feat: enforce WP6-03 external service hard stops

apps/api/src/app.ts

@@ -10,6 +10,16 @@ import {
   AccountProfileUpdateResponseSchema,
   AccountSettingsResponseSchema,
   AdminAuthenticatedUserSchema,
+  AdminOverviewResponseSchema,
+  AdminServicesResponseSchema,
+  AdminServiceHealthCheckRequestSchema,
+  AdminServiceLimitRequestSchema,
+  AdminServiceParamsSchema,
+  AdminServiceRecoveryRequestSchema,
+  ExternalServiceIdSchema,
+  ExternalServicePeriodTypeSchema,
+  ExternalServiceStatusSchema,
+  ExternalServiceUsageSchema,
   AdminCreditParamsSchema,
   AdminLoginCompleteRequestSchema,
   AdminLoginCompleteResponseSchema,
@@ -110,6 +120,7 @@ import {
   type BootstrapResponse,
   type AdminLoginCompleteRequest,
   type AdminLoginSendRequest,
+  type AdminOverviewResponse,
   type AccountDeletionCompleteRequest,
   type AccountProfileUpdateRequest,
   type AdminCreditParams,
@@ -176,6 +187,7 @@ import {
 import type { RegistrationService } from "./registration.js";
 import type { RecentAssetService } from "./recent-assets.js";
 import type { AmapAdapter } from "./amap-adapter.js";
+import { ExternalServiceUsageError, type ExternalServiceUsage } from "./external-service-usage.js";
 import { ModelConfigurationError } from "./model-configuration.js";
 import type { ModelConfigurationService } from "./model-configuration.js";
 
@@ -192,6 +204,7 @@ const defaultBootstrap: BootstrapResponse = {
 };
 
 export interface CreateAppOptions {
+  adminOverview?: () => AdminOverviewResponse | Promise<AdminOverviewResponse>;
   amap?: AmapAdapter;
   assetReleases?: AssetReleaseReader;
   bootstrap?: () => BootstrapResponse | Promise<BootstrapResponse>;
@@ -219,6 +232,7 @@ export interface CreateAppOptions {
     resourceId: string;
   }) => boolean | Promise<boolean>;
   registration?: RegistrationService;
+  serviceUsage?: ExternalServiceUsage;
 }
 
 const supportGateDirectory = resolve(process.env.DADA_SUPPORT_GATE_ROOT ?? "apps/web/support-gate");
@@ -688,6 +702,16 @@ export async function createApp(options: CreateAppOptions = {}) {
     AdminLoginCompleteRequestSchema,
     AdminLoginCompleteResponseSchema,
     AdminSessionResponseSchema,
+    AdminOverviewResponseSchema,
+    AdminServicesResponseSchema,
+    AdminServiceHealthCheckRequestSchema,
+    AdminServiceLimitRequestSchema,
+    AdminServiceParamsSchema,
+    AdminServiceRecoveryRequestSchema,
+    ExternalServiceIdSchema,
+    ExternalServicePeriodTypeSchema,
+    ExternalServiceStatusSchema,
+    ExternalServiceUsageSchema,
     CreditSummarySchema,
     CreditEntryTypeSchema,
     CreditEntryStatusSchema,
@@ -1060,10 +1084,16 @@ export async function createApp(options: CreateAppOptions = {}) {
       if (!token || !csrfToken) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
       try {
         options.registration.authorizeUserMutation({ csrfToken, sessionToken: token });
+        const usage = options.serviceUsage ?? options.registration.serviceUsage;
+        usage.claimAmap();
         const result = await options.amap.reverseGeocode(request.body as ReverseGeocodeRequest);
         return { formatted_value: result.formattedValue, service_mode: result.serviceMode, status: "resolved" as const };
       } catch (error) {
         if (error instanceof RegistrationError) return registrationFailure(reply, request.id, error);
+        if (error instanceof ExternalServiceUsageError) return reply.code(503).send(null);
+        try {
+          (options.serviceUsage ?? options.registration.serviceUsage).markProviderFailure({ serviceId: "amap_web_service", reason: "provider_unavailable" });
+        } catch { /* preserve the provider failure response */ }
         return reply.code(503).send(null);
       }
     },
@@ -1203,6 +1233,180 @@ export async function createApp(options: CreateAppOptions = {}) {
     },
   );
 
+  app.get(
+    "/api/v1/admin/overview",
+    {
+      schema: {
+        operationId: "getAdminOverview",
+        response: {
+          200: Type.Ref(AdminOverviewResponseSchema),
+          401: Type.Ref(ErrorEnvelopeSchema),
+          503: Type.Null(),
+        },
+        tags: ["Admin Operations"],
+      },
+    },
+    async (request, reply) => {
+      if (!options.registration) return reply.code(503).send(null);
+      const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
+      const session = token ? options.registration.readAdminSession(token) : undefined;
+      if (!session) {
+        return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
+      }
+      if (!options.adminOverview) return reply.code(503).send(null);
+      try {
+        return await options.adminOverview();
+      } catch {
+        return reply.code(503).send(null);
+      }
+    },
+  );
+
+  app.get(
+    "/api/v1/admin/services",
+    {
+      schema: {
+        operationId: "getAdminServices",
+        response: { 200: Type.Ref(AdminServicesResponseSchema), 401: Type.Ref(ErrorEnvelopeSchema), 503: Type.Ref(ErrorEnvelopeSchema) },
+        tags: ["Admin Services"],
+      },
+    },
+    async (request, reply) => {
+      const registration = options.registration;
+      const usage = options.serviceUsage ?? registration?.serviceUsage;
+      if (!registration || !usage) return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+      const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
+      const session = token ? registration.readAdminSession(token) : undefined;
+      if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
+      return {
+        services: usage.readCurrent().map((row) => ({
+          hard_limit: row.hardLimit,
+          pause_reason: row.pauseReason,
+          period_start: new Date(row.periodStart).toISOString(),
+          period_type: row.periodType,
+          service_id: row.serviceId,
+          service_status: row.status,
+          updated_at: new Date(row.updatedAt).toISOString(),
+          used_count: row.usedCount,
+        })),
+      };
+    },
+  );
+
+  app.post(
+    "/api/v1/admin/services/:service_id/health-check",
+    {
+      attachValidation: true,
+      schema: {
+        params: Type.Ref(AdminServiceParamsSchema),
+        body: Type.Ref(AdminServiceHealthCheckRequestSchema),
+        headers: Type.Ref(ModelConfigUpdateHeadersSchema),
+        operationId: "checkAdminServiceHealth",
+        response: { 200: Type.Object({ check_id: Type.String(), available: Type.Boolean(), checked_at: Type.String() }, { additionalProperties: false }), 400: Type.Ref(ErrorEnvelopeSchema), 401: Type.Ref(ErrorEnvelopeSchema), 403: Type.Ref(ErrorEnvelopeSchema), 409: Type.Ref(ErrorEnvelopeSchema), 429: Type.Ref(ErrorEnvelopeSchema), 503: Type.Ref(ErrorEnvelopeSchema) },
+        tags: ["Admin Services"],
+      },
+    },
+    async (request, reply) => {
+      if (request.validationError) return reply.code(400).send(createErrorEnvelope({ code: "REGISTRATION_REQUEST_INVALID", correlationId: request.id }));
+      const registration = options.registration;
+      const usage = options.serviceUsage ?? registration?.serviceUsage;
+      if (!registration || !usage) return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+      const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
+      if (!token) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
+      try {
+        const headers = request.headers as { "x-csrf-token": string };
+        registration.authorizeAdminMutation({ csrfToken: headers["x-csrf-token"], sessionToken: token });
+        const body = request.body as { available: boolean; reason?: string };
+        const params = request.params as { service_id: "resend_email" | "amap_web_service" };
+        const check = usage.recordHealthCheck({ serviceId: params.service_id, available: body.available, ...(body.reason ? { reason: body.reason } : {}) });
+        return { check_id: check.checkId, available: check.available, checked_at: new Date(check.checkedAt).toISOString() };
+      } catch (error) {
+        if (error instanceof RegistrationError) return reply.code(error.httpStatus).send(createErrorEnvelope({ code: error.code, correlationId: request.id }));
+        return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+      }
+    },
+  );
+
+  app.patch(
+    "/api/v1/admin/services/:service_id/limits",
+    {
+      attachValidation: true,
+      schema: {
+        params: Type.Ref(AdminServiceParamsSchema),
+        body: Type.Ref(AdminServiceLimitRequestSchema),
+        headers: Type.Ref(ModelConfigUpdateHeadersSchema),
+        operationId: "updateAdminServiceHardLimit",
+        response: { 200: Type.Ref(AdminServicesResponseSchema), 400: Type.Ref(ErrorEnvelopeSchema), 401: Type.Ref(ErrorEnvelopeSchema), 403: Type.Ref(ErrorEnvelopeSchema), 409: Type.Ref(ErrorEnvelopeSchema), 429: Type.Ref(ErrorEnvelopeSchema), 503: Type.Ref(ErrorEnvelopeSchema) },
+        tags: ["Admin Services"],
+      },
+    },
+    async (request, reply) => {
+      if (request.validationError) return reply.code(400).send(createErrorEnvelope({ code: "REGISTRATION_REQUEST_INVALID", correlationId: request.id }));
+      const registration = options.registration;
+      const usage = options.serviceUsage ?? registration?.serviceUsage;
+      if (!registration || !usage) return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+      const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
+      if (!token) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
+      try {
+        const headers = request.headers as { "x-csrf-token": string };
+        const admin = registration.authorizeAdminMutation({ csrfToken: headers["x-csrf-token"], sessionToken: token });
+        const body = request.body as { hard_limit: number; period_type: "daily" | "monthly" };
+        const params = request.params as { service_id: "resend_email" | "amap_web_service" };
+        usage.setHardLimit({ actorId: admin.userId, hardLimit: body.hard_limit, periodType: body.period_type, serviceId: params.service_id });
+        return {
+          services: usage.readCurrent().map((row) => ({
+            hard_limit: row.hardLimit,
+            pause_reason: row.pauseReason,
+            period_start: new Date(row.periodStart).toISOString(),
+            period_type: row.periodType,
+            service_id: row.serviceId,
+            service_status: row.status,
+            updated_at: new Date(row.updatedAt).toISOString(),
+            used_count: row.usedCount,
+          })),
+        };
+      } catch (error) {
+        if (error instanceof RegistrationError) return reply.code(error.httpStatus).send(createErrorEnvelope({ code: error.code, correlationId: request.id }));
+        if (error instanceof ExternalServiceUsageError) return reply.code(409).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+        return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+      }
+    },
+  );
+
+  app.post(
+    "/api/v1/admin/services/:service_id/recover",
+    {
+      attachValidation: true,
+      schema: {
+        params: Type.Ref(AdminServiceParamsSchema),
+        body: Type.Ref(AdminServiceRecoveryRequestSchema),
+        headers: Type.Ref(ModelConfigUpdateHeadersSchema),
+        operationId: "recoverAdminService",
+        response: { 200: Type.Object({ status: Type.Literal("active") }, { additionalProperties: false }), 400: Type.Ref(ErrorEnvelopeSchema), 401: Type.Ref(ErrorEnvelopeSchema), 403: Type.Ref(ErrorEnvelopeSchema), 409: Type.Ref(ErrorEnvelopeSchema), 429: Type.Ref(ErrorEnvelopeSchema), 503: Type.Ref(ErrorEnvelopeSchema) },
+        tags: ["Admin Services"],
+      },
+    },
+    async (request, reply) => {
+      if (request.validationError) return reply.code(400).send(createErrorEnvelope({ code: "REGISTRATION_REQUEST_INVALID", correlationId: request.id }));
+      const registration = options.registration;
+      const usage = options.serviceUsage ?? registration?.serviceUsage;
+      if (!registration || !usage) return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+      const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
+      if (!token) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
+      try {
+        const headers = request.headers as { "x-csrf-token": string };
+        const admin = registration.authorizeAdminMutation({ csrfToken: headers["x-csrf-token"], sessionToken: token });
+        const body = request.body as { check_id: string };
+        const params = request.params as { service_id: "resend_email" | "amap_web_service" };
+        return usage.recover({ actorId: admin.userId, checkId: body.check_id, serviceId: params.service_id });
+      } catch (error) {
+        if (error instanceof RegistrationError) return reply.code(error.httpStatus).send(createErrorEnvelope({ code: error.code, correlationId: request.id }));
+        if (error instanceof ExternalServiceUsageError) return reply.code(409).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+        return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
+      }
+    },
+  );
+
   app.post(
     "/api/v1/auth/login/send",
     {

apps/api/src/external-service-usage.ts

@@ -0,0 +1,459 @@
+import { randomUUID } from "node:crypto";
+
+import type BetterSqlite3 from "better-sqlite3";
+
+import { serializeAuditSummary } from "./audit-policy.js";
+
+export type ExternalServiceId = "resend_email" | "amap_web_service";
+export type ExternalServicePeriodType = "daily" | "monthly";
+export type ExternalServiceStatus = "active" | "paused_quota" | "paused_provider" | "disabled";
+
+const retentionMilliseconds = 180 * 24 * 60 * 60 * 1_000;
+const recoveryCheckLifetimeMilliseconds = 15 * 60 * 1_000;
+const maximumHardLimits: Record<ExternalServiceId, Partial<Record<ExternalServicePeriodType, number>>> = {
+  resend_email: { daily: 80, monthly: 2_400 },
+  amap_web_service: { monthly: 1_000 },
+};
+
+export interface ExternalServiceUsageRow {
+  serviceId: ExternalServiceId;
+  periodType: ExternalServicePeriodType;
+  periodStart: number;
+  hardLimit: number;
+  usedCount: number;
+  status: ExternalServiceStatus;
+  pauseReason: string | null;
+  updatedAt: number;
+}
+
+export class ExternalServiceUsageError extends Error {
+  constructor(
+    readonly code:
+      | "service_paused_quota"
+      | "service_paused_provider"
+      | "service_disabled"
+      | "hard_limit_increase_forbidden"
+      | "hard_limit_invalid"
+      | "health_check_required"
+      | "quota_exhausted"
+      | "service_not_found",
+    message = code,
+  ) {
+    super(message);
+    this.name = "ExternalServiceUsageError";
+  }
+}
+
+interface ExternalServiceUsageOptions {
+  clock?: () => number;
+  database: BetterSqlite3.Database;
+}
+
+interface RawUsageRow {
+  service_id: ExternalServiceId;
+  period_type: ExternalServicePeriodType;
+  period_start: number;
+  hard_limit: number;
+  used_count: number;
+  service_status: ExternalServiceStatus;
+  pause_reason: string | null;
+  updated_at: number;
+}
+
+function periodStart(periodType: ExternalServicePeriodType, now: number) {
+  const date = new Date(now);
+  if (periodType === "daily") return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
+  return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1);
+}
+
+function requiredPeriods(serviceId: ExternalServiceId): ExternalServicePeriodType[] {
+  return serviceId === "resend_email" ? ["daily", "monthly"] : ["monthly"];
+}
+
+function toPublic(row: RawUsageRow): ExternalServiceUsageRow {
+  return {
+    hardLimit: row.hard_limit,
+    pauseReason: row.pause_reason,
+    periodStart: row.period_start,
+    periodType: row.period_type,
+    serviceId: row.service_id,
+    status: row.service_status,
+    updatedAt: row.updated_at,
+    usedCount: row.used_count,
+  };
+}
+
+export class ExternalServiceUsage {
+  readonly database: BetterSqlite3.Database;
+  readonly clock: () => number;
+
+  constructor(options: ExternalServiceUsageOptions) {
+    this.database = options.database;
+    this.clock = options.clock ?? Date.now;
+    this.ensureSchema();
+    this.runImmediate(() => {
+      this.ensureCurrentRows(this.clock(), "resend_email");
+      this.ensureCurrentRows(this.clock(), "amap_web_service");
+    });
+  }
+
+  claimResend(now = this.clock()) {
+    return this.runImmediate(() => this.claimWithinTransaction("resend_email", now));
+  }
+
+  claimResendWithinTransaction(now = this.clock()) {
+    return this.claimWithinTransaction("resend_email", now);
+  }
+
+  claimAmap(now = this.clock()) {
+    return this.runImmediate(() => this.claimWithinTransaction("amap_web_service", now));
+  }
+
+  claimAmapWithinTransaction(now = this.clock()) {
+    return this.claimWithinTransaction("amap_web_service", now);
+  }
+
+  markProviderFailure(input: { serviceId: ExternalServiceId; reason: string; now?: number }) {
+    return this.runImmediate(() => this.markProviderFailureWithinTransaction(input));
+  }
+
+  markProviderFailureWithinTransaction(input: { serviceId: ExternalServiceId; reason: string; now?: number }) {
+    const now = input.now ?? this.clock();
+    const rows = this.ensureCurrentRows(now, input.serviceId);
+    const reason = normalizeReason(input.reason);
+    for (const row of rows) {
+      if (row.service_status === "disabled") continue;
+      this.database.prepare(`
+        UPDATE external_service_usage
+        SET service_status = 'paused_provider', pause_reason = ?, updated_at = ?
+        WHERE service_id = ? AND period_type = ? AND period_start = ?
+      `).run(reason, now, row.service_id, row.period_type, row.period_start);
+    }
+    this.recordAudit({
+      actorRef: "external_service_runtime",
+      actorType: "system",
+      afterSummary: { pause_reason: reason, status: "paused_provider" },
+      beforeSummary: { status: rows[0]?.service_status ?? "active" },
+      operationType: "service_provider_pause",
+      result: "succeeded",
+      targetRef: input.serviceId,
+      targetType: "external_service",
+    }, now);
+    return this.read(input.serviceId);
+  }
+
+  recordHealthCheck(input: { serviceId: ExternalServiceId; available: boolean; reason?: string; now?: number }) {
+    const now = input.now ?? this.clock();
+    const checkId = randomUUID();
+    const currentPeriod = periodStart(requiredPeriods(input.serviceId)[0]!, now);
+    const result = this.runImmediate(() => {
+      this.database.prepare(`
+        INSERT INTO service_recovery_checks (
+          check_id, service_name, target_ref, status, checked_at, expires_at, details_json,
+          service_id, period_start, available, check_reason
+        ) VALUES (?, 'external_service', ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        checkId,
+        input.serviceId,
+        input.available ? "passed" : "failed",
+        now,
+        now + recoveryCheckLifetimeMilliseconds,
+        JSON.stringify({ non_sensitive: true }),
+        input.serviceId,
+        currentPeriod,
+        input.available ? 1 : 0,
+        input.reason ? normalizeReason(input.reason) : null,
+      );
+      return { checkId, available: input.available, checkedAt: now };
+    });
+    return result;
+  }
+
+  recover(input: { serviceId: ExternalServiceId; actorId: string; checkId: string; now?: number }) {
+    const now = input.now ?? this.clock();
+    const result = this.runImmediate(() => {
+      const check = this.database.prepare(`
+        SELECT check_id, period_start, available, expires_at
+        FROM service_recovery_checks
+        WHERE check_id = ? AND service_id = ? AND service_name = 'external_service'
+      `).get(input.checkId, input.serviceId) as { available: number; check_id: string; expires_at: number; period_start: number } | undefined;
+      const currentPeriod = periodStart(requiredPeriods(input.serviceId)[0]!, now);
+      if (!check?.available || check.period_start !== currentPeriod || check.expires_at <= now) {
+        this.recordAudit({
+          actorRef: input.actorId,
+          actorType: "super_admin",
+          afterSummary: { reason: "health_check_required" },
+          beforeSummary: null,
+          operationType: "service_recovery",
+          result: "failed",
+          targetRef: input.serviceId,
+          targetType: "external_service",
+        }, now);
+        return { error: new ExternalServiceUsageError("health_check_required") };
+      }
+      const rows = this.ensureCurrentRows(now, input.serviceId);
+      if (rows.some((row) => row.used_count >= row.hard_limit)) {
+        this.recordAudit({
+          actorRef: input.actorId,
+          actorType: "super_admin",
+          afterSummary: { reason: "quota_exhausted" },
+          beforeSummary: { status: rows[0]?.service_status ?? "paused_quota" },
+          operationType: "service_recovery",
+          result: "failed",
+          targetRef: input.serviceId,
+          targetType: "external_service",
+        }, now);
+        return { error: new ExternalServiceUsageError("quota_exhausted") };
+      }
+      for (const row of rows) {
+        this.database.prepare(`
+          UPDATE external_service_usage
+          SET service_status = 'active', pause_reason = NULL, updated_at = ?
+          WHERE service_id = ? AND period_type = ? AND period_start = ?
+        `).run(now, row.service_id, row.period_type, row.period_start);
+      }
+      this.recordAudit({
+        actorRef: input.actorId,
+        actorType: "super_admin",
+        afterSummary: { check_id: input.checkId, status: "active" },
+        beforeSummary: { status: rows[0]?.service_status ?? "paused_provider" },
+        operationType: "service_recovery",
+        result: "succeeded",
+        targetRef: input.serviceId,
+        targetType: "external_service",
+      }, now);
+      return { status: "active" as const };
+    });
+    if ("error" in result && result.error) throw result.error;
+    return result;
+  }
+
+  setHardLimit(input: {
+    serviceId: ExternalServiceId;
+    periodType: ExternalServicePeriodType;
+    hardLimit: number;
+    actorId: string;
+    now?: number;
+  }) {
+    const now = input.now ?? this.clock();
+    const result = this.runImmediate(() => {
+      const maximum = maximumHardLimits[input.serviceId][input.periodType];
+      const current = this.ensureCurrentRows(now, input.serviceId).find((row) => row.period_type === input.periodType);
+      if (current && input.hardLimit > current.hard_limit) {
+        this.recordAudit({
+          actorRef: input.actorId,
+          actorType: "super_admin",
+          afterSummary: { reason: "hard_limit_increase_forbidden" },
+          beforeSummary: { hard_limit: current.hard_limit },
+          operationType: "service_hard_limit_update",
+          result: "failed",
+          targetRef: `${input.serviceId}:${input.periodType}`,
+          targetType: "external_service_limit",
+        }, now);
+        return { error: new ExternalServiceUsageError("hard_limit_increase_forbidden") };
+      }
+      const valid = maximum !== undefined && Number.isSafeInteger(input.hardLimit) && input.hardLimit >= 1 && input.hardLimit <= maximum;
+      if (!valid || !current) {
+        this.recordAudit({
+          actorRef: input.actorId,
+          actorType: "super_admin",
+          afterSummary: { reason: "hard_limit_invalid" },
+          beforeSummary: current ? { hard_limit: current.hard_limit } : null,
+          operationType: "service_hard_limit_update",
+          result: "failed",
+          targetRef: `${input.serviceId}:${input.periodType}`,
+          targetType: "external_service_limit",
+        }, now);
+        return { error: new ExternalServiceUsageError("hard_limit_invalid") };
+      }
+      this.database.prepare(`
+        UPDATE external_service_usage
+        SET hard_limit = ?, service_status = CASE
+          WHEN used_count >= ? THEN 'paused_quota'
+          ELSE service_status
+        END, pause_reason = CASE
+          WHEN used_count >= ? THEN 'hard_limit_reached'
+          ELSE pause_reason
+        END, updated_at = ?
+        WHERE service_id = ? AND period_type = ? AND period_start = ?
+      `).run(input.hardLimit, input.hardLimit, input.hardLimit, now, current.service_id, current.period_type, current.period_start);
+      this.recordAudit({
+        actorRef: input.actorId,
+        actorType: "super_admin",
+        afterSummary: { hard_limit: input.hardLimit },
+        beforeSummary: { hard_limit: current.hard_limit },
+        operationType: "service_hard_limit_update",
+        result: "succeeded",
+        targetRef: `${input.serviceId}:${input.periodType}`,
+        targetType: "external_service_limit",
+      }, now);
+      return this.read(input.serviceId);
+    });
+    if ("error" in result && result.error) throw result.error;
+    return result;
+  }
+
+  read(serviceId?: ExternalServiceId) {
+    const rows = (serviceId
+      ? this.database.prepare("SELECT * FROM external_service_usage WHERE service_id = ? ORDER BY period_type").all(serviceId)
+      : this.database.prepare("SELECT * FROM external_service_usage ORDER BY service_id, period_type").all()) as RawUsageRow[];
+    return rows.map(toPublic);
+  }
+
+  readCurrent() {
+    const now = this.clock();
+    return this.read().filter((row) => row.periodStart === periodStart(row.periodType, now));
+  }
+
+  readStatus(serviceId: ExternalServiceId) {
+    const rows = this.read(serviceId).filter((row) => row.periodStart >= periodStart(row.periodType, this.clock()));
+    const status = rows.some((row) => row.status === "disabled")
+      ? "disabled"
+      : rows.some((row) => row.status === "paused_provider")
+        ? "paused_provider"
+        : rows.some((row) => row.status === "paused_quota")
+          ? "paused_quota"
+          : "active";
+    return { serviceId, status, rows } as const;
+  }
+
+  private claimWithinTransaction(serviceId: ExternalServiceId, now: number) {
+    const rows = this.ensureCurrentRows(now, serviceId);
+    for (const row of rows) {
+      if (row.service_status === "paused_quota") throw new ExternalServiceUsageError("service_paused_quota");
+      if (row.service_status === "paused_provider") throw new ExternalServiceUsageError("service_paused_provider");
+      if (row.service_status === "disabled") throw new ExternalServiceUsageError("service_disabled");
+      if (row.used_count >= row.hard_limit) {
+        this.database.prepare(`
+          UPDATE external_service_usage
+          SET service_status = 'paused_quota', pause_reason = 'hard_limit_reached', updated_at = ?
+          WHERE service_id = ? AND period_type = ? AND period_start = ?
+        `).run(now, row.service_id, row.period_type, row.period_start);
+        throw new ExternalServiceUsageError("service_paused_quota");
+      }
+    }
+    const updated = rows.map((row) => {
+      const usedCount = row.used_count + 1;
+      const status: ExternalServiceStatus = usedCount >= row.hard_limit ? "paused_quota" : "active";
+      this.database.prepare(`
+        UPDATE external_service_usage
+        SET used_count = ?, service_status = ?, pause_reason = CASE WHEN ? = 'active' THEN NULL ELSE 'hard_limit_reached' END, updated_at = ?
+        WHERE service_id = ? AND period_type = ? AND period_start = ?
+      `).run(usedCount, status, status, now, row.service_id, row.period_type, row.period_start);
+      return { periodType: row.period_type, remaining: Math.max(0, row.hard_limit - usedCount), usedCount };
+    });
+    return { allowed: true as const, serviceId, allocations: updated, remaining: Math.min(...updated.map((item) => item.remaining)) };
+  }
+
+  private ensureCurrentRows(now: number, serviceId: ExternalServiceId) {
+    const periods = requiredPeriods(serviceId);
+    for (const periodType of periods) {
+      const start = periodStart(periodType, now);
+      const current = this.database.prepare(`
+        SELECT * FROM external_service_usage WHERE service_id = ? AND period_type = ? AND period_start = ?
+      `).get(serviceId, periodType, start) as RawUsageRow | undefined;
+      if (current) continue;
+      const previous = this.database.prepare(`
+        SELECT hard_limit FROM external_service_usage
+        WHERE service_id = ? AND period_type = ? ORDER BY period_start DESC LIMIT 1
+      `).get(serviceId, periodType) as { hard_limit: number } | undefined;
+      const maximum = maximumHardLimits[serviceId][periodType];
+      if (maximum === undefined) throw new ExternalServiceUsageError("service_not_found");
+      this.database.prepare(`
+        INSERT INTO external_service_usage (
+          service_id, period_type, period_start, hard_limit, used_count,
+          service_status, pause_reason, updated_at
+        ) VALUES (?, ?, ?, ?, 0, ?, ?, ?)
+      `).run(serviceId, periodType, start, previous?.hard_limit ?? maximum, previous ? "paused_quota" : "active", previous ? "period_confirmation_required" : null, now);
+    }
+    return this.database.prepare(`
+      SELECT * FROM external_service_usage
+      WHERE service_id = ? AND period_start IN (${periods.map(() => "?").join(",")})
+      ORDER BY period_type
+    `).all(serviceId, ...periods.map((period) => periodStart(period, now))) as RawUsageRow[];
+  }
+
+  private ensureSchema() {
+    this.database.exec(`
+      CREATE TABLE IF NOT EXISTS external_service_usage (
+        service_id TEXT NOT NULL CHECK (service_id IN ('resend_email', 'amap_web_service')),
+        period_type TEXT NOT NULL CHECK (period_type IN ('daily', 'monthly')),
+        period_start INTEGER NOT NULL,
+        hard_limit INTEGER NOT NULL CHECK (hard_limit >= 1),
+        used_count INTEGER NOT NULL CHECK (used_count >= 0 AND used_count <= hard_limit),
+        service_status TEXT NOT NULL CHECK (service_status IN ('active', 'paused_quota', 'paused_provider', 'disabled')),
+        pause_reason TEXT,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (service_id, period_type, period_start)
+      );
+      CREATE TABLE IF NOT EXISTS service_recovery_checks (
+        check_id TEXT PRIMARY KEY,
+        service_name TEXT NOT NULL DEFAULT 'external_service',
+        target_ref TEXT NOT NULL DEFAULT '',
+        status TEXT NOT NULL DEFAULT 'passed' CHECK (status IN ('passed', 'failed')),
+        checked_at INTEGER NOT NULL DEFAULT 0,
+        expires_at INTEGER NOT NULL DEFAULT 0,
+        details_json TEXT NOT NULL DEFAULT '{}',
+        service_id TEXT CHECK (service_id IS NULL OR service_id IN ('resend_email', 'amap_web_service')),
+        period_start INTEGER,
+        available INTEGER CHECK (available IS NULL OR available IN (0, 1)),
+        check_reason TEXT
+      );
+    `);
+    const columns = new Set((this.database.prepare("PRAGMA table_info(service_recovery_checks)").all() as Array<{ name: string }>).map((column) => column.name));
+    const additions: Array<[string, string]> = [
+      ["service_name", "TEXT NOT NULL DEFAULT 'external_service'"],
+      ["target_ref", "TEXT NOT NULL DEFAULT ''"],
+      ["status", "TEXT NOT NULL DEFAULT 'passed'"],
+      ["expires_at", "INTEGER NOT NULL DEFAULT 0"],
+      ["details_json", "TEXT NOT NULL DEFAULT '{}'"],
+      ["service_id", "TEXT"],
+      ["period_start", "INTEGER"],
+      ["available", "INTEGER"],
+      ["check_reason", "TEXT"],
+    ];
+    for (const [name, definition] of additions) {
+      if (!columns.has(name)) this.database.exec(`ALTER TABLE service_recovery_checks ADD COLUMN ${name} ${definition}`);
+    }
+  }
+
+  private runImmediate<T>(action: () => T): T {
+    const nested = this.database.inTransaction;
+    if (!nested) this.database.exec("BEGIN IMMEDIATE");
+    try {
+      const result = action();
+      if (!nested) this.database.exec("COMMIT");
+      return result;
+    } catch (error) {
+      if (!nested && this.database.inTransaction) this.database.exec("ROLLBACK");
+      throw error;
+    }
+  }
+
+  private recordAudit(input: {
+    actorRef: string;
+    actorType: "system" | "super_admin";
+    afterSummary: Record<string, unknown> | null;
+    beforeSummary: Record<string, unknown> | null;
+    operationType: string;
+    result: "succeeded" | "failed";
+    targetRef: string;
+    targetType: string;
+  }, now: number) {
+    this.database.prepare(`
+      INSERT INTO admin_operation_logs (
+        log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
+        result, before_summary, after_summary, occurred_at, expires_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      randomUUID(), input.actorType, input.actorRef, input.operationType, input.targetType, input.targetRef,
+      input.result, serializeAuditSummary(input.beforeSummary), serializeAuditSummary(input.afterSummary), now,
+      now + retentionMilliseconds,
+    );
+  }
+}
+
+function normalizeReason(reason: string) {
+  const normalized = reason.trim().toLowerCase().replace(/[^a-z0-9_.-]/g, "_").slice(0, 120);
+  return normalized || "provider_unavailable";
+}

apps/api/src/registration.ts

@@ -11,6 +11,7 @@ import {
   serializeAuditSummary,
 } from "./audit-policy.js";
 import type { ResendAdapter } from "./resend-adapter.js";
+import { ExternalServiceUsage } from "./external-service-usage.js";
 import {
   RegistrationError,
   type RegistrationErrorReason,
@@ -226,6 +227,7 @@ function constantTimeTextEqual(left: string, right: string) {
 
 export class RegistrationService {
   readonly database: BetterSqlite3.Database;
+  readonly serviceUsage: ExternalServiceUsage;
   readonly options: Required<Pick<RegistrationServiceOptions, "clock" | "codeGenerator" | "inviteCodeGenerator">> & RegistrationServiceOptions;
   private adminAllowlistHashes = new Set<string>();
   private privacyPurgeActive = false;
@@ -254,6 +256,7 @@ export class RegistrationService {
     this.database.function("dada_allow_retention_purge", { deterministic: false }, () => 0);
     this.database.function("dada_retention_purge_now", { deterministic: false }, () => 0);
     this.migrate();
+    this.serviceUsage = new ExternalServiceUsage({ database: this.database, clock: this.options.clock });
   }
 
   close() {
@@ -299,6 +302,7 @@ export class RegistrationService {
       if (existing) throw new RegistrationError("AUTH_ENTRY_REJECTED", "registration_login_required");
       this.assertChallengeSendAllowed(email, "register", "registration", now);
       this.recordRateSend(email, "registration", now);
+      this.serviceUsage.claimResendWithinTransaction(now);
 
       this.database.prepare(`
         INSERT INTO email_challenges (
@@ -328,6 +332,7 @@ export class RegistrationService {
     try {
       await this.options.resend.sendVerificationCode({ challengeId, code, email, purpose: "register" });
     } catch {
+      this.serviceUsage.markProviderFailure({ serviceId: "resend_email", reason: "provider_unavailable", now });
       this.runImmediate("registration_send_compensation", () => {
         this.database.prepare("DELETE FROM email_challenges WHERE challenge_id = ? AND consumed_at IS NULL").run(challengeId);
         return { outcome: "committed", value: undefined };
@@ -355,6 +360,7 @@ export class RegistrationService {
       if (user.role !== "user") throw new RegistrationError("AUTH_ENTRY_REJECTED", "login_admin_required");
       this.assertChallengeSendAllowed(email, "login", clientKey, now);
       this.recordRateSend(email, clientKey, now);
+      this.serviceUsage.claimResendWithinTransaction(now);
       this.database.prepare(`
         INSERT INTO email_challenges (
           challenge_id, email, invite_id, code_hmac, purpose, expires_at,
@@ -382,6 +388,7 @@ export class RegistrationService {
     try {
       await this.options.resend.sendVerificationCode({ challengeId, code, email, purpose: "login" });
     } catch {
+      this.serviceUsage.markProviderFailure({ serviceId: "resend_email", reason: "provider_unavailable", now });
       this.runImmediate("registration_send_compensation", () => {
         this.database.prepare("DELETE FROM email_challenges WHERE challenge_id = ? AND consumed_at IS NULL").run(challengeId);
         return { outcome: "committed", value: undefined };
@@ -768,6 +775,7 @@ export class RegistrationService {
       }
       this.assertChallengeSendAllowed(email, "admin_login", clientKey, now);
       this.recordRateSend(email, clientKey, now);
+      this.serviceUsage.claimResendWithinTransaction(now);
       this.database.prepare(`
         INSERT INTO email_challenges (
           challenge_id, email, invite_id, code_hmac, purpose, expires_at,
@@ -795,6 +803,7 @@ export class RegistrationService {
     try {
       await this.options.resend.sendVerificationCode({ challengeId, code, email, purpose: "admin_login" });
     } catch {
+      this.serviceUsage.markProviderFailure({ serviceId: "resend_email", reason: "provider_unavailable", now });
       this.runImmediate("registration_send_compensation", () => {
         this.database.prepare("DELETE FROM email_challenges WHERE challenge_id = ? AND consumed_at IS NULL").run(challengeId);
         this.recordAdminLoginRejection("service_unavailable", now);
@@ -1097,6 +1106,7 @@ export class RegistrationService {
         now + resendDelayMilliseconds,
         now,
       );
+      this.serviceUsage.claimResendWithinTransaction(now);
       return {
         outcome: "committed",
         value: {
@@ -1116,6 +1126,7 @@ export class RegistrationService {
         purpose: "account_delete",
       });
     } catch {
+      this.serviceUsage.markProviderFailure({ serviceId: "resend_email", reason: "provider_unavailable", now });
       this.runImmediate("registration_send_compensation", () => {
         this.database.prepare("DELETE FROM account_deletion_challenges WHERE deletion_id = ? AND consumed_at IS NULL").run(deletionId);
         return { outcome: "committed", value: undefined };

apps/web/src/admin-models.tsx

@@ -147,11 +147,7 @@ export function AdminModelsPage() {
 
   return (
     <div className="admin-models-page">
-      <header className="admin-product-header">
+      <main id="admin-main">
-        <a href="/admin">DADA ADMIN</a>
-        <nav aria-label="后台导航"><a href="/admin/users">用户</a><a aria-current="page" href="/admin/models">模型</a><a href="/admin/audit">审计</a></nav>
-      </header>
-      <main>
         <header className="admin-models-heading">
           <div><p>MODEL OPERATIONS</p><h1>模型配置</h1></div>
           {configuration ? <strong>配置集合 v{configuration.config_set_version}</strong> : null}

apps/web/src/admin-shell.css

@@ -0,0 +1,523 @@
+:root {
+  color-scheme: light;
+  font-family: "Segoe UI", "Microsoft YaHei UI", sans-serif;
+  background: #f3f3ef;
+}
+
+* {
+  box-sizing: border-box;
+  letter-spacing: 0;
+}
+
+body {
+  margin: 0;
+}
+
+button,
+a,
+input,
+textarea {
+  font: inherit;
+}
+
+.admin-shell {
+  min-height: 100vh;
+  color: #171715;
+  background: #f3f3ef;
+}
+
+.admin-skip-link {
+  position: fixed;
+  z-index: 100;
+  top: 8px;
+  left: 228px;
+  padding: 8px 12px;
+  color: #ffffff;
+  background: #171715;
+  transform: translateY(-160%);
+}
+
+.admin-skip-link:focus {
+  transform: translateY(0);
+}
+
+.admin-sidebar {
+  position: fixed;
+  z-index: 20;
+  inset: 0 auto 0 0;
+  display: grid;
+  width: 216px;
+  grid-template-rows: auto 1fr auto;
+  color: #ffffff;
+  background: #171715;
+}
+
+.admin-wordmark {
+  display: grid;
+  min-height: 104px;
+  align-content: center;
+  padding: 20px 22px;
+  border-bottom: 1px solid #494944;
+  color: #ffffff;
+  text-decoration: none;
+}
+
+.admin-wordmark span {
+  font-family: "Arial Black", "Segoe UI", sans-serif;
+  font-size: 30px;
+  line-height: 1;
+}
+
+.admin-wordmark small {
+  margin-top: 6px;
+  color: #d9dc00;
+  font-family: Consolas, monospace;
+  font-size: 10px;
+}
+
+.admin-sidebar nav {
+  display: grid;
+  align-content: start;
+  padding: 12px 0;
+}
+
+.admin-sidebar nav a {
+  display: grid;
+  min-height: 48px;
+  grid-template-columns: 38px 1fr;
+  align-items: center;
+  padding: 0 18px;
+  border-left: 4px solid transparent;
+  color: #d5d5cf;
+  font-size: 13px;
+  font-weight: 700;
+  text-decoration: none;
+}
+
+.admin-sidebar nav a > span {
+  color: #85857d;
+  font-family: Consolas, monospace;
+  font-size: 10px;
+}
+
+.admin-sidebar nav a:hover,
+.admin-sidebar nav a:focus-visible {
+  color: #ffffff;
+  background: #2c2c29;
+}
+
+.admin-sidebar nav a[aria-current="page"] {
+  border-left-color: #e8eb00;
+  color: #171715;
+  background: #eef000;
+}
+
+.admin-sidebar nav a[aria-current="page"] > span {
+  color: #4d4d00;
+}
+
+.admin-sidebar-foot {
+  display: grid;
+  gap: 10px;
+  padding: 18px 22px;
+  border-top: 1px solid #494944;
+  font-family: Consolas, monospace;
+  font-size: 10px;
+}
+
+.admin-sidebar-foot span {
+  color: #a5a59d;
+}
+
+.admin-sidebar-foot strong {
+  color: #ffffff;
+  font-weight: 700;
+}
+
+.admin-shell-workspace {
+  min-width: 0;
+  margin-left: 216px;
+  padding-top: 52px;
+}
+
+.admin-topbar {
+  position: fixed;
+  z-index: 15;
+  top: 0;
+  right: 0;
+  left: 216px;
+  display: flex;
+  height: 52px;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0 28px;
+  border-bottom: 1px solid #b7b7b0;
+  background: rgb(255 255 255 / 96%);
+}
+
+.admin-topbar h1 {
+  margin: 0;
+  font-size: 15px;
+}
+
+.admin-topbar-status {
+  display: flex;
+  align-items: center;
+  gap: 20px;
+  color: #62625c;
+  font-size: 11px;
+}
+
+.admin-topbar-status span {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+}
+
+.admin-topbar-status i {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: #777770;
+}
+
+.admin-topbar-status code {
+  color: #171715;
+}
+
+.admin-shell-content {
+  min-width: 0;
+}
+
+.admin-session-gate {
+  display: grid;
+  min-height: 100vh;
+  place-items: center;
+  color: #171715;
+  background: #f3f3ef;
+}
+
+.admin-session-gate p,
+.admin-session-gate div {
+  padding: 22px;
+  border-left: 5px solid #171715;
+  background: #ffffff;
+}
+
+.admin-session-gate div {
+  display: grid;
+  gap: 12px;
+}
+
+.admin-session-gate button,
+.admin-overview-failure button,
+.admin-placeholder-toolbar button {
+  min-height: 40px;
+  padding: 8px 14px;
+  border: 1px solid #171715;
+  border-radius: 0;
+  color: #171715;
+  background: #eef000;
+  font-weight: 800;
+}
+
+.admin-overview,
+.admin-placeholder {
+  width: min(1320px, calc(100% - 64px));
+  margin: 0 auto;
+  padding: 34px 0 72px;
+}
+
+.admin-page-heading {
+  display: flex;
+  min-height: 74px;
+  align-items: end;
+  justify-content: space-between;
+  gap: 24px;
+  padding-bottom: 18px;
+  border-bottom: 1px solid #8c8c85;
+}
+
+.admin-page-heading p,
+.admin-status-section header p,
+.admin-operation-strip header p {
+  margin: 0 0 5px;
+  font-family: Consolas, monospace;
+  font-size: 10px;
+  font-weight: 700;
+}
+
+.admin-page-heading h2 {
+  margin: 0;
+  font-size: 32px;
+}
+
+.admin-page-heading time {
+  color: #66665f;
+  font-size: 11px;
+}
+
+.admin-capacity-alert {
+  display: grid;
+  min-height: 44px;
+  grid-template-columns: 1fr auto auto;
+  align-items: center;
+  gap: 18px;
+  padding: 9px 14px;
+  border-bottom: 1px solid #171715;
+  color: #171715;
+  background: #eef000;
+  font-size: 12px;
+  text-decoration: none;
+}
+
+.admin-capacity-alert.is-full,
+.admin-capacity-alert.is-unavailable {
+  color: #ffffff;
+  background: #b33a2f;
+}
+
+.admin-overview-loading {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  margin-top: 22px;
+  border-block: 1px solid #b7b7b0;
+}
+
+.admin-overview-loading span {
+  height: 130px;
+  border-right: 1px solid #c7c7c0;
+  background: #e2e2dd;
+}
+
+.admin-overview-failure {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 20px;
+  margin-top: 20px;
+  padding: 14px 16px;
+  border-left: 5px solid #b33a2f;
+  background: #fff0ed;
+}
+
+.admin-metric-band {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  margin-top: 22px;
+  border-block: 1px solid #8c8c85;
+  background: #ffffff;
+}
+
+.admin-metric-band a {
+  display: grid;
+  min-width: 0;
+  min-height: 132px;
+  align-content: center;
+  gap: 7px;
+  padding: 20px;
+  border-right: 1px solid #c3c3bc;
+  color: #171715;
+  text-decoration: none;
+}
+
+.admin-metric-band a:last-child {
+  border-right: 0;
+}
+
+.admin-metric-band span,
+.admin-metric-band small {
+  color: #65655f;
+  font-size: 11px;
+}
+
+.admin-metric-band strong {
+  overflow-wrap: anywhere;
+  font-size: 25px;
+}
+
+.admin-overview-columns {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 24px;
+  margin-top: 24px;
+}
+
+.admin-status-section,
+.admin-operation-strip,
+.admin-placeholder > section {
+  border-top: 3px solid #171715;
+  border-bottom: 1px solid #8c8c85;
+  background: #ffffff;
+}
+
+.admin-status-section > header,
+.admin-operation-strip > header {
+  display: flex;
+  min-height: 64px;
+  align-items: center;
+  justify-content: space-between;
+  padding: 12px 16px;
+  border-bottom: 1px solid #c3c3bc;
+}
+
+.admin-status-section h3,
+.admin-operation-strip h3 {
+  margin: 0;
+  font-size: 17px;
+}
+
+.admin-status-section header a,
+.admin-operation-strip header a {
+  color: #171715;
+  font-size: 12px;
+  font-weight: 800;
+}
+
+.admin-status-section dl {
+  margin: 0;
+}
+
+.admin-status-section dl > div {
+  display: grid;
+  min-height: 52px;
+  grid-template-columns: 126px 1fr;
+  align-items: center;
+  padding: 0 16px;
+  border-bottom: 1px solid #ddddD7;
+}
+
+.admin-status-section dl > div:last-child {
+  border-bottom: 0;
+}
+
+.admin-status-section dt {
+  color: #65655f;
+  font-size: 11px;
+}
+
+.admin-status-section dd {
+  min-width: 0;
+  margin: 0;
+  overflow-wrap: anywhere;
+  font-family: Consolas, monospace;
+  font-size: 12px;
+  font-weight: 700;
+}
+
+.admin-service-list {
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+
+.admin-service-list li {
+  display: grid;
+  min-height: 42px;
+  grid-template-columns: 1fr 84px 76px;
+  align-items: center;
+  padding: 0 16px;
+  border-bottom: 1px solid #ddddd7;
+  font-size: 11px;
+}
+
+.admin-service-list li:last-child {
+  border-bottom: 0;
+}
+
+.admin-service-list strong {
+  color: #1f6639;
+}
+
+.admin-service-list strong.is-degraded,
+.admin-service-list strong.is-paused {
+  color: #8b5608;
+}
+
+.admin-service-list strong.is-unavailable {
+  color: #a52e24;
+}
+
+.admin-service-list time {
+  color: #65655f;
+  text-align: right;
+}
+
+.admin-operation-strip {
+  margin-top: 24px;
+}
+
+.admin-operation-strip > p {
+  margin: 0;
+  padding: 22px 16px;
+  color: #65655f;
+}
+
+.admin-operation-strip table {
+  width: 100%;
+  border-collapse: collapse;
+  table-layout: fixed;
+}
+
+.admin-operation-strip th,
+.admin-operation-strip td {
+  padding: 12px 16px;
+  border-bottom: 1px solid #ddddd7;
+  overflow-wrap: anywhere;
+  text-align: left;
+  font-size: 11px;
+}
+
+.admin-operation-strip th {
+  color: #65655f;
+  background: #efefeb;
+}
+
+.admin-placeholder > section {
+  margin-top: 22px;
+}
+
+.admin-placeholder-toolbar {
+  display: flex;
+  min-height: 58px;
+  align-items: center;
+  justify-content: space-between;
+  padding: 8px 16px;
+  border-bottom: 1px solid #c3c3bc;
+  font-weight: 800;
+}
+
+.admin-placeholder-toolbar button:disabled {
+  color: #777770;
+  background: #dfdfda;
+}
+
+.admin-placeholder > section > p {
+  margin: 0;
+  padding: 44px 16px;
+  color: #65655f;
+}
+
+:is(.admin-shell, .admin-session-gate) :focus-visible {
+  outline: 2px solid #225dd8;
+  outline-offset: 2px;
+}
+
+@media (max-width: 1000px) {
+  .admin-overview,
+  .admin-placeholder {
+    width: calc(100% - 32px);
+  }
+
+  .admin-metric-band {
+    grid-template-columns: 1fr 1fr;
+  }
+
+  .admin-metric-band a:nth-child(2) {
+    border-right: 0;
+  }
+
+  .admin-overview-columns {
+    grid-template-columns: 1fr;
+  }
+}

apps/web/src/admin-shell.tsx

@@ -0,0 +1,229 @@
+import type { AdminOverviewResponse } from "@dada/shared-contracts";
+import { useCallback, useEffect, useState, type ReactNode } from "react";
+
+import "./admin-shell.css";
+
+interface AdminSession {
+  admin: { role: "super_admin"; status: "active"; user_id: string };
+  audience: "admin";
+  authenticated: true;
+  expires_at: string;
+}
+
+interface AdminProtectedRouteProps {
+  children: ReactNode;
+  currentPath: string;
+  title: string;
+}
+
+const adminNavigation = [
+  { href: "/admin", label: "总览", marker: "01" },
+  { href: "/admin/users", label: "用户与点数", marker: "02" },
+  { href: "/admin/invites", label: "邀请码", marker: "03" },
+  { href: "/admin/models", label: "模型", marker: "04" },
+  { href: "/admin/assets", label: "素材", marker: "05" },
+  { href: "/admin/preview", label: "内部预览", marker: "06" },
+  { href: "/admin/generations", label: "生成记录", marker: "07" },
+  { href: "/admin/services-storage", label: "服务与存储", marker: "08" },
+  { href: "/admin/audit", label: "审计", marker: "09" },
+] as const;
+
+function redirectToAdminLogin() {
+  window.location.replace("/admin/login");
+}
+
+export function AdminProtectedRoute({ children, currentPath, title }: AdminProtectedRouteProps) {
+  const [session, setSession] = useState<AdminSession>();
+  const [failed, setFailed] = useState(false);
+  const [revision, setRevision] = useState(0);
+
+  useEffect(() => {
+    const controller = new AbortController();
+    setFailed(false);
+    void fetch("/api/v1/admin-auth/session", { credentials: "same-origin", signal: controller.signal })
+      .then(async (response) => {
+        if (response.status === 401) {
+          redirectToAdminLogin();
+          return;
+        }
+        if (!response.ok) throw new Error("admin_session_unavailable");
+        const body = await response.json() as AdminSession;
+        if (body.audience !== "admin" || body.admin.role !== "super_admin" || body.admin.status !== "active") {
+          redirectToAdminLogin();
+          return;
+        }
+        setSession(body);
+      })
+      .catch((error: unknown) => {
+        if (!(error instanceof DOMException && error.name === "AbortError")) setFailed(true);
+      });
+    return () => controller.abort();
+  }, [revision]);
+
+  if (!session) {
+    return (
+      <main className="admin-session-gate">
+        {failed ? (
+          <div role="alert">
+            <strong>管理员会话暂时无法确认</strong>
+            <button onClick={() => setRevision((value) => value + 1)} type="button">重试</button>
+          </div>
+        ) : <p aria-live="polite">正在确认管理员会话</p>}
+      </main>
+    );
+  }
+
+  return (
+    <div className="admin-shell">
+      <a className="admin-skip-link" href="#admin-main">跳到主要内容</a>
+      <aside className="admin-sidebar">
+        <a className="admin-wordmark" href="/admin" aria-label="Dada 后台总览">
+          <span>DADA</span>
+          <small>OPERATIONS</small>
+        </a>
+        <nav aria-label="后台主导航">
+          {adminNavigation.map((item) => (
+            <a aria-current={currentPath === item.href ? "page" : undefined} href={item.href} key={item.href}>
+              <span aria-hidden="true">{item.marker}</span>
+              {item.label}
+            </a>
+          ))}
+        </nav>
+        <div className="admin-sidebar-foot">
+          <span>LOCAL P0-A</span>
+          <strong>独立管理员会话</strong>
+        </div>
+      </aside>
+      <div className="admin-shell-workspace">
+        <header className="admin-topbar">
+          <h1>{title}</h1>
+          <div className="admin-topbar-status">
+            <span><i aria-hidden="true" />状态摘要</span>
+            <code>{session.admin.user_id.slice(0, 8)}</code>
+          </div>
+        </header>
+        <div className="admin-shell-content">{children}</div>
+      </div>
+    </div>
+  );
+}
+
+const serviceLabels: Record<AdminOverviewResponse["services"][number]["service_id"], string> = {
+  ai_gateway: "AI 网关",
+  amap: "高德",
+  asset_root: "素材根",
+  resend: "Resend",
+  worker: "Worker",
+};
+
+const stateLabels = {
+  available: "正常",
+  degraded: "有异常",
+  paused: "已暂停",
+  unavailable: "不可用",
+} as const;
+
+function formatTime(value: string | null) {
+  if (!value) return "未记录";
+  return new Intl.DateTimeFormat("zh-CN", { hour: "2-digit", minute: "2-digit", month: "2-digit", day: "2-digit" }).format(new Date(value));
+}
+
+export function AdminOverviewPage() {
+  const [summary, setSummary] = useState<AdminOverviewResponse>();
+  const [failed, setFailed] = useState(false);
+  const [loading, setLoading] = useState(true);
+
+  const load = useCallback(async () => {
+    setLoading(true);
+    setFailed(false);
+    try {
+      const response = await fetch("/api/v1/admin/overview", { credentials: "same-origin" });
+      if (response.status === 401) {
+        window.dispatchEvent(new Event("dada:session-invalid"));
+        return;
+      }
+      if (!response.ok) throw new Error("admin_overview_unavailable");
+      setSummary(await response.json() as AdminOverviewResponse);
+    } catch {
+      setFailed(true);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => { void load(); }, [load]);
+
+  const storagePercent = summary
+    ? Math.min(100, (summary.storage.managed_content_bytes / summary.storage.limit_bytes) * 100)
+    : 0;
+  const hasServiceIssue = summary?.services.some((service) => service.status !== "available") ?? false;
+
+  return (
+    <main className="admin-overview" id="admin-main">
+      <header className="admin-page-heading">
+        <div><p>OPERATIONS / LIVE SUMMARY</p><h2>运营总览</h2></div>
+        {summary ? <time dateTime={summary.generated_at}>更新于 {formatTime(summary.generated_at)}</time> : null}
+      </header>
+      {summary && summary.storage.status !== "normal" ? (
+        <a className={`admin-capacity-alert is-${summary.storage.status}`} href="/admin/services-storage">
+          <span>本机内容容量</span>
+          <strong>{storagePercent.toFixed(1)}%</strong>
+          <span>{summary.storage.status === "critical" ? "接近上限" : summary.storage.status === "full" ? "已满" : "不可用"}</span>
+        </a>
+      ) : null}
+      {loading && !summary ? (
+        <div aria-label="运营摘要加载中" className="admin-overview-loading"><span /><span /><span /><span /></div>
+      ) : null}
+      {failed ? (
+        <div className="admin-overview-failure" role="alert">
+          <span>运营摘要暂时无法读取{summary ? `，当前保留 ${formatTime(summary.generated_at)} 的结果` : ""}。</span>
+          <button onClick={() => void load()} type="button">重试</button>
+        </div>
+      ) : null}
+      {summary ? (
+        <>
+          <section aria-label="关键运营指标" className="admin-metric-band">
+            <a href="/admin/users"><span>普通用户名额</span><strong>{summary.user_slots.active_and_suspended} / {summary.user_slots.limit}</strong><small>active + suspended</small></a>
+            <a href="/admin/generations"><span>进行中任务</span><strong>{summary.generation_jobs.queued + summary.generation_jobs.running}</strong><small>排队 {summary.generation_jobs.queued} · 运行 {summary.generation_jobs.running}</small></a>
+            <a href="/admin/generations"><span>成本核对</span><strong>待人工核对 {summary.generation_jobs.pending_manual_review}</strong><small>最早 {formatTime(summary.generation_jobs.pending_manual_review_oldest_at)}</small></a>
+            <a href="/admin/assets"><span>清理任务</span><strong>{summary.asset_cleanup.pending_jobs}</strong><small>等待处理</small></a>
+          </section>
+          <div className="admin-overview-columns">
+            <section className="admin-status-section" aria-labelledby="model-status-heading">
+              <header><div><p>MODEL STATE</p><h3 id="model-status-heading">模型状态</h3></div><a href="/admin/models">查看</a></header>
+              <dl>
+                <div><dt>配置默认</dt><dd>{summary.models.configured_default_model_id ?? "无"}</dd></div>
+                <div><dt>运行时可用</dt><dd>{summary.models.runtime_available_count} / {summary.models.configured_model_count}</dd></div>
+                <div><dt>当前推荐</dt><dd>{summary.models.recommended_model_id ?? "无"}</dd></div>
+              </dl>
+            </section>
+            <section className="admin-status-section" aria-labelledby="service-status-heading">
+              <header><div><p>SERVICE STATE</p><h3 id="service-status-heading">服务状态</h3></div><a href="/admin/services-storage">{hasServiceIssue ? "有异常" : "全部正常"}</a></header>
+              <ul className="admin-service-list">
+                {summary.services.map((service) => <li key={service.service_id}><span>{serviceLabels[service.service_id]}</span><strong className={`is-${service.status}`}>{stateLabels[service.status]}</strong><time dateTime={service.checked_at ?? undefined}>{formatTime(service.checked_at)}</time></li>)}
+              </ul>
+            </section>
+          </div>
+          <section className="admin-operation-strip" aria-labelledby="recent-operation-heading">
+            <header><div><p>AUDIT SNAPSHOT</p><h3 id="recent-operation-heading">最近后台操作</h3></div><a href="/admin/audit">查看全部</a></header>
+            {summary.recent_operations.length === 0 ? <p>当前无近期操作</p> : (
+              <table><thead><tr><th>时间</th><th>操作</th><th>对象摘要</th><th>结果</th></tr></thead><tbody>{summary.recent_operations.map((operation) => <tr key={operation.operation_id}><td>{formatTime(operation.created_at)}</td><td>{operation.operation_type}</td><td><code>{operation.target_ref}</code></td><td>{operation.result}</td></tr>)}</tbody></table>
+            )}
+          </section>
+        </>
+      ) : null}
+    </main>
+  );
+}
+
+export function AdminPlaceholderPage({ title }: { title: string }) {
+  return (
+    <main className="admin-placeholder" id="admin-main">
+      <header className="admin-page-heading"><div><p>OPERATIONS</p><h2>{title}</h2></div></header>
+      <section aria-label={`${title}安全摘要`}>
+        <div className="admin-placeholder-toolbar"><span>安全摘要</span><button disabled type="button">新建</button></div>
+        <p>当前无记录</p>
+      </section>
+    </main>
+  );
+}

apps/web/src/admin-users.tsx

@@ -100,11 +100,7 @@ export function AdminUsersPage() {
 
   return (
     <div className="admin-users-page">
-      <header className="admin-product-header">
+      <main id="admin-main">
-        <a href="/admin">DADA ADMIN</a>
-        <nav aria-label="后台导航"><a aria-current="page" href="/admin/users">用户</a><a href="/admin/models">模型</a><a href="/admin/audit">审计</a></nav>
-      </header>
-      <main>
         <header className="admin-users-heading">
           <div><p>USER OPERATIONS</p><h1>用户点数</h1></div>
           {balance ? <button onClick={openAdjustment} type="button">调整点数</button> : null}

apps/web/src/generated/api/sdk.gen.ts

@@ -1,6 +1,6 @@
 // Generated from openapi/openapi.json. Do not edit by hand.
 
-import type { CreditAdjustmentResponse, CreditAdjustmentRequest, BrowserSupportSuccess, BrowserSupportRequest, AccountDeletionResponse, AccountDeletionCompleteRequest, AdminLoginCompleteResponse, AdminLoginCompleteRequest, LoginCompleteResponse, LoginCompleteRequest, RegistrationCompleteResponse, RegistrationCompleteRequest, GenerationCreateResponse, AccountSettingsResponse, AdminSessionResponse, CreditBalanceResponse, BootstrapResponse, GenerationTaskResponse, SseEvent, ModelConfig, ModelConfigurationResponse, CreditLedgerResponse, ProjectDetailResponse, UserSessionResponse, ProjectListResponse, RecentAssetListResponse, LogoutResponse, ProjectPurgeResponse, RecentAssetRecordResponse, RecentAssetRecordRequest, ProjectRenameResponse, ProjectRenameRequest, ModelConfigUpdateRequest, ProjectRestoreResponse, ReverseGeocodeResponse, ReverseGeocodeRequest, LatestExportSaveResponse, ProjectStateSaveResponse, ProjectEditableState, AccountDeletionSendResponse, RegistrationSendResponse, AdminLoginSendRequest, LoginSendRequest, RegistrationSendRequest, FailedEmptyTrashResponse, FailedEmptyTrashRequest, ProjectTrashResponse, AccountProfileUpdateResponse, AccountProfileUpdateRequest } from "./types.gen.js";
+import type { CreditAdjustmentResponse, CreditAdjustmentRequest, AdminServiceHealthCheckRequest, BrowserSupportSuccess, BrowserSupportRequest, AccountDeletionResponse, AccountDeletionCompleteRequest, AdminLoginCompleteResponse, AdminLoginCompleteRequest, LoginCompleteResponse, LoginCompleteRequest, RegistrationCompleteResponse, RegistrationCompleteRequest, GenerationCreateResponse, AccountSettingsResponse, AdminOverviewResponse, AdminServicesResponse, AdminSessionResponse, CreditBalanceResponse, BootstrapResponse, GenerationTaskResponse, SseEvent, ModelConfig, ModelConfigurationResponse, CreditLedgerResponse, ProjectDetailResponse, UserSessionResponse, ProjectListResponse, RecentAssetListResponse, LogoutResponse, ProjectPurgeResponse, RecentAssetRecordResponse, RecentAssetRecordRequest, AdminServiceRecoveryRequest, ProjectRenameResponse, ProjectRenameRequest, ModelConfigUpdateRequest, ProjectRestoreResponse, ReverseGeocodeResponse, ReverseGeocodeRequest, LatestExportSaveResponse, ProjectStateSaveResponse, ProjectEditableState, AccountDeletionSendResponse, RegistrationSendResponse, AdminLoginSendRequest, LoginSendRequest, RegistrationSendRequest, FailedEmptyTrashResponse, FailedEmptyTrashRequest, ProjectTrashResponse, AccountProfileUpdateResponse, AccountProfileUpdateRequest, AdminServiceLimitRequest } from "./types.gen.js";
 
 export interface ClientOptions { baseUrl?: string; fetch?: typeof globalThis.fetch; headers?: HeadersInit; }
 
@@ -13,6 +13,23 @@ export async function adjustAdminUserCredits(body: CreditAdjustmentRequest, opti
   return response.json() as Promise<CreditAdjustmentResponse>;
 }
 
+export async function checkAdminServiceHealth(body: AdminServiceHealthCheckRequest, options: ClientOptions = {}): Promise<{
+  "available": boolean;
+  "check_id": string;
+  "checked_at": string;
+}> {
+  const request = options.fetch ?? globalThis.fetch;
+  const headers = new Headers(options.headers);
+  headers.set("Content-Type", "application/json");
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/services/{service_id}/health-check`, { body: JSON.stringify(body), method: "POST", headers });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<{
+  "available": boolean;
+  "check_id": string;
+  "checked_at": string;
+}>;
+}
+
 export async function checkBrowserSupport(body: BrowserSupportRequest, options: ClientOptions = {}): Promise<BrowserSupportSuccess> {
   const request = options.fetch ?? globalThis.fetch;
   const headers = new Headers(options.headers);
@@ -87,6 +104,20 @@ export async function getAccountSettings(options: ClientOptions = {}): Promise<A
   return response.json() as Promise<AccountSettingsResponse>;
 }
 
+export async function getAdminOverview(options: ClientOptions = {}): Promise<AdminOverviewResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/overview`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<AdminOverviewResponse>;
+}
+
+export async function getAdminServices(options: ClientOptions = {}): Promise<AdminServicesResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/services`, { method: "GET", headers: options.headers ?? {} });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<AdminServicesResponse>;
+}
+
 export async function getAdminSession(options: ClientOptions = {}): Promise<AdminSessionResponse> {
   const request = options.fetch ?? globalThis.fetch;
   const response = await request(`${options.baseUrl ?? ""}/api/v1/admin-auth/session`, { method: "GET", headers: options.headers ?? {} });
@@ -205,6 +236,19 @@ export async function recordRecentAsset(body: RecentAssetRecordRequest, options:
   return response.json() as Promise<RecentAssetRecordResponse>;
 }
 
+export async function recoverAdminService(body: AdminServiceRecoveryRequest, options: ClientOptions = {}): Promise<{
+  "status": "active";
+}> {
+  const request = options.fetch ?? globalThis.fetch;
+  const headers = new Headers(options.headers);
+  headers.set("Content-Type", "application/json");
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/services/{service_id}/recover`, { body: JSON.stringify(body), method: "POST", headers });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<{
+  "status": "active";
+}>;
+}
+
 export async function renameProject(body: ProjectRenameRequest, options: ClientOptions = {}): Promise<ProjectRenameResponse> {
   const request = options.fetch ?? globalThis.fetch;
   const headers = new Headers(options.headers);
@@ -314,3 +358,12 @@ export async function updateAccountProfile(body: AccountProfileUpdateRequest, op
   if (!response.ok) throw new Error(`HTTP ${response.status}`);
   return response.json() as Promise<AccountProfileUpdateResponse>;
 }
+
+export async function updateAdminServiceHardLimit(body: AdminServiceLimitRequest, options: ClientOptions = {}): Promise<AdminServicesResponse> {
+  const request = options.fetch ?? globalThis.fetch;
+  const headers = new Headers(options.headers);
+  headers.set("Content-Type", "application/json");
+  const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/services/{service_id}/limits`, { body: JSON.stringify(body), method: "PATCH", headers });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json() as Promise<AdminServicesResponse>;
+}

apps/web/src/generated/api/types.gen.ts

@@ -76,6 +76,69 @@ export type AdminLoginSendRequest = {
   "email": string;
 };
 
+export type AdminOverviewResponse = {
+  "asset_cleanup": {
+  "pending_jobs": number;
+};
+  "generated_at": string;
+  "generation_jobs": {
+  "pending_manual_review": number;
+  "pending_manual_review_oldest_at": string | null;
+  "queued": number;
+  "running": number;
+};
+  "models": {
+  "configured_default_model_id": string | null;
+  "configured_model_count": number;
+  "recommended_model_id": string | null;
+  "runtime_available_count": number;
+};
+  "recent_operations": Array<{
+  "created_at": string;
+  "operation_id": string;
+  "operation_type": string;
+  "result": "succeeded" | "rejected" | "failed";
+  "target_ref": string;
+}>;
+  "services": Array<{
+  "checked_at": string | null;
+  "service_id": "resend" | "amap" | "ai_gateway" | "worker" | "asset_root";
+  "status": "available" | "degraded" | "paused" | "unavailable";
+}>;
+  "storage": {
+  "last_measured_at": string | null;
+  "limit_bytes": number;
+  "managed_content_bytes": number;
+  "status": "normal" | "critical" | "full" | "unavailable";
+};
+  "user_slots": {
+  "active_and_suspended": number;
+  "limit": number;
+};
+};
+
+export type AdminServiceHealthCheckRequest = {
+  "available": boolean;
+  "reason"?: string;
+};
+
+export type AdminServiceLimitRequest = {
+  "hard_limit": number;
+  "period_type": ExternalServicePeriodType;
+};
+
+export type AdminServiceParams = {
+  "service_id": ExternalServiceId;
+};
+
+export type AdminServiceRecoveryRequest = {
+  "check_id": string;
+};
+
+export type AdminServicesResponse = {
+  "services": Array<ExternalServiceUsage>;
+};
+
 export type AdminSessionResponse = {
   "acknowledged_private_content_notice_version": string | null;
   "admin": AdminAuthenticatedUser;
@@ -315,6 +378,23 @@ export type ErrorEnvelope = {
 
 export type ExportFormat = "jpg" | "png";
 
+export type ExternalServiceId = "resend_email" | "amap_web_service";
+
+export type ExternalServicePeriodType = "daily" | "monthly";
+
+export type ExternalServiceStatus = "active" | "paused_quota" | "paused_provider" | "disabled";
+
+export type ExternalServiceUsage = {
+  "hard_limit": number;
+  "pause_reason": string | null;
+  "period_start": string;
+  "period_type": ExternalServicePeriodType;
+  "service_id": ExternalServiceId;
+  "service_status": ExternalServiceStatus;
+  "updated_at": string;
+  "used_count": number;
+};
+
 export type FailedEmptyTrashRequest = {
   "project_ids": Array<ProjectId>;
 };

apps/web/src/main.tsx

@@ -1,4 +1,4 @@
-import { StrictMode } from "react";
+import { StrictMode, type ReactNode } from "react";
 import { createRoot } from "react-dom/client";
 
 import { registerPublicAssetServiceWorker } from "./public-asset-cache.js";
@@ -10,6 +10,7 @@ import { AdminModelsPage } from "./admin-models.js";
 import { CreditsPage } from "./credits-page.js";
 import { ProjectDetailPage, ProjectsPage, WorkspacePage } from "./project-pages.js";
 import { EditorPage } from "./editor-page.js";
+import { AdminOverviewPage, AdminPlaceholderPage, AdminProtectedRoute } from "./admin-shell.js";
 
 const root = document.getElementById("root");
 
@@ -34,9 +35,26 @@ function renderAuthenticationEntry() {
   else if (projectDetail?.[1]) authenticationPage = <ProjectDetailPage key={authRevision} projectId={projectDetail[1]} />;
   else if (window.location.pathname === "/app/projects") authenticationPage = <ProjectsPage key={authRevision} />;
   else if (window.location.pathname === "/app") authenticationPage = <WorkspacePage key={authRevision} />;
-  else if (window.location.pathname === "/admin/users") authenticationPage = <AdminUsersPage key={authRevision} />;
+  else if (window.location.pathname === "/admin/login") authenticationPage = <AdminAuthPage key={authRevision} />;
-  else if (window.location.pathname === "/admin/models") authenticationPage = <AdminModelsPage key={authRevision} />;
+  else if (window.location.pathname.startsWith("/admin")) {
-  else if (window.location.pathname.startsWith("/admin")) authenticationPage = <AdminAuthPage key={authRevision} />;
+    const adminPages: Record<string, { content: ReactNode; title: string }> = {
+      "/admin": { content: <AdminOverviewPage />, title: "运营总览" },
+      "/admin/assets": { content: <AdminPlaceholderPage title="素材" />, title: "素材" },
+      "/admin/audit": { content: <AdminPlaceholderPage title="审计" />, title: "审计" },
+      "/admin/generations": { content: <AdminPlaceholderPage title="生成记录" />, title: "生成记录" },
+      "/admin/invites": { content: <AdminPlaceholderPage title="邀请码" />, title: "邀请码" },
+      "/admin/models": { content: <AdminModelsPage />, title: "模型" },
+      "/admin/preview": { content: <AdminPlaceholderPage title="内部预览" />, title: "内部预览" },
+      "/admin/services-storage": { content: <AdminPlaceholderPage title="服务与存储" />, title: "服务与存储" },
+      "/admin/users": { content: <AdminUsersPage />, title: "用户与点数" },
+    };
+    const page = adminPages[window.location.pathname] ?? adminPages["/admin"]!;
+    authenticationPage = (
+      <AdminProtectedRoute currentPath={window.location.pathname} key={authRevision} title={page.title}>
+        {page.content}
+      </AdminProtectedRoute>
+    );
+  }
   else authenticationPage = <UserAuthPage key={authRevision} />;
   appRoot.render(
     <StrictMode>

package.json

@@ -14,7 +14,7 @@
     "test:integration": "vitest run tests/integration",
     "test:api": "pnpm check:openapi && vitest run tests/api",
     "test:worker": "pnpm --filter @dada/worker build && node scripts/worker-smoke.mjs && vitest run tests/worker",
-    "test:e2e": "pnpm check:openapi && playwright test tests/e2e/event-sync.spec.ts tests/e2e/support-gate.spec.ts tests/e2e/local-data-boundary.spec.ts tests/e2e/storage-capacity.spec.ts tests/e2e/public-asset-cache.spec.ts tests/e2e/user-auth.spec.ts tests/e2e/admin-auth.spec.ts tests/e2e/entry-state-ui.spec.ts tests/e2e/session-invalid-ui.spec.ts tests/e2e/user-registration.spec.ts tests/e2e/account-settings.spec.ts tests/e2e/projects-workspace.spec.ts tests/e2e/project-autosave-conflict.spec.ts tests/e2e/project-trash.spec.ts tests/e2e/credits.spec.ts tests/e2e/generation-workspace.spec.ts tests/e2e/generation-terminal-actions.spec.ts tests/e2e/project-latest-exports.spec.ts tests/e2e/admin-models.spec.ts tests/e2e/wp4-01-editor-background.spec.ts tests/e2e/wp4-02-editor-elements.spec.ts tests/e2e/wp4-03-text-editor.spec.ts tests/e2e/wp4-04-color-dynamic.spec.ts tests/e2e/wp4-05-export.spec.ts tests/e2e/wp4-06-accessibility.spec.ts tests/e2e/wp5-02-static-sticker-catalog.spec.ts tests/e2e/wp5-03-template-registry.spec.ts tests/e2e/wp5-04-resource-isolation.spec.ts --config playwright.config.ts",
+    "test:e2e": "pnpm check:openapi && playwright test tests/e2e/event-sync.spec.ts tests/e2e/support-gate.spec.ts tests/e2e/local-data-boundary.spec.ts tests/e2e/storage-capacity.spec.ts tests/e2e/public-asset-cache.spec.ts tests/e2e/user-auth.spec.ts tests/e2e/admin-auth.spec.ts tests/e2e/entry-state-ui.spec.ts tests/e2e/session-invalid-ui.spec.ts tests/e2e/user-registration.spec.ts tests/e2e/account-settings.spec.ts tests/e2e/projects-workspace.spec.ts tests/e2e/project-autosave-conflict.spec.ts tests/e2e/project-trash.spec.ts tests/e2e/credits.spec.ts tests/e2e/generation-workspace.spec.ts tests/e2e/generation-terminal-actions.spec.ts tests/e2e/project-latest-exports.spec.ts tests/e2e/admin-models.spec.ts tests/e2e/wp4-01-editor-background.spec.ts tests/e2e/wp4-02-editor-elements.spec.ts tests/e2e/wp4-03-text-editor.spec.ts tests/e2e/wp4-04-color-dynamic.spec.ts tests/e2e/wp4-05-export.spec.ts tests/e2e/wp4-06-accessibility.spec.ts tests/e2e/wp5-02-static-sticker-catalog.spec.ts tests/e2e/wp5-03-template-registry.spec.ts tests/e2e/wp5-04-resource-isolation.spec.ts tests/e2e/wp6-01-admin-shell.spec.ts --config playwright.config.ts",
     "test:visual": "node scripts/validate-layer-scope.mjs VISUAL",
     "test:performance": "node scripts/validate-layer-scope.mjs PERFORMANCE",
     "test:security": "node scripts/verify-frozen-dependencies.mjs && node scripts/redaction-scan.mjs",
@@ -94,7 +94,9 @@
     "test:wp5-03": "node scripts/run-wp5-03-validation.mjs",
     "test:wp5-03:red": "node scripts/run-wp5-03-validation.mjs --phase red",
     "test:wp5-04": "node scripts/run-wp5-04-validation.mjs",
-    "test:wp5-04:red": "node scripts/run-wp5-04-validation.mjs --phase red"
+    "test:wp5-04:red": "node scripts/run-wp5-04-validation.mjs --phase red",
+    "test:wp6-01": "node scripts/run-wp6-01-validation.mjs --phase scaffold",
+    "test:wp6-01:red": "node scripts/run-wp6-01-validation.mjs --phase red"
   },
   "devDependencies": {
     "@playwright/test": "1.62.0",

packages/shared-contracts/src/admin.ts

@@ -0,0 +1,94 @@
+import { Type, type Static } from "@sinclair/typebox";
+
+const isoTimestampPattern = "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$";
+const modelIdPattern = "^[a-z0-9][a-z0-9.-]+$";
+const safeReferencePattern = "^[A-Za-z0-9][A-Za-z0-9:._-]{0,159}$";
+
+export const AdminOverviewResponseSchema = Type.Object(
+  {
+    generated_at: Type.String({ pattern: isoTimestampPattern }),
+    user_slots: Type.Object(
+      {
+        active_and_suspended: Type.Integer({ minimum: 0 }),
+        limit: Type.Integer({ minimum: 1 }),
+      },
+      { additionalProperties: false },
+    ),
+    generation_jobs: Type.Object(
+      {
+        pending_manual_review: Type.Integer({ minimum: 0 }),
+        pending_manual_review_oldest_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
+        queued: Type.Integer({ minimum: 0 }),
+        running: Type.Integer({ minimum: 0 }),
+      },
+      { additionalProperties: false },
+    ),
+    models: Type.Object(
+      {
+        configured_default_model_id: Type.Union([Type.String({ maxLength: 80, pattern: modelIdPattern }), Type.Null()]),
+        configured_model_count: Type.Integer({ minimum: 0 }),
+        recommended_model_id: Type.Union([Type.String({ maxLength: 80, pattern: modelIdPattern }), Type.Null()]),
+        runtime_available_count: Type.Integer({ minimum: 0 }),
+      },
+      { additionalProperties: false },
+    ),
+    storage: Type.Object(
+      {
+        last_measured_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
+        limit_bytes: Type.Integer({ minimum: 1 }),
+        managed_content_bytes: Type.Integer({ minimum: 0 }),
+        status: Type.Union([
+          Type.Literal("normal"),
+          Type.Literal("critical"),
+          Type.Literal("full"),
+          Type.Literal("unavailable"),
+        ]),
+      },
+      { additionalProperties: false },
+    ),
+    services: Type.Array(
+      Type.Object(
+        {
+          checked_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
+          service_id: Type.Union([
+            Type.Literal("resend"),
+            Type.Literal("amap"),
+            Type.Literal("ai_gateway"),
+            Type.Literal("worker"),
+            Type.Literal("asset_root"),
+          ]),
+          status: Type.Union([
+            Type.Literal("available"),
+            Type.Literal("degraded"),
+            Type.Literal("paused"),
+            Type.Literal("unavailable"),
+          ]),
+        },
+        { additionalProperties: false },
+      ),
+      { maxItems: 5 },
+    ),
+    recent_operations: Type.Array(
+      Type.Object(
+        {
+          created_at: Type.String({ pattern: isoTimestampPattern }),
+          operation_id: Type.String({ pattern: "^[0-9a-fA-F-]{36}$" }),
+          operation_type: Type.String({ maxLength: 80, pattern: "^[a-z][a-z0-9_]+$" }),
+          result: Type.Union([Type.Literal("succeeded"), Type.Literal("rejected"), Type.Literal("failed")]),
+          target_ref: Type.String({ pattern: safeReferencePattern }),
+        },
+        { additionalProperties: false },
+      ),
+      { maxItems: 10 },
+    ),
+    asset_cleanup: Type.Object(
+      {
+        pending_jobs: Type.Integer({ minimum: 0 }),
+      },
+      { additionalProperties: false },
+    ),
+  },
+  { additionalProperties: false, $id: "AdminOverviewResponse" },
+);
+
+export type AdminOverviewResponse = Static<typeof AdminOverviewResponseSchema>;

packages/shared-contracts/src/index.ts

@@ -1,5 +1,7 @@
 export { Type } from "@sinclair/typebox";
 export * from "./api.js";
+export * from "./admin.js";
+export * from "./services.js";
 export * from "./assets.js";
 export * from "./auth.js";
 export * from "./bootstrap.js";

packages/shared-contracts/src/services.ts

@@ -0,0 +1,62 @@
+import { Type, type Static } from "@sinclair/typebox";
+
+const isoTimestampPattern = "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$";
+
+export const ExternalServiceIdSchema = Type.Union([
+  Type.Literal("resend_email"),
+  Type.Literal("amap_web_service"),
+], { $id: "ExternalServiceId" });
+
+export const ExternalServicePeriodTypeSchema = Type.Union([
+  Type.Literal("daily"),
+  Type.Literal("monthly"),
+], { $id: "ExternalServicePeriodType" });
+
+export const ExternalServiceStatusSchema = Type.Union([
+  Type.Literal("active"),
+  Type.Literal("paused_quota"),
+  Type.Literal("paused_provider"),
+  Type.Literal("disabled"),
+], { $id: "ExternalServiceStatus" });
+
+export const ExternalServiceUsageSchema = Type.Object({
+  service_id: Type.Ref(ExternalServiceIdSchema),
+  period_type: Type.Ref(ExternalServicePeriodTypeSchema),
+  period_start: Type.String({ pattern: isoTimestampPattern }),
+  hard_limit: Type.Integer({ minimum: 1 }),
+  used_count: Type.Integer({ minimum: 0 }),
+  service_status: Type.Ref(ExternalServiceStatusSchema),
+  pause_reason: Type.Union([Type.String({ maxLength: 120, pattern: "^[a-z0-9_.-]+$" }), Type.Null()]),
+  updated_at: Type.String({ pattern: isoTimestampPattern }),
+}, { additionalProperties: false, $id: "ExternalServiceUsage" });
+
+export const AdminServicesResponseSchema = Type.Object({
+  services: Type.Array(Type.Ref(ExternalServiceUsageSchema), { maxItems: 3 }),
+}, { additionalProperties: false, $id: "AdminServicesResponse" });
+
+export const AdminServiceLimitRequestSchema = Type.Object({
+  period_type: Type.Ref(ExternalServicePeriodTypeSchema),
+  hard_limit: Type.Integer({ minimum: 1 }),
+}, { additionalProperties: false, $id: "AdminServiceLimitRequest" });
+
+export const AdminServiceHealthCheckRequestSchema = Type.Object({
+  available: Type.Boolean(),
+  reason: Type.Optional(Type.String({ maxLength: 120, pattern: "^[a-zA-Z0-9_. -]+$" })),
+}, { additionalProperties: false, $id: "AdminServiceHealthCheckRequest" });
+
+export const AdminServiceRecoveryRequestSchema = Type.Object({
+  check_id: Type.String({ maxLength: 64, minLength: 1, pattern: "^[0-9a-fA-F-]+$" }),
+}, { additionalProperties: false, $id: "AdminServiceRecoveryRequest" });
+
+export const AdminServiceParamsSchema = Type.Object({
+  service_id: Type.Ref(ExternalServiceIdSchema),
+}, { additionalProperties: false, $id: "AdminServiceParams" });
+
+export type ExternalServiceId = Static<typeof ExternalServiceIdSchema>;
+export type ExternalServicePeriodType = Static<typeof ExternalServicePeriodTypeSchema>;
+export type ExternalServiceUsage = Static<typeof ExternalServiceUsageSchema>;
+export type AdminServicesResponse = Static<typeof AdminServicesResponseSchema>;
+export type AdminServiceLimitRequest = Static<typeof AdminServiceLimitRequestSchema>;
+export type AdminServiceHealthCheckRequest = Static<typeof AdminServiceHealthCheckRequestSchema>;
+export type AdminServiceRecoveryRequest = Static<typeof AdminServiceRecoveryRequestSchema>;
+export type AdminServiceParams = Static<typeof AdminServiceParamsSchema>;

scripts/lib/openapi.mjs

@@ -13,6 +13,7 @@ function runPnpm(args) {
 }
 
 export function buildApiContracts() {
+  runPnpm(["--filter", "@dada/asset-release-manifest", "build"]);
   runPnpm(["--filter", "@dada/shared-contracts", "build"]);
   runPnpm(["--filter", "@dada/api", "build"]);
 }

scripts/run-wp6-01-validation.mjs

@@ -0,0 +1,115 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const phaseIndex = process.argv.indexOf("--phase");
+const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "scaffold";
+if (!new Set(["red", "scaffold"]).has(phase)) throw new Error(`Unsupported phase: ${phase}`);
+
+const runId = process.env.DADA_TDD_RUN_ID ?? `wp6-01-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
+const runDirectory = resolve("artifacts", "tdd", runId);
+const caseDirectory = resolve(runDirectory, "cases", "TDD-WP6-ADM-001-role-and-summary");
+if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
+mkdirSync(caseDirectory, { recursive: true });
+
+const environment = {
+  ...process.env,
+  DADA_EVIDENCE_DIR_ADMIN: caseDirectory,
+  DADA_PLAYWRIGHT_OUTPUT_DIR: resolve(runDirectory, "playwright-output"),
+  DADA_WP6_01_EVIDENCE_DIR: caseDirectory,
+};
+const commands = phase === "red"
+  ? [
+      ["api-red", "pnpm exec vitest run tests/api/wp6-01-admin-shell.test.ts"],
+      ["e2e-red", "pnpm exec playwright test tests/e2e/wp6-01-admin-shell.spec.ts --config playwright.config.ts"],
+    ]
+  : [
+      ["api", "pnpm test:api"],
+      ["e2e", "pnpm test:e2e"],
+      ["security", "pnpm test:security"],
+      ["tdd-trace", "pnpm validate:tdd-trace"],
+    ];
+
+const commandResults = [];
+for (const [name, command] of commands) {
+  const started_at = new Date().toISOString();
+  const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
+    encoding: "utf8",
+    env: environment,
+    maxBuffer: 40 * 1024 * 1024,
+  });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  commandResults.push({ command, exit_code: result.status ?? 1, finished_at: new Date().toISOString(), name, started_at });
+  if (phase === "scaffold" && (result.status ?? 1) !== 0) break;
+}
+
+const redConfirmed = phase === "red" && commandResults.length === commands.length && commandResults.every((item) => item.exit_code !== 0);
+if (phase === "red") {
+  writeFileSync(resolve(caseDirectory, "red-observation.json"), `${JSON.stringify({
+    expected_failure: "The protected admin overview route, nine-entry admin shell, denied-session redirect, and disabled-session ejection are absent before TASK-WP6-01.",
+    observed_commands: commandResults,
+    red_reason: "TDD-WP6-ADM-001 first Red: ordinary or preview subjects can reach the unguarded admin route, while no safe summary API exists.",
+    status: redConfirmed ? "red_confirmed" : "failed",
+  }, null, 2)}\n`);
+}
+
+function findFiles(directory, name) {
+  if (!existsSync(directory)) return [];
+  const matches = [];
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const path = resolve(directory, entry.name);
+    if (entry.isDirectory()) matches.push(...findFiles(path, name));
+    else if (entry.name === name) matches.push(path);
+  }
+  return matches;
+}
+
+if (phase === "scaffold") {
+  const trace = findFiles(environment.DADA_PLAYWRIGHT_OUTPUT_DIR, "trace.zip")
+    .find((path) => path.toLowerCase().includes("wp6-01-admin-shell"));
+  if (trace) copyFileSync(trace, resolve(caseDirectory, "trace.zip"));
+}
+
+const expectedEvidence = phase === "red"
+  ? ["red-observation.json"]
+  : ["response.json", "db-access.json", "trace.zip", "screenshots/admin-denied.png", "screenshots/admin-overview.png"];
+const missingEvidence = expectedEvidence.filter((file) => !existsSync(resolve(caseDirectory, file)));
+const commandsPassed = phase === "scaffold" && commandResults.length === commands.length && commandResults.every((item) => item.exit_code === 0);
+const status = phase === "red"
+  ? redConfirmed && missingEvidence.length === 0 ? "red_confirmed" : "failed"
+  : commandsPassed && missingEvidence.length === 0 ? "red" : "failed";
+const commit = spawnSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).stdout.trim();
+const wp5BaselineSha = spawnSync("git", ["rev-parse", "origin/codex/wp5-04"], { encoding: "utf8" }).stdout.trim();
+const manifest = {
+  path: "tasks.manifest.json",
+  sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase(),
+};
+const result = {
+  acceptance_criteria: ["AC-25", "AC-49"],
+  automation: ["automated"],
+  commit,
+  dependency_gate: {
+    blocked_by: ["TASK-WP5-05", "TASK-WP5-06", "TASK-WP5-07"],
+    baseline_remote_branch: "origin/codex/wp5-04",
+    baseline_remote_sha: wp5BaselineSha,
+    final_green_allowed: false,
+  },
+  evidence_refs: expectedEvidence,
+  layer: ["API", "E2E"],
+  manifest,
+  missing_evidence: missingEvidence,
+  phase,
+  requirements: ["ADMIN-01", "ADMIN-02", "ADMIN-04", "ADMIN-08"],
+  run_id: runId,
+  status,
+  task_id: "TASK-WP6-01",
+  test_id: "TDD-WP6-ADM-001-role-and-summary",
+  work_package: "WP-6",
+};
+writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
+writeFileSync(resolve(caseDirectory, "result.json"), `${JSON.stringify(result, null, 2)}\n`);
+writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({ cases: [{ missing_evidence: missingEvidence, status, test_id: result.test_id }], phase, run_id: runId, status }, null, 2)}\n`);
+console.log(JSON.stringify({ phase, run_id: runId, status }, null, 2));
+if (status === "failed") process.exit(1);

tests/api/wp6-01-admin-shell.test.ts

@@ -0,0 +1,140 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { createApp } from "../../apps/api/src/app.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { adminOverviewFixture } from "../fixtures/wp6-01-admin-overview.js";
+
+const roots: string[] = [];
+const services: RegistrationService[] = [];
+const now = Date.parse("2026-08-03T09:30:00.000Z");
+const requestHeaders = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
+
+function createRegistration() {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp6-01-api-"));
+  roots.push(root);
+  const registration = new RegistrationService({
+    adminAllowlistPepper: Buffer.alloc(32, 0xd1),
+    challengePepper: Buffer.alloc(32, 0xd2),
+    clock: () => now,
+    currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
+    databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0xd3),
+    resend: new MockResendAdapter(),
+    sessionPepper: Buffer.alloc(32, 0xd4),
+  });
+  services.push(registration);
+  return registration;
+}
+
+function seedSubject(registration: RegistrationService, role: "super_admin" | "user") {
+  const userId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (
+      user_id, normalized_email, role, status, counts_toward_stage_limit,
+      registration_id, created_at
+    ) VALUES (?, ?, ?, 'active', ?, ?, ?)
+  `).run(userId, `${role}-${userId}@example.invalid`, role, role === "user" ? 1 : 0, randomUUID(), now);
+  if (role === "super_admin") {
+    registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
+  }
+  return userId;
+}
+
+function tableCounts(registration: RegistrationService) {
+  return {
+    admin: (registration.database.prepare("SELECT COUNT(*) AS count FROM admin_operation_logs").get() as { count: number }).count,
+    private: (registration.database.prepare("SELECT COUNT(*) AS count FROM private_content_access_logs").get() as { count: number }).count,
+  };
+}
+
+afterEach(() => {
+  for (const service of services.splice(0)) service.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TDD-WP6-ADM-001-role-and-summary", () => {
+  it("authorizes only an active admin audience and returns a schema-redacted summary", async () => {
+    const registration = createRegistration();
+    const adminId = seedSubject(registration, "super_admin");
+    const ordinaryId = seedSubject(registration, "user");
+    const previewId = seedSubject(registration, "user");
+    registration.database.exec("CREATE TABLE asset_preview_grants_fixture (user_id TEXT PRIMARY KEY, status TEXT NOT NULL)");
+    registration.database.prepare("INSERT INTO asset_preview_grants_fixture (user_id, status) VALUES (?, 'active')").run(previewId);
+
+    const adminSession = registration.issueAuthenticatedSession(adminId, "admin");
+    const ordinarySession = registration.issueAuthenticatedSession(ordinaryId, "user");
+    const previewSession = registration.issueAuthenticatedSession(previewId, "user");
+    let providerCalls = 0;
+    const app = await createApp({
+      adminOverview: async () => {
+        providerCalls += 1;
+        return {
+          ...adminOverviewFixture,
+          absolute_path: "forbidden-path-trap",
+          ["api" + "_key"]: "forbidden-key-trap",
+          private_prompt: "forbidden-prompt-trap",
+          recent_operations: adminOverviewFixture.recent_operations.map((operation) => ({
+            ...operation,
+            actor_email: "forbidden@example.invalid",
+          })),
+        };
+      },
+      browserGate: false,
+      networkBoundary: { allowTestPort: true },
+      registration,
+    });
+
+    for (const token of [undefined, ordinarySession.sessionToken, previewSession.sessionToken]) {
+      const response = await app.inject({
+        headers: token ? { ...requestHeaders, cookie: `dada_admin_session=${token}` } : requestHeaders,
+        method: "GET",
+        url: "/api/v1/admin/overview",
+      });
+      expect(response.statusCode).toBe(401);
+    }
+    expect(providerCalls).toBe(0);
+
+    const before = tableCounts(registration);
+    const allowed = await app.inject({
+      headers: { ...requestHeaders, cookie: `dada_admin_session=${adminSession.sessionToken}` },
+      method: "GET",
+      url: "/api/v1/admin/overview",
+    });
+    expect(allowed.statusCode).toBe(200);
+    expect(allowed.json()).toEqual(adminOverviewFixture);
+    expect(JSON.stringify(allowed.json())).not.toMatch(/absolute_path|api_key|private_prompt|actor_email|forbidden/i);
+    expect(providerCalls).toBe(1);
+    expect(tableCounts(registration)).toEqual(before);
+
+    registration.revokeAdminSessions(adminId, "disabled");
+    const afterDisable = tableCounts(registration);
+    const revoked = await app.inject({
+      headers: { ...requestHeaders, cookie: `dada_admin_session=${adminSession.sessionToken}` },
+      method: "GET",
+      url: "/api/v1/admin/overview",
+    });
+    expect(revoked.statusCode).toBe(401);
+    expect(providerCalls).toBe(1);
+    expect(tableCounts(registration)).toEqual(afterDisable);
+    const evidenceRoot = process.env.DADA_WP6_01_EVIDENCE_DIR;
+    if (evidenceRoot) {
+      mkdirSync(evidenceRoot, { recursive: true });
+      writeFileSync(resolve(evidenceRoot, "response.json"), `${JSON.stringify({
+        active_admin: allowed.json(),
+        denied_statuses: { anonymous: 401, ordinary: 401, preview: 401, suspended_admin: revoked.statusCode },
+      }, null, 2)}\n`);
+      writeFileSync(resolve(evidenceRoot, "db-access.json"), `${JSON.stringify({
+        active_read_delta: { admin_operation_logs: 0, private_content_access_logs: 0 },
+        denied_read_delta: { admin_operation_logs: 0, private_content_access_logs: 0 },
+        provider_calls: providerCalls,
+      }, null, 2)}\n`);
+    }
+    await app.close();
+  });
+});

tests/api/wp6-03-services.test.ts

@@ -0,0 +1,157 @@
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { ExternalServiceUsage, ExternalServiceUsageError } from "../../apps/api/src/external-service-usage.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { createApp } from "../../apps/api/src/app.js";
+import { MockAmapAdapter } from "../../apps/api/src/amap-adapter.js";
+
+const roots: string[] = [];
+const registrations: RegistrationService[] = [];
+
+afterEach(() => {
+  for (const registration of registrations.splice(0)) registration.close();
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function createRegistration(now = Date.parse("2026-08-04T09:00:00.000Z")) {
+  const root = mkdtempSync(join(tmpdir(), "dada-wp6-03-services-"));
+  roots.push(root);
+  const registration = new RegistrationService({
+    adminAllowlistPepper: Buffer.alloc(32, 0x91),
+    challengePepper: Buffer.alloc(32, 0x92),
+    clock: () => now,
+    currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
+    databasePath: join(root, "dada.sqlite3"),
+    invitePepper: Buffer.alloc(32, 0x93),
+    resend: new MockResendAdapter(),
+    sessionPepper: Buffer.alloc(32, 0x94),
+  });
+  registrations.push(registration);
+  return registration;
+}
+
+function seedAdmin(registration: RegistrationService, now = Date.parse("2026-08-04T09:00:00.000Z")) {
+  const userId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at)
+    VALUES (?, ?, 'super_admin', 'active', 0, ?, ?)
+  `).run(userId, `${userId}@example.invalid`, randomUUID(), now);
+  registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
+  return userId;
+}
+
+function seedUser(registration: RegistrationService, now = Date.parse("2026-08-04T09:00:00.000Z")) {
+  const userId = randomUUID();
+  registration.database.prepare(`
+    INSERT INTO users (user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at)
+    VALUES (?, ?, 'user', 'active', 1, ?, ?)
+  `).run(userId, `${userId}@example.invalid`, randomUUID(), now);
+  registration.database.prepare("INSERT INTO user_profiles (user_id, creator_name, social_id) VALUES (?, 'Test User', '@test_user')").run(userId);
+  registration.database.prepare("INSERT INTO credit_accounts (user_id, available_balance, reserved_balance, updated_at) VALUES (?, 10, 0, ?)").run(userId, now);
+  return userId;
+}
+
+describe("TDD-WP6-SVC-001 quota hard stop", () => {
+  it("claims Resend daily and monthly quotas transactionally and pauses before the next call", () => {
+    const registration = createRegistration();
+    const usage = registration.serviceUsage;
+    usage.setHardLimit({ serviceId: "resend_email", periodType: "daily", hardLimit: 2, actorId: "fixture-admin" });
+    usage.setHardLimit({ serviceId: "resend_email", periodType: "monthly", hardLimit: 2, actorId: "fixture-admin" });
+
+    expect(usage.claimResend()).toMatchObject({ allowed: true, remaining: 1 });
+    expect(usage.claimResend()).toMatchObject({ allowed: true, remaining: 0 });
+    expect(() => usage.claimResend()).toThrowError(ExternalServiceUsageError);
+    expect(usage.read("resend_email").every((row) => row.status === "paused_quota")).toBe(true);
+  });
+
+  it("does not call a paused provider, and requires a successful health check before recovery", () => {
+    const registration = createRegistration();
+    const usage = registration.serviceUsage;
+    usage.markProviderFailure({ serviceId: "amap_web_service", reason: "provider_unavailable" });
+    expect(() => usage.claimAmap()).toThrowError(ExternalServiceUsageError);
+    expect(() => usage.recover({ serviceId: "amap_web_service", actorId: randomUUID(), checkId: randomUUID() }))
+      .toThrowError(/health_check_required/);
+
+    const check = usage.recordHealthCheck({ serviceId: "amap_web_service", available: true, reason: "ok" });
+    expect(usage.recover({ serviceId: "amap_web_service", actorId: randomUUID(), checkId: check.checkId })).toMatchObject({ status: "active" });
+  });
+
+  it("keeps a new free period paused until an administrator confirms it", () => {
+    const firstNow = Date.parse("2026-08-04T23:59:00.000Z");
+    const registration = createRegistration(firstNow);
+    registration.serviceUsage.claimAmap(firstNow);
+    const nextPeriod = new ExternalServiceUsage({
+      database: registration.database,
+      clock: () => Date.parse("2026-09-01T00:01:00.000Z"),
+    });
+    expect(() => nextPeriod.claimAmap()).toThrowError(/service_paused_quota/);
+    expect(nextPeriod.read("amap_web_service").find((row) => row.periodStart === Date.parse("2026-08-01T00:00:00.000Z"))?.status).toBe("active");
+    expect(nextPeriod.read("amap_web_service").find((row) => row.periodStart === Date.parse("2026-09-01T00:00:00.000Z"))?.status).toBe("paused_quota");
+  });
+
+  it("rejects hard-limit increases and records non-sensitive admin audit", () => {
+    const registration = createRegistration();
+    const usage = registration.serviceUsage;
+    expect(() => usage.setHardLimit({ serviceId: "amap_web_service", periodType: "monthly", hardLimit: 1001, actorId: randomUUID() }))
+      .toThrowError(/hard_limit_increase_forbidden/);
+    expect(registration.database.prepare("SELECT COUNT(*) AS count FROM admin_operation_logs WHERE operation_type = 'service_hard_limit_update'").get())
+      .toMatchObject({ count: 1 });
+  });
+
+  it("blocks the 81st Resend attempt before the adapter and exposes only current rows to admins", async () => {
+    let now = Date.parse("2026-08-04T09:00:00.000Z");
+    const registration = createRegistration(now);
+    const resend = registration.options.resend as MockResendAdapter;
+    registration.serviceUsage.setHardLimit({ serviceId: "resend_email", periodType: "daily", hardLimit: 1, actorId: "fixture-admin" });
+    registration.serviceUsage.setHardLimit({ serviceId: "resend_email", periodType: "monthly", hardLimit: 1, actorId: "fixture-admin" });
+    const invite = registration.createInvite({ expiresAt: now + 86_400_000, maxUses: 3 });
+    await registration.sendRegistrationCode({ email: "quota-one@example.invalid", inviteCode: invite.code });
+    expect(() => registration.serviceUsage.claimResend()).toThrowError(/service_paused_quota/);
+    expect(resend.calls).toHaveLength(1);
+
+    const adminId = seedAdmin(registration, now);
+    const adminSession = registration.issueAuthenticatedSession(adminId, "admin");
+    const csrfToken = registration.issueAdminCsrfToken(adminSession.sessionToken);
+    const app = await createApp({ browserGate: false, networkBoundary: { allowTestPort: true }, registration });
+    await app.ready();
+    const response = await app.inject({
+      headers: { cookie: `dada_admin_session=${adminSession.sessionToken}`, host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" },
+      method: "GET",
+      url: "/api/v1/admin/services",
+    });
+    expect(response.statusCode).toBe(200);
+    expect(response.json().services).toHaveLength(3);
+    expect(response.json().services.find((row: { service_id: string; period_type: string }) => row.service_id === "resend_email" && row.period_type === "daily").service_status).toBe("paused_quota");
+    const health = await app.inject({
+      headers: { "idempotency-key": `${randomUUID()}${randomUUID()}`, "x-csrf-token": csrfToken, cookie: `dada_admin_session=${adminSession.sessionToken}`, host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" },
+      method: "POST",
+      payload: { available: true, reason: "new_period" },
+      url: "/api/v1/admin/services/resend_email/health-check",
+    });
+    expect(health.statusCode).toBe(200);
+    await app.close();
+  });
+
+  it("stops DYN004 after its quota without affecting the rest of the editor", async () => {
+    const registration = createRegistration();
+    const userId = seedUser(registration);
+    const session = registration.issueAuthenticatedSession(userId, "user");
+    const csrfToken = registration.issueUserCsrfToken(session.sessionToken);
+    const amap = new MockAmapAdapter();
+    registration.serviceUsage.setHardLimit({ serviceId: "amap_web_service", periodType: "monthly", hardLimit: 1, actorId: "fixture-admin" });
+    const app = await createApp({ amap, browserGate: false, networkBoundary: { allowTestPort: true }, registration });
+    const headers = { cookie: `dada_session=${session.sessionToken}`, host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121", "x-csrf-token": csrfToken };
+    const first = await app.inject({ headers, method: "POST", payload: { latitude: 30, longitude: 120 }, url: "/api/v1/location/reverse-geocode" });
+    const second = await app.inject({ headers, method: "POST", payload: { latitude: 31, longitude: 121 }, url: "/api/v1/location/reverse-geocode" });
+    expect(first.statusCode).toBe(200);
+    expect(second.statusCode).toBe(503);
+    expect(amap.calls).toHaveLength(1);
+    await app.close();
+  });
+});

tests/e2e/wp6-01-admin-shell.spec.ts

@@ -0,0 +1,137 @@
+import { mkdirSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { expect, test, type Page } from "@playwright/test";
+import { createServer, type ViteDevServer } from "vite";
+
+import { adminOverviewFixture } from "../fixtures/wp6-01-admin-overview.js";
+
+let vite: ViteDevServer;
+let webUrl: string;
+
+const adminSession = {
+  acknowledged_private_content_notice_version: null,
+  admin: { role: "super_admin", status: "active", user_id: "00000000-0000-4000-8000-000000000601" },
+  audience: "admin",
+  authenticated: true,
+  csrf_token: "csrf-admin-shell-fixture-000000000000000000000000000000000",
+  current_private_content_notice_version: null,
+  expires_at: "2026-09-02T09:30:00.000Z",
+  notice_acknowledged: false,
+};
+
+const navigation = [
+  ["总览", "/admin"],
+  ["用户与点数", "/admin/users"],
+  ["邀请码", "/admin/invites"],
+  ["模型", "/admin/models"],
+  ["素材", "/admin/assets"],
+  ["内部预览", "/admin/preview"],
+  ["生成记录", "/admin/generations"],
+  ["服务与存储", "/admin/services-storage"],
+  ["审计", "/admin/audit"],
+] as const;
+
+test.beforeAll(async () => {
+  vite = await createServer({
+    configFile: resolve("apps/web/vite.config.ts"),
+    root: resolve("apps/web"),
+    server: { host: "127.0.0.1", port: 0 },
+  });
+  await vite.listen();
+  const address = vite.httpServer?.address();
+  if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
+  webUrl = `http://127.0.0.1:${address.port}`;
+});
+
+test.afterAll(async () => vite.close());
+
+async function routeActiveAdmin(page: Page) {
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({
+    body: JSON.stringify(adminSession),
+    contentType: "application/json",
+    status: 200,
+  }));
+  await page.route("**/api/v1/admin/overview", (route) => route.fulfill({
+    body: JSON.stringify(adminOverviewFixture),
+    contentType: "application/json",
+    status: 200,
+  }));
+}
+
+test("TDD-WP6-ADM-001-role-and-summary renders the protected nine-entry admin shell", async ({ page }) => {
+  const requests: string[] = [];
+  page.on("request", (request) => requests.push(request.url()));
+  await routeActiveAdmin(page);
+  await page.goto(`${webUrl}/admin`);
+
+  await expect(page.getByRole("heading", { level: 2, name: "运营总览" })).toBeVisible();
+  const sidebar = page.getByRole("navigation", { name: "后台主导航" });
+  await expect(sidebar).toBeVisible();
+  for (const [name, href] of navigation) {
+    await expect(sidebar.getByRole("link", { name, exact: true })).toHaveAttribute("href", href);
+  }
+  expect(Math.round((await sidebar.boundingBox())?.width ?? 0)).toBe(216);
+  await expect(page.getByText("4 / 10", { exact: true })).toBeVisible();
+  await expect(page.getByText("待人工核对 1", { exact: true })).toBeVisible();
+  await expect(page.getByText("85.0%", { exact: true })).toBeVisible();
+  await expect(page.getByRole("link", { name: "有异常", exact: true })).toBeVisible();
+  await expect(page.locator("body")).not.toContainText(/forbidden|example\.invalid|api[_ -]?key|完整提示词/i);
+  expect(requests.some((url) => /prompt|private-content|image-content/i.test(url))).toBe(false);
+
+  const evidenceRoot = process.env.DADA_EVIDENCE_DIR_ADMIN;
+  if (evidenceRoot) {
+    const screenshotDirectory = resolve(evidenceRoot, "screenshots");
+    mkdirSync(screenshotDirectory, { recursive: true });
+    await page.screenshot({ fullPage: true, path: resolve(screenshotDirectory, "admin-overview.png") });
+  }
+});
+
+test("TDD-WP6-ADM-001-role-and-summary keeps ordinary and preview sessions outside admin", async ({ page }) => {
+  let overviewCalls = 0;
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({
+    body: JSON.stringify({ error: { code: "AUTH_SESSION_INVALID", subject: "preview_user" } }),
+    contentType: "application/json",
+    status: 401,
+  }));
+  await page.route("**/api/v1/admin/overview", (route) => {
+    overviewCalls += 1;
+    return route.fulfill({ body: "null", contentType: "application/json", status: 401 });
+  });
+
+  await page.goto(`${webUrl}/admin`);
+  await expect(page).toHaveURL(`${webUrl}/admin/login`);
+  await expect(page.getByRole("heading", { name: "管理员邮箱验证码登录" })).toBeVisible();
+  expect(overviewCalls).toBe(0);
+  await expect(page.getByText("DADA ADMIN", { exact: true })).toHaveCount(0);
+  const evidenceRoot = process.env.DADA_EVIDENCE_DIR_ADMIN;
+  if (evidenceRoot) {
+    const screenshotDirectory = resolve(evidenceRoot, "screenshots");
+    mkdirSync(screenshotDirectory, { recursive: true });
+    await page.screenshot({ fullPage: true, path: resolve(screenshotDirectory, "admin-denied.png") });
+  }
+});
+
+test("TDD-WP6-ADM-001-role-and-summary ejects a disabled admin when the session is rechecked", async ({ page }) => {
+  let active = true;
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill(active ? {
+    body: JSON.stringify(adminSession),
+    contentType: "application/json",
+    status: 200,
+  } : {
+    body: JSON.stringify({ error: { code: "AUTH_SESSION_INVALID" } }),
+    contentType: "application/json",
+    status: 401,
+  }));
+  await page.route("**/api/v1/admin/overview", (route) => route.fulfill({
+    body: JSON.stringify(adminOverviewFixture),
+    contentType: "application/json",
+    status: 200,
+  }));
+  await page.goto(`${webUrl}/admin`);
+  await expect(page.getByRole("heading", { level: 2, name: "运营总览" })).toBeVisible();
+
+  active = false;
+  await page.evaluate(() => window.dispatchEvent(new Event("dada:session-invalid")));
+  await expect(page).toHaveURL(`${webUrl}/admin/login`);
+});

tests/fixtures/wp6-01-admin-overview.ts

@@ -0,0 +1,44 @@
+export const adminOverviewFixture = {
+  generated_at: "2026-08-03T09:30:00.000Z",
+  user_slots: {
+    active_and_suspended: 4,
+    limit: 10,
+  },
+  generation_jobs: {
+    pending_manual_review: 1,
+    pending_manual_review_oldest_at: "2026-08-03T09:12:00.000Z",
+    queued: 2,
+    running: 1,
+  },
+  models: {
+    configured_default_model_id: "gemini-3.1-flash-image-preview",
+    configured_model_count: 3,
+    recommended_model_id: "gemini-3-pro-image-preview",
+    runtime_available_count: 2,
+  },
+  storage: {
+    last_measured_at: "2026-08-03T09:29:00.000Z",
+    limit_bytes: 5_368_709_120,
+    managed_content_bytes: 4_563_402_752,
+    status: "critical" as const,
+  },
+  services: [
+    { checked_at: "2026-08-03T09:29:00.000Z", service_id: "resend", status: "available" as const },
+    { checked_at: "2026-08-03T09:29:00.000Z", service_id: "amap", status: "available" as const },
+    { checked_at: "2026-08-03T09:29:00.000Z", service_id: "ai_gateway", status: "degraded" as const },
+    { checked_at: "2026-08-03T09:29:00.000Z", service_id: "worker", status: "available" as const },
+    { checked_at: "2026-08-03T09:29:00.000Z", service_id: "asset_root", status: "degraded" as const },
+  ],
+  recent_operations: [
+    {
+      created_at: "2026-08-03T09:20:00.000Z",
+      operation_id: "00000000-0000-4000-8000-000000000621",
+      operation_type: "model_configuration_update",
+      result: "succeeded" as const,
+      target_ref: "model-config-set:7",
+    },
+  ],
+  asset_cleanup: {
+    pending_jobs: 0,
+  },
+};