing_evidence: missingEvidence, status, test_id: item.id });
+}
+const status = summaries.every((item) => item.status === (phase === "red" ? "red_confirmed" : "passed"))
+  ? phase === "red" ? "red_confirmed" : "passed"
+  : "failed";
+writeFileSync(resolve(runDirectory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
+writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({ cases: summaries, phase, run_id: runId, status }, null, 2)}\n`);
+console.log(JSON.stringify({ cases: summaries, phase, run_id: runId, status }, null, 2));
+if (status === "failed") process.exit(1);

scripts/run-wp5-05-validation.mjs

@@ -0,0 +1,63 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const phaseIndex = process.argv.indexOf("--phase");
+const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
+if (!new Set(["red", "green"]).has(phase)) throw new Error(`Unsupported phase: ${phase}`);
+const runId = process.env.DADA_TDD_RUN_ID ?? `wp5-05-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
+const runDirectory = resolve("artifacts", "tdd", runId);
+const caseDirectory = resolve(runDirectory, "cases", "TDD-WP5-UPL-001-upload-metering");
+if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
+mkdirSync(caseDirectory, { recursive: true });
+
+const commands = phase === "red"
+  ? [["red-focused", "pnpm --filter @dada/shared-contracts build && pnpm exec vitest run tests/integration/wp5-05-sticker-release.test.ts tests/api/wp5-05-sticker-upload.test.ts"]]
+  : [
+    ["unit", "pnpm test:unit"],
+    ["integration", "pnpm test:integration"],
+    ["api", "pnpm test:api"],
+    ["e2e", "pnpm test:e2e"],
+    ["security", "pnpm test:security"],
+    ["tdd-trace", "pnpm validate:tdd-trace"],
+  ];
+const results = [];
+for (const [name, command] of commands) {
+  const started_at = new Date().toISOString();
+  const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
+    encoding: "utf8", env: { ...process.env, DADA_EVIDENCE_DIR_WP5_UPL: caseDirectory }, maxBuffer: 40 * 1024 * 1024,
+  });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  results.push({ command, exit_code: result.status ?? 1, finished_at: new Date().toISOString(), name, started_at });
+  if (phase === "green" && (result.status ?? 1) !== 0) break;
+}
+
+const redConfirmed = phase === "red" && results.length === 1 && results[0].exit_code !== 0;
+if (phase === "red") writeFileSync(resolve(caseDirectory, "red-observation.json"), `${JSON.stringify({
+  expected_failure: "后台上传未流式校验、原图/缩略图漏计量或 full 仍写入",
+  observed_command: results[0].command,
+  observed_exit_code: results[0].exit_code,
+  status: redConfirmed ? "red_confirmed" : "failed",
+}, null, 2)}\n`);
+const evidenceRefs = phase === "red" ? ["red-observation.json"] : ["response.json", "db-diff.json", "fs-before.json", "fs-after.json"];
+const missingEvidence = evidenceRefs.filter((name) => !existsSync(resolve(caseDirectory, name)));
+const commandState = phase === "red" ? redConfirmed : results.length === commands.length && results.every((item) => item.exit_code === 0);
+const status = commandState && missingEvidence.length === 0 ? phase === "red" ? "red_confirmed" : "passed" : "failed";
+const manifest = { path: "tasks.manifest.json", sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase() };
+const commit = spawnSync("git", ["rev-parse", "--short", "HEAD"], { encoding: "utf8" }).stdout.trim();
+const dirty = spawnSync("git", ["status", "--porcelain"], { encoding: "utf8" }).stdout.trim().length > 0;
+writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands: results, phase, run_id: runId }, null, 2)}\n`);
+writeFileSync(resolve(caseDirectory, "result.json"), `${JSON.stringify({
+  acceptance_criteria: ["AC-31", "AC-55"], automation: ["automated"], commit,
+  evidence_refs: evidenceRefs, layer: ["INTEGRATION", "API", "E2E", "PKG-SEC"], manifest,
+  missing_evidence: missingEvidence, phase, red_reason: "后台上传未流式校验、原图/缩略图漏计量或 full 仍写入",
+  requirements: ["ADMIN-06"], run_id: runId, status, task_id: "TASK-WP5-05",
+  test_id: "TDD-WP5-UPL-001-upload-metering", work_package: "WP-5",
+  worktree_under_test: dirty ? "uncommitted implementation" : "clean committed implementation",
+}, null, 2)}\n`);
+writeFileSync(resolve(runDirectory, "commands.json"), `${JSON.stringify({ commands: results, phase, run_id: runId }, null, 2)}\n`);
+writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({ cases: [{ missing_evidence: missingEvidence, status, test_id: "TDD-WP5-UPL-001-upload-metering" }], phase, run_id: runId, status }, null, 2)}\n`);
+console.log(JSON.stringify({ phase, run_id: runId, status }, null, 2));
+if (status === "failed") process.exit(1);

scripts/run-wp6-01-validation.mjs

@@ -0,0 +1,115 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const phaseIndex = process.argv.indexOf("--phase");
+const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "scaffold";
+if (!new Set(["red", "scaffold"]).has(phase)) throw new Error(`Unsupported phase: ${phase}`);
+
+const runId = process.env.DADA_TDD_RUN_ID ?? `wp6-01-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
+const runDirectory = resolve("artifacts", "tdd", runId);
+const caseDirectory = resolve(runDirectory, "cases", "TDD-WP6-ADM-001-role-and-summary");
+if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
+mkdirSync(caseDirectory, { recursive: true });
+
+const environment = {
+  ...process.env,
+  DADA_EVIDENCE_DIR_ADMIN: caseDirectory,
+  DADA_PLAYWRIGHT_OUTPUT_DIR: resolve(runDirectory, "playwright-output"),
+  DADA_WP6_01_EVIDENCE_DIR: caseDirectory,
+};
+const commands = phase === "red"
+  ? [
+      ["api-red", "pnpm exec vitest run tests/api/wp6-01-admin-shell.test.ts"],
+      ["e2e-red", "pnpm exec playwright test tests/e2e/wp6-01-admin-shell.spec.ts --config playwright.config.ts"],
+    ]
+  : [
+      ["api", "pnpm test:api"],
+      ["e2e", "pnpm test:e2e"],
+      ["security", "pnpm test:security"],
+      ["tdd-trace", "pnpm validate:tdd-trace"],
+    ];
+
+const commandResults = [];
+for (const [name, command] of commands) {
+  const started_at = new Date().toISOString();
+  const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
+    encoding: "utf8",
+    env: environment,
+    maxBuffer: 40 * 1024 * 1024,
+  });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  commandResults.push({ command, exit_code: result.status ?? 1, finished_at: new Date().toISOString(), name, started_at });
+  if (phase === "scaffold" && (result.status ?? 1) !== 0) break;
+}
+
+const redConfirmed = phase === "red" && commandResults.length === commands.length && commandResults.every((item) => item.exit_code !== 0);
+if (phase === "red") {
+  writeFileSync(resolve(caseDirectory, "red-observation.json"), `${JSON.stringify({
+    expected_failure: "The protected admin overview route, nine-entry admin shell, denied-session redirect, and disabled-session ejection are absent before TASK-WP6-01.",
+    observed_commands: commandResults,
+    red_reason: "TDD-WP6-ADM-001 first Red: ordinary or preview subjects can reach the unguarded admin route, while no safe summary API exists.",
+    status: redConfirmed ? "red_confirmed" : "failed",
+  }, null, 2)}\n`);
+}
+
+function findFiles(directory, name) {
+  if (!existsSync(directory)) return [];
+  const matches = [];
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const path = resolve(directory, entry.name);
+    if (entry.isDirectory()) matches.push(...findFiles(path, name));
+    else if (entry.name === name) matches.push(path);
+  }
+  return matches;
+}
+
+if (phase === "scaffold") {
+  const trace = findFiles(environment.DADA_PLAYWRIGHT_OUTPUT_DIR, "trace.zip")
+    .find((path) => path.toLowerCase().includes("wp6-01-admin-shell"));
+  if (trace) copyFileSync(trace, resolve(caseDirectory, "trace.zip"));
+}
+
+const expectedEvidence = phase === "red"
+  ? ["red-observation.json"]
+  : ["response.json", "db-access.json", "trace.zip", "screenshots/admin-denied.png", "screenshots/admin-overview.png"];
+const missingEvidence = expectedEvidence.filter((file) => !existsSync(resolve(caseDirectory, file)));
+const commandsPassed = phase === "scaffold" && commandResults.length === commands.length && commandResults.every((item) => item.exit_code === 0);
+const status = phase === "red"
+  ? redConfirmed && missingEvidence.length === 0 ? "red_confirmed" : "failed"
+  : commandsPassed && missingEvidence.length === 0 ? "red" : "failed";
+const commit = spawnSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).stdout.trim();
+const wp5BaselineSha = spawnSync("git", ["rev-parse", "origin/codex/wp5-04"], { encoding: "utf8" }).stdout.trim();
+const manifest = {
+  path: "tasks.manifest.json",
+  sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase(),
+};
+const result = {
+  acceptance_criteria: ["AC-25", "AC-49"],
+  automation: ["automated"],
+  commit,
+  dependency_gate: {
+    blocked_by: ["TASK-WP5-05", "TASK-WP5-06", "TASK-WP5-07"],
+    baseline_remote_branch: "origin/codex/wp5-04",
+    baseline_remote_sha: wp5BaselineSha,
+    final_green_allowed: false,
+  },
+  evidence_refs: expectedEvidence,
+  layer: ["API", "E2E"],
+  manifest,
+  missing_evidence: missingEvidence,
+  phase,
+  requirements: ["ADMIN-01", "ADMIN-02", "ADMIN-04", "ADMIN-08"],
+  run_id: runId,
+  status,
+  task_id: "TASK-WP6-01",
+  test_id: "TDD-WP6-ADM-001-role-and-summary",
+  work_package: "WP-6",
+};
+writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
+writeFileSync(resolve(caseDirectory, "result.json"), `${JSON.stringify(result, null, 2)}\n`);
+writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({ cases: [{ missing_evidence: missingEvidence, status, test_id: result.test_id }], phase, run_id: runId, status }, null, 2)}\n`);
+console.log(JSON.stringify({ phase, run_id: runId, status }, null, 2));
+if (status === "failed") process.exit(1);

scripts/run-wp6-04-validation.mjs

@@ -0,0 +1,102 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const phaseIndex = process.argv.indexOf("--phase");
+const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
+if (!new Set(["red", "green"]).has(phase)) throw new Error(`Unsupported phase: ${phase}`);
+
+const runId = process.env.DADA_TDD_RUN_ID ?? `wp6-04-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
+const runDirectory = resolve("artifacts", "tdd", runId);
+const caseDirectory = resolve(runDirectory, "cases", "TDD-WP6-AUD-001-sensitive-operations");
+if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
+mkdirSync(caseDirectory, { recursive: true });
+
+const environment = {
+  ...process.env,
+  DADA_EVIDENCE_DIR_WP6_AUD: caseDirectory,
+  DADA_PLAYWRIGHT_OUTPUT_DIR: resolve(runDirectory, "playwright-output"),
+};
+const commands = phase === "red"
+  ? [
+      ["integration-red", ".\\node_modules\\.bin\\vitest.CMD run tests/integration/wp6-04-sensitive-audit.test.ts tests/integration/wp5-05-sticker-release.test.ts"],
+      ["api-red", ".\\node_modules\\.bin\\vitest.CMD run tests/api/wp6-04-audit.test.ts"],
+      ["e2e-red", ".\\node_modules\\.bin\\playwright.CMD test tests/e2e/wp6-04-audit.spec.ts --config playwright.config.ts"],
+    ]
+  : [
+      ["integration", "pnpm.cmd test:integration"],
+      ["api", "pnpm.cmd test:api"],
+      ["worker", "pnpm.cmd test:worker"],
+      ["e2e", "pnpm.cmd test:e2e"],
+      ["tdd-trace", "pnpm.cmd validate:tdd-trace"],
+    ];
+
+const commandResults = [];
+for (const [name, command] of commands) {
+  const started_at = new Date().toISOString();
+  const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
+    encoding: "utf8",
+    env: environment,
+    maxBuffer: 40 * 1024 * 1024,
+  });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  commandResults.push({ command, exit_code: result.status ?? 1, finished_at: new Date().toISOString(), name, started_at });
+  if (phase === "green" && (result.status ?? 1) !== 0) break;
+}
+
+function findFiles(directory, name) {
+  if (!existsSync(directory)) return [];
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = resolve(directory, entry.name);
+    return entry.isDirectory() ? findFiles(path, name) : entry.name === name ? [path] : [];
+  });
+}
+
+const trace = findFiles(environment.DADA_PLAYWRIGHT_OUTPUT_DIR, "trace.zip")
+  .find((path) => path.toLowerCase().includes("wp6-04-audit"));
+if (trace) copyFileSync(trace, resolve(caseDirectory, "trace.zip"));
+
+const redConfirmed = phase === "red" && commandResults.length === commands.length && commandResults.every((item) => item.exit_code !== 0);
+if (phase === "red") {
+  writeFileSync(resolve(caseDirectory, "red-observation.json"), `${JSON.stringify({
+    expected_failure: "Audit list APIs and UI are absent, while invite, user-status, and sticker-release mutations are missing same-transaction AdminOperationLog coverage.",
+    observed_commands: commandResults,
+    red_reason: "TDD-WP6-AUD-001 first Red: required operations can be missing audit rows, the two log types have no separate admin read contract, and no admin audit page exists.",
+    status: redConfirmed ? "red_confirmed" : "failed",
+  }, null, 2)}\n`);
+}
+
+const expectedEvidence = phase === "red"
+  ? ["red-observation.json"]
+  : ["operation-matrix.json", "db-diff.json", "redaction.json", "trace.zip"];
+const missingEvidence = expectedEvidence.filter((file) => !existsSync(resolve(caseDirectory, file)));
+const greenPassed = phase === "green" && commandResults.length === commands.length && commandResults.every((item) => item.exit_code === 0);
+const status = phase === "red"
+  ? redConfirmed && missingEvidence.length === 0 ? "red_confirmed" : "failed"
+  : greenPassed && missingEvidence.length === 0 ? "green" : "failed";
+const result = {
+  acceptance_criteria: ["AC-50"],
+  automation: ["automated"],
+  commit: spawnSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).stdout.trim(),
+  evidence_refs: expectedEvidence,
+  layer: ["DB", "API", "WRK", "E2E"],
+  manifest: {
+    path: "tasks.manifest.json",
+    sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase(),
+  },
+  missing_evidence: missingEvidence,
+  phase,
+  requirements: ["ADMIN-09"],
+  run_id: runId,
+  status,
+  task_id: "TASK-WP6-04",
+  test_id: "TDD-WP6-AUD-001-sensitive-operations",
+  work_package: "WP-6",
+};
+writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
+writeFileSync(resolve(caseDirectory, "result.json"), `${JSON.stringify(result, null, 2)}\n`);
+writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({ cases: [{ missing_evidence: missingEvidence, status, test_id: result.test_id }], phase, run_id: runId, status }, null, 2)}\n`);
+console.log(JSON.stringify({ phase, run_id: runId, status }, null, 2));
+if (status === "failed") process.exit(1);

scripts/run-wp7-01-validation.mjs

@@ -0,0 +1,78 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { createReleaseCandidate } from "./lib/release-candidate.mjs";
+
+const runId = process.env.DADA_TDD_RUN_ID ?? `wp7-01-candidate-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
+const runDirectory = resolve("artifacts", "tdd", runId);
+if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
+mkdirSync(runDirectory, { recursive: true });
+
+function run(command, args) {
+  const startedAt = new Date().toISOString();
+  const executable = process.platform === "win32" ? (process.env.ComSpec ?? "cmd.exe") : command;
+  const actualArgs = process.platform === "win32" ? ["/d", "/s", "/c", [command, ...args].join(" ")] : args;
+  const result = spawnSync(executable, actualArgs, { encoding: "utf8", stdio: "inherit" });
+  return {
+    command: [command, ...args].join(" "),
+    exit_code: result.status ?? 1,
+    finished_at: new Date().toISOString(),
+    started_at: startedAt,
+  };
+}
+
+const commands = [
+  run("pnpm", ["test:security"]),
+  run("pnpm", ["test:package"]),
+  run("pnpm", ["validate:tdd-trace"]),
+  run("node", ["--test", "tests/package/wp7-01-candidate.test.mjs"]),
+];
+const failed = commands.filter(({ exit_code }) => exit_code !== 0);
+let candidate;
+if (failed.length === 0) {
+  const commit = spawnSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).stdout.trim();
+  candidate = await createReleaseCandidate({
+    commit,
+    evidenceRoot: runDirectory,
+    outputRoot: resolve(".build", runId),
+  });
+}
+
+writeFileSync(resolve(runDirectory, "commands.json"), `${JSON.stringify({ commands, run_id: runId, schema_version: "1.0" }, null, 2)}\n`);
+const recordPath = resolve(runDirectory, "release-candidate.json");
+const missingEvidence = [
+  "release-candidate.json",
+  "candidate-package/START-HERE.txt",
+  "candidate-package/package-manifest.json",
+  "candidate-package/package-scan.json",
+  "candidate-package/process-tree.json",
+  ...(candidate ? [`candidate-package/${candidate.record.candidate_package.file_name}`] : []),
+].filter((path) => !existsSync(resolve(runDirectory, path)));
+const finalReleaseWritten = existsSync(resolve("RELEASE.json"));
+const status = failed.length === 0 && missingEvidence.length === 0 && !finalReleaseWritten ? "pending_manual_review" : "failed";
+const result = {
+  acceptance_criteria: ["AC-24", "AC-41"],
+  automation: ["automated", "manual_review"],
+  build_commit: candidate?.record.build_commit ?? null,
+  candidate_status: candidate?.record.status ?? null,
+  final_release_written: finalReleaseWritten,
+  finished_at: new Date().toISOString(),
+  fixed_port: candidate?.record.fixed_port ?? null,
+  manifest: {
+    path: "tasks.manifest.json",
+    sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase(),
+  },
+  missing_evidence: missingEvidence,
+  release_gate: ["release:P0-A"],
+  requirements: ["NFR-01", "NFR-09"],
+  run_id: runId,
+  schema_version: "1.0",
+  status,
+  task_id: "TASK-WP7-01",
+  work_package: "WP-7",
+};
+writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify(result, null, 2)}\n`);
+console.log(JSON.stringify(result, null, 2));
+if (status === "failed") process.exit(1);

scripts/run-wp7-02-validation.mjs

@@ -0,0 +1,239 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import {
+  WP7_02_MODEL_IDS,
+  validateCandidateDependency,
+  validateIndependentEvidenceSet,
+} from "./lib/wp7-02-external-contract.mjs";
+import { validateSanitizedEvidence } from "./lib/wp7-02-controlled-executor.mjs";
+
+const wp701Sha = "623cad25b2a2a9a003502c9a92ebd318dad06248";
+const candidateRunId = "wp7-01-candidate-20260804052447717";
+const controlledReal = process.argv.includes("--controlled-real");
+const runId = process.env.DADA_TDD_RUN_ID ?? `wp7-02-${controlledReal ? "controlled" : "readiness"}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
+const runDirectory = resolve("artifacts", "tdd", runId);
+const caseDirectory = resolve(runDirectory, "cases", "TDD-WP7-EXT-001-three-real-models");
+const candidatePath = process.env.DADA_WP7_01_CANDIDATE_RECORD;
+const configPath = resolve(process.env.DADA_WP7_02_MODEL_CONFIG_MANIFEST ?? "config/wp7-02-oneapi-test.json");
+
+process.on("uncaughtException", (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  const code = /^WP7_02_[A-Z0-9_:]+$/.test(message) ? message : "WP7_02_VALIDATION_FAILED";
+  console.error(JSON.stringify({ code, real_calls: 0, run_id: runId, status: "failed" }));
+  process.exit(1);
+});
+
+if (existsSync(runDirectory)) throw new Error("WP7_02_EVIDENCE_RUN_ALREADY_EXISTS");
+if (!candidatePath || !existsSync(candidatePath)) throw new Error("WP7_02_CANDIDATE_RECORD_REQUIRED");
+if (!existsSync(configPath)) throw new Error("WP7_02_MODEL_CONFIG_MANIFEST_REQUIRED");
+if (controlledReal && process.env.DADA_WP7_02_CONTROLLED_REAL_CONFIRMATION !== "authorized-120") {
+  throw new Error("WP7_02_CONTROLLED_REAL_CONFIRMATION_REQUIRED");
+}
+mkdirSync(caseDirectory, { recursive: true });
+
+function sha256(path) {
+  return createHash("sha256").update(readFileSync(path)).digest("hex").toUpperCase();
+}
+
+function gitOutput(args) {
+  const result = spawnSync("git", args, { encoding: "utf8", timeout: 60_000 });
+  if ((result.status ?? 1) !== 0) throw new Error(`WP7_02_GIT_COMMAND_FAILED:${args[0]}`);
+  return result.stdout.trim();
+}
+
+function remoteSha(branch) {
+  const result = spawnSync("git", ["ls-remote", "--heads", "origin", `refs/heads/${branch}`], { encoding: "utf8", timeout: 60_000 });
+  if ((result.status ?? 1) !== 0) throw new Error("WP7_02_REMOTE_UNREADABLE");
+  return result.stdout.trim().split(/\s+/)[0];
+}
+
+function verifyUpstream() {
+  const remote = remoteSha("codex/wp7-01");
+  if (remote !== wp701Sha) throw new Error("WP7_02_WP7_01_REMOTE_SHA_MISMATCH");
+  const ancestry = spawnSync("git", ["merge-base", "--is-ancestor", wp701Sha, "HEAD"], { timeout: 30_000 });
+  if ((ancestry.status ?? 1) !== 0) throw new Error("WP7_02_WP7_01_NOT_ANCESTOR");
+  return remote;
+}
+
+function run(name, command, args, options = {}) {
+  const started_at = new Date().toISOString();
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    env: { ...process.env, ...(options.env ?? {}) },
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: options.timeout ?? 300_000,
+    windowsHide: true,
+  });
+  return {
+    command: options.logicalCommand ?? [command, ...args].join(" "),
+    exit_code: result.status ?? 1,
+    finished_at: new Date().toISOString(),
+    name,
+    started_at,
+  };
+}
+
+function pnpmRun(name, commandLine, options = {}) {
+  const command = process.platform === "win32" ? (process.env.ComSpec ?? "cmd.exe") : "pnpm";
+  const args = process.platform === "win32" ? ["/d", "/c", commandLine] : commandLine.replace(/^pnpm\s+/, "").split(" ");
+  return run(name, command, args, { ...options, logicalCommand: commandLine });
+}
+
+function readJson(path) {
+  return validateSanitizedEvidence(JSON.parse(readFileSync(path, "utf8")));
+}
+
+const upstreamRemoteSha = verifyUpstream();
+const candidate = validateCandidateDependency(JSON.parse(readFileSync(candidatePath, "utf8")));
+const commands = [
+  run("contract-harness", process.execPath, ["--test", "tests/package/wp7-02-external-contract.test.mjs", "tests/package/wp7-02-controlled-executor.test.mjs"], {
+    logicalCommand: "node --test tests/package/wp7-02-external-contract.test.mjs tests/package/wp7-02-controlled-executor.test.mjs",
+  }),
+  pnpmRun("deterministic-state", "pnpm exec vitest run tests/integration/wp7-02-controlled-state.test.ts", {
+    env: { DADA_WP7_02_STATE_EVIDENCE_ROOT: caseDirectory }, timeout: 120_000,
+  }),
+  run("supervisor-build", "dotnet", ["build", "supervisor/Dada.Supervisor/Dada.Supervisor.csproj", "--no-restore"], {
+    logicalCommand: "dotnet build supervisor/Dada.Supervisor/Dada.Supervisor.csproj --no-restore", timeout: 120_000,
+  }),
+  pnpmRun("tdd-trace", "pnpm validate:tdd-trace"),
+  pnpmRun("security", "pnpm test:security"),
+];
+const firstAutomationFailure = commands.find((command) => command.exit_code !== 0);
+if (firstAutomationFailure) {
+  writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands, run_id: runId }, null, 2)}\n`);
+  console.error(JSON.stringify({ code: "WP7_02_AUTOMATED_PREREQUISITE_FAILED", command: firstAutomationFailure.command, exit_code: firstAutomationFailure.exit_code, real_calls: 0, run_id: runId, status: "failed" }));
+  process.exit(1);
+}
+
+const externalCommands = [];
+for (const modelId of WP7_02_MODEL_IDS) {
+  const modelDirectoryName = modelId.replaceAll(".", "_");
+  const modelDirectory = resolve(caseDirectory, modelDirectoryName);
+  const flags = controlledReal
+    ? `--max-real-calls 120 --confirm-controlled-real --execute-controlled-real`
+    : "--confirm-controlled-real --readiness-only";
+  const commandLine = `pnpm validate:external -- --service ai-gateway-service-id --model ${modelId} --run-id ${runId} ${flags}`;
+  externalCommands.push(pnpmRun(`${controlledReal ? "controlled" : "readiness"}-${modelId}`, commandLine, {
+    env: {
+      DADA_WP7_01_CANDIDATE_RECORD: candidatePath,
+      DADA_WP7_02_EVIDENCE_DIR: modelDirectory,
+      DADA_WP7_02_MODEL_CONFIG_MANIFEST: configPath,
+    },
+    timeout: 20 * 60_000,
+  }));
+}
+commands.push(...externalCommands);
+
+const externalExitCodesValid = controlledReal
+  ? externalCommands.every((command) => command.exit_code === 0 || command.exit_code === 3)
+  : externalCommands.every((command) => command.exit_code === 3);
+if (!externalExitCodesValid) {
+  writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands, run_id: runId }, null, 2)}\n`);
+  const failed = externalCommands.find((command) => ![0, 3].includes(command.exit_code));
+  console.error(JSON.stringify({ code: "WP7_02_EXTERNAL_COMMAND_FAILED", command: failed?.command, exit_code: failed?.exit_code, real_calls: 0, run_id: runId, status: "failed" }));
+  process.exit(1);
+}
+
+if (controlledReal) {
+  const manualConfirmed = process.env.DADA_WP7_02_MANUAL_REVIEW_CONFIRMATION === "confirmed";
+  const manual = run("manual-review", process.execPath, ["scripts/record-wp7-02-manual-review.mjs", ...(manualConfirmed ? ["--confirm-manual-review"] : [])], {
+    env: { DADA_TDD_RUN_ID: runId, DADA_WP7_02_CASE_DIR: caseDirectory },
+    logicalCommand: `pnpm review:wp7-02${manualConfirmed ? " -- --confirm-manual-review" : ""}`,
+  });
+  commands.push(manual);
+  if (![0, 3].includes(manual.exit_code)) {
+    writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands, run_id: runId }, null, 2)}\n`);
+    console.error(JSON.stringify({ code: "WP7_02_MANUAL_REVIEW_COMMAND_FAILED", command: manual.command, exit_code: manual.exit_code, real_calls: 0, run_id: runId, status: "failed" }));
+    process.exit(1);
+  }
+}
+
+const modelEvidence = WP7_02_MODEL_IDS.map((modelId) => {
+  const directory = resolve(caseDirectory, modelId.replaceAll(".", "_"));
+  const readiness = readJson(resolve(directory, "readiness.json"));
+  return {
+    blockers: readiness.blockers,
+    candidate: readiness.candidate,
+    evidence_id: readiness.evidence_id,
+    external_calls: readJson(resolve(directory, "external-calls.json")),
+    manual_review: readJson(resolve(directory, "manual-review.json")),
+    matrix: readJson(resolve(directory, "contract-matrix.json")),
+    model_id: readiness.model_id,
+    redaction: readJson(resolve(directory, "redaction.json")),
+    run_id: readiness.run_id,
+    status: readiness.status,
+  };
+});
+validateIndependentEvidenceSet(modelEvidence);
+
+const requiredModelEvidence = WP7_02_MODEL_IDS.flatMap((modelId) => {
+  const directory = modelId.replaceAll(".", "_");
+  return ["contract-matrix.json", "deterministic-state.json", "external-calls.json", "manual-review.json", "readiness.json", "redaction.json"]
+    .map((name) => `${directory}/${name}`);
+});
+writeFileSync(resolve(caseDirectory, "candidate-dependency.json"), `${JSON.stringify({
+  candidate_run_id: candidateRunId,
+  record: candidate,
+  remote_branch: "codex/wp7-01",
+  remote_commit: upstreamRemoteSha,
+  status: "passed",
+}, null, 2)}\n`);
+writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands, run_id: runId }, null, 2)}\n`);
+
+const evidenceRefs = ["candidate-dependency.json", "commands.json", ...requiredModelEvidence];
+const missingEvidence = evidenceRefs.filter((path) => !existsSync(resolve(caseDirectory, path)));
+const allModelsPassed = modelEvidence.every((entry) => entry.status === "passed" && entry.manual_review.status === "passed");
+const commit = gitOutput(["rev-parse", "HEAD"]);
+const remoteCommit = remoteSha("codex/wp7-02");
+const dirty = gitOutput(["status", "--porcelain"]).length > 0;
+const deliveryMatched = !dirty && commit === remoteCommit;
+const status = missingEvidence.length > 0 ? "failed"
+  : allModelsPassed && deliveryMatched ? "passed"
+    : allModelsPassed ? "green"
+      : "externally_blocked";
+const blockersByModel = Object.fromEntries(modelEvidence.map((entry) => [entry.model_id, entry.blockers]));
+const realCalls = modelEvidence.reduce((total, entry) => total + entry.external_calls.real_calls, 0);
+if (realCalls > 120) throw new Error("WP7_02_REAL_CALL_LIMIT_EXCEEDED");
+const result = {
+  acceptance_criteria: ["AC-40", "AC-41"],
+  automation: ["controlled_real", "manual_review"],
+  blockers_by_model: blockersByModel,
+  candidate_run_id: candidateRunId,
+  commit,
+  evidence_refs: evidenceRefs,
+  fixture_ids: ["FX-WP7-CONTROLLED-REFERENCE"],
+  layer: ["EXT-REAL", "MANUAL"],
+  manifest: { path: "tasks.manifest.json", sha256: sha256("tasks.manifest.json") },
+  missing_evidence: missingEvidence,
+  phase: controlledReal ? "controlled_real" : "controlled_real_readiness",
+  real_calls: realCalls,
+  red_reason: "任一模型缺独立真实契约证据",
+  release_gate: ["release:P0-A"],
+  remote_branch: "codex/wp7-02",
+  remote_commit: remoteCommit,
+  requirements: ["GEN-13"],
+  run_id: runId,
+  status,
+  task_id: "TASK-WP7-02",
+  test_id: "TDD-WP7-EXT-001-three-real-models",
+  work_package: "WP-7",
+  worktree_under_test: dirty ? "uncommitted implementation" : "clean committed implementation",
+};
+writeFileSync(resolve(caseDirectory, "result.json"), `${JSON.stringify(result, null, 2)}\n`);
+writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({
+  cases: [{ blockers_by_model: blockersByModel, missing_evidence: missingEvidence, status, test_id: result.test_id }],
+  candidate_run_id: candidateRunId,
+  commit,
+  phase: result.phase,
+  real_calls: realCalls,
+  redaction_scan: "passed",
+  remote_commit: remoteCommit,
+  run_id: runId,
+  status,
+  task_id: result.task_id,
+}, null, 2)}\n`);
+console.log(JSON.stringify({ blockers_by_model: blockersByModel, candidate_run_id: candidateRunId, real_calls: realCalls, run_id: runId, status }));
+if (status === "failed") process.exit(1);

scripts/validate-external.mjs

@@ -1,3 +1,23 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import {
+  WP7_02_CONTROLLED_REAL_LIMIT,
+  validateSanitizedEvidence,
+} from "./lib/wp7-02-controlled-executor.mjs";
+import {
+  assembleControlledModelEvidence,
+  runControlledRealScenarios,
+} from "./lib/wp7-02-controlled-matrix.mjs";
+import {
+  AI_GATEWAY_CREDENTIAL_TARGET,
+  WP7_02_MODEL_IDS,
+  buildBlockedModelEvidence,
+  inspectAiGatewayReadiness,
+  writeBlockedModelEvidence,
+} from "./lib/wp7-02-external-contract.mjs";
+
 const allowedServices = new Set(["ai", "ai-gateway-service-id", "resend", "amap"]);
 
 function argument(name) {
@@ -5,23 +25,199 @@ function argument(name) {
   return index >= 0 ? process.argv[index + 1] : undefined;
 }
 
+function output(value, error = false) {
+  const serialized = JSON.stringify(validateSanitizedEvidence(value));
+  if (error) console.error(serialized); else console.log(serialized);
+}
+
 const service = argument("--service");
 const runId = argument("--run-id");
 const model = argument("--model");
+const candidatePath = argument("--candidate-record") ?? process.env.DADA_WP7_01_CANDIDATE_RECORD;
+const configPath = argument("--config-manifest") ?? process.env.DADA_WP7_02_MODEL_CONFIG_MANIFEST;
+const evidenceDirectory = argument("--evidence-dir") ?? process.env.DADA_WP7_02_EVIDENCE_DIR;
+const maxRealCalls = Number(argument("--max-real-calls"));
+const confirmed = process.argv.includes("--confirm-controlled-real");
+const executeControlledReal = process.argv.includes("--execute-controlled-real");
+const credentialStdin = process.argv.includes("--credential-stdin");
+const readinessOnly = process.argv.includes("--readiness-only");
 
-if (!allowedServices.has(service) || !runId || ((service === "ai" || service === "ai-gateway-service-id") && !model)) {
-  console.error("Usage: pnpm validate:external -- --service <ai|ai-gateway-service-id|resend|amap> --run-id <id> [--model <model-id>]");
+if (!allowedServices.has(service) || !runId || ((service === "ai" || service === "ai-gateway-service-id") && !WP7_02_MODEL_IDS.includes(model))) {
+  console.error("Usage: pnpm validate:external -- --service <ai|ai-gateway-service-id|resend|amap> --run-id <id> [--model <model-id>] [--readiness-only]");
   process.exit(2);
 }
 
-console.log(
-  JSON.stringify({
-    blocker: service === "ai" || service === "ai-gateway-service-id" ? "real_gateway_credentials_absent" : undefined,
-    mode: "mock",
-    model,
-    real_calls: 0,
-    run_id: runId,
-    service,
-    status: service === "ai" || service === "ai-gateway-service-id" ? "not_applicable" : "not_applicable_for_TASK-WP0-01",
-  }),
-);
+if (service !== "ai" && service !== "ai-gateway-service-id") {
+  console.log(JSON.stringify({ mode: "mock", real_calls: 0, run_id: runId, service, status: "not_applicable_for_TASK-WP0-01" }));
+  process.exit(0);
+}
+
+function parseInputs() {
+  const candidateRecord = candidatePath && existsSync(candidatePath) ? JSON.parse(readFileSync(candidatePath, "utf8")) : undefined;
+  const configManifest = configPath && existsSync(configPath) ? JSON.parse(readFileSync(configPath, "utf8")) : undefined;
+  const modelConfig = Array.isArray(configManifest?.models)
+    ? configManifest.models.find((entry) => entry?.model_id === model)
+    : undefined;
+  return { candidateRecord, modelConfig };
+}
+
+function delegateToSecureBroker() {
+  if (!candidatePath || !configPath || !evidenceDirectory || !confirmed || maxRealCalls !== WP7_02_CONTROLLED_REAL_LIMIT) {
+    output({ code: "WP7_02_CONTROLLED_EXECUTION_ARGUMENTS_REQUIRED", model, real_calls: 0, run_id: runId, service, status: "failed" }, true);
+    return 2;
+  }
+  const args = [
+    "run", "--no-build", "--project", "supervisor/Dada.Supervisor/Dada.Supervisor.csproj", "--",
+    "validate-external",
+    "--service", "ai-gateway-service-id",
+    "--model", model,
+    "--run-id", runId,
+    "--max-real-calls", String(maxRealCalls),
+    "--confirm-controlled-real",
+    "--execute-controlled-real",
+  ];
+  const result = spawnSync("dotnet", args, {
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      DADA_WP7_01_CANDIDATE_RECORD: candidatePath,
+      DADA_WP7_02_EVIDENCE_DIR: evidenceDirectory,
+      DADA_WP7_02_MODEL_CONFIG_MANIFEST: configPath,
+    },
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: 20 * 60_000,
+    windowsHide: true,
+  });
+  const stdout = result.stdout?.trim() ?? "";
+  const stderr = result.stderr?.trim() ?? "";
+  const selected = stdout || stderr;
+  try {
+    if (!selected || (stdout && stderr)) throw new Error("invalid_output");
+    const parsed = validateSanitizedEvidence(JSON.parse(selected));
+    output(parsed, !stdout);
+  } catch {
+    output({ code: "WP7_02_SECURE_BROKER_FAILED", model, real_calls: 0, run_id: runId, service, status: "failed" }, true);
+    return 1;
+  }
+  return result.status ?? 1;
+}
+
+async function readCredentialFromStdin() {
+  let serialized = "";
+  for await (const chunk of process.stdin) {
+    serialized += chunk.toString("utf8");
+    if (serialized.length > 16_384) throw new Error("WP7_02_CREDENTIAL_CHANNEL_INVALID");
+  }
+  const payload = JSON.parse(serialized);
+  serialized = "";
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)
+    || Object.keys(payload).length !== 1 || typeof payload[AI_GATEWAY_CREDENTIAL_TARGET] !== "string"
+    || payload[AI_GATEWAY_CREDENTIAL_TARGET].length < 8) {
+    throw new Error("WP7_02_CREDENTIAL_CHANNEL_INVALID");
+  }
+  const token = payload[AI_GATEWAY_CREDENTIAL_TARGET];
+  payload[AI_GATEWAY_CREDENTIAL_TARGET] = "";
+  return token;
+}
+
+function readDeterministicState() {
+  const path = evidenceDirectory && resolve(evidenceDirectory, "deterministic-state.json");
+  if (!path || !existsSync(path)) throw new Error("WP7_02_DETERMINISTIC_STATE_REQUIRED");
+  return validateSanitizedEvidence(JSON.parse(readFileSync(path, "utf8")));
+}
+
+function writeControlledEvidence(directory, evidence, readiness) {
+  mkdirSync(resolve(directory), { recursive: true });
+  const files = {
+    "contract-matrix.json": evidence.matrix,
+    "external-calls.json": evidence.external_calls,
+    "manual-review.json": evidence.manual_review,
+    "readiness.json": {
+      blockers: evidence.status === "passed" ? [] : evidence.external_calls.calls.filter((call) => call.status !== "passed").map((call) => call.error_code ?? call.scenario_id),
+      candidate: readiness.candidate,
+      evidence_id: evidence.evidence_id,
+      model_id: evidence.model_id,
+      run_id: evidence.run_id,
+      status: evidence.status,
+    },
+    "redaction.json": evidence.redaction,
+  };
+  for (const [name, value] of Object.entries(files)) {
+    writeFileSync(resolve(directory, name), `${JSON.stringify(validateSanitizedEvidence(value), null, 2)}\n`);
+  }
+}
+
+async function main() {
+  const { candidateRecord, modelConfig } = parseInputs();
+  if (!candidateRecord) {
+    output({ blockers: ["candidate_record_absent", ...(confirmed ? [] : ["explicit_confirmation_absent"])], mode: "controlled_real_not_executed", model, real_calls: 0, run_id: runId, service, status: "externally_blocked" });
+    return 3;
+  }
+
+  if (executeControlledReal && !credentialStdin) return delegateToSecureBroker();
+
+  let token = "";
+  try {
+    if (credentialStdin) token = await readCredentialFromStdin();
+    const readiness = inspectAiGatewayReadiness({
+      candidateRecord,
+      confirmed,
+      credentialTargets: credentialStdin ? [AI_GATEWAY_CREDENTIAL_TARGET] : [],
+      modelConfig,
+      modelId: model,
+    });
+    if (!credentialStdin) {
+      readiness.blockers = readiness.blockers.filter((blocker) => blocker !== "real_gateway_credentials_absent");
+      readiness.blockers.push("secure_credential_check_requires_execution");
+    }
+    readiness.status = readiness.blockers.length > 0 ? "externally_blocked" : "ready_for_controlled_execution";
+
+    if (!executeControlledReal || readinessOnly || readiness.blockers.length > 0) {
+      if (readiness.blockers.length > 0 && evidenceDirectory) {
+        writeBlockedModelEvidence(evidenceDirectory, buildBlockedModelEvidence({
+          blockers: readiness.blockers, candidateRecord, modelConfig: readiness.model_config, modelId: model, runId,
+        }));
+      }
+      output({
+        blockers: readiness.blockers,
+        candidate_build_commit: readiness.candidate.build_commit,
+        mode: readinessOnly ? "readiness_only" : "controlled_real_not_executed",
+        model,
+        planned_provider_requests_max: readiness.plan.planned_provider_requests_max,
+        planned_request_breakdown: readiness.plan.planned_request_breakdown,
+        real_calls: 0,
+        run_id: runId,
+        service,
+        status: readiness.status,
+      });
+      return readiness.blockers.length > 0 ? 3 : 0;
+    }
+
+    const deterministicState = readDeterministicState();
+    const realExecution = await runControlledRealScenarios({ maxRealCalls, modelConfig, token });
+    const evidence = assembleControlledModelEvidence({ deterministicState, modelConfig, realExecution, runId });
+    writeControlledEvidence(evidenceDirectory, evidence, readiness);
+    output({
+      blockers: realExecution.blockers,
+      config_version: modelConfig.config_version,
+      model,
+      planned_real_calls: realExecution.planned_real_calls,
+      real_calls: realExecution.real_calls,
+      run_id: runId,
+      service,
+      status: evidence.status === "passed" ? "controlled_real_passed_pending_manual_review" : "externally_blocked",
+    });
+    return evidence.status === "passed" ? 0 : 3;
+  } finally {
+    token = "";
+  }
+}
+
+try {
+  process.exitCode = await main();
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const code = /^WP7_02_[A-Z0-9_:]+$/.test(message) ? message : "WP7_02_EXTERNAL_VALIDATION_FAILED";
+  output({ code, model, real_calls: 0, run_id: runId, service, status: "failed" }, true);
+  process.exitCode = 1;
+}

supervisor/Dada.Supervisor.Tests/Program.cs

@@ -16,6 +16,12 @@ internal static class Program
             return await RunCredentialChildAsync();
         }
 
+        if (args.FirstOrDefault() == "--credential-echo")
+        {
+            Console.Write(await Console.In.ReadToEndAsync());
+            return 0;
+        }
+
         if (args.FirstOrDefault() == "--instance-probe")
         {
             using var instance = await SingleInstanceCoordinator.TryAcquireAsync(args[1], args[2]);
@@ -120,6 +126,33 @@ internal static class Program
 
         var workerProbe = await LaunchCredentialProbeAsync(ChildRole.Worker, store);
         EqualSequence(new[] { CredentialCatalog.WorkerAiGateway }, workerProbe.Names, "Worker credential scope");
+        var leakProbe = await CredentialProcessLauncher.RunToCompletionAsync(
+            new ProcessStartInfo(Environment.ProcessPath!, "--credential-echo"), ChildRole.Worker, store);
+        True(leakProbe.SensitiveOutputDetected, "credential echo must be detected");
+        Equal(string.Empty, leakProbe.StandardOutput, "credential echo output discarded");
+        Equal(string.Empty, leakProbe.StandardError, "credential echo error discarded");
+
+        var externalArguments = new[]
+        {
+            "--service", "ai-gateway-service-id",
+            "--model", "gpt-image-2",
+            "--run-id", "wp7-02-supervisor-probe",
+            "--max-real-calls", "120",
+            "--confirm-controlled-real",
+            "--execute-controlled-real",
+        };
+        EqualSequence(externalArguments, ControlledExternalValidationLauncher.ValidateArguments(externalArguments), "controlled external argument allowlist");
+        var stableGeminiArguments = externalArguments.ToArray();
+        stableGeminiArguments[3] = "gemini-3.1-flash-image";
+        EqualSequence(stableGeminiArguments, ControlledExternalValidationLauncher.ValidateArguments(stableGeminiArguments), "stable Gemini external argument allowlist");
+        var previewGeminiArguments = externalArguments.ToArray();
+        previewGeminiArguments[3] = "gemini-3.1-flash-image-preview";
+        Throws<ArgumentException>(
+            () => ControlledExternalValidationLauncher.ValidateArguments(previewGeminiArguments),
+            "preview Gemini external argument rejected");
+        Throws<ArgumentException>(
+            () => ControlledExternalValidationLauncher.ValidateArguments(externalArguments.Where(value => value != "--confirm-controlled-real").ToArray()),
+            "controlled external confirmation required");
 
         store.Delete(CredentialCatalog.WorkerAiGateway);
         await ThrowsAsync<MissingCredentialException>(
@@ -166,15 +199,10 @@ internal static class Program
 
     private static async Task<CredentialProbe> LaunchCredentialProbeAsync(ChildRole role, ICredentialStore store)
     {
-        var startInfo = new ProcessStartInfo(Environment.ProcessPath!, "--credential-child")
-        {
-            RedirectStandardOutput = true,
-        };
-        using var process = await CredentialProcessLauncher.StartAsync(startInfo, role, store);
-        var output = await process.StandardOutput.ReadToEndAsync();
-        await process.WaitForExitAsync();
-        Equal(0, process.ExitCode, "credential child exit code");
-        return JsonSerializer.Deserialize<CredentialProbe>(output, new JsonSerializerOptions { PropertyNameCaseInsensitive = true })
+        var result = await CredentialProcessLauncher.RunToCompletionAsync(new ProcessStartInfo(Environment.ProcessPath!, "--credential-child"), role, store);
+        Equal(0, result.ExitCode, "credential child exit code");
+        False(result.SensitiveOutputDetected, "credential child output contains injected value");
+        return JsonSerializer.Deserialize<CredentialProbe>(result.StandardOutput, new JsonSerializerOptions { PropertyNameCaseInsensitive = true })
             ?? throw new InvalidOperationException("Credential child returned invalid JSON.");
     }
 
@@ -355,6 +383,19 @@ internal static class Program
         throw new InvalidOperationException(message);
     }
 
+    private static void Throws<TException>(Action action, string message) where TException : Exception
+    {
+        try
+        {
+            action();
+        }
+        catch (TException)
+        {
+            return;
+        }
+        throw new InvalidOperationException(message);
+    }
+
     private sealed record CredentialProbe(string[] Names, bool EnvironmentContainsMarker, bool ArgumentsContainMarker);
 
     private sealed class TestCredentialStore : ICredentialStore

supervisor/Dada.Supervisor/ControlledExternalValidationLauncher.cs

@@ -0,0 +1,131 @@
+using System.Diagnostics;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+
+namespace Dada.Supervisor;
+
+internal static partial class ControlledExternalValidationLauncher
+{
+    private static readonly HashSet<string> AllowedModels =
+    [
+        "gemini-3.1-flash-image",
+        "gpt-image-2",
+    ];
+
+    private static readonly HashSet<string> ValueOptions =
+    [
+        "--max-real-calls",
+        "--model",
+        "--run-id",
+        "--service",
+    ];
+
+    private static readonly HashSet<string> SwitchOptions =
+    [
+        "--confirm-controlled-real",
+        "--execute-controlled-real",
+    ];
+
+    internal static async Task<int> RunAsync(string[] args, ICredentialStore credentials, CancellationToken cancellationToken = default)
+    {
+        var validated = ValidateArguments(args);
+        var script = Path.GetFullPath(Path.Combine(Environment.CurrentDirectory, "scripts", "validate-external.mjs"));
+        if (!File.Exists(script)) throw new InvalidOperationException("external_validator_not_found");
+        var startInfo = new ProcessStartInfo("node") { WorkingDirectory = Environment.CurrentDirectory };
+        startInfo.ArgumentList.Add(script);
+        foreach (var value in validated) startInfo.ArgumentList.Add(value);
+        startInfo.ArgumentList.Add("--credential-stdin");
+
+        var result = await CredentialProcessLauncher.RunToCompletionAsync(startInfo, ChildRole.Worker, credentials, cancellationToken);
+        if (result.SensitiveOutputDetected || !TrySelectSanitizedJson(result, out var output, out var useError))
+        {
+            Console.Error.WriteLine("{\"code\":\"external_validator_output_invalid\",\"real_calls\":0,\"status\":\"failed\"}");
+            return 1;
+        }
+        if (useError) Console.Error.WriteLine(output); else Console.WriteLine(output);
+        return result.ExitCode;
+    }
+
+    internal static string[] ValidateArguments(string[] args)
+    {
+        var values = new Dictionary<string, string>(StringComparer.Ordinal);
+        var switches = new HashSet<string>(StringComparer.Ordinal);
+        for (var index = 0; index < args.Length; index++)
+        {
+            var option = args[index];
+            if (SwitchOptions.Contains(option))
+            {
+                if (!switches.Add(option)) throw new ArgumentException("external_validator_argument_duplicate");
+                continue;
+            }
+            if (!ValueOptions.Contains(option) || index + 1 >= args.Length || !values.TryAdd(option, args[++index]))
+            {
+                throw new ArgumentException("external_validator_argument_invalid");
+            }
+        }
+        if (values.GetValueOrDefault("--service") != "ai-gateway-service-id"
+            || !AllowedModels.Contains(values.GetValueOrDefault("--model") ?? string.Empty)
+            || !SafeRunId().IsMatch(values.GetValueOrDefault("--run-id") ?? string.Empty)
+            || values.GetValueOrDefault("--max-real-calls") != "120"
+            || !switches.SetEquals(SwitchOptions))
+        {
+            throw new ArgumentException("external_validator_argument_invalid");
+        }
+        if (values.Values.Any(value => value.Length == 0 || value.IndexOfAny(['\r', '\n', '\0']) >= 0))
+        {
+            throw new ArgumentException("external_validator_argument_invalid");
+        }
+        return args.ToArray();
+    }
+
+    private static bool TrySelectSanitizedJson(CredentialProcessResult result, out string output, out bool useError)
+    {
+        var stdout = result.StandardOutput.Trim();
+        var stderr = result.StandardError.Trim();
+        useError = stdout.Length == 0;
+        output = useError ? stderr : stdout;
+        if (output.Length == 0 || (stdout.Length > 0 && stderr.Length > 0)) return false;
+        try
+        {
+            using var document = JsonDocument.Parse(output);
+            return IsSanitized(document.RootElement);
+        }
+        catch (JsonException)
+        {
+            return false;
+        }
+    }
+
+    private static bool IsSanitized(JsonElement element)
+    {
+        if (element.ValueKind == JsonValueKind.Object)
+        {
+            foreach (var property in element.EnumerateObject())
+            {
+                if (ForbiddenKey().IsMatch(property.Name) || property.NameEquals("verified") || !IsSanitized(property.Value)) return false;
+            }
+        }
+        else if (element.ValueKind == JsonValueKind.Array)
+        {
+            foreach (var item in element.EnumerateArray()) if (!IsSanitized(item)) return false;
+        }
+        else if (element.ValueKind == JsonValueKind.String)
+        {
+            var value = element.GetString() ?? string.Empty;
+            if (WindowsUserPath().IsMatch(value) || BearerValue().IsMatch(value)) return false;
+        }
+        return true;
+    }
+
+    [GeneratedRegex("^[A-Za-z0-9][A-Za-z0-9._-]{0,119}$", RegexOptions.CultureInvariant)]
+    private static partial Regex SafeRunId();
+
+    [GeneratedRegex("(?:^|_)(?:absolute_path|authorization|body|credential|image|password|path|prompt|raw|secret|token)(?:_|$)", RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)]
+    private static partial Regex ForbiddenKey();
+
+    [GeneratedRegex("[A-Za-z]:\\\\Users\\\\", RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)]
+    private static partial Regex WindowsUserPath();
+
+    [GeneratedRegex("(?:Bearer\\s+|\\bsk-[A-Za-z0-9_-]{8,})", RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)]
+    private static partial Regex BearerValue();
+}

supervisor/Dada.Supervisor/Credentials.cs

@@ -37,8 +37,58 @@ internal interface ICredentialStore
 internal sealed class MissingCredentialException(string target)
     : InvalidOperationException($"Required credential is not configured: {target}");
 
+internal sealed record CredentialProcessResult(int ExitCode, string StandardOutput, string StandardError, bool SensitiveOutputDetected);
+
 internal static class CredentialProcessLauncher
 {
+    internal static async Task<CredentialProcessResult> RunToCompletionAsync(
+        ProcessStartInfo startInfo,
+        ChildRole role,
+        ICredentialStore store,
+        CancellationToken cancellationToken = default)
+    {
+        var credentials = new Dictionary<string, string>(StringComparer.Ordinal);
+        foreach (var target in CredentialCatalog.RequiredFor(role))
+        {
+            credentials[target] = store.Read(target) ?? throw new MissingCredentialException(target);
+        }
+
+        startInfo.UseShellExecute = false;
+        startInfo.CreateNoWindow = true;
+        startInfo.RedirectStandardInput = true;
+        startInfo.RedirectStandardOutput = true;
+        startInfo.RedirectStandardError = true;
+        using var process = Process.Start(startInfo) ?? throw new InvalidOperationException("Unable to start credential child process.");
+        var outputTask = process.StandardOutput.ReadToEndAsync(cancellationToken);
+        var errorTask = process.StandardError.ReadToEndAsync(cancellationToken);
+        var payload = JsonSerializer.SerializeToUtf8Bytes(credentials);
+        try
+        {
+            await process.StandardInput.BaseStream.WriteAsync(payload, cancellationToken);
+            await process.StandardInput.BaseStream.FlushAsync(cancellationToken);
+            process.StandardInput.Close();
+            await process.WaitForExitAsync(cancellationToken);
+            var output = await outputTask;
+            var error = await errorTask;
+            var sensitive = credentials.Values.Where(value => value.Length > 0).Any(value =>
+                output.Contains(value, StringComparison.Ordinal) || error.Contains(value, StringComparison.Ordinal));
+            return sensitive
+                ? new CredentialProcessResult(1, string.Empty, string.Empty, true)
+                : new CredentialProcessResult(process.ExitCode, output, error, false);
+        }
+        catch
+        {
+            if (!process.HasExited) process.Kill(entireProcessTree: true);
+            throw;
+        }
+        finally
+        {
+            Array.Clear(payload);
+            foreach (var target in credentials.Keys.ToArray()) credentials[target] = string.Empty;
+            credentials.Clear();
+        }
+    }
+
     internal static async Task<Process> StartAsync(
         ProcessStartInfo startInfo,
         ChildRole role,

supervisor/Dada.Supervisor/OfflineCommandRouter.cs

@@ -29,6 +29,7 @@ internal static class OfflineCommandRouter
                 "secrets" => RunSecrets(args.Skip(1).ToArray(), credentials),
                 "admin-allowlist" => RunAdminAllowlist(args.Skip(1).ToArray(), credentials),
                 "doctor" when args.Length == 1 => RunDoctor(credentials),
+                "validate-external" => await ControlledExternalValidationLauncher.RunAsync(args.Skip(1).ToArray(), credentials),
                 _ => Usage(),
             };
         }
@@ -198,7 +199,7 @@ internal static class OfflineCommandRouter
 
     private static int Usage()
     {
-        WriteResult("usage: configure init|data-root|asset-root; secrets set|status|clear; admin-allowlist add|remove|status; doctor", false);
+        WriteResult("usage: configure init|data-root|asset-root; secrets set|status|clear; admin-allowlist add|remove|status; doctor; validate-external", false);
         return 2;
     }
 }

tests/api/wp5-04-asset-access.test.ts

@@ -0,0 +1,150 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { createApp } from "../../apps/api/src/app.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { createAssetReleaseManifest } from "../../packages/asset-release-manifest/src/index.js";
+
+const now = Date.parse("2026-08-03T10:00:00.000Z");
+const releaseVersion = "asset-20260803.1";
+const publicId = "7f0c9530-a7d9-4bf1-8c65-0e9298dd04ac";
+const previewId = "ab18fd72-60e1-44e3-a9a0-3dfccb12e17c";
+const ungrantedPreviewId = "d8fe890d-6df4-46a9-a578-96c1f8361ac0";
+const privateId = "e3792605-5252-4d3b-a101-827408ab3515";
+const headers = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
+const roots: string[] = [];
+const registrations: RegistrationService[] = [];
+
+function addUser(registration: RegistrationService, role: "super_admin" | "user") {
+  const userId = randomUUID();
+  registration.database.prepare(`INSERT INTO users (
+    user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at
+  ) VALUES (?, ?, ?, 'active', ?, ?, ?)`).run(
+    userId,
+    `${role}-${userId}@example.invalid`,
+    role,
+    role === "user" ? 1 : 0,
+    randomUUID(),
+    now,
+  );
+  if (role === "user") {
+    registration.database.prepare("INSERT INTO user_profiles (user_id, creator_name, social_id) VALUES (?, 'Asset User', '@asset_user')").run(userId);
+    registration.database.prepare("INSERT INTO credit_accounts (user_id, available_balance, reserved_balance, updated_at) VALUES (?, 10, 0, ?)").run(userId, now);
+  } else {
+    registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
+  }
+  return { session: registration.issueAuthenticatedSession(userId, role === "user" ? "user" : "admin"), userId };
+}
+
+function evidence(name: string, value: unknown) {
+  const directory = process.env.DADA_EVIDENCE_DIR_WP5_RES;
+  if (!directory) return;
+  mkdirSync(directory, { recursive: true });
+  writeFileSync(resolve(directory, name), `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function harness() {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp5-04-api-"));
+  roots.push(root);
+  const registration = new RegistrationService({
+    challengePepper: Buffer.alloc(32, 0x31), clock: () => now,
+    currentPrivacyNoticeVersion: "p0a-registration-notice-v1", databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0x32), resend: new MockResendAdapter(), sessionPepper: Buffer.alloc(32, 0x33),
+  });
+  registrations.push(registration);
+  const owner = addUser(registration, "user");
+  const intruder = addUser(registration, "user");
+  const admin = addUser(registration, "super_admin");
+  const assetReleases = createAssetReleaseManifest({
+    items: [
+      { access_class: "public_release_asset", cache_kind: "thumbnail", content: Buffer.from("public"), mime_type: "image/png", relative_path: "public/FLOWER001.png", resource_id: publicId, root_ref: "canonical-assets" },
+      { access_class: "internal_preview_asset", content: Buffer.from("preview"), mime_type: "image/webp", relative_path: "preview/FLOWER009.webp", resource_id: previewId, root_ref: "canonical-assets" },
+      { access_class: "internal_preview_asset", content: Buffer.from("ungranted-preview"), mime_type: "image/webp", relative_path: "preview/FLOWER010.webp", resource_id: ungrantedPreviewId, root_ref: "canonical-assets" },
+      { access_class: "private_user_asset", content: Buffer.from("private"), mime_type: "image/png", owner_id: owner.userId, relative_path: "private/generated.png", resource_id: privateId, root_ref: "managed-assets" },
+    ],
+    release_version: releaseVersion,
+  });
+  let previewGranted = true;
+  let previewChecks = 0;
+  const appPromise = createApp({
+    assetReleases,
+    browserGate: false,
+    networkBoundary: { allowTestPort: true },
+    previewAssetAuthorizer: ({ resourceId, userId }) => {
+      previewChecks += 1;
+      return previewGranted && userId === owner.userId && resourceId === previewId;
+    },
+    privateAssetAdminAuthorizer: ({ adminUserId, ownerId }) => adminUserId === admin.userId && ownerId === owner.userId,
+    registration,
+  });
+  return { admin, appPromise, intruder, owner, previewChecks: () => previewChecks, revokePreview: () => { previewGranted = false; } };
+}
+
+afterEach(() => {
+  for (const registration of registrations.splice(0)) registration.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TDD-WP5-RES-001 three access classes", () => {
+  it("separates route projections, per-request authorization, and cache headers", async () => {
+    const test = harness();
+    const app = await test.appPromise;
+    const ownerCookie = `dada_session=${test.owner.session.sessionToken}`;
+    const intruderCookie = `dada_session=${test.intruder.session.sessionToken}`;
+    const adminCookie = `dada_admin_session=${test.admin.session.sessionToken}`;
+
+    const publicManifest = await app.inject({ headers, method: "GET", url: `/api/v1/assets/public/${releaseVersion}/manifest` });
+    const publicAsset = await app.inject({ headers, method: "GET", url: `/api/v1/assets/public/${releaseVersion}/${publicId}` });
+    const previewManifest = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/manifest` });
+    const previewAsset = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/${previewId}` });
+    const privateManifest = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/manifest` });
+    const privateAsset = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/${privateId}` });
+    const deniedPrivate = await app.inject({ headers: { ...headers, cookie: intruderCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/${privateId}` });
+    const controlledAdmin = await app.inject({ headers: { ...headers, cookie: adminCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/${privateId}` });
+
+    expect(publicManifest.statusCode).toBe(200);
+    expect(publicManifest.headers["cache-control"]).toBe("public, max-age=31536000, immutable");
+    expect(publicManifest.json().items).toEqual([expect.objectContaining({ access_class: "public_release_asset", resource_id: publicId })]);
+    expect(JSON.stringify(publicManifest.json())).not.toMatch(/preview|private|relative_path|root_ref|[A-Z]:\\\\/i);
+    expect(publicAsset.statusCode).toBe(200);
+    expect(publicAsset.rawPayload).toEqual(Buffer.from("public"));
+    expect(publicAsset.headers["cache-control"]).toBe("public, max-age=31536000, immutable");
+
+    expect(previewManifest.statusCode).toBe(200);
+    expect(previewManifest.headers["cache-control"]).toBe("private, no-store");
+    expect(previewManifest.json().items).toEqual([expect.objectContaining({ resource_id: previewId })]);
+    expect(JSON.stringify(previewManifest.json())).not.toContain(ungrantedPreviewId);
+    expect(previewAsset.statusCode).toBe(200);
+    expect(previewAsset.headers["cache-control"]).toBe("private, no-store");
+    expect(privateManifest.json().items).toEqual([expect.objectContaining({ access_class: "private_user_asset", resource_id: privateId })]);
+    expect(privateAsset.rawPayload).toEqual(Buffer.from("private"));
+    expect(privateAsset.headers["cache-control"]).toBe("private, no-store");
+    expect(deniedPrivate.statusCode).toBe(404);
+    expect(controlledAdmin.statusCode).toBe(200);
+
+    const publicGuess = await app.inject({ headers, method: "GET", url: `/api/v1/assets/public/${releaseVersion}/${privateId}` });
+    expect(publicGuess.statusCode).toBe(404);
+    test.revokePreview();
+    const revoked = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/${previewId}` });
+    expect(revoked.statusCode).toBe(404);
+    expect(test.previewChecks()).toBe(4);
+
+    evidence("response.json", {
+      controlled_admin_status: controlledAdmin.statusCode,
+      private_intruder_status: deniedPrivate.statusCode,
+      public_guess_status: publicGuess.statusCode,
+      revoked_preview_status: revoked.statusCode,
+    });
+    evidence("headers.json", {
+      private: privateAsset.headers["cache-control"],
+      preview: previewAsset.headers["cache-control"],
+      public: publicAsset.headers["cache-control"],
+    });
+    await app.close();
+  });
+});

tests/api/wp5-05-sticker-upload.test.ts

@@ -0,0 +1,109 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { createApp } from "../../apps/api/src/app.js";
+import { ManagedStorage } from "../../apps/api/src/managed-storage.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { StickerReleaseService } from "../../apps/api/src/sticker-releases.js";
+
+const now = Date.parse("2026-08-03T12:00:00.000Z");
+const png = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAQAAAADCAYAAAC09K7GAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEklEQVQImWO4E6XxHxkzEBQAANIxHF3ECQOzAAAAAElFTkSuQmCC", "base64");
+const roots: string[] = [];
+const closeables: Array<{ close(): void }> = [];
+const baseHeaders = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
+
+async function multipart() {
+  const form = new FormData();
+  form.append("stable_id", "STK1408");
+  form.append("part", "25");
+  form.append("order", "184");
+  form.append("enabled", "true");
+  form.append("original_byte_size", String(png.byteLength));
+  form.append("original_sha256", createHash("sha256").update(png).digest("hex"));
+  form.append("sticker_file", new Blob([png], { type: "image/png" }), "STK1408.png");
+  const serialized = new Response(form);
+  return { contentType: serialized.headers.get("content-type")!, payload: Buffer.from(await serialized.arrayBuffer()) };
+}
+
+function evidence(value: unknown) {
+  const directory = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
+  if (!directory) return;
+  mkdirSync(directory, { recursive: true });
+  writeFileSync(resolve(directory, "response.json"), `${JSON.stringify(value, null, 2)}\n`);
+}
+
+afterEach(() => {
+  for (const value of closeables.splice(0).reverse()) value.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TASK-WP5-05 admin sticker API", () => {
+  it("requires admin mutation controls, publishes upload, and exposes current and versioned public resources", async () => {
+    const dataRoot = mkdtempSync(join(tmpdir(), "dada-wp5-05-api-"));
+    roots.push(dataRoot);
+    mkdirSync(join(dataRoot, "db"), { recursive: true });
+    const databasePath = join(dataRoot, "db", "dada.sqlite3");
+    const registration = new RegistrationService({
+      challengePepper: Buffer.alloc(32, 0x41), clock: () => now,
+      currentPrivacyNoticeVersion: "p0a-registration-notice-v1", databasePath,
+      invitePepper: Buffer.alloc(32, 0x42), resend: new MockResendAdapter(), sessionPepper: Buffer.alloc(32, 0x43),
+    });
+    const storage = new ManagedStorage({ dataRoot, databasePath });
+    const stickers = new StickerReleaseService({ clock: () => now, databasePath, storage });
+    closeables.push(stickers, storage, registration);
+    const adminId = randomUUID();
+    registration.database.prepare(`INSERT INTO users (
+      user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at
+    ) VALUES (?, 'sticker-admin@example.invalid', 'super_admin', 'active', 0, ?, ?)`).run(adminId, randomUUID(), now);
+    registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(adminId);
+    const session = registration.issueAuthenticatedSession(adminId, "admin");
+    const csrf = registration.issueAdminCsrfToken(session.sessionToken);
+    const app = await createApp({ browserGate: false, networkBoundary: { allowTestPort: true }, registration, stickers });
+    const uploadKey = `sticker-${randomUUID()}-${randomUUID()}`;
+
+    const body = await multipart();
+    const denied = await app.inject({ headers: { ...baseHeaders, "content-type": body.contentType }, method: "POST", payload: body.payload, url: "/api/v1/admin/assets/static-stickers" });
+    expect(denied.statusCode).toBe(401);
+
+    const acceptedBody = await multipart();
+    const accepted = await app.inject({
+      headers: {
+        ...baseHeaders, cookie: `dada_admin_session=${session.sessionToken}`, "content-type": acceptedBody.contentType,
+        "idempotency-key": uploadKey, "x-csrf-token": csrf,
+      },
+      method: "POST", payload: acceptedBody.payload, url: "/api/v1/admin/assets/static-stickers",
+    });
+    expect(accepted.statusCode).toBe(201);
+    expect(accepted.json()).toMatchObject({ item: { stable_id: "STK1408" }, release_version: "asset-20260803.1" });
+    const replayBody = await multipart();
+    const replay = await app.inject({
+      headers: {
+        ...baseHeaders, cookie: `dada_admin_session=${session.sessionToken}`, "content-type": replayBody.contentType,
+        "idempotency-key": uploadKey, "x-csrf-token": csrf,
+      },
+      method: "POST", payload: replayBody.payload, url: "/api/v1/admin/assets/static-stickers",
+    });
+    expect(replay.statusCode).toBe(200);
+    expect(replay.json()).toMatchObject({ created: false, release_version: "asset-20260803.1" });
+    expect(storage.inspectCounts()).toMatchObject({ managed_files: 2 });
+
+    const adminList = await app.inject({ headers: { ...baseHeaders, cookie: `dada_admin_session=${session.sessionToken}` }, method: "GET", url: "/api/v1/admin/assets/static-stickers" });
+    const publicList = await app.inject({ headers: baseHeaders, method: "GET", url: "/api/v1/static-stickers/current" });
+    const original = await app.inject({ headers: baseHeaders, method: "GET", url: "/api/v1/assets/public/asset-20260803.1/STK1408" });
+    const thumbnail = await app.inject({ headers: baseHeaders, method: "GET", url: "/api/v1/assets/public/asset-20260803.1/STK1408?variant=thumbnail" });
+    expect(adminList.statusCode).toBe(200);
+    expect(publicList.json()).toMatchObject({ count: 1, items: [{ stable_id: "STK1408" }] });
+    expect(original.rawPayload).toEqual(png);
+    expect(thumbnail.statusCode).toBe(200);
+    expect(thumbnail.headers["content-type"]).toMatch(/^image\/png/);
+    expect(thumbnail.rawPayload).not.toEqual(png);
+
+    evidence({ admin_list_status: adminList.statusCode, public_count: publicList.json().count, upload_status: accepted.statusCode });
+    await app.close();
+  });
+});

tests/api/wp5-07-preview-grants.test.ts

@@ -0,0 +1,179 @@
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { createApp } from "../../apps/api/src/app.js";
+import { AssetPreviewGrantService } from "../../apps/api/src/preview-grants.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { createAssetReleaseManifest } from "../../packages/asset-release-manifest/src/index.js";
+
+const start = Date.parse("2026-08-04T08:00:00.000Z");
+const releaseVersion = "asset-20260804.1";
+const previewResourceId = "8f9b5c62-7488-4c7a-9f0c-3b8f3fc34f92";
+const roots: string[] = [];
+const registrations: RegistrationService[] = [];
+
+function harness() {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp5-07-"));
+  roots.push(root);
+  let now = start;
+  const registration = new RegistrationService({
+    challengePepper: Buffer.alloc(32, 0x71),
+    clock: () => now,
+    currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
+    databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0x72),
+    resend: new MockResendAdapter(),
+    sessionPepper: Buffer.alloc(32, 0x73),
+  });
+  registrations.push(registration);
+  const userId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (
+      user_id, normalized_email, role, status, counts_toward_stage_limit,
+      registration_id, created_at
+    ) VALUES (?, ?, 'user', 'active', 1, ?, ?)
+  `).run(userId, `${userId}@example.invalid`, randomUUID(), start);
+  registration.database.prepare(`
+    INSERT INTO user_profiles (user_id, creator_name, social_id)
+    VALUES (?, 'Preview User', '@preview_user')
+  `).run(userId);
+  registration.database.prepare(`
+    INSERT INTO credit_accounts (user_id, available_balance, reserved_balance, updated_at)
+    VALUES (?, 10, 0, ?)
+  `).run(userId, start);
+  const adminId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (
+      user_id, normalized_email, role, status, counts_toward_stage_limit,
+      registration_id, created_at
+    ) VALUES (?, ?, 'super_admin', 'active', 0, ?, ?)
+  `).run(adminId, `${adminId}@example.invalid`, randomUUID(), start);
+  registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(adminId);
+  const assetReleases = createAssetReleaseManifest({
+    items: [{
+      access_class: "internal_preview_asset",
+      content: Buffer.from("preview-content"),
+      mime_type: "image/webp",
+      relative_path: "preview/TEMPLATE.webp",
+      resource_id: previewResourceId,
+      root_ref: "canonical-assets",
+    }],
+    release_version: releaseVersion,
+  });
+  const service = new AssetPreviewGrantService({ assetReleases, registration, clock: () => now });
+  return {
+    advance(milliseconds: number) { now += milliseconds; },
+    adminId,
+    registration,
+    service,
+    userId,
+  };
+}
+
+afterEach(() => {
+  for (const registration of registrations.splice(0)) registration.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TASK-WP5-07 internal preview grant lifecycle", () => {
+  it("keeps ordinary role, returns randomized manifest item IDs, and blocks revoked/expired grants", () => {
+    const test = harness();
+    const batch = test.service.createBatch({
+      name: "WP5 preview batch",
+      adminUserId: test.adminId,
+    });
+    test.service.addBatchItems({
+      adminUserId: test.adminId,
+      batchId: batch.batchId,
+      releaseVersion,
+      resourceIds: [previewResourceId],
+    });
+    const grant = test.service.grant({
+      adminUserId: test.adminId,
+      batchId: batch.batchId,
+      expiresAt: start + 60_000,
+      userId: test.userId,
+    });
+
+    const firstManifest = test.service.projectManifest({ releaseVersion, userId: test.userId });
+    expect(firstManifest?.items).toHaveLength(1);
+    expect(firstManifest?.items[0].resource_id).not.toBe(previewResourceId);
+    expect(firstManifest?.items[0].url).toContain(firstManifest?.items[0].resource_id ?? "");
+    expect(test.service.readManifestItem({
+      manifestItemId: firstManifest!.items[0].resource_id,
+      releaseVersion,
+      userId: test.userId,
+    })?.bytes).toEqual(Buffer.from("preview-content"));
+    expect(test.registration.database.prepare("SELECT role FROM users WHERE user_id = ?").get(test.userId)).toEqual({ role: "user" });
+
+    test.service.revoke({ adminUserId: test.adminId, grantId: grant.grantId });
+    expect(test.service.projectManifest({ releaseVersion, userId: test.userId })).toBeUndefined();
+    expect(test.service.readManifestItem({
+      manifestItemId: firstManifest!.items[0].resource_id,
+      releaseVersion,
+      userId: test.userId,
+    })).toBeUndefined();
+
+    const secondGrant = test.service.grant({
+      adminUserId: test.adminId,
+      batchId: batch.batchId,
+      expiresAt: start + 10_000,
+      userId: test.userId,
+    });
+    expect(secondGrant.status).toBe("active");
+    test.advance(10_001);
+    expect(test.service.projectManifest({ releaseVersion, userId: test.userId })).toBeUndefined();
+    expect(test.registration.database.prepare("SELECT status FROM asset_preview_grants WHERE grant_id = ?").get(secondGrant.grantId)).toEqual({ status: "expired" });
+
+    test.registration.database.prepare("UPDATE users SET status = 'active' WHERE user_id = ?").run(test.userId);
+    test.service.grant({
+      adminUserId: test.adminId,
+      batchId: batch.batchId,
+      expiresAt: start + 120_000,
+      userId: test.userId,
+    });
+    test.registration.changeUserStatus(test.userId, "suspended");
+    expect(test.service.projectManifest({ releaseVersion, userId: test.userId })).toBeUndefined();
+    expect(test.registration.database.prepare("SELECT COUNT(*) AS count FROM admin_operation_logs WHERE operation_type LIKE 'preview_grant_%'").get()).toEqual({ count: 5 });
+  });
+
+  it("serves the randomized item through the authenticated no-store route", async () => {
+    const test = harness();
+    const batch = test.service.createBatch({ name: "WP5 route batch", adminUserId: test.adminId });
+    test.service.addBatchItems({
+      adminUserId: test.adminId,
+      batchId: batch.batchId,
+      releaseVersion,
+      resourceIds: [previewResourceId],
+    });
+    const grant = test.service.grant({ adminUserId: test.adminId, batchId: batch.batchId, expiresAt: start + 60_000, userId: test.userId });
+    const session = test.registration.issueAuthenticatedSession(test.userId, "user");
+    const app = await createApp({
+      browserGate: false,
+      networkBoundary: { allowTestPort: true },
+      previewGrants: test.service,
+      registration: test.registration,
+    });
+    try {
+      const headers = { cookie: `dada_session=${session.sessionToken}`, host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
+      const manifest = await app.inject({ headers, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/manifest` });
+      expect(manifest.statusCode).toBe(200);
+      const itemId = manifest.json().items[0].resource_id;
+      expect(itemId).not.toBe(previewResourceId);
+      const asset = await app.inject({ headers, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/${itemId}` });
+      expect(asset.statusCode).toBe(200);
+      expect(asset.headers["cache-control"]).toBe("private, no-store");
+      expect(asset.rawPayload).toEqual(Buffer.from("preview-content"));
+      test.service.revoke({ adminUserId: test.adminId, grantId: grant.grantId });
+      const revoked = await app.inject({ headers, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/${itemId}` });
+      expect(revoked.statusCode).toBe(404);
+    } finally {
+      await app.close();
+    }
+  });
+});

tests/api/wp6-01-admin-shell.test.ts

@@ -0,0 +1,140 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { createApp } from "../../apps/api/src/app.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { adminOverviewFixture } from "../fixtures/wp6-01-admin-overview.js";
+
+const roots: string[] = [];
+const services: RegistrationService[] = [];
+const now = Date.parse("2026-08-03T09:30:00.000Z");
+const requestHeaders = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
+
+function createRegistration() {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp6-01-api-"));
+  roots.push(root);
+  const registration = new RegistrationService({
+    adminAllowlistPepper: Buffer.alloc(32, 0xd1),
+    challengePepper: Buffer.alloc(32, 0xd2),
+    clock: () => now,
+    currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
+    databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0xd3),
+    resend: new MockResendAdapter(),
+    sessionPepper: Buffer.alloc(32, 0xd4),
+  });
+  services.push(registration);
+  return registration;
+}
+
+function seedSubject(registration: RegistrationService, role: "super_admin" | "user") {
+  const userId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (
+      user_id, normalized_email, role, status, counts_toward_stage_limit,
+      registration_id, created_at
+    ) VALUES (?, ?, ?, 'active', ?, ?, ?)
+  `).run(userId, `${role}-${userId}@example.invalid`, role, role === "user" ? 1 : 0, randomUUID(), now);
+  if (role === "super_admin") {
+    registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
+  }
+  return userId;
+}
+
+function tableCounts(registration: RegistrationService) {
+  return {
+    admin: (registration.database.prepare("SELECT COUNT(*) AS count FROM admin_operation_logs").get() as { count: number }).count,
+    private: (registration.database.prepare("SELECT COUNT(*) AS count FROM private_content_access_logs").get() as { count: number }).count,
+  };
+}
+
+afterEach(() => {
+  for (const service of services.splice(0)) service.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TDD-WP6-ADM-001-role-and-summary", () => {
+  it("authorizes only an active admin audience and returns a schema-redacted summary", async () => {
+    const registration = createRegistration();
+    const adminId = seedSubject(registration, "super_admin");
+    const ordinaryId = seedSubject(registration, "user");
+    const previewId = seedSubject(registration, "user");
+    registration.database.exec("CREATE TABLE asset_preview_grants_fixture (user_id TEXT PRIMARY KEY, status TEXT NOT NULL)");
+    registration.database.prepare("INSERT INTO asset_preview_grants_fixture (user_id, status) VALUES (?, 'active')").run(previewId);
+
+    const adminSession = registration.issueAuthenticatedSession(adminId, "admin");
+    const ordinarySession = registration.issueAuthenticatedSession(ordinaryId, "user");
+    const previewSession = registration.issueAuthenticatedSession(previewId, "user");
+    let providerCalls = 0;
+    const app = await createApp({
+      adminOverview: async () => {
+        providerCalls += 1;
+        return {
+          ...adminOverviewFixture,
+          absolute_path: "forbidden-path-trap",
+          ["api" + "_key"]: "forbidden-key-trap",
+          private_prompt: "forbidden-prompt-trap",
+          recent_operations: adminOverviewFixture.recent_operations.map((operation) => ({
+            ...operation,
+            actor_email: "forbidden@example.invalid",
+          })),
+        };
+      },
+      browserGate: false,
+      networkBoundary: { allowTestPort: true },
+      registration,
+    });
+
+    for (const token of [undefined, ordinarySession.sessionToken, previewSession.sessionToken]) {
+      const response = await app.inject({
+        headers: token ? { ...requestHeaders, cookie: `dada_admin_session=${token}` } : requestHeaders,
+        method: "GET",
+        url: "/api/v1/admin/overview",
+      });
+      expect(response.statusCode).toBe(401);
+    }
+    expect(providerCalls).toBe(0);
+
+    const before = tableCounts(registration);
+    const allowed = await app.inject({
+      headers: { ...requestHeaders, cookie: `dada_admin_session=${adminSession.sessionToken}` },
+      method: "GET",
+      url: "/api/v1/admin/overview",
+    });
+    expect(allowed.statusCode).toBe(200);
+    expect(allowed.json()).toEqual(adminOverviewFixture);
+    expect(JSON.stringify(allowed.json())).not.toMatch(/absolute_path|api_key|private_prompt|actor_email|forbidden/i);
+    expect(providerCalls).toBe(1);
+    expect(tableCounts(registration)).toEqual(before);
+
+    registration.revokeAdminSessions(adminId, "disabled");
+    const afterDisable = tableCounts(registration);
+    const revoked = await app.inject({
+      headers: { ...requestHeaders, cookie: `dada_admin_session=${adminSession.sessionToken}` },
+      method: "GET",
+      url: "/api/v1/admin/overview",
+    });
+    expect(revoked.statusCode).toBe(401);
+    expect(providerCalls).toBe(1);
+    expect(tableCounts(registration)).toEqual(afterDisable);
+    const evidenceRoot = process.env.DADA_WP6_01_EVIDENCE_DIR;
+    if (evidenceRoot) {
+      mkdirSync(evidenceRoot, { recursive: true });
+      writeFileSync(resolve(evidenceRoot, "response.json"), `${JSON.stringify({
+        active_admin: allowed.json(),
+        denied_statuses: { anonymous: 401, ordinary: 401, preview: 401, suspended_admin: revoked.statusCode },
+      }, null, 2)}\n`);
+      writeFileSync(resolve(evidenceRoot, "db-access.json"), `${JSON.stringify({
+        active_read_delta: { admin_operation_logs: 0, private_content_access_logs: 0 },
+        denied_read_delta: { admin_operation_logs: 0, private_content_access_logs: 0 },
+        provider_calls: providerCalls,
+      }, null, 2)}\n`);
+    }
+    await app.close();
+  });
+});

tests/api/wp6-02-private-content.test.ts

@@ -0,0 +1,105 @@
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { createApp } from "../../apps/api/src/app.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+
+const roots: string[] = [];
+const services: RegistrationService[] = [];
+const now = Date.parse("2026-08-04T09:30:00.000Z");
+const headers = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
+
+function harness() {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp6-02-api-"));
+  roots.push(root);
+  const registration = new RegistrationService({
+    adminAllowlistPepper: Buffer.alloc(32, 0xc1),
+    challengePepper: Buffer.alloc(32, 0xc2),
+    clock: () => now,
+    currentPrivacyNoticeVersion: "p0a-private-content-v1",
+    databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0xc3),
+    resend: new MockResendAdapter(),
+    sessionPepper: Buffer.alloc(32, 0xc4),
+  });
+  services.push(registration);
+  const adminId = randomUUID();
+  const ownerId = randomUUID();
+  const projectId = randomUUID();
+  const generationId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at)
+    VALUES (?, ?, 'super_admin', 'active', 0, ?, ?), (?, ?, 'user', 'active', 1, ?, ?)
+  `).run(adminId, `admin-${adminId}@example.invalid`, randomUUID(), now, ownerId, `user-${ownerId}@example.invalid`, randomUUID(), now);
+  registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(adminId);
+  registration.database.prepare("INSERT INTO user_profiles (user_id, creator_name, social_id) VALUES (?, 'Admin', '@admin')").run(adminId);
+  registration.database.exec(`
+    CREATE TABLE generation_jobs (
+      generation_id TEXT PRIMARY KEY, owner_id TEXT NOT NULL, project_id TEXT NOT NULL,
+      prompt TEXT NOT NULL, ratio TEXT NOT NULL, status TEXT NOT NULL, model_id TEXT NOT NULL,
+      model_config_version INTEGER NOT NULL, confirmed_credit_cost INTEGER NOT NULL,
+      reserved_credits INTEGER NOT NULL, final_credit_state TEXT, error_category TEXT,
+      created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, submission_ready INTEGER NOT NULL DEFAULT 1
+    );
+    CREATE TABLE project_images (image_id TEXT PRIMARY KEY, project_id TEXT NOT NULL, generation_id TEXT NOT NULL, created_at INTEGER NOT NULL);
+  `);
+  registration.database.prepare(`
+    INSERT INTO generation_jobs (
+      generation_id, owner_id, project_id, prompt, ratio, status, model_id, model_config_version,
+      confirmed_credit_cost, reserved_credits, final_credit_state, error_category, created_at, updated_at, submission_ready
+    ) VALUES (?, ?, ?, ?, '1:1', 'succeeded', 'demo.model', 1, 2, 0, 'committed', NULL, ?, ?, 1)
+  `).run(generationId, ownerId, projectId, "secret prompt must never be listed", now - 1000, now);
+  return { registration, adminId, generationId, adminSession: registration.issueAuthenticatedSession(adminId, "admin") };
+}
+
+afterEach(() => {
+  for (const service of services.splice(0)) service.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TDD-WP6-PRIV-001/TDD-WP6-PRIV-002", () => {
+  it("persists notice acknowledgement, returns metadata only, and audits every prompt open", async () => {
+    const fixture = harness();
+    const app = await createApp({ browserGate: false, networkBoundary: { allowTestPort: true }, registration: fixture.registration });
+    const cookie = `dada_admin_session=${fixture.adminSession.sessionToken}`;
+    const denied = await app.inject({ headers: { ...headers, cookie }, method: "GET", url: "/api/v1/admin/generations" });
+    expect(denied.statusCode).toBe(428);
+    expect(denied.json()).toMatchObject({ error: { code: "PRIVATE_CONTENT_NOTICE_ACK_REQUIRED", details: { latest_version: "p0a-private-content-v1" } } });
+    expect(JSON.stringify(denied.json())).not.toContain("secret prompt");
+
+    const csrf = fixture.registration.issueAdminCsrfToken(fixture.adminSession.sessionToken);
+    const ack = await app.inject({
+      headers: { ...headers, cookie, "x-csrf-token": csrf, "idempotency-key": "wp6-02-ack-000000000000000000000000000000" },
+      method: "POST", payload: { expected_notice_version: "p0a-private-content-v1" }, url: "/api/v1/admin/private-content-notice/ack",
+    });
+    expect(ack.statusCode).toBe(200);
+    expect(ack.json()).toMatchObject({ notice_version: "p0a-private-content-v1", status: "acknowledged" });
+
+    const stale = await app.inject({
+      headers: { ...headers, cookie, "x-csrf-token": fixture.registration.issueAdminCsrfToken(fixture.adminSession.sessionToken), "idempotency-key": "wp6-02-ack-stale-000000000000000000000000000" },
+      method: "POST", payload: { expected_notice_version: "old-private-content-v0" }, url: "/api/v1/admin/private-content-notice/ack",
+    });
+    expect(stale.statusCode).toBe(428);
+    expect(stale.json()).toMatchObject({ error: { code: "PRIVATE_CONTENT_NOTICE_ACK_REQUIRED", details: { latest_version: "p0a-private-content-v1" } } });
+
+    const list = await app.inject({ headers: { ...headers, cookie }, method: "GET", url: "/api/v1/admin/generations" });
+    expect(list.statusCode).toBe(200);
+    expect(list.json().items[0]).toMatchObject({ generation_id: fixture.generationId, owner_ref: expect.any(String), status: "succeeded" });
+    expect(JSON.stringify(list.json())).not.toContain("secret prompt");
+
+    const opened = await app.inject({ headers: { ...headers, cookie }, method: "GET", url: `/api/v1/admin/private-content/generations/${fixture.generationId}/prompt` });
+    expect(opened.statusCode).toBe(200);
+    expect(opened.json()).toEqual({ content_type: "prompt", generation_id: fixture.generationId, prompt: "secret prompt must never be listed" });
+    expect((fixture.registration.database.prepare("SELECT COUNT(*) AS count FROM private_content_access_logs").get() as { count: number }).count).toBe(1);
+
+    const reopened = await app.inject({ headers: { ...headers, cookie }, method: "GET", url: `/api/v1/admin/private-content/generations/${fixture.generationId}/prompt` });
+    expect(reopened.statusCode).toBe(200);
+    expect((fixture.registration.database.prepare("SELECT COUNT(*) AS count FROM private_content_access_logs").get() as { count: number }).count).toBe(2);
+    await app.close();
+  });
+});

tests/api/wp6-03-services.test.ts

@@ -0,0 +1,157 @@
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { ExternalServiceUsage, ExternalServiceUsageError } from "../../apps/api/src/external-service-usage.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { createApp } from "../../apps/api/src/app.js";
+import { MockAmapAdapter } from "../../apps/api/src/amap-adapter.js";
+
+const roots: string[] = [];
+const registrations: RegistrationService[] = [];
+
+afterEach(() => {
+  for (const registration of registrations.splice(0)) registration.close();
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function createRegistration(now = Date.parse("2026-08-04T09:00:00.000Z")) {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp6-03-services-"));
+  roots.push(root);
+  const registration = new RegistrationService({
+    adminAllowlistPepper: Buffer.alloc(32, 0x91),
+    challengePepper: Buffer.alloc(32, 0x92),
+    clock: () => now,
+    currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
+    databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0x93),
+    resend: new MockResendAdapter(),
+    sessionPepper: Buffer.alloc(32, 0x94),
+  });
+  registrations.push(registration);
+  return registration;
+}
+
+function seedAdmin(registration: RegistrationService, now = Date.parse("2026-08-04T09:00:00.000Z")) {
+  const userId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at)
+    VALUES (?, ?, 'super_admin', 'active', 0, ?, ?)
+  `).run(userId, `${userId}@example.invalid`, randomUUID(), now);
+  registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
+  return userId;
+}
+
+function seedUser(registration: RegistrationService, now = Date.parse("2026-08-04T09:00:00.000Z")) {
+  const userId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at)
+    VALUES (?, ?, 'user', 'active', 1, ?, ?)
+  `).run(userId, `${userId}@example.invalid`, randomUUID(), now);
+  registration.database.prepare("INSERT INTO user_profiles (user_id, creator_name, social_id) VALUES (?, 'Test User', '@test_user')").run(userId);
+  registration.database.prepare("INSERT INTO credit_accounts (user_id, available_balance, reserved_balance, updated_at) VALUES (?, 10, 0, ?)").run(userId, now);
+  return userId;
+}
+
+describe("TDD-WP6-SVC-001 quota hard stop", () => {
+  it("claims Resend daily and monthly quotas transactionally and pauses before the next call", () => {
+    const registration = createRegistration();
+    const usage = registration.serviceUsage;
+    usage.setHardLimit({ serviceId: "resend_email", periodType: "daily", hardLimit: 2, actorId: "fixture-admin" });
+    usage.setHardLimit({ serviceId: "resend_email", periodType: "monthly", hardLimit: 2, actorId: "fixture-admin" });
+
+    expect(usage.claimResend()).toMatchObject({ allowed: true, remaining: 1 });
+    expect(usage.claimResend()).toMatchObject({ allowed: true, remaining: 0 });
+    expect(() => usage.claimResend()).toThrowError(ExternalServiceUsageError);
+    expect(usage.read("resend_email").every((row) => row.status === "paused_quota")).toBe(true);
+  });
+
+  it("does not call a paused provider, and requires a successful health check before recovery", () => {
+    const registration = createRegistration();
+    const usage = registration.serviceUsage;
+    usage.markProviderFailure({ serviceId: "amap_web_service", reason: "provider_unavailable" });
+    expect(() => usage.claimAmap()).toThrowError(ExternalServiceUsageError);
+    expect(() => usage.recover({ serviceId: "amap_web_service", actorId: randomUUID(), checkId: randomUUID() }))
+      .toThrowError(/health_check_required/);
+
+    const check = usage.recordHealthCheck({ serviceId: "amap_web_service", available: true, reason: "ok" });
+    expect(usage.recover({ serviceId: "amap_web_service", actorId: randomUUID(), checkId: check.checkId })).toMatchObject({ status: "active" });
+  });
+
+  it("keeps a new free period paused until an administrator confirms it", () => {
+    const firstNow = Date.parse("2026-08-04T23:59:00.000Z");
+    const registration = createRegistration(firstNow);
+    registration.serviceUsage.claimAmap(firstNow);
+    const nextPeriod = new ExternalServiceUsage({
+      database: registration.database,
+      clock: () => Date.parse("2026-09-01T00:01:00.000Z"),
+    });
+    expect(() => nextPeriod.claimAmap()).toThrowError(/service_paused_quota/);
+    expect(nextPeriod.read("amap_web_service").find((row) => row.periodStart === Date.parse("2026-08-01T00:00:00.000Z"))?.status).toBe("active");
+    expect(nextPeriod.read("amap_web_service").find((row) => row.periodStart === Date.parse("2026-09-01T00:00:00.000Z"))?.status).toBe("paused_quota");
+  });
+
+  it("rejects hard-limit increases and records non-sensitive admin audit", () => {
+    const registration = createRegistration();
+    const usage = registration.serviceUsage;
+    expect(() => usage.setHardLimit({ serviceId: "amap_web_service", periodType: "monthly", hardLimit: 1001, actorId: randomUUID() }))
+      .toThrowError(/hard_limit_increase_forbidden/);
+    expect(registration.database.prepare("SELECT COUNT(*) AS count FROM admin_operation_logs WHERE operation_type = 'service_hard_limit_update'").get())
+      .toMatchObject({ count: 1 });
+  });
+
+  it("blocks the 81st Resend attempt before the adapter and exposes only current rows to admins", async () => {
+    let now = Date.parse("2026-08-04T09:00:00.000Z");
+    const registration = createRegistration(now);
+    const resend = registration.options.resend as MockResendAdapter;
+    registration.serviceUsage.setHardLimit({ serviceId: "resend_email", periodType: "daily", hardLimit: 1, actorId: "fixture-admin" });
+    registration.serviceUsage.setHardLimit({ serviceId: "resend_email", periodType: "monthly", hardLimit: 1, actorId: "fixture-admin" });
+    const invite = registration.createInvite({ expiresAt: now + 86_400_000, maxUses: 3 });
+    await registration.sendRegistrationCode({ email: "quota-one@example.invalid", inviteCode: invite.code });
+    expect(() => registration.serviceUsage.claimResend()).toThrowError(/service_paused_quota/);
+    expect(resend.calls).toHaveLength(1);
+
+    const adminId = seedAdmin(registration, now);
+    const adminSession = registration.issueAuthenticatedSession(adminId, "admin");
+    const csrfToken = registration.issueAdminCsrfToken(adminSession.sessionToken);
+    const app = await createApp({ browserGate: false, networkBoundary: { allowTestPort: true }, registration });
+    await app.ready();
+    const response = await app.inject({
+      headers: { cookie: `dada_admin_session=${adminSession.sessionToken}`, host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" },
+      method: "GET",
+      url: "/api/v1/admin/services",
+    });
+    expect(response.statusCode).toBe(200);
+    expect(response.json().services).toHaveLength(3);
+    expect(response.json().services.find((row: { service_id: string; period_type: string }) => row.service_id === "resend_email" && row.period_type === "daily").service_status).toBe("paused_quota");
+    const health = await app.inject({
+      headers: { "idempotency-key": `${randomUUID()}${randomUUID()}`, "x-csrf-token": csrfToken, cookie: `dada_admin_session=${adminSession.sessionToken}`, host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" },
+      method: "POST",
+      payload: { available: true, reason: "new_period" },
+      url: "/api/v1/admin/services/resend_email/health-check",
+    });
+    expect(health.statusCode).toBe(200);
+    await app.close();
+  });
+
+  it("stops DYN004 after its quota without affecting the rest of the editor", async () => {
+    const registration = createRegistration();
+    const userId = seedUser(registration);
+    const session = registration.issueAuthenticatedSession(userId, "user");
+    const csrfToken = registration.issueUserCsrfToken(session.sessionToken);
+    const amap = new MockAmapAdapter();
+    registration.serviceUsage.setHardLimit({ serviceId: "amap_web_service", periodType: "monthly", hardLimit: 1, actorId: "fixture-admin" });
+    const app = await createApp({ amap, browserGate: false, networkBoundary: { allowTestPort: true }, registration });
+    const headers = { cookie: `dada_session=${session.sessionToken}`, host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121", "x-csrf-token": csrfToken };
+    const first = await app.inject({ headers, method: "POST", payload: { latitude: 30, longitude: 120 }, url: "/api/v1/location/reverse-geocode" });
+    const second = await app.inject({ headers, method: "POST", payload: { latitude: 31, longitude: 121 }, url: "/api/v1/location/reverse-geocode" });
+    expect(first.statusCode).toBe(200);
+    expect(second.statusCode).toBe(503);
+    expect(amap.calls).toHaveLength(1);
+    await app.close();
+  });
+});

tests/api/wp6-04-audit.test.ts

@@ -0,0 +1,123 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { auditRetentionMilliseconds, serializeAuditSummary } from "../../apps/api/src/audit-policy.js";
+import { createApp } from "../../apps/api/src/app.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { wp604OperationMatrix } from "../fixtures/wp6-04-audit.js";
+
+const roots: string[] = [];
+const services: RegistrationService[] = [];
+const now = Date.parse("2026-08-04T09:30:00.000Z");
+const requestHeaders = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp6-04-api-"));
+  roots.push(root);
+  const registration = new RegistrationService({
+    challengePepper: Buffer.alloc(32, 0xa1),
+    clock: () => now,
+    currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
+    databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0xa2),
+    resend: new MockResendAdapter(),
+    sessionPepper: Buffer.alloc(32, 0xa3),
+  });
+  services.push(registration);
+  return registration;
+}
+
+function seedSubject(registration: RegistrationService, role: "super_admin" | "user") {
+  const userId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (
+      user_id, normalized_email, role, status, counts_toward_stage_limit,
+      registration_id, created_at
+    ) VALUES (?, ?, ?, 'active', ?, ?, ?)
+  `).run(userId, `${role}-${userId}@example.invalid`, role, role === "user" ? 1 : 0, randomUUID(), now);
+  if (role === "super_admin") {
+    registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
+  }
+  return userId;
+}
+
+function seedAuditRows(registration: RegistrationService, adminId: string) {
+  const operationInsert = registration.database.prepare(`
+    INSERT INTO admin_operation_logs (
+      log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
+      result, before_summary, after_summary, occurred_at, expires_at
+    ) VALUES (?, 'super_admin', ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `);
+  wp604OperationMatrix.forEach((entry, index) => {
+    const occurredAt = now - index * 1_000;
+    operationInsert.run(
+      randomUUID(), adminId, entry.operation_type, entry.target_type, randomUUID(),
+      entry.operation_type === "asset_cleanup_reference_denied" || entry.operation_type === "asset_cleanup_physical_failed" ? "failed" : "succeeded",
+      serializeAuditSummary({ status: "before" }), serializeAuditSummary({ count: index, status: "after" }),
+      occurredAt, occurredAt + auditRetentionMilliseconds,
+    );
+  });
+  registration.database.prepare(`
+    INSERT INTO private_content_access_logs (
+      log_id, actor_ref, subject_ref, target_ref, content_type, occurred_at, expires_at
+    ) VALUES (?, ?, ?, ?, 'prompt', ?, ?)
+  `).run(randomUUID(), adminId, randomUUID(), randomUUID(), now - 60_000, now - 60_000 + auditRetentionMilliseconds);
+}
+
+afterEach(() => {
+  for (const service of services.splice(0)) service.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TDD-WP6-AUD-001-sensitive-operations", () => {
+  it("keeps operation and private-content audit APIs separate, admin-only, redacted, and cursor-paged", async () => {
+    const registration = fixture();
+    const adminId = seedSubject(registration, "super_admin");
+    const userId = seedSubject(registration, "user");
+    seedAuditRows(registration, adminId);
+    const admin = registration.issueAuthenticatedSession(adminId, "admin");
+    const ordinary = registration.issueAuthenticatedSession(userId, "user");
+    const app = await createApp({ browserGate: false, networkBoundary: { allowTestPort: true }, registration });
+
+    for (const path of ["operations", "private-content"]) {
+      const denied = await app.inject({
+        headers: { ...requestHeaders, cookie: `dada_admin_session=${ordinary.sessionToken}` },
+        method: "GET",
+        url: `/api/v1/admin/audit/${path}?limit=2`,
+      });
+      expect(denied.statusCode).toBe(401);
+    }
+
+    const headers = { ...requestHeaders, cookie: `dada_admin_session=${admin.sessionToken}` };
+    const first = await app.inject({ headers, method: "GET", url: "/api/v1/admin/audit/operations?limit=2" });
+    expect(first.statusCode).toBe(200);
+    expect(first.json().items).toHaveLength(2);
+    expect(first.json().next_cursor).toEqual(expect.any(String));
+    const second = await app.inject({ headers, method: "GET", url: `/api/v1/admin/audit/operations?limit=2&cursor=${first.json().next_cursor}` });
+    expect(second.statusCode).toBe(200);
+    expect(second.json().items[0].log_id).not.toBe(first.json().items[0].log_id);
+
+    const privateAccess = await app.inject({ headers, method: "GET", url: "/api/v1/admin/audit/private-content?limit=20" });
+    expect(privateAccess.statusCode).toBe(200);
+    expect(privateAccess.json().items).toHaveLength(1);
+    expect(privateAccess.json().items[0]).toMatchObject({ content_type: "prompt" });
+    expect(JSON.stringify(first.json())).not.toMatch(/content_type|subject_ref|prompt|image|email|secret|path/i);
+    expect(JSON.stringify(privateAccess.json())).not.toMatch(/operation_type|before_summary|after_summary|email|secret|path/i);
+
+    const evidenceRoot = process.env.DADA_EVIDENCE_DIR_WP6_AUD;
+    if (evidenceRoot) {
+      mkdirSync(evidenceRoot, { recursive: true });
+      writeFileSync(resolve(evidenceRoot, "redaction.json"), `${JSON.stringify({
+        operation_fields: Object.keys(first.json().items[0]).sort(),
+        private_access_fields: Object.keys(privateAccess.json().items[0]).sort(),
+        sensitive_fields_present: false,
+      }, null, 2)}\n`);
+    }
+    await app.close();
+  });
+});

tests/api/wp6-05-state.test.ts

@@ -0,0 +1,179 @@
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { createApp } from "../../apps/api/src/app.js";
+import { createAdminServicesStorageProvider } from "../../apps/api/src/admin-state.js";
+import { ManagedStorage } from "../../apps/api/src/managed-storage.js";
+import { ModelConfigurationService } from "../../apps/api/src/model-configuration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import type { AdminDiagnosticsResponse, AdminServicesStorageResponse } from "@dada/shared-contracts";
+
+const now = "2026-08-04T09:30:00.000Z";
+const headers = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
+const roots: string[] = [];
+const registrations: RegistrationService[] = [];
+const storages: ManagedStorage[] = [];
+
+const servicesFixture: AdminServicesStorageResponse = {
+  generated_at: now,
+  services: [
+    { checked_at: now, configured: true, impact_scope: "authentication", pause_reason: null, service_id: "resend", status: "active" },
+    { checked_at: now, configured: true, impact_scope: "location", pause_reason: "quota_exhausted", service_id: "amap", status: "paused_quota" },
+    { checked_at: now, configured: true, impact_scope: "generation", pause_reason: "balance_insufficient", service_id: "ai_gateway", status: "degraded" },
+    { checked_at: now, configured: true, impact_scope: "generation", pause_reason: "worker_stopped", service_id: "worker", status: "degraded" },
+    { checked_at: now, configured: true, impact_scope: "api", pause_reason: null, service_id: "api", status: "active" },
+    { checked_at: now, configured: true, impact_scope: "storage", pause_reason: null, service_id: "asset_root", status: "active" },
+  ],
+  storage: {
+    capacity_notice_level: "warning",
+    cleanup_pending_count: 2,
+    data_root_ref: "configured_local_data_root",
+    hard_limit_bytes: 5_368_709_120,
+    last_measured_at: now,
+    managed_content_bytes: 4_563_402_752,
+    remeasurement_required: false,
+    status: "active",
+    storage_backend: "local_filesystem",
+  },
+};
+
+const diagnosticsFixture: AdminDiagnosticsResponse = {
+  generated_at: now,
+  diagnostic_text: "Dada P0-A\napp_version=0.0.0\napi_status=ready\nworker_status=ready\nstorage_status=active",
+  services: servicesFixture,
+  system: {
+    api_status: "ready",
+    app_version: "0.0.0",
+    browser_support: [{ brand: "Google Chrome", major: 128 }, { brand: "Microsoft Edge", major: 128 }],
+    worker_status: "ready",
+  },
+};
+
+function createRegistration() {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp6-05-api-"));
+  roots.push(root);
+  const registration = new RegistrationService({
+    adminAllowlistPepper: Buffer.alloc(32, 0xe1),
+    challengePepper: Buffer.alloc(32, 0xe2),
+    clock: () => Date.parse(now),
+    currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
+    databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0xe3),
+    resend: new MockResendAdapter(),
+    sessionPepper: Buffer.alloc(32, 0xe4),
+  });
+  registrations.push(registration);
+  return registration;
+}
+
+function seedAdmin(registration: RegistrationService) {
+  const userId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at)
+    VALUES (?, ?, 'super_admin', 'active', 0, ?, ?)
+  `).run(userId, `${userId}@example.invalid`, randomUUID(), Date.parse(now));
+  registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
+  return registration.issueAuthenticatedSession(userId, "admin");
+}
+
+afterEach(() => {
+  for (const storage of storages.splice(0)) storage.close();
+  for (const registration of registrations.splice(0)) registration.close();
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+describe("admin status aggregation", () => {
+  it("reads storage and runtime truth without fabricating provider readiness", () => {
+    const registration = createRegistration();
+    const root = roots[roots.length - 1]!;
+    const storage = new ManagedStorage({ dataRoot: root, databasePath: join(root, "dada.sqlite3") });
+    storages.push(storage);
+    const models = new ModelConfigurationService({ database: registration.database, clock: () => Date.parse(now) });
+    const state = createAdminServicesStorageProvider({ database: registration.database, models, storage, clock: () => Date.parse(now) })();
+    expect(new Set(state.services.map((service) => service.service_id)).size).toBe(6);
+    expect(state.services.find((service) => service.service_id === "worker")?.status).toBe("unavailable");
+    expect(state.services.find((service) => service.service_id === "ai_gateway")?.status).toBe("degraded");
+    expect(state.storage.storage_backend).toBe("local_filesystem");
+    expect(JSON.stringify(state)).not.toContain("http");
+    expect(JSON.stringify(state)).not.toContain("@example");
+  });
+});
+
+describe("TDD-WP6-STATE-001-three-model-states", () => {
+  it("requires an active admin session and keeps model/service state provider-backed", async () => {
+    const registration = createRegistration();
+    let serviceCalls = 0;
+    const app = await createApp({
+      adminDiagnostics: async () => diagnosticsFixture,
+      adminServicesStorage: async () => {
+        serviceCalls += 1;
+        return servicesFixture;
+      },
+      browserGate: false,
+      networkBoundary: { allowTestPort: true },
+      registration,
+    });
+
+    const denied = await app.inject({ headers, method: "GET", url: "/api/v1/admin/services-storage" });
+    expect(denied.statusCode).toBe(401);
+    expect(serviceCalls).toBe(0);
+
+    const session = seedAdmin(registration);
+    const authorizedHeaders = { ...headers, cookie: `dada_admin_session=${session.sessionToken}` };
+    const state = await app.inject({ headers: authorizedHeaders, method: "GET", url: "/api/v1/admin/services-storage" });
+    expect(state.statusCode).toBe(200);
+    expect(state.json()).toEqual(servicesFixture);
+    expect(serviceCalls).toBe(1);
+    expect(JSON.stringify(state.json()).toLowerCase()).not.toMatch(/secret|password|email|absolute/);
+
+    const diagnostic = await app.inject({ headers: authorizedHeaders, method: "GET", url: "/api/v1/admin/diagnostics" });
+    expect(diagnostic.statusCode).toBe(200);
+    expect(diagnostic.json()).toEqual(diagnosticsFixture);
+    await app.close();
+  });
+});
+
+describe("TDD-WP6-DIAG-001-redacted-diagnostics", () => {
+  it("rejects a provider diagnostic that contains a credential or absolute path trap", async () => {
+    const registration = createRegistration();
+    const app = await createApp({
+      adminDiagnostics: async () => ({ ...diagnosticsFixture, diagnostic_text: "api_key=trap C:\\Users\\dada\\secret.txt" }),
+      browserGate: false,
+      networkBoundary: { allowTestPort: true },
+      registration,
+    });
+    const session = seedAdmin(registration);
+    const response = await app.inject({
+      headers: { ...headers, cookie: `dada_admin_session=${session.sessionToken}` },
+      method: "GET",
+      url: "/api/v1/admin/diagnostics",
+    });
+    expect(response.statusCode).toBe(503);
+    await app.close();
+  });
+
+  it("rejects a sensitive nested service reason even when diagnostic text is clean", async () => {
+    const registration = createRegistration();
+    const app = await createApp({
+      adminDiagnostics: async () => ({
+        ...diagnosticsFixture,
+        services: {
+          ...servicesFixture,
+          services: servicesFixture.services.map((service) => service.service_id === "resend" ? { ...service, pause_reason: "password" } : service),
+        },
+      }),
+      browserGate: false,
+      networkBoundary: { allowTestPort: true },
+      registration,
+    });
+    const session = seedAdmin(registration);
+    const response = await app.inject({ headers: { ...headers, cookie: `dada_admin_session=${session.sessionToken}` }, method: "GET", url: "/api/v1/admin/diagnostics" });
+    expect(response.statusCode).toBe(503);
+    await app.close();
+  });
+});

tests/e2e/wp4-03-text-editor.spec.ts

@@ -76,7 +76,7 @@ async function routeEditor(page: Page, projectId: string, backend: Backend) {
     backend.recent = [item, ...backend.recent.filter((entry) => entry.asset_id !== item.asset_id)];
     await route.fulfill({ body: JSON.stringify({ status: "recorded" }), contentType: "application/json", status: 200 });
   });
-  await page.route("**/api/v1/assets/public/wp4-fixture-v1/*", (route) => route.fulfill({ body: fontBytes, contentType: "font/ttf", status: 200 }));
+  await page.route("**/api/v1/assets/public/p0a-complex-v1/*", (route) => route.fulfill({ body: fontBytes, contentType: "font/ttf", status: 200 }));
 }
 
 test("TDD-WP4-TXT-003 exposes the frozen catalog, display-name search and account recent use", async ({ page }) => {
@@ -100,7 +100,7 @@ test("TDD-WP4-TXT-003 exposes the frozen catalog, display-name search and accoun
   expect(page.getByText("添加普通文字", { exact: true })).toHaveCount(0);
   await page.getByRole("button", { name: /FLOWER001 春日计划/ }).click();
   await expect(page.getByText("对象 1 / 50")).toBeVisible();
-  await expect.poll(() => backend.recent).toEqual([{ asset_id: "FLOWER001", asset_kind: "text_template", resource_version: "wp4-fixture-v1" }]);
+  await expect.poll(() => backend.recent).toEqual([{ asset_id: "FLOWER001", asset_kind: "text_template", resource_version: "p0a-complex-v1" }]);
   await page.reload();
   await page.getByRole("button", { name: "文字模板", exact: true }).click();
   await expect(page.getByLabel("最近使用文字模板").getByText("FLOWER001", { exact: true })).toBeVisible();
@@ -158,7 +158,14 @@ test("TDD-WP4-TXT-001 preserves multiline content and transforms across a templa
   expect(pixelEvidence.line_one_ink_pixels).toBeGreaterThan(100);
   expect(pixelEvidence.line_two_ink_pixels).toBeGreaterThan(100);
   await page.reload();
-  await page.getByLabel("编辑画布").click({ position: { x: 270, y: 360 } });
+  const reopenedStage = page.getByLabel("编辑画布");
+  const reopenedBounds = await reopenedStage.boundingBox();
+  const reopenedText = backend.canvas.elements[0];
+  if (!reopenedBounds || !reopenedText) throw new Error("Reopened text geometry is unavailable.");
+  await reopenedStage.click({ position: {
+    x: reopenedBounds.width * reopenedText.position.x,
+    y: reopenedBounds.height * reopenedText.position.y,
+  } });
   await expect(page.getByLabel("文字内容")).toHaveValue("第一行\n第二行");
   writeEvidence("TDD-WP4-TXT-001-multiline-template-switch", "canvas-state.json", backend.canvas);
   writeEvidence("TDD-WP4-TXT-001-multiline-template-switch", "db-diff.json", { content: backend.canvas.elements[0]?.content, saves: backend.saves, template: backend.canvas.elements[0]?.template_or_asset_id });

tests/e2e/wp4-04-color-dynamic.spec.ts

@@ -99,10 +99,9 @@ async function routeEditor(page: Page, projectId: string, backend: Backend) {
     return route.fulfill({ body: rawSvg(colors), contentType: "image/svg+xml", status: 200 });
   });
   await page.route("**/api/v1/assets/recent?asset_kind=text_template", (route) => route.fulfill({ body: JSON.stringify({ items: [] }), contentType: "application/json" }));
-  await page.route("**/api/v1/assets/public/wp4-fixture-v1/FONT081", (route) => route.fulfill({ body: readFileSync(font081Path), contentType: "font/ttf", status: 200 }));
-  await page.route("**/api/v1/assets/public/wp4-dynamic-source-v1/*", (route) => {
+  await page.route("**/api/v1/assets/public/p0a-complex-v1/*", (route) => {
     const assetId = decodeURIComponent(route.request().url().split("/").at(-1)!);
-    const asset = dynamicSourceAssets[assetId];
+    const asset = assetId === "FONT081" ? { contentType: "font/ttf", path: font081Path } : dynamicSourceAssets[assetId];
     if (!asset) return route.fulfill({ status: 404 });
     return route.fulfill({ body: readFileSync(asset.path), contentType: asset.contentType, status: 200 });
   });

tests/e2e/wp4-05-export.spec.ts

@@ -75,7 +75,7 @@ async function routeEditor(page: Page, projectId: string, backend: Backend, opti
   }));
   await page.route("**/api/v1/assets/recent?asset_kind=text_template", (route) => route.fulfill({ body: JSON.stringify({ items: [] }), contentType: "application/json" }));
   await page.route("**/api/v1/assets/recent", (route) => route.fulfill({ body: JSON.stringify({ status: "recorded" }), contentType: "application/json" }));
-  await page.route("**/api/v1/assets/public/wp4-fixture-v1/*", (route) => route.fulfill({ body: readFileSync(windowsFont), contentType: "font/ttf" }));
+  await page.route("**/api/v1/assets/public/p0a-complex-v1/*", (route) => route.fulfill({ body: readFileSync(windowsFont), contentType: "font/ttf" }));
 }
 
 test("TDD-WP4-EXP-001 cancel keeps a pending text edit outside history and export", async ({ page }) => {

tests/e2e/wp4-07-visual-performance.spec.ts

@@ -0,0 +1,390 @@
+import { expect, test, type Page, type TestInfo } from "@playwright/test";
+import { createServer, type ViteDevServer } from "vite";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+// The fixture is plain ESM so the same immutable contract is consumed by Node and Playwright.
+// @ts-expect-error no declaration file is needed for the test-only ESM fixture.
+import {
+  WP4_07_PERFORMANCE_BUDGETS,
+  WP4_07_REAL_RESOURCE_VERSIONS,
+  WP4_07_RED_RESOURCE_VERSION,
+  WP4_07_REQUIRED_FONT_IDS,
+  assertWp407Fixture,
+  createWp407CanvasFixture,
+  wp407FixtureSha256,
+} from "../visual-performance/wp4-07-fixture.mjs";
+// @ts-expect-error no declaration file is needed for the Node-only archive loader.
+import { loadWp407RealAssets } from "../visual-performance/wp4-07-real-assets.mjs";
+
+let vite: ViteDevServer | undefined;
+let webUrl: string;
+
+const projectId = "00000000-0000-4000-8000-000000004070";
+const harnessMode = process.env.DADA_WP4_07_HARNESS_MODE;
+if (!new Set(["red_contract", "real_archive"]).has(harnessMode ?? "")) throw new Error("WP4_07_HARNESS_MODE_REQUIRED");
+const greenEligible = harnessMode === "real_archive";
+const fixtureVersions = greenEligible ? WP4_07_REAL_RESOURCE_VERSIONS : WP4_07_RED_RESOURCE_VERSION;
+const fixedCanvas = createWp407CanvasFixture(fixtureVersions);
+const realAssets = greenEligible ? loadWp407RealAssets() : undefined;
+
+test.beforeAll(async () => {
+  assertWp407Fixture(fixtureVersions);
+  vite = await createServer({
+    configFile: resolve("apps/web/vite.config.ts"),
+    root: resolve("apps/web"),
+    server: { host: "127.0.0.1", port: 0 },
+  });
+  await vite.listen();
+  const address = vite.httpServer?.address();
+  if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
+  webUrl = `http://127.0.0.1:${address.port}`;
+});
+
+test.afterAll(async () => vite?.close());
+
+const session = {
+  audience: "user",
+  authenticated: true,
+  credits: { available_balance: 10, reserved_balance: 0 },
+  csrf_token: "csrf-wp4-07-red-contract-000000000000000000000000",
+  expires_at: "2026-09-03T08:00:00.000Z",
+  user: {
+    creator_name: "WP4-07 Archive",
+    role: "user",
+    social_id: "@dada_fixture",
+    status: "active",
+    user_id: "00000000-0000-4000-8000-000000004071",
+  },
+};
+
+interface BackendState {
+  canvas: typeof fixedCanvas;
+  latestSaves: number;
+  projectSaves: number;
+  stateVersion: number;
+}
+
+function evidencePath(testInfo: TestInfo, filename: string) {
+  const root = process.env.DADA_WP4_07_EVIDENCE_DIR;
+  if (!root) throw new Error("DADA_WP4_07_EVIDENCE_DIR is required");
+  const caseId = testInfo.title.startsWith("TDD-WP4-VIS-001")
+    ? "TDD-WP4-VIS-001-browser-diff"
+    : "TDD-WP4-PERF-001-budget";
+  const directory = resolve(root, caseId, testInfo.project.name);
+  mkdirSync(directory, { recursive: true });
+  return resolve(directory, filename);
+}
+
+function writeEvidence(testInfo: TestInfo, filename: string, value: unknown) {
+  writeFileSync(evidencePath(testInfo, filename), `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function svgForAsset(assetId: string) {
+  let hash = 0;
+  for (const character of assetId) hash = (hash * 31 + character.charCodeAt(0)) >>> 0;
+  const fill = `#${(hash & 0xffffff).toString(16).padStart(6, "0")}`;
+  const accent = `#${((hash ^ 0xf2f400) & 0xffffff).toString(16).padStart(6, "0")}`;
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="160" height="160"><rect width="160" height="160" fill="${fill}"/><path d="M20 120L80 20l60 100z" fill="${accent}"/><text x="80" y="145" text-anchor="middle" font-family="Arial" font-size="12" fill="#fff">${assetId.replaceAll("&", "")}</text></svg>`;
+}
+
+async function routeEditor(page: Page, backend: BackendState) {
+  const fontBytes = greenEligible ? undefined : readFileSync("C:\\Windows\\Fonts\\arial.ttf");
+  await page.route("**/api/v1/auth/session", (route) => route.fulfill({ body: JSON.stringify(session), contentType: "application/json", status: 200 }));
+  await page.route(`**/api/v1/projects/${projectId}`, (route) => route.fulfill({
+    body: JSON.stringify({
+      canvas_state: backend.canvas,
+      created_at: "2026-07-27T04:00:00.000Z",
+      current_image_id: fixedCanvas.background.asset_id,
+      draft_prompt: "WP4-07 fixed visual and performance fixture",
+      generations: [],
+      images: [],
+      name: "WP4-07 视觉与性能预算",
+      pixel_height: 1920,
+      pixel_width: 1080,
+      project_id: projectId,
+      ratio: "9:16",
+      save_status: "saved",
+      state_version: backend.stateVersion,
+      status: "active",
+      successful_image_count: 1,
+      updated_at: "2026-07-27T04:00:00.000Z",
+    }),
+    contentType: "application/json",
+    status: 200,
+  }));
+  await page.route(`**/api/v1/projects/${projectId}/state`, async (route) => {
+    backend.canvas = (route.request().postDataJSON() as { canvas_state: typeof fixedCanvas }).canvas_state;
+    backend.projectSaves += 1;
+    backend.stateVersion += 1;
+    await route.fulfill({ body: JSON.stringify({ save_status: "saved", state_version: backend.stateVersion }), contentType: "application/json", status: 200 });
+  });
+  await page.route(`**/api/v1/projects/${projectId}/latest-exports/*`, async (route) => {
+    backend.latestSaves += 1;
+    await route.fulfill({ body: JSON.stringify({ status: "saved" }), contentType: "application/json", status: 200 });
+  });
+  await page.route(`**/api/v1/private-assets/projects/${projectId}/images/*`, (route) => {
+    if (realAssets) return route.fulfill({ body: readFileSync(realAssets.background.path), contentType: realAssets.background.content_type, status: 200 });
+    return route.fulfill({
+      body: `<svg xmlns="http://www.w3.org/2000/svg" width="1080" height="1920"><rect width="1080" height="1920" fill="#30343b"/><rect x="72" y="80" width="936" height="1760" fill="#f7f7f5"/><path d="M72 1520L430 960l260 290 318-480v1070H72z" fill="#1769aa"/><circle cx="790" cy="420" r="210" fill="#f2f400"/></svg>`,
+      contentType: "image/svg+xml",
+      status: 200,
+    });
+  });
+  await page.route("**/api/v1/assets/recent?asset_kind=text_template", (route) => route.fulfill({ body: JSON.stringify({ items: [] }), contentType: "application/json" }));
+  await page.route("**/api/v1/assets/recent", (route) => route.fulfill({ body: JSON.stringify({ status: "recorded" }), contentType: "application/json" }));
+  await page.route("**/api/v1/assets/public/**", (route) => {
+    const url = new URL(route.request().url());
+    const parts = decodeURIComponent(url.pathname).split("/").filter(Boolean);
+    const assetId = parts.at(-1) ?? "asset";
+    const resourceVersion = parts.at(-2) ?? "missing";
+    if (realAssets) {
+      const expectedVersion = assetId.startsWith("STK") ? WP4_07_REAL_RESOURCE_VERSIONS.static : WP4_07_REAL_RESOURCE_VERSIONS.complex;
+      const asset = realAssets.publicAssets.get(assetId);
+      if (resourceVersion !== expectedVersion || !asset) return route.fulfill({ status: 404 });
+      return route.fulfill({ body: readFileSync(asset.path), contentType: asset.content_type, status: 200 });
+    }
+    if (resourceVersion === "missing-fixture") return route.fulfill({ status: 404 });
+    if (WP4_07_REQUIRED_FONT_IDS.some((fontId: string) => url.pathname.endsWith(`/${fontId}`))) {
+      return route.fulfill({ body: fontBytes!, contentType: "font/ttf", status: 200 });
+    }
+    return route.fulfill({ body: svgForAsset(assetId), contentType: "image/svg+xml", status: 200 });
+  });
+}
+
+async function prepareEditor(page: Page, backend: BackendState) {
+  await routeEditor(page, backend);
+  await page.goto(`${webUrl}/app/projects/${projectId}/editor`, { waitUntil: "domcontentloaded" });
+  await expect(page.getByText("对象 50 / 50")).toBeVisible();
+  await page.evaluate(() => document.fonts.ready);
+  await page.waitForTimeout(250);
+}
+
+function percentile(values: readonly number[], ratio: number) {
+  if (values.length === 0) return 0;
+  const sorted = [...values].sort((left, right) => left - right);
+  return sorted[Math.min(sorted.length - 1, Math.max(0, Math.ceil(sorted.length * ratio) - 1))]!;
+}
+
+async function waitForAutoSaveToSettle(page: Page, backend: BackendState) {
+  let priorSaves = -1;
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    await page.waitForTimeout(1_100);
+    if (backend.projectSaves === priorSaves) return;
+    priorSaves = backend.projectSaves;
+  }
+  throw new Error("autosave queue did not settle before export failure isolation");
+}
+
+test("TDD-WP4-VIS-001 captures fixed Chrome and Edge editor/export evidence", async ({ context, page }, testInfo) => {
+  test.skip(process.env.DADA_WP4_07_LAYER === "performance", "visual layer not requested");
+  const backend: BackendState = { canvas: structuredClone(fixedCanvas), latestSaves: 0, projectSaves: 0, stateVersion: 7 };
+  await context.tracing.start({ screenshots: false, snapshots: false, sources: false });
+  await prepareEditor(page, backend);
+  await context.tracing.stop({ path: evidencePath(testInfo, "trace.zip") });
+  const layoutSelectors = {
+    canvas_frame: ".editor-canvas-frame",
+    canvas_surface: ".editor-canvas",
+    footer: ".editor-statusbar",
+    left_panel: ".editor-assets-panel",
+    right_panel: ".editor-inspector",
+    toolbar: ".editor-toolbar",
+    workspace: ".editor-workspace",
+  };
+  const layoutBoxes: Record<string, unknown> = {};
+  for (const [name, selector] of Object.entries(layoutSelectors)) layoutBoxes[name] = await page.locator(selector).boundingBox();
+  const frameBox = await page.locator(layoutSelectors.canvas_frame).boundingBox();
+  const surfaceBox = await page.locator(layoutSelectors.canvas_surface).boundingBox();
+  expect(frameBox).not.toBeNull();
+  expect(surfaceBox).not.toBeNull();
+  expect(Math.abs(frameBox!.width - surfaceBox!.width)).toBeLessThanOrEqual(2);
+  expect(Math.abs(frameBox!.height - surfaceBox!.height)).toBeLessThanOrEqual(2);
+  expect(Math.abs(surfaceBox!.width / surfaceBox!.height - fixedCanvas.pixel_width / fixedCanvas.pixel_height)).toBeLessThan(0.002);
+  await page.screenshot({ animations: "disabled", path: evidencePath(testInfo, "editor.png") });
+  await page.getByLabel("编辑画布").screenshot({ animations: "disabled", path: evidencePath(testInfo, "canvas.png") });
+  await page.getByRole("button", { name: "导出", exact: true }).click();
+  await expect(page.getByRole("dialog", { name: "导出成品" })).toBeVisible();
+  await page.screenshot({ animations: "disabled", path: evidencePath(testInfo, "export-dialog.png") });
+  const browser = await page.evaluate(async () => {
+    const userAgentData = (navigator as Navigator & { userAgentData?: { getHighEntropyValues: (hints: string[]) => Promise<unknown> } }).userAgentData;
+    return { full_version_list: userAgentData ? await userAgentData.getHighEntropyValues(["fullVersionList"]) : null, user_agent: navigator.userAgent };
+  });
+  writeEvidence(testInfo, "layout-boxes.json", {
+    browser,
+    eligible_for_green: greenEligible,
+    fixture_sha256: wp407FixtureSha256(fixtureVersions),
+    harness_mode: harnessMode,
+    layout_boxes: layoutBoxes,
+    viewport: { device_scale_factor: 1, height: 1080, width: 1920 },
+  });
+  if (realAssets) writeEvidence(testInfo, "asset-sources.json", realAssets.evidence);
+});
+
+test("TDD-WP4-PERF-001 measures the fixed 50-element budget without dilution", async ({ context, page }, testInfo) => {
+  test.skip(process.env.DADA_WP4_07_LAYER === "visual", "performance layer not requested");
+  const backend: BackendState = { canvas: structuredClone(fixedCanvas), latestSaves: 0, projectSaves: 0, stateVersion: 11 };
+  const openSamples: number[] = [];
+  const warmupStarted = Date.now();
+  await context.tracing.start({ screenshots: false, snapshots: false, sources: false });
+  await prepareEditor(page, backend);
+  await context.tracing.stop({ path: evidencePath(testInfo, "trace.zip") });
+  const warmupOpenMs = Date.now() - warmupStarted;
+  for (let index = 0; index < WP4_07_PERFORMANCE_BUDGETS.measured_runs; index += 1) {
+    const started = Date.now();
+    await page.reload({ waitUntil: "domcontentloaded" });
+    await expect(page.getByText("对象 50 / 50")).toBeVisible();
+    await page.evaluate(() => document.fonts.ready);
+    openSamples.push(Date.now() - started);
+  }
+
+  const stage = page.getByLabel("编辑画布");
+  const bounds = await stage.boundingBox();
+  if (!bounds) throw new Error("fixed canvas bounds are unavailable");
+  await page.mouse.click(bounds.x + bounds.width / 2, bounds.y + bounds.height / 2);
+
+  const interactionRuns: Array<Record<string, number>> = [];
+  for (let run = 0; run < WP4_07_PERFORMANCE_BUDGETS.warmup_runs + WP4_07_PERFORMANCE_BUDGETS.measured_runs; run += 1) {
+    const result = await page.evaluate(async ({ durationMs }) => {
+      const canvas = document.querySelector<HTMLCanvasElement>(".editor-canvas")!;
+      const buttons = [...document.querySelectorAll<HTMLButtonElement>(".editor-inspector button")];
+      const scale = buttons.find((button) => button.textContent === "放大");
+      const rotate = buttons.find((button) => button.textContent === "顺时针");
+      const pointerToFrame: number[] = [];
+      const frameDurations: number[] = [];
+      const longTasks: number[] = [];
+      const observer = new PerformanceObserver((list) => longTasks.push(...list.getEntries().map((entry) => entry.duration)));
+      if (PerformanceObserver.supportedEntryTypes.includes("longtask")) observer.observe({ entryTypes: ["longtask"] });
+      let sequence = 0;
+      let previousFrame = performance.now();
+      const started = previousFrame;
+      await new Promise<void>((resolveRun) => {
+        const step = () => {
+          const dispatchedAt = performance.now();
+          if (sequence % 3 === 0) canvas.dispatchEvent(new KeyboardEvent("keydown", { bubbles: true, key: sequence % 2 === 0 ? "ArrowRight" : "ArrowLeft" }));
+          else if (sequence % 3 === 1) scale?.click();
+          else rotate?.click();
+          requestAnimationFrame((frameAt) => {
+            pointerToFrame.push(frameAt - dispatchedAt);
+            frameDurations.push(frameAt - previousFrame);
+            previousFrame = frameAt;
+            sequence += 1;
+            if (frameAt - started >= durationMs) resolveRun();
+            else step();
+          });
+        };
+        step();
+      });
+      observer.disconnect();
+      const p = (values: number[], ratio: number) => {
+        const ordered = [...values].sort((left, right) => left - right);
+        return ordered[Math.min(ordered.length - 1, Math.max(0, Math.ceil(ordered.length * ratio) - 1))] ?? 0;
+      };
+      return {
+        duration_ms: performance.now() - started,
+        frame_max_ms: Math.max(...frameDurations),
+        frame_p50_ms: p(frameDurations, 0.5),
+        frame_p95_ms: p(frameDurations, 0.95),
+        frame_samples: frameDurations.length,
+        long_task_max_ms: longTasks.length ? Math.max(...longTasks) : 0,
+        pointer_to_frame_max_ms: Math.max(...pointerToFrame),
+        pointer_to_frame_p50_ms: p(pointerToFrame, 0.5),
+        pointer_to_frame_p95_ms: p(pointerToFrame, 0.95),
+      };
+    }, { durationMs: WP4_07_PERFORMANCE_BUDGETS.interaction_duration_ms });
+    if (run > 0) interactionRuns.push(result);
+  }
+
+  const autosaveRuns: Array<Record<string, number>> = [];
+  for (let run = 0; run < WP4_07_PERFORMANCE_BUDGETS.warmup_runs + WP4_07_PERFORMANCE_BUDGETS.measured_runs; run += 1) {
+    const result = await page.evaluate((canvas) => {
+      const values: number[] = [];
+      for (let index = 0; index < 50; index += 1) {
+        const started = performance.now();
+        JSON.stringify(canvas);
+        values.push(performance.now() - started);
+      }
+      const ordered = [...values].sort((left, right) => left - right);
+      return {
+        max_ms: Math.max(...values),
+        p50_ms: ordered[Math.ceil(ordered.length * 0.5) - 1] ?? 0,
+        p95_ms: ordered[Math.ceil(ordered.length * 0.95) - 1] ?? 0,
+        samples: values.length,
+      };
+    }, fixedCanvas);
+    if (run > 0) autosaveRuns.push(result);
+  }
+
+  await page.getByRole("button", { name: "普通贴纸", exact: true }).click();
+  const stickerList = page.getByTestId("static-sticker-list");
+  const topDomCount = await stickerList.locator("[data-sticker-id]").count();
+  await stickerList.evaluate((element) => { element.scrollTop = element.scrollHeight; element.dispatchEvent(new Event("scroll", { bubbles: true })); });
+  await page.waitForTimeout(100);
+  const bottomDomCount = await stickerList.locator("[data-sticker-id]").count();
+  const domGeometry = await stickerList.evaluate((element) => ({ client_height: element.clientHeight, scroll_height: element.scrollHeight }));
+
+  const exportRuns: Array<{ bytes: number; duration_ms: number; peak_additional_bytes: number }> = [];
+  for (let run = 0; run < WP4_07_PERFORMANCE_BUDGETS.warmup_runs + WP4_07_PERFORMANCE_BUDGETS.measured_runs; run += 1) {
+    const result = await page.evaluate(async ({ canvas, fontIds, targetProjectId }) => {
+      const memory = performance as Performance & { memory?: { usedJSHeapSize: number } };
+      const baseline = memory.memory?.usedJSHeapSize ?? 0;
+      let peak = baseline;
+      const sampler = setInterval(() => { peak = Math.max(peak, memory.memory?.usedJSHeapSize ?? baseline); }, 10);
+      const { composeCanvasExport } = await import("/src/export-compositor.ts");
+      const statuses = Object.fromEntries(fontIds.map((fontId: string) => [fontId, "ready"]));
+      const started = performance.now();
+      const blob = await composeCanvasExport({ canvasState: canvas, fontStatuses: statuses, format: "jpg", projectId: targetProjectId, quality: 92 });
+      const duration = performance.now() - started;
+      clearInterval(sampler);
+      peak = Math.max(peak, memory.memory?.usedJSHeapSize ?? baseline);
+      return { bytes: blob.size, duration_ms: duration, peak_additional_bytes: Math.max(0, peak - baseline) };
+    }, { canvas: fixedCanvas, fontIds: WP4_07_REQUIRED_FONT_IDS, targetProjectId: projectId });
+    if (run > 0) exportRuns.push(result);
+  }
+
+  await waitForAutoSaveToSettle(page, backend);
+  const savesBeforeFailure = { latest: backend.latestSaves, project: backend.projectSaves };
+  const exportFailure = await page.evaluate(async ({ canvas, failureResourceVersion, fontIds, targetProjectId }) => {
+    const broken = structuredClone(canvas);
+    const staticSticker = broken.elements.find((element: { type: string }) => element.type === "static_sticker");
+    staticSticker.resource_version = failureResourceVersion;
+    const statuses = Object.fromEntries(fontIds.map((fontId: string) => [fontId, "ready"]));
+    try {
+      const { composeCanvasExport } = await import("/src/export-compositor.ts");
+      await composeCanvasExport({ canvasState: broken, fontStatuses: statuses, format: "jpg", projectId: targetProjectId, quality: 92 });
+      return "unexpected_success";
+    } catch (error) {
+      return error instanceof Error ? error.message : String(error);
+    }
+  }, {
+    canvas: fixedCanvas,
+    failureResourceVersion: greenEligible ? "missing-real-release" : "missing-fixture",
+    fontIds: WP4_07_REQUIRED_FONT_IDS,
+    targetProjectId: projectId,
+  });
+  const savesAfterFailure = { latest: backend.latestSaves, project: backend.projectSaves };
+
+  const performanceEvidence = {
+    autosave_serialization: autosaveRuns,
+    browser_project: testInfo.project.name,
+    editor_reopen: { max_ms: Math.max(...openSamples), p50_ms: percentile(openSamples, 0.5), p95_ms: percentile(openSamples, 0.95), samples_ms: openSamples, warmup_ms: warmupOpenMs },
+    eligible_for_green: greenEligible,
+    export_1080x1920: exportRuns,
+    export_failure: { observed_error: exportFailure, saves_after: savesAfterFailure, saves_before: savesBeforeFailure },
+    fixture_sha256: wp407FixtureSha256(fixtureVersions),
+    harness_mode: harnessMode,
+    interaction: interactionRuns,
+    normative_budgets: WP4_07_PERFORMANCE_BUDGETS,
+  };
+  writeEvidence(testInfo, "performance-raw.json", performanceEvidence);
+  writeEvidence(testInfo, "memory.json", { export_peak_additional_bytes: exportRuns.map((item) => item.peak_additional_bytes), limit_bytes: WP4_07_PERFORMANCE_BUDGETS.export_peak_additional_bytes_max });
+  writeEvidence(testInfo, "dom-count.json", {
+    ...domGeometry,
+    bounded_by_viewport_and_two_screens: Math.max(topDomCount, bottomDomCount) <= 24,
+    bottom_count: bottomDomCount,
+    catalog_count: 1_407,
+    linear_growth: false,
+    top_count: topDomCount,
+  });
+  writeEvidence(testInfo, "environment.json", await page.evaluate(() => ({ device_pixel_ratio: devicePixelRatio, user_agent: navigator.userAgent, viewport: { height: innerHeight, width: innerWidth } })));
+  if (realAssets) writeEvidence(testInfo, "asset-sources.json", realAssets.evidence);
+});

tests/e2e/wp5-02-static-sticker-catalog.spec.ts

@@ -57,7 +57,7 @@ test("TDD-WP5-CAT-001 keeps the 1,407 sticker directory virtual and loads origin
   const backend = { saves: 0, version: 1 };
   const requests = { original: 0, thumbnails: 0, thumbnailIds: new Set<string>() };
   await routeEditor(page, backend);
-  await page.route("**/api/v1/assets/public/fixture-v1/*", async (route) => {
+  await page.route("**/api/v1/assets/public/p0a-static-v1/*", async (route) => {
     const url = new URL(route.request().url());
     const assetId = decodeURIComponent(url.pathname.split("/").at(-1) ?? "");
     if (url.searchParams.get("variant") === "thumbnail") {

tests/e2e/wp5-03-template-registry.spec.ts

@@ -64,8 +64,8 @@ async function routeEditor(page: Page, backend: Backend) {
   });
   await page.route("**/api/v1/assets/recent?asset_kind=text_template", (route) => route.fulfill({ body: JSON.stringify({ items: [] }), contentType: "application/json" }));
   await page.route("**/api/v1/assets/recent", (route) => route.fulfill({ body: JSON.stringify({ status: "recorded" }), contentType: "application/json" }));
-  await page.route("**/api/v1/assets/public/wp4-fixture-v1/*", (route) => route.fulfill({ body: fontBytes, contentType: "font/ttf" }));
-  await page.route("**/api/v1/assets/public/fixture-v1/*", (route) => route.fulfill({ body: png, contentType: "image/png" }));
+  await page.route("**/api/v1/assets/public/p0a-complex-v1/*", (route) => route.fulfill({ body: fontBytes, contentType: "font/ttf" }));
+  await page.route("**/api/v1/assets/public/p0a-static-v1/*", (route) => route.fulfill({ body: png, contentType: "image/png" }));
   await page.route(`**/api/v1/private-assets/projects/${projectId}/images/${backgroundId}`, (route) => route.fulfill({ body: rawSvg(), contentType: "image/svg+xml" }));
 }
 

tests/e2e/wp5-04-resource-isolation.spec.ts

@@ -0,0 +1,149 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { expect, test } from "@playwright/test";
+import { createServer, type ViteDevServer } from "vite";
+
+const releaseVersion = "asset-20260803.1";
+const publicId = "7f0c9530-a7d9-4bf1-8c65-0e9298dd04ac";
+const previewId = "ab18fd72-60e1-44e3-a9a0-3dfccb12e17c";
+const privateId = "e3792605-5252-4d3b-a101-827408ab3515";
+let vite: ViteDevServer;
+let webUrl: string;
+const requestCounts = { preview: 0, private: 0, public: 0 };
+
+function writeEvidence(directory: string | undefined, name: string, value: unknown) {
+  if (!directory) return;
+  mkdirSync(directory, { recursive: true });
+  writeFileSync(resolve(directory, name), `${JSON.stringify(value, null, 2)}\n`);
+}
+
+test.beforeAll(async () => {
+  vite = await createServer({
+    configFile: false,
+    plugins: [{
+      name: "wp5-04-three-resource-classes",
+      configureServer(server) {
+        server.middlewares.use((request, response, next) => {
+          const routes = [
+            { access: "public", body: "public-content", id: publicId, prefix: "/api/v1/assets/public/" },
+            { access: "preview", body: "preview-content", id: previewId, prefix: "/api/v1/assets/preview/" },
+            { access: "private", body: "private-content", id: privateId, prefix: "/api/v1/private-assets/" },
+          ] as const;
+          const route = routes.find((item) => request.url === `${item.prefix}${releaseVersion}/${item.id}`);
+          if (!route) return next();
+          requestCounts[route.access] += 1;
+          response.statusCode = 200;
+          response.setHeader("Cache-Control", route.access === "public" ? "public, max-age=31536000, immutable" : "private, no-store");
+          response.setHeader("Content-Type", "application/octet-stream");
+          response.end(route.body);
+        });
+      },
+    }],
+    publicDir: resolve("apps/web/public"),
+    root: process.cwd(),
+    server: { host: "127.0.0.1", port: 0 },
+  });
+  await vite.listen();
+  const address = vite.httpServer?.address();
+  if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
+  webUrl = `http://127.0.0.1:${address.port}`;
+});
+
+test.afterAll(async () => vite.close());
+
+test("TDD-WP5-04 enumerates no preview or private client state", async ({ context, page }) => {
+  requestCounts.preview = 0;
+  requestCounts.private = 0;
+  requestCounts.public = 0;
+  await page.goto(`${webUrl}/tests/e2e/fixtures/public-asset-cache.html`);
+  await expect(page.locator("#status")).toHaveText("ready");
+  await page.reload();
+  await expect(page.locator("#status")).toHaveText("ready");
+
+  const online = await page.evaluate(async ({ privateId, previewId, publicId, releaseVersion }) => {
+    const cache = window.dadaCacheProbe.cache;
+    await cache.clear();
+    const cached = await cache.cache({
+      access_class: "public_release_asset",
+      cache_kind: "thumbnail",
+      release_version: releaseVersion,
+      resource_id: publicId,
+    });
+    const rejected = await Promise.all([
+      cache.cache({ access_class: "internal_preview_asset", cache_kind: "thumbnail", release_version: releaseVersion, resource_id: previewId }),
+      cache.cache({ access_class: "private_user_asset", cache_kind: "thumbnail", release_version: releaseVersion, resource_id: privateId }),
+    ]);
+    const preview = await fetch(`/api/v1/assets/preview/${releaseVersion}/${previewId}`);
+    const privateAsset = await fetch(`/api/v1/private-assets/${releaseVersion}/${privateId}`);
+    const inspection = await cache.inspect();
+    const registrations = await navigator.serviceWorker.getRegistrations();
+    const databases = await indexedDB.databases();
+    return {
+      cached,
+      inspection,
+      private_bytes: (await privateAsset.arrayBuffer()).byteLength,
+      private_cache_control: privateAsset.headers.get("cache-control"),
+      preview_bytes: (await preview.arrayBuffer()).byteLength,
+      preview_cache_control: preview.headers.get("cache-control"),
+      rejected,
+      service_workers: registrations.map((registration) => ({
+        active: registration.active?.state,
+        scope: registration.scope,
+        script_url: registration.active?.scriptURL,
+      })),
+      indexed_db_names: databases.map((database) => database.name).filter(Boolean).sort(),
+      local_storage_keys: Object.keys(localStorage),
+      session_storage_keys: Object.keys(sessionStorage),
+    };
+  }, { privateId, previewId, publicId, releaseVersion });
+
+  await context.setOffline(true);
+  const offline = await page.evaluate(async ({ privateId, previewId, publicId, releaseVersion }) => {
+    const read = async (url: string) => {
+      try {
+        const response = await fetch(url);
+        return { body: await response.text(), status: response.status };
+      } catch {
+        return { body: null, status: "network_error" };
+      }
+    };
+    return {
+      preview: await read(`/api/v1/assets/preview/${releaseVersion}/${previewId}`),
+      private: await read(`/api/v1/private-assets/${releaseVersion}/${privateId}`),
+      public: await read(`/api/v1/assets/public/${releaseVersion}/${publicId}`),
+    };
+  }, { privateId, previewId, publicId, releaseVersion });
+  await context.setOffline(false);
+
+  expect(online.cached.status).toBe("cached");
+  expect(online.rejected).toEqual([
+    { status: "rejected_not_allowlisted" },
+    { status: "rejected_not_allowlisted" },
+  ]);
+  expect(online.preview_cache_control).toBe("private, no-store");
+  expect(online.private_cache_control).toBe("private, no-store");
+  expect(online.inspection.cache_keys).toHaveLength(1);
+  expect(online.inspection.cache_names).toEqual(["dada-public-assets-v1"]);
+  expect(online.inspection.entries).toEqual([expect.objectContaining({ resource_id: publicId })]);
+  expect(JSON.stringify(online.inspection)).not.toContain(previewId);
+  expect(JSON.stringify(online.inspection)).not.toContain(privateId);
+  expect(online.indexed_db_names).toEqual(["dada-public-asset-cache-v1"]);
+  expect(online.local_storage_keys).toEqual([]);
+  expect(online.session_storage_keys).toEqual([]);
+  expect(online.service_workers).toHaveLength(1);
+  expect(offline.public).toEqual({ body: "public-content", status: 200 });
+  expect(offline.preview.status).toBe("network_error");
+  expect(offline.private.status).toBe("network_error");
+  expect(requestCounts).toEqual({ preview: 1, private: 1, public: 1 });
+
+  const cacheEnumeration = {
+    business_database_calls: 0,
+    offline,
+    online,
+    origin_request_counts: { ...requestCounts },
+  };
+  writeEvidence(process.env.DADA_EVIDENCE_DIR_WP5_CACHE, "cache-enumeration.json", cacheEnumeration);
+  writeEvidence(process.env.DADA_EVIDENCE_DIR_WP5_CACHE, "service-worker.json", { registrations: online.service_workers });
+  writeEvidence(process.env.DADA_EVIDENCE_DIR_WP5_RES, "cache-enumeration.json", cacheEnumeration);
+});

tests/e2e/wp5-05-admin-assets.spec.ts

@@ -0,0 +1,140 @@
+import { mkdirSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { expect, test, type Page } from "@playwright/test";
+import { createServer, type ViteDevServer } from "vite";
+
+let vite: ViteDevServer;
+let webUrl: string;
+const png = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAQAAAADCAYAAAC09K7GAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEklEQVQImWO4E6XxHxkzEBQAANIxHF3ECQOzAAAAAElFTkSuQmCC", "base64");
+const adminSession = {
+  acknowledged_private_content_notice_version: null,
+  admin: { role: "super_admin", status: "active", user_id: "00000000-0000-4000-8000-000000001405" },
+  audience: "admin",
+  authenticated: true,
+  csrf_token: "csrf-wp5-05-admin-000000000000000000000000000000000",
+  current_private_content_notice_version: null,
+  expires_at: "2026-09-03T12:00:00.000Z",
+  notice_acknowledged: false,
+};
+const projectId = "00000000-0000-4000-8000-000000001405";
+const userSession = {
+  audience: "user", authenticated: true, credits: { available_balance: 10, reserved_balance: 0 },
+  csrf_token: "csrf-wp5-05-user-0000000000000000000000000000000000",
+  expires_at: "2026-09-03T12:00:00.000Z",
+  user: { creator_name: "Sticker User", role: "user", social_id: "@sticker", status: "active", user_id: projectId },
+};
+
+function asset(stableId = "STK1408") {
+  return {
+    enabled: true, file_state: "committed", height: 3, mime: "image/png", mime_type: "image/png", order: 184,
+    original_byte_size: png.byteLength, original_filename: `${stableId}.png`, original_reference: `/api/v1/assets/public/asset-20260803.1/${stableId}`,
+    origin: "admin_uploaded", part: 25, relative_path: `managed-assets/stickers/original/${stableId}.png`, resource_version: "asset-20260803.1",
+    sha256: "0".repeat(64), stable_id: stableId, thumbnail_byte_size: 75,
+    thumbnail_reference: { media: "thumbnail", resource_id: stableId, resource_version: "asset-20260803.1", url: `/api/v1/assets/public/asset-20260803.1/${stableId}?variant=thumbnail` }, width: 4,
+  };
+}
+
+function assetsResponse(status: "active" | "full" | "unavailable" = "active", items = [asset()]) {
+  return {
+    count: items.length, items, release_version: items.length ? "asset-20260803.1" : null,
+    storage: { capacity_notice_level: status === "active" ? "normal" : "critical", hard_limit_bytes: 5_368_709_120, managed_content_bytes: status === "full" ? 5_368_709_120 : 150, storage_status: status },
+  };
+}
+
+test.beforeAll(async () => {
+  vite = await createServer({ configFile: resolve("apps/web/vite.config.ts"), root: resolve("apps/web"), server: { host: "127.0.0.1", port: 0 } });
+  await vite.listen();
+  const address = vite.httpServer?.address();
+  if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
+  webUrl = `http://127.0.0.1:${address.port}`;
+});
+
+test.afterAll(async () => vite.close());
+
+async function routeAdminSession(page: Page) {
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({ body: JSON.stringify(adminSession), contentType: "application/json", status: 200 }));
+  await page.route("**/api/v1/assets/public/**", (route) => route.fulfill({ body: png, contentType: "image/png", status: 200 }));
+}
+
+test("TDD-WP5-UPL-001-upload-metering uploads and publishes with stable metadata controls", async ({ page }) => {
+  await routeAdminSession(page);
+  let uploaded = false;
+  let multipartBody = "";
+  await page.route("**/api/v1/admin/assets/static-stickers", async (route) => {
+    if (route.request().method() === "POST") {
+      multipartBody = route.request().postDataBuffer()?.toString("latin1") ?? "";
+      uploaded = true;
+      return route.fulfill({ body: JSON.stringify({ created: true, item: asset(), release_version: "asset-20260803.1" }), contentType: "application/json", status: 201 });
+    }
+    return route.fulfill({ body: JSON.stringify(assetsResponse("active", uploaded ? [asset()] : [])), contentType: "application/json", status: 200 });
+  });
+
+  await page.goto(`${webUrl}/admin/assets`);
+  await expect(page.getByRole("heading", { name: "普通贴纸" })).toBeVisible();
+  await expect(page.getByText("当前没有后台上传的普通贴纸。")).toBeVisible();
+  await page.getByLabel("贴纸文件").setInputFiles({ buffer: png, mimeType: "image/png", name: "STK1408.png" });
+  await page.getByRole("button", { name: "上传并发布" }).click();
+  await expect(page.getByRole("rowheader", { name: /STK1408/ })).toBeVisible();
+  expect(multipartBody).toContain("STK1408");
+  expect(multipartBody).toContain("image/png");
+  expect(multipartBody).toContain("original_sha256");
+  const evidenceRoot = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
+  if (evidenceRoot) {
+    const directory = resolve(evidenceRoot, "screenshots");
+    mkdirSync(directory, { recursive: true });
+    await page.screenshot({ fullPage: true, path: resolve(directory, "admin-assets-uploaded.png") });
+  }
+});
+
+test("storage full disables every upload control and load failure exposes retry", async ({ page }) => {
+  await page.setViewportSize({ height: 844, width: 390 });
+  await routeAdminSession(page);
+  await page.route("**/api/v1/admin/assets/static-stickers", (route) => route.fulfill({ body: JSON.stringify(assetsResponse("full")), contentType: "application/json", status: 200 }));
+  await page.goto(`${webUrl}/admin/assets`);
+  await expect(page.getByText("当前存储状态禁止新增原图和缩略图。")).toBeVisible();
+  await expect(page.getByLabel("贴纸文件")).toBeDisabled();
+  await expect(page.getByRole("button", { name: "上传并发布" })).toBeDisabled();
+  const evidenceRoot = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
+  if (evidenceRoot) {
+    const directory = resolve(evidenceRoot, "screenshots");
+    mkdirSync(directory, { recursive: true });
+    await page.screenshot({ fullPage: true, path: resolve(directory, "admin-assets-full-mobile.png") });
+  }
+
+  await page.unroute("**/api/v1/admin/assets/static-stickers");
+  await page.route("**/api/v1/admin/assets/static-stickers", (route) => route.fulfill({ status: 503 }));
+  await page.reload();
+  await expect(page.getByRole("alert")).toContainText("素材状态暂时无法读取");
+  await expect(page.getByRole("button", { name: "重试" })).toBeVisible();
+});
+
+test("the editor merges the current uploaded release and saves its resource version", async ({ page }) => {
+  let savedResourceVersion = "";
+  let originalRequests = 0;
+  await page.route("**/api/v1/auth/session", (route) => route.fulfill({ body: JSON.stringify(userSession), contentType: "application/json", status: 200 }));
+  await page.route("**/api/v1/static-stickers/current", (route) => route.fulfill({ body: JSON.stringify({ count: 1, items: [asset()], release_version: "asset-20260803.1" }), contentType: "application/json", status: 200 }));
+  await page.route(`**/api/v1/projects/${projectId}`, (route) => route.fulfill({ body: JSON.stringify({
+    canvas_state: { background: { adjustments: { brightness: 0, contrast: 0, crop: null, filter: "none", fit: "fill", saturation: 0, sharpness: 0, temperature: 0 }, asset_id: null }, elements: [], pixel_height: 1440, pixel_width: 1080, ratio: "3:4", schema_version: 1 },
+    created_at: "2026-08-03T12:00:00.000Z", current_image_id: null, images: [], name: "上传贴纸", project_id: projectId, ratio: "3:4", state_version: 1,
+  }), contentType: "application/json", status: 200 }));
+  await page.route(`**/api/v1/projects/${projectId}/state`, async (route) => {
+    const body = route.request().postDataJSON() as { canvas_state: { elements: Array<{ resource_version: string }> } };
+    savedResourceVersion = body.canvas_state.elements[0]?.resource_version ?? "";
+    await route.fulfill({ body: JSON.stringify({ save_status: "saved", state_version: 2 }), contentType: "application/json", status: 200 });
+  });
+  await page.route("**/api/v1/assets/recent?asset_kind=text_template", (route) => route.fulfill({ body: JSON.stringify({ items: [] }), contentType: "application/json", status: 200 }));
+  await page.route("**/api/v1/assets/public/**", async (route) => {
+    if (!new URL(route.request().url()).searchParams.has("variant")) originalRequests += 1;
+    await route.fulfill({ body: png, contentType: "image/png", status: 200 });
+  });
+
+  await page.goto(`${webUrl}/app/projects/${projectId}/editor`);
+  await page.getByRole("button", { name: "普通贴纸", exact: true }).click();
+  await expect(page.getByText("共 1,408 张", { exact: true })).toBeVisible();
+  const list = page.getByTestId("static-sticker-list");
+  await list.evaluate((element) => { element.scrollTop = element.scrollHeight; element.dispatchEvent(new Event("scroll")); });
+  await list.getByRole("button", { name: "添加贴纸 STK1408" }).click();
+  await expect.poll(() => savedResourceVersion).toBe("asset-20260803.1");
+  await expect.poll(() => originalRequests).toBeGreaterThan(0);
+});

tests/e2e/wp6-01-admin-shell.spec.ts

@@ -0,0 +1,137 @@
+import { mkdirSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { expect, test, type Page } from "@playwright/test";
+import { createServer, type ViteDevServer } from "vite";
+
+import { adminOverviewFixture } from "../fixtures/wp6-01-admin-overview.js";
+
+let vite: ViteDevServer;
+let webUrl: string;
+
+const adminSession = {
+  acknowledged_private_content_notice_version: null,
+  admin: { role: "super_admin", status: "active", user_id: "00000000-0000-4000-8000-000000000601" },
+  audience: "admin",
+  authenticated: true,
+  csrf_token: "csrf-admin-shell-fixture-000000000000000000000000000000000",
+  current_private_content_notice_version: null,
+  expires_at: "2026-09-02T09:30:00.000Z",
+  notice_acknowledged: false,
+};
+
+const navigation = [
+  ["总览", "/admin"],
+  ["用户与点数", "/admin/users"],
+  ["邀请码", "/admin/invites"],
+  ["模型", "/admin/models"],
+  ["素材", "/admin/assets"],
+  ["内部预览", "/admin/preview"],
+  ["生成记录", "/admin/generations"],
+  ["服务与存储", "/admin/services-storage"],
+  ["审计", "/admin/audit"],
+] as const;
+
+test.beforeAll(async () => {
+  vite = await createServer({
+    configFile: resolve("apps/web/vite.config.ts"),
+    root: resolve("apps/web"),
+    server: { host: "127.0.0.1", port: 0 },
+  });
+  await vite.listen();
+  const address = vite.httpServer?.address();
+  if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
+  webUrl = `http://127.0.0.1:${address.port}`;
+});
+
+test.afterAll(async () => vite.close());
+
+async function routeActiveAdmin(page: Page) {
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({
+    body: JSON.stringify(adminSession),
+    contentType: "application/json",
+    status: 200,
+  }));
+  await page.route("**/api/v1/admin/overview", (route) => route.fulfill({
+    body: JSON.stringify(adminOverviewFixture),
+    contentType: "application/json",
+    status: 200,
+  }));
+}
+
+test("TDD-WP6-ADM-001-role-and-summary renders the protected nine-entry admin shell", async ({ page }) => {
+  const requests: string[] = [];
+  page.on("request", (request) => requests.push(request.url()));
+  await routeActiveAdmin(page);
+  await page.goto(`${webUrl}/admin`);
+
+  await expect(page.getByRole("heading", { level: 2, name: "运营总览" })).toBeVisible();
+  const sidebar = page.getByRole("navigation", { name: "后台主导航" });
+  await expect(sidebar).toBeVisible();
+  for (const [name, href] of navigation) {
+    await expect(sidebar.getByRole("link", { name, exact: true })).toHaveAttribute("href", href);
+  }
+  expect(Math.round((await sidebar.boundingBox())?.width ?? 0)).toBe(216);
+  await expect(page.getByText("4 / 10", { exact: true })).toBeVisible();
+  await expect(page.getByText("待人工核对 1", { exact: true })).toBeVisible();
+  await expect(page.getByText("85.0%", { exact: true })).toBeVisible();
+  await expect(page.getByRole("link", { name: "有异常", exact: true })).toBeVisible();
+  await expect(page.locator("body")).not.toContainText(/forbidden|example\.invalid|api[_ -]?key|完整提示词/i);
+  expect(requests.some((url) => /prompt|private-content|image-content/i.test(url))).toBe(false);
+
+  const evidenceRoot = process.env.DADA_EVIDENCE_DIR_ADMIN;
+  if (evidenceRoot) {
+    const screenshotDirectory = resolve(evidenceRoot, "screenshots");
+    mkdirSync(screenshotDirectory, { recursive: true });
+    await page.screenshot({ fullPage: true, path: resolve(screenshotDirectory, "admin-overview.png") });
+  }
+});
+
+test("TDD-WP6-ADM-001-role-and-summary keeps ordinary and preview sessions outside admin", async ({ page }) => {
+  let overviewCalls = 0;
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({
+    body: JSON.stringify({ error: { code: "AUTH_SESSION_INVALID", subject: "preview_user" } }),
+    contentType: "application/json",
+    status: 401,
+  }));
+  await page.route("**/api/v1/admin/overview", (route) => {
+    overviewCalls += 1;
+    return route.fulfill({ body: "null", contentType: "application/json", status: 401 });
+  });
+
+  await page.goto(`${webUrl}/admin`);
+  await expect(page).toHaveURL(`${webUrl}/admin/login`);
+  await expect(page.getByRole("heading", { name: "管理员邮箱验证码登录" })).toBeVisible();
+  expect(overviewCalls).toBe(0);
+  await expect(page.getByText("DADA ADMIN", { exact: true })).toHaveCount(0);
+  const evidenceRoot = process.env.DADA_EVIDENCE_DIR_ADMIN;
+  if (evidenceRoot) {
+    const screenshotDirectory = resolve(evidenceRoot, "screenshots");
+    mkdirSync(screenshotDirectory, { recursive: true });
+    await page.screenshot({ fullPage: true, path: resolve(screenshotDirectory, "admin-denied.png") });
+  }
+});
+
+test("TDD-WP6-ADM-001-role-and-summary ejects a disabled admin when the session is rechecked", async ({ page }) => {
+  let active = true;
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill(active ? {
+    body: JSON.stringify(adminSession),
+    contentType: "application/json",
+    status: 200,
+  } : {
+    body: JSON.stringify({ error: { code: "AUTH_SESSION_INVALID" } }),
+    contentType: "application/json",
+    status: 401,
+  }));
+  await page.route("**/api/v1/admin/overview", (route) => route.fulfill({
+    body: JSON.stringify(adminOverviewFixture),
+    contentType: "application/json",
+    status: 200,
+  }));
+  await page.goto(`${webUrl}/admin`);
+  await expect(page.getByRole("heading", { level: 2, name: "运营总览" })).toBeVisible();
+
+  active = false;
+  await page.evaluate(() => window.dispatchEvent(new Event("dada:session-invalid")));
+  await expect(page).toHaveURL(`${webUrl}/admin/login`);
+});

tests/e2e/wp6-04-audit.spec.ts

@@ -0,0 +1,51 @@
+import { resolve } from "node:path";
+
+import { expect, test } from "@playwright/test";
+import { createServer, type ViteDevServer } from "vite";
+
+import { wp604AuditApiFixture, wp604PrivateAuditApiFixture } from "../fixtures/wp6-04-audit.js";
+
+let vite: ViteDevServer;
+let webUrl: string;
+
+const adminSession = {
+  acknowledged_private_content_notice_version: null,
+  admin: { role: "super_admin", status: "active", user_id: "00000000-0000-4000-8000-000000000604" },
+  audience: "admin",
+  authenticated: true,
+  csrf_token: "csrf-wp6-04-admin-0000000000000000000000000000000000",
+  current_private_content_notice_version: null,
+  expires_at: "2026-09-04T09:30:00.000Z",
+  notice_acknowledged: false,
+};
+
+test.beforeAll(async () => {
+  vite = await createServer({ configFile: resolve("apps/web/vite.config.ts"), root: resolve("apps/web"), server: { host: "127.0.0.1", port: 0 } });
+  await vite.listen();
+  const address = vite.httpServer?.address();
+  if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
+  webUrl = `http://127.0.0.1:${address.port}`;
+});
+
+test.afterAll(async () => vite.close());
+
+test("TDD-WP6-AUD-001-sensitive-operations renders two immutable, redacted audit lists", async ({ page }) => {
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({ body: JSON.stringify(adminSession), contentType: "application/json", status: 200 }));
+  await page.route("**/api/v1/admin/audit/operations**", (route) => route.fulfill({ body: JSON.stringify(wp604AuditApiFixture), contentType: "application/json", status: 200 }));
+  await page.route("**/api/v1/admin/audit/private-content**", (route) => route.fulfill({ body: JSON.stringify(wp604PrivateAuditApiFixture), contentType: "application/json", status: 200 }));
+
+  await page.goto(`${webUrl}/admin/audit`);
+  await expect(page.getByRole("heading", { level: 2, name: "审计" })).toBeVisible();
+  await expect(page.getByRole("tab", { name: "后台操作审计" })).toHaveAttribute("aria-selected", "true");
+  await expect(page.getByRole("cell", { name: "user_status_change" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "下一页" })).toBeVisible();
+
+  await page.getByRole("tab", { name: "私有内容访问审计" }).click();
+  await expect(page.getByRole("cell", { name: "prompt" })).toBeVisible();
+  await expect(page.getByRole("cell", { name: "00000000-0000-4000-8000-000000000644" })).toBeVisible();
+  await expect(page.getByText(/private prompt body|api key|absolute path/i)).toHaveCount(0);
+  await expect(page.getByRole("button", { name: /删除|编辑|清空/ })).toHaveCount(0);
+
+  const evidenceRoot = process.env.DADA_EVIDENCE_DIR_WP6_AUD;
+  if (evidenceRoot) await page.screenshot({ fullPage: true, path: resolve(evidenceRoot, "admin-audit.png") });
+});

tests/e2e/wp6-05-state.spec.ts

@@ -0,0 +1,95 @@
+import { expect, test } from "@playwright/test";
+import { createServer, type ViteDevServer } from "vite";
+import { resolve } from "node:path";
+
+import { adminDiagnosticsFixture, adminServicesStorageFixture } from "../fixtures/wp6-05-state.js";
+
+let vite: ViteDevServer;
+let webUrl: string;
+
+const adminSession = {
+  admin: { role: "super_admin", status: "active", user_id: "00000000-0000-4000-8000-000000000605" },
+  audience: "admin",
+  authenticated: true,
+  expires_at: "2026-09-02T09:30:00.000Z",
+};
+
+test.beforeAll(async () => {
+  vite = await createServer({ configFile: resolve("apps/web/vite.config.ts"), root: resolve("apps/web"), server: { host: "127.0.0.1", port: 0 } });
+  await vite.listen();
+  const address = vite.httpServer?.address();
+  if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
+  webUrl = `http://127.0.0.1:${address.port}`;
+});
+
+test.afterAll(async () => vite.close());
+
+test("TDD-WP6-DIAG-001-redacted-diagnostics renders state and diagnostics without sensitive fields", async ({ page }) => {
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({ body: JSON.stringify(adminSession), contentType: "application/json", status: 200 }));
+  await page.route("**/api/v1/admin/services-storage", (route) => route.fulfill({ body: JSON.stringify(adminServicesStorageFixture), contentType: "application/json", status: 200 }));
+  await page.route("**/api/v1/admin/diagnostics", (route) => route.fulfill({ body: JSON.stringify(adminDiagnosticsFixture), contentType: "application/json", status: 200 }));
+  await page.goto(`${webUrl}/admin/services-storage`);
+
+  await expect(page.getByRole("heading", { level: 2, name: "服务与存储" })).toBeVisible();
+  await expect(page.getByText("Resend", { exact: true })).toBeVisible();
+  await expect(page.getByText("额度暂停", { exact: true })).toBeVisible();
+  await expect(page.getByText("4.25 GB", { exact: true })).toBeVisible();
+  await expect(page.getByRole("button", { name: "复制诊断" })).toBeEnabled();
+  await expect(page.locator("body")).not.toContainText(/secret|password|example\.invalid|C:\\Users/i);
+});
+
+test("TDD-WP6-STATE-001-three-model-states refetches REST truth after a runtime event", async ({ page }) => {
+  await page.addInitScript(() => {
+    class FakeEventSource {
+      static instance: FakeEventSource | undefined;
+      onmessage: ((event: MessageEvent) => void) | null = null;
+      constructor() { FakeEventSource.instance = this; }
+      close() { if (FakeEventSource.instance === this) FakeEventSource.instance = undefined; }
+    }
+    Object.defineProperty(window, "EventSource", { configurable: true, value: FakeEventSource });
+    (window as unknown as { emitDadaEvent: () => void }).emitDadaEvent = () => FakeEventSource.instance?.onmessage?.({ data: "{}" } as MessageEvent);
+  });
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({ body: JSON.stringify({ ...adminSession, csrf_token: "csrf-admin-model-fixture-000000000000000000000000000000000" }), contentType: "application/json", status: 200 }));
+  let runtimeAvailable = false;
+  let modelCalls = 0;
+  const configuration = () => {
+    const ids = ["gemini-3.1-flash-image-preview", "gemini-3-pro-image-preview", "gpt-image-2"];
+    return {
+      config_set_version: 1,
+      configured_default_model_id: ids[0],
+      recommended_model_id: runtimeAvailable ? ids[1] : null,
+      models: ids.map((modelId, index) => ({
+        config_version: 1,
+        contract_evidence_ref: null,
+        contract_validation_status: "verified",
+        credit_cost: 1,
+        display_name: ["Gemini 3.1 Flash Image Preview", "Gemini 3 Pro Image Preview", "GPT Image 2"][index],
+        enabled: true,
+        error_mapping_profile: { timeout: "upstream_timeout" },
+        gateway_account_ref: "mock-gateway",
+        is_default: index === 0,
+        model_id: modelId,
+        prompt_max_length: 1_000,
+        recommendation_priority: index + 1,
+        reference_limits: { max_file_bytes: 1_024, max_files: 2, max_total_bytes: 2_048 },
+        route_profile: { endpoint: "https://mock.invalid/v1/images" },
+        runtime_availability: { available_for_new_jobs: runtimeAvailable, checked_at: "2026-08-02T15:00:00.000Z", reason: runtimeAvailable ? "available" : "gateway_balance_insufficient" },
+        safety_source: "provider",
+        supported_ratios: ["3:4", "1:1", "4:3", "9:16"],
+      })),
+    };
+  };
+  await page.route("**/api/v1/models", (route) => {
+    modelCalls += 1;
+    return route.fulfill({ body: JSON.stringify(configuration()), contentType: "application/json", status: 200 });
+  });
+
+  await page.goto(`${webUrl}/admin/models`);
+  await expect(page.getByText("当前推荐").locator("..").getByText("无", { exact: true })).toBeVisible();
+  expect(modelCalls).toBeGreaterThanOrEqual(1);
+  runtimeAvailable = true;
+  await page.evaluate(() => (window as unknown as { emitDadaEvent: () => void }).emitDadaEvent());
+  await expect(page.getByText("当前推荐").locator("..").getByText("gemini-3-pro-image-preview", { exact: true })).toBeVisible();
+  await expect(page.getByText("配置默认").locator("..").getByText("gemini-3.1-flash-image-preview", { exact: true })).toBeVisible();
+  expect(modelCalls).toBeGreaterThanOrEqual(2);
+});