Remove stale runner and deployment instructions after monorepo cleanup

Merge latest dashboard and Turbo setup into dev while preserving workspace features
Rename the unified application to dashboard
2026-11-04 23:22:52 +08:00 · 2026-11-04 23:16:28 +08:00 · 2026-11-04 23:01:32 +08:00 · 2026-11-04 14:57:46 +00:00 · 2026-11-04 22:49:09 +08:00 · 2026-11-04 14:37:17 +00:00
487 changed files with 6197 additions and 19105 deletions
@@ -1,24 +0,0 @@
 .git
 **/.next
 **/node_modules
 **/dist
 coverage
 .env
 .env.*
 !.env.example
 *.tsbuildinfo
 .DS_Store
 .agents
 .codex
 # Documentation and CI metadata are not application build inputs.
 /docs
 /.gitea
 /README.md
 /AGENTS.md
 **/__pycache__
 **/.venv
 # Local authoring assets are uploaded via APIs, never application build inputs.
 /content
@@ -1,37 +0,0 @@
 name: creative workspace review checks
 on:
  pull_request:
    branches: [main]
    paths:
      - 'apps/studio/**'
      - 'apps/waterfall-wiki/**'
      - '.gitea/workflows/**'
      - 'scripts/*studio*'
      - 'compose.creative-review.yml'
      - 'scripts/integration.sh'
 concurrency:
  group: creative-workspace-${{ gitea.event.pull_request.number }}
  cancel-in-progress: true
 jobs:
  verify:
    runs-on: ces-control
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Check patch formatting
        run: git diff --check HEAD^ HEAD
      - name: Verify Studio types, tests, build and smoke
        run: docker build -f apps/studio/Dockerfile -t "creative-studio-review:${{ gitea.sha }}" .
      - name: Build Wiki integration and runtime images
        run: |
          docker build --target integration -t "creative-wiki-tests:${{ gitea.sha }}" .
          docker build --target runtime -t "creative-wiki-review:${{ gitea.sha }}" .
      - name: Verify isolated PostgreSQL, S3 and browser integration
        env:
          STUDIO_REVIEW_IMAGE: creative-studio-review:${{ gitea.sha }}
          WATERFALL_WIKI_IMAGE: creative-wiki-review:${{ gitea.sha }}
          WATERFALL_WIKI_TEST_IMAGE: creative-wiki-tests:${{ gitea.sha }}
          GITEA_RUN_ID: ${{ gitea.run_id }}
        run: bash scripts/integration.sh
@@ -1,23 +0,0 @@
 name: python CI and deployment
 on:
  push:
    branches: [main]
    paths:
      - 'apps/python/**'
      - 'scripts/deploy-python.sh'
      - '.gitea/workflows/python.yml'
 jobs:
  verify-and-deploy:
    if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
    runs-on: ces-control
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Build and verify python
        run: docker build -f apps/python/Dockerfile -t "prompt-python:${{ gitea.sha }}" .
      - name: Release python
        if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
        run: bash scripts/deploy-python.sh "${{ gitea.sha }}"
@@ -1,62 +0,0 @@
 name: creative workspace CI and deployment
 on:
  push:
    branches: [main]
    paths:
      - 'apps/waterfall-wiki/**'
      - 'apps/studio/**'
      - 'scripts/*studio*'
      - 'content/studio-examples/**'
      - 'content/studio-tools/layouts-api.md'
      - '.gitea/workflows/waterfall-wiki.yml'
      - 'Dockerfile'
      - 'compose.yml'
      - 'scripts/deploy.sh'
      - 'scripts/wiki-image-lifecycle.py'
      - 'scripts/infra.sh'
      - 'scripts/auth-admin.sh'
      - 'scripts/integration.sh'
      - 'pnpm-workspace.yaml'
 jobs:
  verify-and-deploy:
    if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
    runs-on: ces-control
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Check shared content and documentation contracts
        run: |
          node scripts/check-studio-contracts.mjs
          node --check scripts/export-studio-series.cjs
          node --check scripts/save-studio-series.mjs
          bash -n scripts/publish-studio-guide.sh scripts/deliver-studio-series.sh
      - name: Build and verify Studio
        run: docker build -f apps/studio/Dockerfile -t "prompt-studio:${{ gitea.sha }}" .
      - name: Build, verify, deploy and retain wiki images
        env:
          RELEASE_SHA: ${{ gitea.sha }}
        run: |
          if [ "$(id -u)" -eq 0 ]; then
            python3 scripts/wiki-image-lifecycle.py ci --sha "$RELEASE_SHA"
          else
            sudo -n python3 scripts/wiki-image-lifecycle.py ci --sha "$RELEASE_SHA"
          fi
      - name: Release Studio after Wiki routes are deployed
        run: bash scripts/deploy-studio.sh "${{ gitea.sha }}"
      - name: Verify the deployed creative workspace
        run: bash scripts/verify-studio-production.sh
      - name: Save server acceptance evidence
        id: acceptance_evidence
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: studio-production-acceptance
          path: artifacts/studio-acceptance/
          if-no-files-found: ignore
          retention-days: 7
      - name: Remove temporary acceptance output after upload
        if: always() && steps.acceptance_evidence.outcome == 'success'
        run: rm -rf artifacts/studio-acceptance
@@ -1,19 +0,0 @@
 name: Wiki image retention checks
 on:
  push:
    branches: [main]
    paths:
      - 'scripts/wiki-image-lifecycle.py'
      - 'tests/test_wiki_image_lifecycle.py'
      - '.gitea/workflows/wiki-image-retention-checks.yml'
 jobs:
  retention-policy:
    if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
    runs-on: ces-control
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - name: Check retention without building or accessing the Docker daemon
        run: |
          bash -n scripts/deploy.sh
          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p 'test_wiki_image_lifecycle.py' -v
@@ -1,4 +1,6 @@
 node_modules/
 .pnpm-store/
 .turbo/
 .next/
 coverage/
 .env*
@@ -18,3 +20,10 @@ __pycache__/
 *.webp
 *.gif
 *.avif
 # Approved, versioned brand resources are package source assets.
 !packages/brand/assets/**/*.png
 !packages/brand/docs/logo-preview.png
 /apps/dashboard/public/brand/
 /apps/dashboard/public/favicon.ico
 /apps/dashboard/public/apple-touch-icon.png
@@ -8,9 +8,15 @@ This block is written and re-added by `next dev` — verify at `node_modules/nex
 <!-- END:nextjs-agent-rules -->
-## 交付与视觉验收
+## 项目维护
- 用户指定服务器为唯一运行与验收入口：http://8.211.154.134:18131/。
+- Wiki 和 Studio 共用 `apps/dashboard` 的 Pages Router、登录保护和品牌包。保留已发布的路由、媒体标识和数据库迁移。
- 页面改动必须先 push，等待 ces-control 的 CI/CD 成功部署，再直接访问服务器检查效果。
+
- 不启动本地网页预览，不使用 localhost / 127.0.0.1 页面进行视觉验收，也不把本地预览链接交付给用户。
+## 开发分支与集成
- 类型检查、单元测试等不提供网页预览的检查可以本地执行；完整运行检查由 Docker CI 完成。
+
 - `dev` 是日常开发成果的集成分支。开始新任务前检查工作区和远程状态，默认从最新 `origin/dev` 创建或复用对应任务分支，避免夹带其他任务的未完成改动。
 - 每项任务完成并通过适当检查后，提交并推送任务分支，再将该任务合并到 `dev` 并推送；用户已持续授权这类向 `dev` 的合并与推送，无需逐次确认。
 - 合并前检查完整差异和待合入提交；保留 `dev` 已有工作，冲突解决后重新执行受影响的检查。不强推或重写共享历史，不擅自删除任务分支。
 - `main` 保持人工集成：未经用户针对本次操作明确授权，不直接推送 `main`，也不代为合并面向 `main` 的 PR。需要发布到主线时，准备 `dev` 到 `main` 的可评审 PR，等待用户手动合并。
 - 当前不使用 CI/CD，不因合并或推送 `dev` 自动恢复旧流水线、远程预览或部署安排。完整构建与运行验证是否执行及其环境，按用户另行授权处理。
 - 交付报告说明任务分支、提交、检查结果以及是否已合并并推送 `dev`；区分 `dev` 集成与 `main` 合并、部署。
@@ -1,40 +0,0 @@
 FROM node:24-bookworm-slim AS base
 LABEL io.entroia.project="waterfall-wiki"
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
 RUN apt-get update \
    && apt-get install -y --no-install-recommends ffmpeg ca-certificates chromium fonts-noto-cjk \
    && rm -rf /var/lib/apt/lists/*
 FROM base AS dependencies
 LABEL io.entroia.wiki.build="true"
 RUN corepack enable && corepack prepare pnpm@11.25.0 --activate
 COPY apps/waterfall-wiki/pnpm-lock.yaml ./
 COPY pnpm-workspace.yaml /tmp/monorepo-policy.yaml
 RUN node -e "const fs=require('fs');const text=fs.readFileSync('/tmp/monorepo-policy.yaml','utf8');fs.writeFileSync('pnpm-workspace.yaml', text.slice(text.indexOf('allowBuilds:')));"
 RUN pnpm fetch --frozen-lockfile --fetch-timeout=300000 --network-concurrency=8
 COPY apps/waterfall-wiki/package.json ./
 RUN pnpm install --offline --frozen-lockfile
 FROM dependencies AS build
 # .dockerignore excludes docs and operational notes without extra legacy COPY snapshots.
 COPY apps/waterfall-wiki/ .
 RUN pnpm typecheck && pnpm test && pnpm build && pnpm test:smoke
 FROM build AS integration
 USER node
 CMD ["npm", "run", "test:integration"]
 FROM base AS runtime
 ENV NODE_ENV=production HOSTNAME=0.0.0.0 PORT=3000 \
    FFMPEG_PATH=/usr/bin/ffmpeg FFPROBE_PATH=/usr/bin/ffprobe
 COPY --from=build --chown=node:node /app/.next/standalone/ ./
 COPY --from=build --chown=node:node /app/dist/worker.cjs /app/dist/bootstrap.cjs /app/dist/publish-learning-series.cjs /app/dist/auth-cli.cjs ./
 COPY --from=build --chown=node:node /app/db/ ./db/
 COPY --chown=node:node apps/waterfall-wiki/scripts/container-health.mjs ./
 COPY --chown=node:node apps/waterfall-wiki/scripts/import-character-packs.mjs apps/waterfall-wiki/scripts/verify-character-pack.mjs ./scripts/
 COPY --chown=node:node apps/waterfall-wiki/seed/characters/ ./seed/characters/
 COPY --chown=node:node apps/waterfall-wiki/src/content/managed-media.json ./src/content/managed-media.json
 USER node
 EXPOSE 3000
 CMD ["node", "server.js"]
@@ -1,104 +1,44 @@
-# PROMPT
+# 啡跃 Endoleap
-把提示词、参考图、分步文档和创作工具收进同一个可连接的知识库。人可以浏览瀑布流、搜索和编辑；AI 可以从同一篇 post 读取纯文本、图片与 API 说明，再调用 Studio 生成作品。
+啡跃把笔记、参考素材和创作工作台放在同一个 Next.js 应用里。应用位于 `apps/dashboard`，共享主题与品牌资源位于 `packages/brand`。
-**PROMPT 是网站与项目品牌；`waterfall-wiki` 是知识库应用的内部名称。** 目录、包、CI、镜像和 Compose 服务使用内部名称，网站导航与页面标题使用 PROMPT。
+| 入口 | 用途 |
 线上入口：[PROMPT](http://8.211.154.134:18131/)。内容、媒体、API 与 Studio 共用登录入口。
 ## 从一篇 post 开始
 每篇内容都有稳定的 `/explore/<id>` 地址。标题、标签、正文和封面可以修改，链接保持不变。数据库内容可以保留 24 位 public ID，内部仍使用 UUID；旧 `/p/<slug>`、`/skills/...` 等地址保留兼容跳转。
 - **浏览**：首页按不同笔记的反向引用数优先排序。重复引用和自引用不重复计数，代码、图片与外站链接不冒充笔记引用。详情可以查看引用来源。
 - **搜索**：标题、简介、正文、普通标签和系统标签共同匹配。支持多个关键词及双引号短语，先按相关性、再按引用数和时间排序；先筛选再分页。
 - **标签**：普通标签使用 `#中国风`、`#贴纸` 等名称，可以创建、添加或移除。系统标签是固定列表，目前为“文档入口”和“参考图”，只能搜索并勾选，不能通过 `#` 创建。系统标签显示在图片角标，普通标签显示在文字区；分类页顶部按系统标签筛选。
 - **编辑**：卡片与详情都能直接编辑标签；完整编辑器可以修改标题、简介、Markdown。保存使用 revision 检测并发冲突，避免旧窗口覆盖新修改。
 - **素材**：原件和加工结果都是普通资产，可被多篇 post 引用。文档封面与实际参考素材分开，子文档可以有自己的封面，同时保留原参考图。
 ## 给 AI 的入口
 在同一个 post 地址加 `?agent_mode=True` 可以读取纯文本正文和媒体链接。业务 API 的相同参数会先返回接口说明；已有查询参数时使用 `&agent_mode=True`。这些入口同样需要登录或有效 Bearer JWT。
 | 地址 | 用途 |
 | --- | --- |
-| `/explore/<id>` | 人看的 post；加 `?agent_mode=True` 读纯文本 |
+| `/` | 浏览内容，打开 `/explore/<id>` 查看笔记 |
 | `/guide` | 浏览指导文档 |
 | `/graphic` | 图文排版 |
 | `/infinite_canvas` | 无限画布 |
 | `/api?agent_mode=True` | 业务 API 目录 |
-| `/api/explore-feed` | 统一搜索、系统/普通标签筛选与分页 |
+| `/studio/api` | Studio API 目录 |
 | `/api/notes/<id>` | GET 读取；PUT 编辑全文；PATCH 仅更新标签 |
 | `/api/tags` | GET 查看普通/系统标签；POST 创建或复用普通标签 |
 | `/api/upload` | 上传媒体；`assetOnly=true` 独立保存，不创建 post |
 | `/api/posts` | 用正文和已有资产创建普通 post |
 | `/api/media/<id>` | 媒体原件与衍生文件，支持 Range |
 | `/api/preview` | 有尺寸上限的 WebP 预览，不接受任意远程 URL |
-标签 PATCH 请求为 `{ "tags": ["标签 UUID"], "revision": "GET 返回的 revision" }`。它不会要求用户重输正文。Tag 对象的 `kind` 为 `normal` 或 `system`；系统标签还有稳定的 `system_key`。普通创建接口不允许提交 `kind` 或 `system_key`。
+## 运行
-Wiki 中的教程是普通 post 与媒体数据，不需要为每份资料增加专用网页路由、JSON 文件端点或代码注册。
+准备 Node.js 24、pnpm 11.25.0、PostgreSQL、S3 兼容对象存储和 FFmpeg。参考 [环境变量示例](apps/dashboard/.env.example)，将变量注入 Web、初始化和媒体 worker 进程。邮箱注册与找回密码需要可用的 SMTP 服务。
-## Studio：从教程进入工具
+在仓库根目录运行 `pnpm install --frozen-lockfile` 和 `pnpm build`。然后在 `apps/dashboard` 目录准备数据库和存储，初始化管理员认证并启动 Web。
 Studio 负责交互式排版与无状态渲染，知识库负责教程、来源和入口。`/studio` 返回 PROMPT 首页；请从对应 post 打开具体工具。
 27 套排版工具：`/studio/layouts/ref-01` 至 `/studio/layouts/ref-27`，每套对应原图 T/I/D 构件。目录与参数 API 为 `/studio/api/layouts` 和 `/studio/api/layouts/<id>`；POST 参数生成 SVG。效果通过 `/api/studio/designs` 存入 Wiki 现有 PostgreSQL，返回独立 ID，`/studio/designs/<id>` 可再次打开；PATCH 携带 revision 更新同一效果。Studio 不需要数据库连接或第二套数据库。详见 [27 套排版 API 教程](content/studio-tools/layouts-api.md)。
 其他试版工具：
 - `/studio/ideas/learning-skills-template`：ref-17 同一母版的四张占位封面。
 - `/studio/ideas/layout-selection`：ref-01、ref-07、ref-26 三种构图；可修改文字与配色，核对构件边界。
 - `/studio/api/export/<slug>`：GET 读取方案或初始 SVG；POST 校验自定义参数并生成 SVG/JSON。详细说明读取该地址的 `?agent_mode=True`。
 渲染不自动保存作品，也不自动发布 post。需要保留的结果应下载后再通过普通媒体和 post API 发布。原图的 T/I/D 构件、画板比例与来源保留为可读取数据；文字替换和矢量重建的范围应在教程中明确。
 ## 仓库结构
 | 路径 | 职责 |
 | --- | --- |
 | `apps/waterfall-wiki` | Next.js Pages Router 知识库、搜索、标签、媒体 API、认证与后台视频加工 |
 | `apps/studio` | 独立 Next.js 创作工具与封面渲染 API |
 | `apps/python` | 按需运行的 PNG/视频导出 CLI，没有常驻网络服务 |
 | `content` | 本地作者资料、教程及排版源图，不打入 Wiki 运行镜像 |
 | `scripts` | CI 部署、运维、API 发布与作者工具 |
 | `docs` | 数据模型、接口、认证与部署说明 |
 两个 JavaScript 应用分别维护冻结的 pnpm 锁文件。根 Dockerfile 是 waterfall-wiki 的构建入口；应用目录的 Dockerfile 与它保持一致。
 ## 环境与检查
 运行环境：Node.js 24、pnpm 11.25.0、PostgreSQL 17、S3 兼容对象存储；视频处理使用 FFmpeg，部分导出使用 Chromium。Python 工具需要 Python 3.12+。
 ```sh
-pnpm install
+node dist/bootstrap.cjs
-pnpm --dir apps/waterfall-wiki typecheck
+node dist/auth-cli.cjs init
-pnpm --dir apps/waterfall-wiki test
+pnpm start
 pnpm --dir apps/studio typecheck
 bash -n scripts/deploy.sh scripts/integration.sh scripts/deploy-studio.sh
 ```
-完整集成测试只针对显式隔离的数据库、对象存储和生产容器运行，覆盖存储、视频加工、编辑冲突、真实搜索与引用、标签规则和登录保护。不要把生产存储配置拿来运行集成测试。
+媒体 worker 在同一目录作为独立进程运行 `node dist/worker.cjs`。绑定管理员验证器时，在远程交互终端执行 `node dist/auth-cli.cjs qr`。已有实例复用原数据库、对象存储和私有认证文件。
-本项目以指定服务器为唯一网页运行与验收入口：先推送，再等待 ces-control CI/CD，最后直接检查服务器。不要启动本地网页预览，不用 localhost 页面作为视觉验收或交付入口。具体约定见 [AGENTS.md](AGENTS.md)。
+## Monorepo 与 Turborepo
-## 部署与持久化
+仓库在现有 pnpm workspace 上接入 Turborepo，无需运行面向新项目的 `npx create-turbo@latest`。应用仍位于 `apps/dashboard`，源码品牌包仍位于 `packages/brand`；子包脚本和应用产物路径保持原样。依赖统一锁定在根目录 `pnpm-lock.yaml`，安装从仓库根目录执行。
-Web 应用由 `waterfall-wiki.yml` 统一发布，两个应用的路径都能触发它：先检查并构建 Studio，再完成 Wiki 的类型检查、单元测试、生产构建、冒烟及隔离 PostgreSQL/S3 集成测试并部署 Wiki，随后部署 Studio，最后在指定服务器验收。顺序在同一个 ces-control 作业内保证，避免独立作业互相等待。PR 检查也运行隔离集成测试，但不部署。Python 检查仍由 `python.yml` 承担；文档与作者数据本身不触发应用部署。
+根目录命令由 Turbo 调度：`pnpm dev` 启动开发任务，`pnpm dev:dashboard` 仅启动 Wiki，`pnpm build` 构建应用及 worker/CLI，`pnpm typecheck` 生成 Next.js 类型并检查 TypeScript。`pnpm start` 继续直接启动现有应用。也可以在子包目录使用原有命令。
-| 服务 | 入口/端口 |
+锁文件合并保留应用原有依赖解析。唯一重叠差异是 `@tailwindcss/postcss` 的间接 PostCSS 依赖：品牌包原为 8.5.32，现在沿用应用的 8.5.31；品牌包直接声明的 PostCSS 8.5.6 不变。
 | --- | --- |
 | `waterfall-wiki` | 公网 `18131`，也是 Studio 的统一入口 |
 | PostgreSQL | `127.0.0.1:18132` |
 | 对象存储 | `127.0.0.1:18133` |
 | Studio | `127.0.0.1:18134`；编辑器公网入口为 `/graphic`、`/infinite_canvas`，资源和 API 保留 `/studio` 代理 |
 | Python | 无网络端口，按需运行 |
-生产 Compose 项目仍为 `prompt`，部署根目录仍为 `/opt/prompt`。既有 `prompt_postgres_data`、`prompt_objects`、`prompt_auth_data` 卷与数据库身份保留；应用更名不会重新创建一套空存储。Compose 应用服务改为 `waterfall-wiki` 和 `waterfall-wiki-worker`，镜像参数为 `WATERFALL_WIKI_IMAGE` / `WATERFALL_WIKI_TEST_IMAGE`。
+迁移阶段所有任务禁用缓存，根命令使用 `--env-mode=loose` 透传既有环境变量，保留品牌资源准备步骤的每次执行。后续启用缓存前，需明确环境变量输入、跨包资源和所有输出。当前不配置 CI/CD，也不自动发布。
-部署在停止写入后备份数据库，再运行迁移和启动新版。失败时恢复兼容旧镜像的备份并回滚服务。生产不执行 `down -v`，也不清空对象文件。早期合集验证会遍历分页，不假定旧文章一定在第一页。
+仅检查任务计划、不执行编译或生成应用产物时，可运行 `pnpm build --dry=json` 和 `pnpm typecheck --dry=json`。完整构建与运行验证另行执行。
-## 登录与自动化
+## 开发流程
-共享验证器的 6 位 TOTP 动态码登录，JWT 保存在 HttpOnly Cookie 中；这属于单因素动态码登录，不是 2FA。密钥保存在服务器认证卷，不进入 Git、镜像或 HTTP 二维码接口。
+`dev` 集成已完成的任务。新任务默认从最新 `origin/dev` 创建独立分支，检查完成后提交并推送任务分支，再合并并推送 `dev`。`main` 仍通过 PR 由用户手动合并；推送 `dev` 不代表已发布或部署。当前不使用 CI/CD。
-服务器管理员在交互式 SSH 终端运行 `sudo /opt/prompt/auth qr` 绑定验证器。不要把二维码、动态密钥或 JWT 粘贴到聊天、日志和仓库。服务端自动化可使用 `node auth-cli.cjs run <脚本>`，在进程内为本机 API 请求附加短期凭据，不输出令牌。
+本次同步保留原 `dev` 的双侧栏工作区、画布子集与近期编辑记录、工作区创建和加入 API，以及 `db/018_workspaces.sql` 迁移。已有数据库仍需在应用启动前按“运行”章节执行数据库初始化；合并代码本身不会执行迁移。认证 Cookie 名称继续支持原 `dev` 的 `ACCOUNT_COOKIE_NAME` 与 `AUTH_COOKIE_NAME` 配置，未设置时使用原默认名称。
 更多说明：[登录与 SSH 绑定](docs/dynamic-code-login.md) · [API](docs/api.md) · [数据模型](docs/data-model.md) · [项目结构与部署](docs/monorepo.md)。
@@ -0,0 +1,18 @@
 # Export to the web, storage bootstrap and worker processes.
 DATABASE_URL=postgresql://endoleap:replace-me@127.0.0.1:5432/endoleap
 S3_ENDPOINT=http://127.0.0.1:9000
 S3_ACCESS_KEY=replace-me
 S3_SECRET_KEY=replace-me
 S3_BUCKET=prompt
 PORT=3000
 AUTH_CONFIG_FILE=/path/to/private/auth.json
 AUTH_COOKIE_SECURE=true
 ACCOUNT_PUBLIC_ORIGIN=https://endoleap.example
 ACCOUNT_TRUST_PROXY=false
 # Email verification and recovery
 SMTP_HOST=
 SMTP_PORT=465
 SMTP_USERNAME=
 SMTP_FROM=
 SMTP_PASSWORD=
@@ -1,6 +1,7 @@
 # Email accounts
-`/account` offers registration, password login, email verification/resend, and logout.
+`/account` offers registration, password login, email verification/resend, password
 recovery, and logout.
 `/api/account/session` returns the current account; other actions use same-origin POST.
 Passwords require at least 12 characters and at most 256 UTF-8 bytes. Only verified
 accounts can log in. Verification links expire after 30 minutes and are consumed once.
@@ -9,24 +10,22 @@ Only token SHA-256 digests are stored. Passwords use individually salted scrypt.
 ## Runtime configuration
-The existing production deployment reads `/etc/prompt.env` on ces-control. Set its
+Use [the environment example](.env.example) and the root README to configure the Web,
-ownership to root and mode to 0600. The operator should update SMTP_PASSWORD there
+bootstrap, and worker processes. The repository no longer supplies CI/CD or Compose
-through a secure remote session, without putting it in command arguments, repository,
+deployment configuration. Keep SMTP_PASSWORD and other credentials in the process
-CI output, release.env, or chat. Existing compose deployment reads this file without
+environment or an operator-managed private file with restricted permissions, outside
-copying credentials into the release directory. Do not run `docker compose config`
+the repository. Do not put credentials in command arguments, logs, or chat.
 without `--quiet` against the production environment because interpolation shows secrets.
 Docker administrators can inspect container environment; access to Docker is privileged.
-Set ACCOUNT_PUBLIC_ORIGIN to the exact browser origin and SMTP_HOST=smtpdm.aliyun.com,
+Set ACCOUNT_PUBLIC_ORIGIN to the exact browser origin and configure SMTP_HOST,
-SMTP_PORT=465, SMTP_USERNAME and SMTP_FROM=noreply@notice.entroia.com. TLS certificate
+SMTP_PORT, SMTP_USERNAME, SMTP_FROM, and SMTP_PASSWORD for the mail provider. TLS certificate
 validation stays enabled. Missing SMTP configuration returns a generic service failure;
 resend with the registration password can recover an account whose initial delivery failed.
 Keep AUTH_CONFIG_FILE configured for administrator access. Missing administrator
 configuration fails closed. AUTH_DISABLED_FOR_TESTS is false by default and is enabled
-only by the disposable legacy integration stack; never enable it in production.
+only for an explicitly isolated test environment; never enable it in production.
 Email account cookies never satisfy administrator authorization. With the current HTTP
-acceptance origin use AUTH_COOKIE_SECURE=false; use true after enabling HTTPS.
+runtime origin use AUTH_COOKIE_SECURE=false; use true for HTTPS.
 Limits persist in PostgreSQL: 10 logins and 3 registration/resend attempts per email per
 15 minutes, plus 300 requests per 15 minutes globally. ACCOUNT_TRUST_PROXY defaults
@@ -37,13 +36,16 @@ response for existing/unknown emails, and login uses a dummy KDF for unknown acc
 The rate limit itself can reveal recent activity for a known email; it does not reveal
 whether an account exists. Synchronous SMTP latency can still expose a timing side channel;
 a durable asynchronous mail queue would be needed to fully decouple delivery timing.
-Logout remains available when login/mail limits are exhausted. No password recovery or
+Logout remains available when login/mail limits are exhausted. Password recovery uses
-account deletion is included.
+a single-use reset link that expires after 30 minutes; resetting the password revokes
 existing sessions. Account deletion is not included.
 ## Verification
-ces-control runs crypto/origin tests, PostgreSQL verification-token replay races,
+There is no automatic verification pipeline. Turbo dry-runs only verify task planning;
-expired/revoked sessions, concurrent limit consumption and unverified login rejection.
+they do not exercise account behavior. Runtime verification requires an explicitly
-Production-auth exercises verify that account cookies cannot authorize legacy writes.
+authorized environment with PostgreSQL and SMTP configuration. Cover token replay,
-Actual SMTP delivery and visual acceptance at http://8.211.154.134:18131/account require
+expired/revoked sessions, concurrent limits, password recovery, and rejection of
-operator runtime configuration and the normal manually approved deployment.
+unverified logins. Verify separately that account cookies cannot authorize administrator
 writes, that real email is delivered, and that the account page works in a browser.
 Report the checks actually executed; merging into `dev` does not deploy the application.
@@ -0,0 +1,5 @@
 BEGIN;
 ALTER TABLE account_tokens DROP CONSTRAINT account_tokens_kind_check;
 ALTER TABLE account_tokens ADD CONSTRAINT account_tokens_kind_check CHECK (kind IN ('verify','session','reset'));
 INSERT INTO schema_migrations(version) VALUES ('017_password_reset');
 COMMIT;
@@ -0,0 +1,22 @@
 BEGIN;
 CREATE TABLE workspaces (
 id uuid PRIMARY KEY,
 owner_id uuid NOT NULL REFERENCES account_users(id),
 name text NOT NULL CHECK (char_length(name) BETWEEN 1 AND 40),
 purpose text NOT NULL CHECK (purpose IN ('工作与团队','个人创作','学习与研究')),
 created_at timestamptz NOT NULL DEFAULT now()
 );
 CREATE TABLE workspace_members (
 workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
 user_id uuid NOT NULL REFERENCES account_users(id) ON DELETE CASCADE,
 PRIMARY KEY (workspace_id, user_id)
 );
 CREATE INDEX workspace_members_user ON workspace_members(user_id);
 CREATE TABLE workspace_invites (
 digest text PRIMARY KEY,
 workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
 expires_at timestamptz NOT NULL
 );
 CREATE INDEX workspace_invites_workspace ON workspace_invites(workspace_id);
 INSERT INTO schema_migrations(version) VALUES ('018_workspaces');
 COMMIT;
@@ -1,7 +1,9 @@
 import { resolve } from "node:path";
 import type { NextConfig } from "next";
 import managedMedia from "./src/content/managed-media.json";
 const nextConfig: NextConfig = {
  turbopack: { root: resolve(process.cwd(), "../..") },
  serverExternalPackages: ["playwright-core"],
  async redirects(){return [
    {source:'/studio/graphic',destination:'/graphic',permanent:true},
@@ -9,10 +11,11 @@ const nextConfig: NextConfig = {
    {source:'/studio',destination:'/workspace',permanent:false},
  ]},
  async rewrites(){return [
-    ...Object.entries(managedMedia).filter(([path])=>path.startsWith("apps/waterfall-wiki/public/")).map(([path,asset])=>({source:"/"+path.slice("apps/waterfall-wiki/public/".length),destination:"/api/media/"+asset.id})),
+    ...Object.entries(managedMedia).filter(([path])=>path.startsWith("apps/dashboard/public/")).map(([path,asset])=>({source:"/"+path.slice("apps/dashboard/public/".length),destination:"/api/media/"+asset.id})),
-    {source:'/graphic',destination:'http://prompt-studio:3000/studio/graphic'},
+    {source:"/studio/api/:path*",destination:"/api/studio-ui/:path*"},
-    {source:'/infinite_canvas',destination:'http://prompt-studio:3000/studio/infinite_canvas'},
+    {source:"/studio/brand/:path*",destination:"/brand/:path*"},
-    {source:"/studio/:path*",destination:"http://prompt-studio:3000/studio/:path*"},
+    {source:"/studio/favicon.ico",destination:"/favicon.ico"},
    {source:"/studio/apple-touch-icon.png",destination:"/apple-touch-icon.png"},
    {source:"/index.md",destination:"/api/agent-index"},
    {source:"/skills/index.md",destination:"/api/guidance/skills"},
    {source:"/skills/:path+/index.md",destination:"/api/guidance/skills/:path+"},
@@ -20,8 +23,6 @@ const nextConfig: NextConfig = {
    {source:"/agent/index.md",destination:"/api/agent-index"},
    {source:"/skills/:skill/:doc.md",destination:"/api/skill-docs/:skill/:doc"},
  ]},
  output: "standalone", outputFileTracingRoot: process.cwd(),
  outputFileTracingIncludes: {"/*":["./node_modules/playwright-core/**/*"]},
  poweredByHeader: false,
 };
@@ -0,0 +1,50 @@
 {
  "name": "@prompt/dashboard",
  "version": "0.1.0",
  "private": true,
  "engines": {
    "node": ">=24 <25"
  },
  "scripts": {
    "dev": "pnpm brand:prepare && next dev",
    "build": "pnpm brand:prepare && next build && esbuild src/worker.ts --bundle --platform=node --format=cjs --external:pg-native --external:playwright-core --outfile=dist/worker.cjs && esbuild scripts/bootstrap.ts --bundle --platform=node --format=cjs --external:pg-native --external:playwright-core --outfile=dist/bootstrap.cjs && esbuild scripts/auth-cli.ts --bundle --platform=node --format=cjs --external:pg-native --outfile=dist/auth-cli.cjs",
    "start": "next start",
    "typecheck": "next typegen && tsc --noEmit",
    "storage:prepare": "tsx scripts/bootstrap.ts",
    "worker": "tsx src/worker.ts",
    "brand:prepare": "node ../../packages/brand/scripts/prepare-app.mjs"
  },
  "dependencies": {
    "@aws-sdk/client-s3": "3.1155.0",
    "formidable": "3.5.4",
    "lucide-react": "1.61.0",
    "mdast-util-from-markdown": "2.1.0",
    "next": "16.4.2",
    "nodemailer": "10.2.1",
    "pg": "8.23.1",
    "playwright-core": "1.56.1",
    "qrcode": "1.5.4",
    "react": "19.3.1",
    "react-dom": "19.3.1",
    "react-markdown": "10.1.0",
    "remark-gfm": "4.0.1",
    "sharp": "0.35.5",
    "zod": "4.6.7",
    "@endoleap/brand": "workspace:*"
  },
  "devDependencies": {
    "@tailwindcss/postcss": "4.3.3",
    "@types/formidable": "3.5.1",
    "@types/node": "24.19.2",
    "@types/nodemailer": "7.0.4",
    "@types/pg": "8.23.1",
    "@types/qrcode": "1.5.6",
    "@types/react": "19.3.0",
    "@types/react-dom": "19.3.0",
    "esbuild": "0.28.2",
    "tailwindcss": "4.3.3",
    "tsx": "4.23.15",
    "typescript": "5.9.3"
  },
  "packageManager": "pnpm@11.25.0"
 }
@@ -48,6 +48,7 @@ async function main() {
  const request = (path:string,init:RequestInit={}) => fetch(base+path,{...init,redirect:'manual'});
  const buildId = readFileSync('.next/BUILD_ID','utf8').trim();
  for(const path of ['/','/workspace','/documents','/account'])assert.equal((await request(path)).status,200,'Public shell '+path);
  for(const path of ['/favicon.ico','/brand/logo-light.svg','/brand/logo-dark.svg','/brand/icon-dark.svg','/apple-touch-icon.png']) assert.equal((await request(path)).status,200,'Public brand asset '+path);
  const studio=await request('/studio');assert.equal(studio.status,307);assert.equal(studio.headers.get('location'),'/workspace');
  for(const [from,to] of [['/studio/graphic','/graphic'],['/studio/infinite_canvas','/infinite_canvas']]){const r=await request(from);assert.equal(r.status,308);assert.equal(r.headers.get('location'),to)}
  assert.equal((await request('/account')).status,200,'Public account page');
@@ -0,0 +1,4 @@
 /** The approved mark is copied from @endoleap/brand by brand:prepare. */
 export function Brand({ compact = false, markOnly = false }: { compact?: boolean; markOnly?: boolean }) {
  return <span className="endoleap-brand"><img src="/brand/logo-light.svg" className="endoleap-mark endoleap-mark-light" alt="" width={32} height={32}/><img src="/brand/logo-dark.svg" className="endoleap-mark endoleap-mark-dark" alt="" width={32} height={32}/>{!markOnly && <span className="endoleap-wordmark">啡跃{!compact && <small>Endoleap</small>}</span>}</span>;
 }
@@ -35,7 +35,7 @@ export function ExploreDetail({entry:initial,background}:{entry:ExploreEntry;bac
 async function archive(){
  setArchiveBusy(true);setCopyError('');try{const r=await fetch('/api/posts/'+entry.id+'/archive',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({archived:!entry.archived})});const d=await r.json();if(!r.ok)throw Error(d.error||'操作失败');const state=await fetch('/api/notes/'+entry.id).then(r=>r.json());setEntry(state.entry);void router.replace(router.asPath,undefined,{scroll:false})}catch(e){setCopyError(e instanceof Error?e.message:'操作失败')}finally{setArchiveBusy(false)}
 }
- return <Shell><Head><title>{entry.title} · PROMPT</title><link rel="canonical" href={exploreUrl(entry.id)}/><link rel="alternate" type="text/plain" href={exploreUrl(entry.id)+'?agent_mode=True'}/></Head>
+ return <Shell><Head><title>{entry.title} · 啡跃 Endoleap</title><link rel="canonical" href={exploreUrl(entry.id)}/><link rel="alternate" type="text/plain" href={exploreUrl(entry.id)+'?agent_mode=True'}/></Head>
 <div aria-hidden="true" inert><ExploreFeed key={entry.revision} initial={background.map(e=>e.id===entry.id?entry:e)}/></div>
 <div className="note-overlay" onClick={()=>{if(!editing)close()}}><div className="note-dialog" ref={detailRef} role="dialog" aria-modal="true" aria-labelledby="note-title" onClick={e=>e.stopPropagation()}>
 <button className="note-close" ref={closeRef} aria-label={editing?'取消编辑':'关闭详情'} onClick={close}><X/></button>
@@ -31,12 +31,12 @@ export function Feed({initial,section='',tagPath=''}:{initial:FeedData;section?:
 useEffect(()=>{generation.current++;setPosts(initial.posts);setCursor(initial.nextCursor);setError('');setBusy(false);},[initial,router.query.q]);
 const current=sections.find(s=>s.path===section);const target=initial.tags.find(t=>t.path===tagPath);const children=initial.tags;
 async function load(){const gen=generation.current;setBusy(true);setError('');try{const q=new URLSearchParams({section,path:tagPath,cursor:cursor||'',q:String(router.query.q||'')});const res=await fetch('/api/feed?'+q);const d=await res.json();if(!res.ok)throw new Error(d.error);if(gen===generation.current){setPosts(old=>[...old,...d.posts.filter((p:Post)=>!old.some(a=>a.id===p.id))]);setCursor(d.nextCursor);}}catch{if(gen===generation.current)setError('加载没有完成，点击重试。');}finally{if(gen===generation.current)setBusy(false);}}
- return <Shell><Head><title>{target?.name||current?.name||'灵感首页'} · PROMPT</title><meta name="description" content="自己的图文、视频与声音创作空间"/><link rel="alternate" type="text/markdown" href="/index.md" title="Agent 文档入口"/></Head>
+ return <Shell><Head><title>{target?.name||current?.name||'灵感首页'} · 啡跃 Endoleap</title><meta name="description" content="自己的图文、视频与声音创作空间"/><link rel="alternate" type="text/markdown" href="/index.md" title="Agent 文档入口"/></Head>
  {current&&<header className="page-header feed-heading"><div><h1>{target?.name||current.name}</h1><p>{current.hint}</p></div></header>}
  {tagPath&&<div className="breadcrumbs"><Link href={`/${section}`}>全部{current?.name}</Link>{tagPath.split('/').map((_,i)=>{const path=tagPath.split('/').slice(0,i+1).join('/');return <span key={path}> / <Link href={`/${section}/${path}`}>{initial.tags.find(t=>t.path===path)?.name}</Link></span>;})}</div>}
  <div className="feed-toolbar"><div className="feed-tabs">{!section?<><Link className="selected" href="/">全部</Link>{sections.map(s=><Link key={s.path} href={`/${s.path}`}>{s.name}</Link>)}</>:<><Link className={!tagPath?'selected':''} href={`/${section}`}>全部</Link>{children.map(t=><Link key={t.id} href={`/${section}/${t.path}`}>{t.name}</Link>)}</>}</div><span className="sort-label"><ArrowDown size={13}/>最近收录</span></div>
  {initial.unavailable?<div className="empty-state"><Layers/><h2>素材库暂时没有连接上</h2><p>请稍后刷新，已保存的内容不会因此丢失。</p></div>:(posts.length||(!section&&skillCatalog.some(s=>(s.title+s.description+s.category).toLowerCase().includes(String(router.query.q||'').toLowerCase()))))?<Masonry posts={posts} includeSkills={!section} q={String(router.query.q||'')}/>:<div className="empty-state"><div className="empty-art"><span/><ImageIcon size={42} strokeWidth={1.2}/><i><AudioLines size={18}/></i><b><Film size={19}/></b></div><span className="eyebrow">A LITTLE SPACE FOR SOMETHING GOOD</span><h2>{router.query.q?'还没有找到这份灵感':'这里还没有内容'}</h2><p>{router.query.q?'换一个词试试看。':'导入图片、视频或声音，开始整理你的素材。'}</p><Link className="primary-button" href={`/library/import${current&&['image','video','audio'].includes(current.kind)?'?kind='+current.kind:''}`}><Upload size={16}/>导入素材<ArrowUpRight size={16}/></Link><small>图文和动态作品通过代码加入，自由决定每一个像素。</small></div>}
  {cursor&&<div className="load-more"><button disabled={busy} onClick={load}>{busy?'正在翻找…':error||'再看一些'}<ArrowDown size={14}/></button></div>}
-  <footer className="page-footer">PROMPT <span>·</span> PROBABLY RENDERING ONE MORE PIXEL TONIGHT</footer>
+  <footer className="page-footer">啡跃 <span>·</span> Endoleap</footer>
 </Shell>;
 }
@@ -4,7 +4,7 @@ import {Shell} from './Shell';
 import {SkillCard} from './SkillCard';
 import {skillCatalog} from '@/content/skills/catalog';
 import {guidanceDocuments,humanDocumentUrl} from '@/content/skills/guidance';
-export function GuidanceIndex(){return <Shell><Head><title>指导文档 · PROMPT</title><link rel="canonical" href="/skills"/><link rel="alternate" type="text/markdown" href="/skills/index.md" title="指导文档"/></Head>
+export function GuidanceIndex(){return <Shell><Head><title>指导文档 · 啡跃 Endoleap</title><link rel="canonical" href="/skills"/><link rel="alternate" type="text/markdown" href="/skills/index.md" title="指导文档"/></Head>
 <header className="page-header"><div><h1>指导文档</h1><p>每篇都有独立地址，网页与 Markdown 一一对应。沿着引用，找到需要的方法。</p></div></header>
 <article className="docs-body"><h2>全部文档</h2><p>这些分组只帮助浏览。任何一篇都可以独立进入，也可以引用其他文档。</p><div className="guidance-directory">{guidanceDocuments.map(doc=><div key={doc.path}><Link href={humanDocumentUrl(doc.path)}>{doc.title}</Link><small>{doc.collection}</small><a href={`${humanDocumentUrl(doc.path)}/index.md`}>Markdown ↗</a></div>)}</div></article>
 <h2>按创作主题浏览</h2>
@@ -333,7 +333,7 @@ export default function GuidanceReader({
                <dt>来源</dt>
                <dd>
                  {source === "example"
-                    ? "织页协议样例"
+                    ? "啡跃协议样例"
                    : canEdit
                      ? "你的文档"
                      : "社区作者"}
@@ -1,3 +1,6 @@
 import a from "@/styles/account.module.css";
 import { ThemeToggle } from "./ThemeToggle";
 import { Brand } from "./Brand";
 import Head from "next/head";
 import Link from "next/link";
 import { useRouter } from "next/router";
@@ -46,9 +49,11 @@ export const useGuidanceAccount = () => useContext(AccountContext);
 export default function GuidanceShell({
  children,
  title = "探索文档",
  standalone = false,
 }: {
  children: ReactNode;
  title?: string;
  standalone?: boolean;
 }) {
  const router = useRouter();
  const dialog = useRef<HTMLDialogElement>(null);
@@ -110,12 +115,7 @@ export default function GuidanceShell({
          href="/"
          onClick={() => dialog.current?.close()}
        >
-          <span className={s.brandMark}>
+          <Brand/>
            <Waypoints size={22} strokeWidth={2.2} />
          </span>
          <span>
            织页<small>KNOWLEDGE FOR AGENTS</small>
          </span>
        </Link>
        <div className={s.workspaceLabel}>
          <Globe2 size={16} />
@@ -190,11 +190,23 @@ export default function GuidanceShell({
      </>
    );
  }
  if (standalone) return (
    <AccountContext.Provider value={{ user, loading, error, refresh }}>
      <div className={a.page}>
        <Head><title>{`${title} · 啡跃`}</title></Head>
        <a className={s.skipLink} href="#account-content">跳到正文</a>
        <header className={a.header}>
          <div><Link href="/">返回首页</Link><ThemeToggle /></div>
        </header>
        <main id="account-content">{children}</main>
      </div>
    </AccountContext.Provider>
  );
  return (
    <AccountContext.Provider value={{ user, loading, error, refresh }}>
      <div className={s.site}>
        <Head>
-          <title>{`${title} · 织页`}</title>
+          <title>{`${title} · 啡跃`}</title>
          <meta
            name="description"
            content="为 Agent 编写、发现和连接可独立使用的指导文档。"
@@ -230,7 +242,7 @@ export default function GuidanceShell({
              <ChevronRight size={14} />
              <strong>{title}</strong>
            </div>
-            <div className={s.topbarActions}>
+            <div className={s.topbarActions}><ThemeToggle/>
              <Link className={s.topbarProtocol} href="/protocol">
                <span className={s.statusDot} />
                Linked Guidance 0.1
@@ -253,7 +265,7 @@ export default function GuidanceShell({
            {children}
          </main>
          <footer className={s.workspaceFooter}>
-            <span>织页 · 让知识按需连接</span>
+            <span>啡跃 · 让知识按需连接</span>
            <Link href="/protocol">
              文档协议 <ArrowUpRight size={12} />
            </Link>
@@ -0,0 +1,25 @@
 type Pose = "idea" | "read" | "make" | "collect" | "dream";
 /** Original theme-aware line drawings, independent of the fixed brand mark. */
 export function CreatorSketch({ pose }: { pose: Pose }) {
  return <svg viewBox="0 0 200 220" fill="none" stroke="currentColor" strokeWidth="2.2" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
    <path d="M13 17 185 14l3 176-174 3ZM17 202q42-3 86 0m-85 8 62 1" strokeWidth="1.5" />
    <path d="M42 188q3-46 31-60l42 1q28 16 42 59" fill="var(--selection)" />
    <path d="M78 64q-20-3-15-20 5-15 21-11 11-15 29-6 20 7 11 31l-18-10-15 18Z" fill="currentColor" />
    <path d="M79 63q-11 5-5 17l8 2q1 27 21 29 21-4 21-39l-3-15m-34 52-5 20m24-18 7 18m-17-58-2 13 8 2m-9 13q9 5 17-3m-23-23h1m24-1h1" />
    {pose === "idea" && <><path d="m117 135 17-38 13-48 11 3-7 53-14 49M68 143l-5 27 37 15" fill="var(--background)" /><path d="m141 70-8-31 26-9 11 29Z" fill="var(--selection)" /><path d="m142 42 14-5m-11 14 13-5m-10 13 12-5M151 22V12m16 14 8-7m-41 12-9-4" /></>}
    {pose === "read" && <><path d="m49 132 49 16 46-20-4 58-41 15-46-15Z" fill="var(--background)" /><path d="m98 148 1 53m-35-54 23 8m-22 3 20 7m-19 3 16 6m28-16 20-8m-20 19 18-7m-18 17 15-6" /><path d="m50 162 12-5q8 1 5 8l-14 13m89-17-12-4q-9 0-6 7l15 12" fill="var(--background)" /></>}
    {pose === "make" && <><path d="m99 143 65-7 15 51-68 5Z" fill="var(--background)" /><path d="m101 150-22 3-8 19 32 5m-39-6 16 7 29-2m21-12h13m-28 29H37" /><path d="m151 46 5-14 8 12 15 2-11 9 1 15-13-8-13 5 4-13-10-10Z" fill="var(--selection)" /></>}
    {pose === "collect" && <><path d="m60 156 15-18 53 7-5 40-62-5Z" fill="var(--background)" /><path d="m76 138 8-11 19 3 7 13m-12 9a12 12 0 1 0 1 24 12 12 0 0 0-1-24m-36 10-11-5-8 8 15 15m64-21 15 9-13 11" /><path d="m143 68 25-7 7 31-25 7Zm7 14 6-6 10 9m-8-14h1" stroke="var(--primary)" /></>}
    {pose === "dream" && <><path d="m82 136 16 30 26-6 12-36m-18 38 18 11 11-35-7-20q-4-7-8-3l-2 14-6-7m-46 26-9 25 28 14 37-13" fill="var(--background)" /><path d="m142 32 29-10-13 25-4-12-12-3 12 3 17-13m-36 25q-21 4-15 17t25 2" stroke="var(--primary)" /></>}
  </svg>;
 }
 export function IdeaSketch({ kind }: { kind: "collect" | "connect" | "read" | "make" }) {
  return <svg viewBox="0 0 140 110" fill="none" stroke="currentColor" strokeWidth="2.1" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
    {kind === "collect" && <><path d="m43 25 49-5 7 64-53 6Z" fill="var(--selection)" /><path d="m54 39 25-2m-24 14 30-3m-28 14 21-2m20-23 18-20 7 7-20 21-9 3ZM34 18l-6-8m19 3-1-10m61 62 8 3m-81 2-10 2" /></>}
    {kind === "connect" && <><path d="M42 37q27-31 50-1m-48 8q27-17 47-1M45 62q23 28 46 2" /><path d="m18 32 29-3 3 34-31 2Zm72-8 32 4-3 33-30-3ZM52 73l32-1 2 25-32 2Z" fill="var(--selection)" /><path d="m26 43 14-1m-13 9 10-1m62-13 13 2m-13 7 11 1M62 83h13m-12 7h9" /></>}
    {kind === "read" && <><path d="M20 30q25-8 49 7 24-17 51-10l-3 56q-24-5-48 10-22-13-47-7Z" fill="var(--selection)" /><path d="m69 37 0 56M32 42q13-1 25 5m-23 8 21 5m-21 8 20 4m27-27 24-6m-23 19 21-6m-20 18 18-4m-35-44-2-11m17 10 6-10" /></>}
    {kind === "make" && <><path d="m24 29 85-3 5 63-86 4ZM31 41h71M45 34h1m-10 0h1m20-1h1m-18 21 21-2 1 26-22 1Zm31 0 27-1m-26 12 20-1m-19 13 24-1" /><path d="m103 14 7-11 4 12 13 2-10 8 2 11-10-6-10 7 2-12-10-7Z" fill="var(--selection)" /></>}
  </svg>;
 }
@@ -1,3 +1,5 @@
 import { ThemeToggle } from "./ThemeToggle";
 import { Brand } from "./Brand";
 import Link from "next/link";
 import { useRouter } from "next/router";
 import { Grid2X2,Image,Film,AudioLines,BookOpen,Clapperboard,Sparkles,ArrowUpRight,Layers,Tags,Upload,Menu,X,Search } from "lucide-react";
@@ -7,9 +9,9 @@ export function Shell({children}:{children:ReactNode}){
 const router=useRouter();const [open,setOpen]=useState(false);const [query,setQuery]=useState(String(router.query.q||''));
 useEffect(()=>setQuery(String(router.query.q||'')),[router.query.q]);
 return <div className="app-shell"><button className="mobile-menu icon-button" aria-label={open?"关闭导航":"展开导航"} aria-expanded={open} onClick={()=>setOpen(!open)}>{open?<X size={22}/>:<Menu size={22}/>}</button>
-  <aside className={`sidebar ${open?'is-open':''}`}><Link href="/" className="brand" aria-label="PROMPT 首页" onClick={()=>setOpen(false)}><img className="brand-mark" src="/brand-mark.svg" width={40} height={40} alt=""/><strong>PROMPT</strong></Link>
+  <aside className={`sidebar ${open?'is-open':''}`}><Link href="/" className="brand" aria-label="啡跃 Endoleap 首页" onClick={()=>setOpen(false)}><Brand/></Link>
   <nav>{groups.map((g,i)=><div className="nav-group" key={i}>{g.label&&<p>{g.label}</p>}{g.items.map(item=>{const active=item.href==='/'?router.asPath.split('?')[0]==='/':router.asPath.split('?')[0].startsWith(item.href);return <Link key={item.href} href={item.href} title={item.label} className={`nav-item ${active?'active':''}`} onClick={()=>setOpen(false)}><item.icon size={24} strokeWidth={active?2.2:1.8}/><span>{item.label}</span></Link>;})}</div>)}</nav>
-  <button className="auth-logout" onClick={async()=>{const response=await fetch('/api/auth/logout',{method:'POST'});if(response.ok)window.location.assign('/login');}}>退出登录</button></aside><main className="main-content"><div className="global-topbar"><form className="global-search" role="search" onSubmit={e=>{e.preventDefault();const path=router.asPath.split('?')[0];const destination=path==='/categories'?path:'/';void router.push({pathname:destination,query:{...(destination==='/categories'&&router.query.category?{category:router.query.category}:{}),...(query.trim()?{q:query.trim()}:{})}});}}><Search size={24}/><input aria-label="搜索笔记全文" placeholder="搜索知识、灵感和素材" value={query} onChange={e=>setQuery(e.target.value)}/>{query&&<button type="button" aria-label="清空搜索" onClick={()=>{setQuery('');void router.push({pathname:router.pathname==='/categories'?'/categories':'/',query:router.query.category?{category:router.query.category}:{}})}}><X size={20}/></button>}<button type="submit" className="search-submit">搜索</button></form></div>{children}</main>{open&&<button className="nav-scrim" aria-label="关闭导航" onClick={()=>setOpen(false)}/>}
+  <button className="auth-logout" onClick={async()=>{const response=await fetch('/api/auth/logout',{method:'POST'});if(response.ok)window.location.assign('/login');}}>退出登录</button></aside><main className="main-content"><div className="global-topbar"><ThemeToggle/><form className="global-search" role="search" onSubmit={e=>{e.preventDefault();const path=router.asPath.split('?')[0];const destination=path==='/categories'?path:'/';void router.push({pathname:destination,query:{...(destination==='/categories'&&router.query.category?{category:router.query.category}:{}),...(query.trim()?{q:query.trim()}:{})}});}}><Search size={24}/><input aria-label="搜索笔记全文" placeholder="搜索知识、灵感和素材" value={query} onChange={e=>setQuery(e.target.value)}/>{query&&<button type="button" aria-label="清空搜索" onClick={()=>{setQuery('');void router.push({pathname:router.pathname==='/categories'?'/categories':'/',query:router.query.category?{category:router.query.category}:{}})}}><X size={20}/></button>}<button type="submit" className="search-submit">搜索</button></form></div>{children}</main>{open&&<button className="nav-scrim" aria-label="关闭导航" onClick={()=>setOpen(false)}/>}
 </div>;
 }
@@ -26,7 +26,7 @@ export function SkillDocs({documentPath,documentId='index',skillId='street-peopl
   setCopied(true);
  }catch{setCopied(false)}
 }
- return <Shell><Head><title>{doc.title} · 指导文档 · PROMPT</title><link rel="canonical" href={humanDocumentUrl(path)}/><link rel="alternate" type="text/markdown" href={markdownDocumentUrl(path)} title={doc.title}/></Head>
+ return <Shell><Head><title>{doc.title} · 指导文档 · 啡跃 Endoleap</title><link rel="canonical" href={humanDocumentUrl(path)}/><link rel="alternate" type="text/markdown" href={markdownDocumentUrl(path)} title={doc.title}/></Head>
  <div className="docs-top"><Link href="/skills">← 全部指导文档</Link><button onClick={()=>setOpen(v=>!v)} aria-expanded={open}><PanelRight size={16}/>文档与来源 · {doc.resources.length}</button></div>
  <div className={`docs-layout ${open?'with-sources':''}`}><article className="docs-body">
   <div className="docs-eyebrow">{doc.collection} / 指导文档</div><h1>{doc.title}</h1>
@@ -0,0 +1,7 @@
 import { useEffect, useState } from 'react';
 export function ThemeToggle() {
  const [dark, setDark] = useState(false);
  const [ready, setReady] = useState(false);
  useEffect(() => { const sync = () => setDark(document.documentElement.dataset.mode === 'dark'); sync(); setReady(true); window.addEventListener('endoleap-theme', sync); return () => window.removeEventListener('endoleap-theme', sync); }, []);
  return <button type="button" data-theme-ready={ready} className="endoleap-theme-toggle" aria-label="切换明暗主题" title={dark ? '切换浅色模式' : '切换深色模式'} onClick={() => { const mode = document.documentElement.dataset.mode === 'dark' ? 'light' : 'dark'; const scope = document.documentElement.dataset.theme?.startsWith('canvas-') ? 'canvas' : 'home'; document.documentElement.dataset.mode = mode; document.documentElement.dataset.theme = `${scope}-${mode}`; try { localStorage.setItem('endoleap.theme', mode); } catch {} window.dispatchEvent(new Event('endoleap-theme')); }}><span aria-hidden="true">◐</span></button>;
 }
@@ -0,0 +1,366 @@
 import Head from 'next/head';
 import {useEffect, useRef, useState, type ReactNode} from 'react';
 import {ArrowLeft, ArrowUpRight, BookOpen, Bot, Check, ChevronDown, ChevronRight, Layers, LogOut, User, House, LayoutGrid, Palette, PanelLeft, Plus, Search, Settings, Sparkles, Workflow, X} from 'lucide-react';
 import {Brand} from './Brand';
 import {ThemeToggle} from './ThemeToggle';
 import {parseCanvasDocument, type CanvasNode} from '@/lib/canvas-document';
 import s from '@/styles/workspace.module.css';
 const tools = [
  {label: '无限画布', detail: '收集灵感，连接文字与参考素材', href: '/infinite_canvas', icon: Workflow},
  {label: '图形设计', detail: '编辑文字、图像与版式', href: '/graphic', icon: Palette},
  {label: '知识与教程', detail: '查找指南和创作方法', href: '/documents', icon: BookOpen},
  {label: 'Agent 接入', detail: '了解如何连接创作工具与 API', href: '/studio/api', icon: Bot},
 ];
 const purposes = [
  {label: '工作与团队', detail: '整理项目和工作资料。', icon: LayoutGrid},
  {label: '个人创作', detail: '收集灵感，让想法成形。', icon: House},
  {label: '学习与研究', detail: '梳理资料，记录研究过程。', icon: BookOpen},
 ];
 type Space = {id?: string; name: string; purpose: string; owner?: boolean};
 const spaceKey = (space: Space) => space.id ?? space.name;
 export type Subcanvas = {id: string; name: string; nodes: string[]; editedAt?: string};
 const personal = {name: '个人空间', purpose: ''};
 type WorkspaceShellProps = {
  editor?: (subset: Subcanvas | undefined) => ReactNode;
  liveNodes?: CanvasNode[];
 };
 export function WorkspaceShell({editor, liveNodes}: WorkspaceShellProps) {
  const [email, setEmail] = useState('');
  const [state, setState] = useState('loading');
  const [sidebar, setSidebar] = useState(true);
  const [spaces, setSpaces] = useState<Space[]>([]);
  const [active, setActive] = useState(personal);
  const [query, setQuery] = useState('');
  const [step, setStep] = useState<'choice' | 'join' | 'purpose' | 'name' | 'invite'>('choice');
  const [code, setCode] = useState('');
  const [busy, setBusy] = useState(false);
  const [purpose, setPurpose] = useState('');
  const [name, setName] = useState('');
  const [error, setError] = useState('');
  const [notice, setNotice] = useState('');
  const [savedNodes, setNodes] = useState<CanvasNode[]>([]);
  const nodes = liveNodes ?? savedNodes;
  const [subcanvases, setSubcanvases] = useState<Subcanvas[]>([]);
  const [selectedCanvas, setSelectedCanvas] = useState(editor ? '' : 'history');
  const [draftEditedAt, setDraftEditedAt] = useState<string>();
  const [expanded, setExpanded] = useState(true);
  const [subsetName, setSubsetName] = useState('');
  const [subsetNodes, setSubsetNodes] = useState<string[]>([]);
  const subsetDialog = useRef<HTMLDialogElement>(null);
  const dialog = useRef<HTMLDialogElement>(null);
  const switcher = useRef<HTMLDetailsElement>(null);
  const search = useRef<HTMLInputElement>(null);
  useEffect(() => {
    setSidebar(window.matchMedia('(min-width: 761px)').matches);
    const request = new AbortController();
    fetch('/api/account/session', {signal: request.signal}).then(async response => {
      if (!response.ok) throw Error();
      const data = await response.json();
      if (!data.user) {
        if (editor) setState('ready');
        else window.location.replace('/account?next=/workspace');
        return;
      }
      setEmail(data.user.email);
      let local: Space[] = [];
      let activeKey = '';
      try {
        const saved = JSON.parse(localStorage.getItem('studio.workspace:' + data.user.email) || 'null');
        if (Array.isArray(saved?.spaces)) local = saved.spaces.filter((space: Space) => !space.id);
        activeKey = saved?.active || '';
      } catch {}
      let shared: Space[] = [];
      try {
        const response = await fetch('/api/account/workspaces', {signal: request.signal});
        if (response.ok) shared = (await response.json()).spaces;
      } catch {}
      if (request.signal.aborted) return;
      const available = [...local, ...shared];
      setSpaces(available);
      setActive(available.find(space => spaceKey(space) === activeKey) || personal);
      setState('ready');
    }).catch(() => {
      if (!request.signal.aborted) setState('error');
    });
    return () => request.abort();
  }, []);
  useEffect(() => {
    if (!notice) return;
    const timeout = window.setTimeout(() => setNotice(''), 4500);
    return () => window.clearTimeout(timeout);
  }, [notice]);
  function selectSpace(space: Space, next = spaces) {
    localStorage.setItem('studio.workspace:' + email, JSON.stringify({spaces: next, active: spaceKey(space)}));
    setSpaces(next);
    setActive(space);
    switcher.current?.removeAttribute('open');
  }
  const subsetKey = 'studio.subcanvases:' + email + ':' + spaceKey(active);
  useEffect(() => {
    if (!email) return;
    setSelectedCanvas(editor ? '' : 'history');
    setQuery('');
    try {
      const draft = localStorage.getItem('studio.infinite-canvas.v1');
      setDraftEditedAt(localStorage.getItem('studio.infinite-canvas.v1.editedAt') || undefined);
      setNodes(draft ? parseCanvasDocument(draft).cards : []);
    } catch {
      setNodes([]);
    }
    try {
      const saved = JSON.parse(localStorage.getItem(subsetKey) || '[]');
      const list: Subcanvas[] = Array.isArray(saved) ? saved : [];
      setSubcanvases(list);
      if (editor) {
        const id = new URLSearchParams(window.location.search).get('subset');
        if (list.some(item => item.id === id)) setSelectedCanvas(id!);
      }
    } catch {
      setSubcanvases([]);
    }
  }, [email, subsetKey]);
  function openSubsetDialog(edit?: Subcanvas) {
    setError('');
    setSubsetName(edit?.name ?? '');
    setSubsetNodes(edit?.nodes ?? []);
    subsetDialog.current?.showModal();
  }
  function saveSubset(event: React.FormEvent) {
    event.preventDefault();
    const name = subsetName.trim();
    if (!name || !subsetNodes.length) return setError('请输入名称并选择至少一个节点。');
    const id = selectedCanvas || window.crypto?.randomUUID?.() || String(Date.now());
    const subset = {id, name, nodes: subsetNodes, editedAt: new Date().toISOString()};
    const next = [...subcanvases.filter(item => item.id !== id), subset];
    try {
      localStorage.setItem(subsetKey, JSON.stringify(next));
      setSubcanvases(next);
      setSelectedCanvas(id);
      setExpanded(true);
      subsetDialog.current?.close();
    } catch {
      setError('浏览器无法保存子画布。');
    }
  }
  async function signOut() {
    try {
      const response = await fetch('/api/account/logout', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{}'});
      if (!response.ok) throw Error();
      window.location.assign('/account?next=/workspace');
    } catch {
      setNotice('暂时无法退出登录，请重试。');
    }
  }
  function openDialog() {
    setStep('choice');
    setCode('');
    setPurpose('');
    setName('');
    setError('');
    dialog.current?.showModal();
  }
  async function workspaceRequest(payload: object) {
    const response = await fetch('/api/account/workspaces', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify(payload)});
    const result = await response.json();
    if (!response.ok) throw new Error(result.error || '空间操作失败');
    return result;
  }
  async function submitWorkspace(event: React.FormEvent) {
    event.preventDefault();
    if (busy) return;
    const clean = name.trim();
    if (step === 'name' && !clean) return setError('请填写 Workspace 名称。');
    if (step === 'join' && !code.trim()) return setError('请输入邀请码。');
    setBusy(true);
    setError('');
    try {
      const {space} = await workspaceRequest(step === 'join' ? {action:'join', code:code.trim()} : {action:'create', name:clean, purpose});
      selectSpace(space, [...spaces.filter(item => spaceKey(item) !== spaceKey(space)), space]);
      dialog.current?.close();
      setNotice((step === 'join' ? '已加入' : '已创建') + '「' + space.name + '」');
    } catch (error) {
      setError(error instanceof Error ? error.message : '空间操作失败');
    } finally {
      setBusy(false);
    }
  }
  async function inviteMember() {
    if (busy || !active.id) return;
    switcher.current?.removeAttribute('open');
    setCode('');
    setError('');
    setStep('invite');
    dialog.current?.showModal();
    setBusy(true);
    try {
      const result = await workspaceRequest({action:'invite', workspaceId:active.id});
      setCode(result.code);
    } catch (error) {
      setError(error instanceof Error ? error.message : '无法生成邀请码');
    } finally {
      setBusy(false);
    }
  }
  const subset = subcanvases.find(item => item.id === selectedCanvas);
  const visibleNodes = subset ? nodes.filter(node => subset.nodes.includes(node.id)) : nodes;
  const visibleSubsets = subcanvases.filter(item => item.name.toLowerCase().includes(query.trim().toLowerCase()));
  const canvasName = '无限画布';
  const showHistory = selectedCanvas === 'history';
  const dates = new Intl.DateTimeFormat('zh-CN', {year: 'numeric', month: 'long', day: 'numeric'});
  const times = new Intl.DateTimeFormat('zh-CN', {hour: '2-digit', minute: '2-digit', hour12: false});
  const entries = [
    ...(nodes.length || draftEditedAt ? [{id: '', name: canvasName, editedAt: draftEditedAt, summary: nodes[0]?.text || nodes[0]?.title || '本机草稿'}] : []),
    ...subcanvases.map(item => ({...item, summary: nodes.find(node => item.nodes.includes(node.id))?.text || '子画布'})),
  ].filter(item => item.name.toLowerCase().includes(query.trim().toLowerCase()));
  entries.sort((a, b) => (b.editedAt ?? '').localeCompare(a.editedAt ?? ''));
  const history = new Map<string, typeof entries>();
  for (const entry of entries) {
    const day = entry.editedAt && Number.isFinite(Date.parse(entry.editedAt)) ? dates.format(new Date(entry.editedAt)) : '编辑时间未记录';
    const group = history.get(day) ?? [];
    group.push(entry);
    history.set(day, group);
  }
  return <div className={s.app}>
    {!editor && <Head><title>工作台 · 啡跃</title></Head>}
    <nav className={s.rail} aria-label="全局导航">
      <a className={s.logo} href="/" aria-label="啡跃首页"><Brand markOnly/></a>
      <button type="button" aria-label="切换工作台导航" title="切换工作台导航" aria-current="page" aria-expanded={sidebar} onClick={() => setSidebar(!sidebar)}><LayoutGrid size={18}/></button>
      <a href="/infinite_canvas" aria-label="无限画布" title="无限画布"><Workflow size={18}/></a>
      <button type="button" aria-label="搜索画布" title="搜索画布" disabled={state !== 'ready'} onClick={() => {setSidebar(true); requestAnimationFrame(() => search.current?.focus());}}><Search size={18}/></button>
      <a href="/graphic" aria-label="图形设计" title="图形设计"><Palette size={18}/></a>
      <a href="/studio/api" aria-label="Agent 接入" title="Agent 接入"><Bot size={18}/></a>
      <a className={s.settings} href="/account" aria-label="账户设置" title="账户设置"><Settings size={18}/></a>
    </nav>
    {sidebar && <aside className={s.panel} id="workspace-navigation">
      <div className={s.identity}>
        <details ref={switcher} className={s.switcher}>
          <summary><span className={s.avatar}>{Array.from(active.name)[0]}</span><strong>{active.name}</strong><ChevronDown size={14}/></summary>
          {state === 'ready' && <div className={s.menu}>
            <div className={s.menuIdentity}><span className={s.avatar}>{Array.from(active.name)[0]}</span><div><strong>{active.name}</strong><small>{active.id ? '当前空间 · 共享空间' : '当前空间 · 保存在此浏览器'}</small></div></div>
            {email && <div className={s.menuSection}>
              {active.owner && <button type="button" onClick={() => void inviteMember()}><Plus size={16}/>邀请成员</button>}<small>{email}</small>
              {[personal, ...spaces].map(space => <button type="button" key={spaceKey(space)} aria-pressed={spaceKey(space) === spaceKey(active)} onClick={() => {
                try { selectSpace(space); } catch { setNotice('浏览器无法保存空间切换。'); }
              }}><span className={s.avatar}>{Array.from(space.name)[0]}</span><span>{space.name}</span>{spaceKey(space) === spaceKey(active) && <Check size={16}/>}</button>)}
              <button className={s.menuAdd} type="button" onClick={() => {switcher.current?.removeAttribute('open'); openDialog();}}><Plus size={16}/>添加 Workspace</button>
            </div>}
            <div className={s.menuSection}><a href="/account"><User size={16}/>账户管理</a>{email && <button type="button" onClick={() => void signOut()}><LogOut size={16}/>退出登录</button>}</div>
          </div>}
        </details>
        <a className={s.avatar} href="/account" aria-label="账户设置" title={email || '账户设置'}>{email ? email.charAt(0).toUpperCase() : <Settings size={15}/>}</a>
      </div>
      <div className={s.panelTitle}><strong>画布</strong><button type="button" disabled={!email || !nodes.length} onClick={() => {setSelectedCanvas(''); openSubsetDialog();}} aria-label="新建子画布" title="新建子画布"><Plus size={18}/></button></div>
      <label className={s.search}><Search size={16}/><input ref={search} type="search" value={query} onChange={e => setQuery(e.target.value)} placeholder="搜索画布…" aria-label="搜索画布名称"/></label>
      {state === 'ready' && <nav className={s.links} aria-label="画布树">
        <button className={s.historyLink} type="button" aria-current={showHistory ? 'page' : undefined} onClick={() => editor ? window.location.assign('/workspace') : setSelectedCanvas('history')}>编辑历史</button>
        <p>本机画布</p>
        <div className={s.treeRoot}>
          <button type="button" aria-label="展开或折叠子画布" aria-expanded={expanded || !!query} disabled={!!query} onClick={() => setExpanded(!expanded)}>{expanded || query ? <ChevronDown size={15}/> : <ChevronRight size={15}/>}</button>
          <button type="button" aria-current={!subset && !showHistory ? 'page' : undefined} onClick={() => setSelectedCanvas('')}><Layers size={16}/>{canvasName}</button>
        </div>
        {(expanded || query) && <ul className={s.children}>{visibleSubsets.map(item => <li key={item.id}><button type="button" aria-current={item.id === selectedCanvas ? 'page' : undefined} onClick={() => setSelectedCanvas(item.id)}><LayoutGrid size={15}/>{item.name}</button></li>)}</ul>}
        {query && !visibleSubsets.length && !canvasName.includes(query.trim()) && <p role="status">没有匹配的画布。</p>}
      </nav>}
      <small className={s.local}>空间设置保存在此浏览器</small>
    </aside>}
    <main className={editor ? s.editorMain : s.main}>
      {editor ? <>
        <button className={s.editorToggle} type="button" aria-label="切换画布树" aria-expanded={sidebar} onClick={() => setSidebar(!sidebar)}><PanelLeft size={18}/></button>
        {editor(subset)}
      </> : <>
      <header className={s.top}>
        <div><button type="button" title="切换导航栏" aria-label="切换导航栏" aria-expanded={sidebar} aria-controls={sidebar ? 'workspace-navigation' : undefined} onClick={() => setSidebar(!sidebar)}><PanelLeft size={18}/></button><span>{active.name} / {showHistory ? '编辑历史' : subset?.name ?? canvasName}</span></div>
        <ThemeToggle/>
      </header>
      {state === 'loading' ? <p className={s.status} role="status">正在打开工作台…</p> : state === 'error' ? <p className={s.status} role="alert">暂时无法读取账户。 <a href="/account?next=/workspace">重新登录</a></p> :
        showHistory ? <section className={s.history} aria-labelledby="history-heading">
          <header><div><h1 id="history-heading">编辑历史</h1><p>按最近编辑日期排列</p></div><a className={s.primary} href="/infinite_canvas">打开画布 <ArrowUpRight size={16}/></a></header>
          {Array.from(history, ([day, items]) => <section className={s.historyGroup} key={day}>
            <h2>{day} · {items.length}</h2>
            <ul>{items.map(item => <li key={item.id}><button type="button" onClick={() => setSelectedCanvas(item.id)}>
              {item.id ? <LayoutGrid size={18}/> : <Layers size={18}/>}
              <span className={s.historyItem}><strong>{item.name}</strong><small>{item.summary}</small></span>
              {item.editedAt && Number.isFinite(Date.parse(item.editedAt)) && <time dateTime={item.editedAt}>{times.format(new Date(item.editedAt))}</time>}
              <ChevronRight size={16}/>
            </button></li>)}</ul>
          </section>)}
          {!entries.length && <p className={s.historyEmpty}>{query ? '没有匹配的画布。' : '还没有编辑记录。打开画布开始创作，保存后就会出现在这里。'}</p>}
        </section> : <div className={s.content}>
          <section className={s.intro}>
            <Layers size={20}/>
            <h1>{subset?.name ?? canvasName}</h1>
            <p>{subset ? `子画布 · ${visibleNodes.length} 个节点 · 属于无限画布` : `${active.name} · ${nodes.length} 个节点`}</p>
            {subset ? <><button className={s.primary} type="button" onClick={() => openSubsetDialog(subset)}>编辑子画布</button><a className={s.openSubset} href={'/infinite_canvas?subset=' + encodeURIComponent(subset.id)}>在编辑器打开 <ArrowUpRight size={16}/></a></> : <a className={s.primary} href="/infinite_canvas">打开画布 <ArrowUpRight size={16}/></a>}
          </section>
          <section aria-labelledby="workspace-nodes">
            <h2 id="workspace-nodes">画布内容</h2>
            {visibleNodes.length ? <div className={s.tools}>{visibleNodes.map(node => <article className={s.node} key={node.id}><strong>{node.title || '未命名节点'}</strong>{node.image && <img src={node.image} alt=""/>}{node.text && <p>{node.text}</p>}</article>)}</div> : <p>{subset ? '原画布中已没有这些节点。' : '画布还是空的。添加节点后，就可以在这里创建子画布。'}</p>}
          </section>
          <nav className={s.shortcuts} aria-label="其他创作工具">{tools.slice(1).map(({label, href}) => <a key={href} href={href}>{label} <ArrowUpRight size={14}/></a>)}</nav>
        </div>}
      </>}
    </main>
    <dialog className={s.dialog} ref={subsetDialog} aria-labelledby="subcanvas-title">
      <div className={s.dialogTop}><h2 id="subcanvas-title">{subset ? '编辑子画布' : '新建子画布'}</h2><button type="button" aria-label="关闭" onClick={() => subsetDialog.current?.close()}><X size={20}/></button></div>
      <form onSubmit={saveSubset}>
        <p>从无限画布选择节点。原画布会保留这些节点。</p>
        <label htmlFor="subcanvas-name">子画布名称</label>
        <input id="subcanvas-name" value={subsetName} maxLength={40} onChange={event => setSubsetName(event.target.value)}/>
        <fieldset className={s.members}><legend>包含的节点</legend>{nodes.map(node => <label key={node.id}><input type="checkbox" checked={subsetNodes.includes(node.id)} onChange={event => setSubsetNodes(event.target.checked ? [...subsetNodes, node.id] : subsetNodes.filter(id => id !== node.id))}/>{node.title || '未命名节点'}</label>)}</fieldset>
        {error && <p className={s.error} role="alert">{error}</p>}
        <button className={s.primary} type="submit">保存子画布</button>
      </form>
    </dialog>
    <dialog className={s.dialog} ref={dialog} aria-labelledby="workspace-dialog-title">
      <div className={s.dialogTop}>
        {step !== 'choice' && step !== 'invite' && <button type="button" aria-label="返回上一步" onClick={() => {setError(''); setStep(step === 'name' ? 'purpose' : 'choice');}}><ArrowLeft size={20}/></button>}
        <h2 id="workspace-dialog-title">{{choice:'建立一个创作空间',join:'加入 Workspace',purpose:'这个空间用来做什么？',name:'给你的 Workspace 命名',invite:'邀请成员'}[step]}</h2>
        <button type="button" aria-label="关闭" onClick={() => dialog.current?.close()}><X size={20}/></button>
      </div>
      {step === 'choice' ? <>
        <p>加入已有空间，或创建自己的 Workspace。</p>
        <div className={s.options}>
          <button type="button" onClick={() => setStep('join')}><User size={22}/><span><strong>加入已有空间</strong><small>使用空间所有者提供的邀请码</small></span></button>
          <button type="button" onClick={() => setStep('purpose')}><Plus size={22}/><span><strong>创建 Workspace</strong><small>为新项目建立一个空间</small></span></button>
        </div>
      </> : step === 'join' ? <form onSubmit={submitWorkspace}>
        <label htmlFor="workspace-invite">邀请码</label>
        <input id="workspace-invite" value={code} maxLength={80} onChange={event => setCode(event.target.value)}/>
        {error && <p className={s.error} role="alert">{error}</p>}
        <button className={s.primary} type="submit" disabled={busy}>加入 Workspace</button>
      </form> : step === 'invite' ? <>
        <p>邀请码有效期为 24 小时。把它交给要加入的成员。</p>
        {busy && <p role="status">正在生成邀请码…</p>}
        {error && <p className={s.error} role="alert">{error}</p>}
        {code && <input aria-label="邀请码" readOnly value={code} onFocus={event => event.target.select()}/>}
      </> : step === 'purpose' ? <>
        <p>选择一个起点。</p>
        <div className={s.options}>{purposes.map(({label, detail, icon: Icon}) => <button key={label} type="button" aria-pressed={purpose === label} onClick={() => setPurpose(label)}><Icon size={23}/><span><strong>{label}</strong><small>{detail}</small></span></button>)}</div>
        <button className={s.primary} type="button" disabled={!purpose} onClick={() => setStep('name')}>继续 <ArrowUpRight size={16}/></button>
      </> : <form onSubmit={submitWorkspace}>
        <p>{purpose} · 一个空间，装下你的想法与作品。</p>
        <div className={s.iconPreview}><span className={s.avatar}>{Array.from(name.trim())[0] || '空'}</span>空间图标</div>
        <label htmlFor="workspace-name">Workspace 名称</label>
        <input id="workspace-name" autoFocus value={name} maxLength={40} onChange={e => {setName(e.target.value); setError('');}} aria-invalid={!!error} aria-describedby={error ? 'workspace-error' : undefined} placeholder="输入空间名称"/>
        {error && <p id="workspace-error" role="alert" className={s.error}>{error}</p>}
        <button className={s.primary} type="submit" disabled={busy}>创建 Workspace <ArrowUpRight size={16}/></button>
      </form>}
    </dialog>
    {notice && <div role="status" className={s.notice}>{notice}</div>}
  </div>;
 }
@@ -1,5 +1,5 @@
 {
-  "apps/waterfall-wiki/public/learning-skills/cover.png": {
+  "apps/dashboard/public/learning-skills/cover.png": {
    "id": "a9cafd80-8207-567b-aaa4-ebd250edaab5",
    "key": "repository-media/sha256/8049b5704e44b2ebf3b97cef2495a85628af9a16d933ede2f7e790bc69b5fab1.png",
    "sha256": "8049b5704e44b2ebf3b97cef2495a85628af9a16d933ede2f7e790bc69b5fab1",
@@ -8,7 +8,7 @@
    "width": 1080,
    "height": 1440
  },
-  "apps/waterfall-wiki/public/skills/shadow-puppet/dancer-example.png": {
+  "apps/dashboard/public/skills/shadow-puppet/dancer-example.png": {
    "id": "6514a180-bb28-558d-ac9e-0dd49279a058",
    "key": "repository-media/sha256/94803894dcb06dae84d3744f963f55e077326d34f103a4fce05e32c2f4ab6895.png",
    "sha256": "94803894dcb06dae84d3744f963f55e077326d34f103a4fce05e32c2f4ab6895",
@@ -17,7 +17,7 @@
    "width": 680,
    "height": 900
  },
-  "apps/waterfall-wiki/public/skills/shadow-puppet/egret-example.png": {
+  "apps/dashboard/public/skills/shadow-puppet/egret-example.png": {
    "id": "63aefa65-5431-5a2e-a20c-4293a010410e",
    "key": "repository-media/sha256/2dd294282bf6c0dda86902cb2be265ba5b89c160a4d5e01ec50f79dac7ac6b82.png",
    "sha256": "2dd294282bf6c0dda86902cb2be265ba5b89c160a4d5e01ec50f79dac7ac6b82",
@@ -26,7 +26,7 @@
    "width": 1043,
    "height": 1380
  },
-  "apps/waterfall-wiki/public/skills/street-people/reference.png": {
+  "apps/dashboard/public/skills/street-people/reference.png": {
    "id": "26cdf219-7264-5b51-b1bd-b13eaedcb946",
    "key": "repository-media/sha256/e488a52338ac3496e6e51ea4843d99b8ca9cfe3bec4fc8d1ade3985bbb4f4c86.png",
    "sha256": "e488a52338ac3496e6e51ea4843d99b8ca9cfe3bec4fc8d1ade3985bbb4f4c86",
@@ -35,7 +35,7 @@
    "width": 1200,
    "height": 2133
  },
-  "apps/waterfall-wiki/public/skills/street-people/sample.png": {
+  "apps/dashboard/public/skills/street-people/sample.png": {
    "id": "c1d98b87-a103-5cf6-829a-3f46321db72f",
    "key": "repository-media/sha256/2db53d7593010e6c48dab8f212bc3004b02fc278944ea1686f74d6178a700b88.png",
    "sha256": "2db53d7593010e6c48dab8f212bc3004b02fc278944ea1686f74d6178a700b88",
@@ -44,7 +44,7 @@
    "width": 1024,
    "height": 1536
  },
-  "apps/waterfall-wiki/seed/characters/original/01-florist.png": {
+  "apps/dashboard/seed/characters/original/01-florist.png": {
    "id": "c1d98b87-a103-5cf6-829a-3f46321db72f",
    "key": "repository-media/sha256/2db53d7593010e6c48dab8f212bc3004b02fc278944ea1686f74d6178a700b88.png",
    "sha256": "2db53d7593010e6c48dab8f212bc3004b02fc278944ea1686f74d6178a700b88",
@@ -53,7 +53,7 @@
    "width": 1024,
    "height": 1536
  },
-  "apps/waterfall-wiki/seed/characters/original/02-reader.png": {
+  "apps/dashboard/seed/characters/original/02-reader.png": {
    "id": "85c30364-9644-5d4a-9e83-96e982860bbe",
    "key": "repository-media/sha256/669c85e689e7e88f8eff9f4bdaf9b4b7816df88c1956e817d82f8fd39bcdf278.png",
    "sha256": "669c85e689e7e88f8eff9f4bdaf9b4b7816df88c1956e817d82f8fd39bcdf278",
@@ -62,7 +62,7 @@
    "width": 1024,
    "height": 1536
  },
-  "apps/waterfall-wiki/seed/characters/original/03-cyclist.png": {
+  "apps/dashboard/seed/characters/original/03-cyclist.png": {
    "id": "0200f54c-a0a9-50bd-bf04-6512059da0c5",
    "key": "repository-media/sha256/6dedf97b96fafe9f70a16822b0fe9156a073d9149bad5eeab1450323b67ce575.png",
    "sha256": "6dedf97b96fafe9f70a16822b0fe9156a073d9149bad5eeab1450323b67ce575",
@@ -71,7 +71,7 @@
    "width": 1347,
    "height": 1167
  },
-  "apps/waterfall-wiki/seed/characters/original/04-coffee.png": {
+  "apps/dashboard/seed/characters/original/04-coffee.png": {
    "id": "ebd511bf-559e-588d-886a-095b785216bd",
    "key": "repository-media/sha256/ab337b3a2e5c05406c03aa4a69018191624f18de70081accf740e79993a1835e.png",
    "sha256": "ab337b3a2e5c05406c03aa4a69018191624f18de70081accf740e79993a1835e",
@@ -80,7 +80,7 @@
    "width": 1024,
    "height": 1536
  },
-  "apps/waterfall-wiki/seed/characters/reference/01-basket.png": {
+  "apps/dashboard/seed/characters/reference/01-basket.png": {
    "id": "48ff5ce0-2763-5fa5-86cb-86c654bf4e24",
    "key": "repository-media/sha256/62e6785bb373676cb5f24d44b9fa71a8ec8f413a4d518419aa29006ae62b7af8.png",
    "sha256": "62e6785bb373676cb5f24d44b9fa71a8ec8f413a4d518419aa29006ae62b7af8",
@@ -89,7 +89,7 @@
    "width": 1106,
    "height": 1422
  },
-  "apps/waterfall-wiki/seed/characters/reference/02-phone.png": {
+  "apps/dashboard/seed/characters/reference/02-phone.png": {
    "id": "d21179b3-29aa-57c4-bc50-79f2459b5ee8",
    "key": "repository-media/sha256/f27657c347e73786cc84df290f689f11284bb57822415a651c4c7567c15d034e.png",
    "sha256": "f27657c347e73786cc84df290f689f11284bb57822415a651c4c7567c15d034e",
@@ -98,7 +98,7 @@
    "width": 1161,
    "height": 1354
  },
-  "apps/waterfall-wiki/seed/characters/reference/03-coffee.png": {
+  "apps/dashboard/seed/characters/reference/03-coffee.png": {
    "id": "10e3d787-2575-52f5-8403-cb62072cd1f0",
    "key": "repository-media/sha256/cd53d3d1771c014cb4c5c1b7ed4d1846f72ec996d48a889514268461ed9c5f7c.png",
    "sha256": "cd53d3d1771c014cb4c5c1b7ed4d1846f72ec996d48a889514268461ed9c5f7c",
@@ -107,7 +107,7 @@
    "width": 1191,
    "height": 1320
  },
-  "apps/waterfall-wiki/seed/characters/reference/04-red-coat.png": {
+  "apps/dashboard/seed/characters/reference/04-red-coat.png": {
    "id": "3fe8aac2-160f-5069-9b67-6615732fe54f",
    "key": "repository-media/sha256/39249450ccd7f0a207f191742e2c27117f8404d35dfbe092ccdaa54ae59e218d.png",
    "sha256": "39249450ccd7f0a207f191742e2c27117f8404d35dfbe092ccdaa54ae59e218d",
@@ -116,7 +116,7 @@
    "width": 1024,
    "height": 1536
  },
-  "apps/waterfall-wiki/seed/characters/reference/05-blue-dogs.png": {
+  "apps/dashboard/seed/characters/reference/05-blue-dogs.png": {
    "id": "8db94ff7-cee3-526d-a594-282a757317cf",
    "key": "repository-media/sha256/d6c7ce1c8e3375f8aaa40012a91d11925113a7776b0fe383c74c734d91edfc37.png",
    "sha256": "d6c7ce1c8e3375f8aaa40012a91d11925113a7776b0fe383c74c734d91edfc37",
@@ -125,7 +125,7 @@
    "width": 1536,
    "height": 1024
  },
-  "apps/waterfall-wiki/seed/characters/reference/06-dark-dog.png": {
+  "apps/dashboard/seed/characters/reference/06-dark-dog.png": {
    "id": "a3a00127-0f67-5c8f-9ae9-259e9c390be0",
    "key": "repository-media/sha256/9e19ac9d04c30e5d0a552c7d59a8365ffca8be5df1b7f9ec12fb35bef7aa444b.png",
    "sha256": "9e19ac9d04c30e5d0a552c7d59a8365ffca8be5df1b7f9ec12fb35bef7aa444b",
@@ -134,7 +134,7 @@
    "width": 1372,
    "height": 1146
  },
-  "apps/waterfall-wiki/seed/characters/reference/07-pockets.png": {
+  "apps/dashboard/seed/characters/reference/07-pockets.png": {
    "id": "468c8637-c841-5819-8afb-24d246b77821",
    "key": "repository-media/sha256/158c1f3a492a7a3223bf4ed56d3750d192c696a054dc66d2c3ae65ce9e0a8dad.png",
    "sha256": "158c1f3a492a7a3223bf4ed56d3750d192c696a054dc66d2c3ae65ce9e0a8dad",
@@ -143,7 +143,7 @@
    "width": 1024,
    "height": 1536
  },
-  "apps/waterfall-wiki/seed/characters/reference/08-blue-board.png": {
+  "apps/dashboard/seed/characters/reference/08-blue-board.png": {
    "id": "1731746a-2a59-5b8b-b91c-8f862567f7ef",
    "key": "repository-media/sha256/fa8f0dd989cb8133ad5565c19dc9f798a9c2bd216e3c90342d1a4e45329e8cd9.png",
    "sha256": "fa8f0dd989cb8133ad5565c19dc9f798a9c2bd216e3c90342d1a4e45329e8cd9",
@@ -152,7 +152,7 @@
    "width": 1130,
    "height": 1392
  },
-  "apps/waterfall-wiki/seed/characters/reference/09-scarf-dog.png": {
+  "apps/dashboard/seed/characters/reference/09-scarf-dog.png": {
    "id": "7e99a693-1c95-5544-af4c-ae2ce12824c8",
    "key": "repository-media/sha256/8ee2ea052e4985a28eef1ba415190bdbea70e4ca52eb3bdcd5206210a4285bc7.png",
    "sha256": "8ee2ea052e4985a28eef1ba415190bdbea70e4ca52eb3bdcd5206210a4285bc7",
@@ -161,7 +161,7 @@
    "width": 1220,
    "height": 1289
  },
-  "apps/waterfall-wiki/seed/characters/reference/10-elder.png": {
+  "apps/dashboard/seed/characters/reference/10-elder.png": {
    "id": "be125dda-5a86-5a7b-9498-a8dba66df31e",
    "key": "repository-media/sha256/45bfe1e35f88e52adfc7f97b0834a5dbeea7dbcf283ebdabb9adf4236eb93eab.png",
    "sha256": "45bfe1e35f88e52adfc7f97b0834a5dbeea7dbcf283ebdabb9adf4236eb93eab",
@@ -170,7 +170,7 @@
    "width": 1195,
    "height": 1316
  },
-  "apps/waterfall-wiki/seed/characters/reference/11-long-coat.png": {
+  "apps/dashboard/seed/characters/reference/11-long-coat.png": {
    "id": "5bb056a0-735e-5f24-bfd1-1036ebb208e8",
    "key": "repository-media/sha256/76f00ba08e5b8e7caf4fe2801368cfc5f7cf3c445ae2a80b496a4f431272d053.png",
    "sha256": "76f00ba08e5b8e7caf4fe2801368cfc5f7cf3c445ae2a80b496a4f431272d053",
@@ -179,7 +179,7 @@
    "width": 1148,
    "height": 1371
  },
-  "apps/waterfall-wiki/seed/characters/reference/12-trolley.png": {
+  "apps/dashboard/seed/characters/reference/12-trolley.png": {
    "id": "11da89bb-daa9-59b3-b22f-997f1fba46fe",
    "key": "repository-media/sha256/8235f95071abb54f0618b61d66c20e63633e6d929a8ec4d43d4cef121226e078.png",
    "sha256": "8235f95071abb54f0618b61d66c20e63633e6d929a8ec4d43d4cef121226e078",
@@ -188,7 +188,7 @@
    "width": 1241,
    "height": 1267
  },
-  "apps/waterfall-wiki/seed/characters/reference/13-bucket.png": {
+  "apps/dashboard/seed/characters/reference/13-bucket.png": {
    "id": "3f203043-3d69-52c4-91fa-c898daf61eb6",
    "key": "repository-media/sha256/2a4b34afdb45d439f2588095abc89378f7772fd842bdc38518e4a03756b15b82.png",
    "sha256": "2a4b34afdb45d439f2588095abc89378f7772fd842bdc38518e4a03756b15b82",
@@ -197,7 +197,7 @@
    "width": 1140,
    "height": 1380
  },
-  "apps/waterfall-wiki/seed/characters/reference/14-curly.png": {
+  "apps/dashboard/seed/characters/reference/14-curly.png": {
    "id": "5cfb45ab-542f-5bd8-89f5-549072e4caf3",
    "key": "repository-media/sha256/f10faf8145e56830c9a179b6a52cfdd688de3f460fa33ded82fa2b3fe0678b3e.png",
    "sha256": "f10faf8145e56830c9a179b6a52cfdd688de3f460fa33ded82fa2b3fe0678b3e",
@@ -206,7 +206,7 @@
    "width": 1141,
    "height": 1379
  },
-  "apps/waterfall-wiki/seed/characters/reference/15-red-walk.png": {
+  "apps/dashboard/seed/characters/reference/15-red-walk.png": {
    "id": "41e92c94-adca-54b4-9fe9-db192a266937",
    "key": "repository-media/sha256/238eae73ac2faf53e6ac02591b00759115378233fbcbfdcf8e67ce93a804d26e.png",
    "sha256": "238eae73ac2faf53e6ac02591b00759115378233fbcbfdcf8e67ce93a804d26e",
@@ -1,7 +1,8 @@
 import { randomBytes, scrypt as derive, timingSafeEqual, createHash } from 'node:crypto';
 import { promisify } from 'node:util';
 const scrypt = promisify(derive);
-export const ACCOUNT_COOKIE = 'wiki_account';
+export const ACCOUNT_COOKIE = process.env.ACCOUNT_COOKIE_NAME || 'wiki_account';
 if (!/^[A-Za-z0-9_-]{1,64}$/.test(ACCOUNT_COOKIE)) throw Error('Invalid ACCOUNT_COOKIE_NAME');
 export const SESSION_TTL = 7 * 86400;
 export function normalizeEmail(value: unknown) {
 if (typeof value !== 'string') return null;
@@ -1,6 +1,6 @@
 import { NextResponse } from 'next/server';
 import { normalizeEmail,validPassword, trustedOrigin,accountCookie } from './account-crypto';
-import { rateLimit,registerAccount,resendVerification,verifyAccount,loginAccount,currentAccount,logoutAccount } from './account';
+import { requestPasswordReset,resetPassword,rateLimit,registerAccount,resendVerification,verifyAccount,loginAccount,currentAccount,logoutAccount } from './account';
 export const runtime = 'nodejs';
 const headers = {'Cache-Control':'private, no-store','Referrer-Policy':'no-referrer'};
 const json = (body: object,status=200) => NextResponse.json(body,{status,headers});
@@ -12,7 +12,7 @@ export async function GET(request: Request,context: Context) {
 export async function POST(request: Request,context: Context) {
 if (!trustedOrigin(request)) return json({error:'请求来源不受信任'},403);
 const {action} = await context.params;
- if (!['register','resend','verify','login','logout'].includes(action)) return json({error:'不存在'},404);
+ if (!['register','resend','verify','login','logout','forgot','reset'].includes(action)) return json({error:'不存在'},404);
 try {
  // Revocation remains available even when login or mail limits are exhausted.
  if (action === 'logout') { await logoutAccount(request); const r=json({ok:true});r.headers.set('Set-Cookie',accountCookie('',true));return r; }
@@ -27,6 +27,19 @@ export async function POST(request: Request,context: Context) {
   if(typeof body.token!=='string'||! /^[a-f0-9]{64}$/.test(body.token))return json({error:'验证链接无效或已过期'},400);
   return await verifyAccount(body.token) ? json({ok:true,message:'邮箱已验证，请登录'}) : json({error:'验证链接无效或已过期'},400);
  }
  if(action==='reset') {
   if(typeof body.token!=='string'||!/^[a-f0-9]{64}$/.test(body.token)||!validPassword(body.password))return json({error:'重设链接无效，或密码不符合要求'},400);
   if(!await rateLimit('reset:'+body.token,5))return json({error:'请求过于频繁，请稍后再试'},429);
   if(!await resetPassword(body.token,body.password))return json({error:'重设链接无效或已过期，请重新申请'},400);
   const r=json({ok:true,message:'密码已更新，请使用新密码登录'});r.headers.set('Set-Cookie',accountCookie('',true));return r;
  }
  if(action==='forgot') {
   const email=normalizeEmail(body.email);
   if(!email)return json({error:'请输入有效邮箱'},400);
   if(!await rateLimit('forgot:'+email,3))return json({error:'请求过于频繁，请 15 分钟后再试'},429);
   await requestPasswordReset(email);
   return json({ok:true,message:'若该邮箱对应已验证账户，重设链接将发送至邮箱，有效期 30 分钟。'});
  }
  const email=normalizeEmail(body.email);
  if(!email||!validPassword(body.password))return json({error:'请输入有效邮箱及 12–256 字节密码'},400);
  if(!await rateLimit(action+':'+email,action==='login'?10:3))return json({error:'请求过于频繁，请 15 分钟后再试'},429);
@@ -1,20 +1,44 @@
 import { randomUUID } from 'node:crypto';
 import nodemailer from 'nodemailer';
 import { db, transaction } from './db';
-import { ACCOUNT_COOKIE, SESSION_TTL, newToken, tokenDigest, hashPassword, checkPassword } from './account-crypto';
+import { ACCOUNT_COOKIE, SESSION_TTL, newToken, tokenDigest, hashPassword, checkPassword, validPassword } from './account-crypto';
 export async function rateLimit(key: string, limit: number) {
 const result = await db().query(`INSERT INTO account_limits(key,attempts,window_start) VALUES ($1,1,now())
 ON CONFLICT(key) DO UPDATE SET attempts=CASE WHEN account_limits.window_start < now()-interval '15 minutes' THEN 1 ELSE account_limits.attempts+1 END,
 window_start=CASE WHEN account_limits.window_start < now()-interval '15 minutes' THEN now() ELSE account_limits.window_start END RETURNING attempts`,[tokenDigest(key)]);
 return result.rows[0].attempts <= limit;
 }
-export async function sendVerification(email: string, token: string) {
+async function sendAccountMail(email: string, token: string, kind: 'verify' | 'reset') {
 const origin = process.env.ACCOUNT_PUBLIC_ORIGIN;
 if (!origin || !process.env.SMTP_PASSWORD || !process.env.SMTP_USERNAME) throw Error('SMTP unavailable');
- const url = new URL('/account',origin); url.searchParams.set('verify',token);
+ const url = new URL('/account',origin); url.searchParams.set(kind,token);
 const smtp = nodemailer.createTransport({host:process.env.SMTP_HOST || 'smtpdm.aliyun.com',port:Number(process.env.SMTP_PORT || 465),secure:true,
 auth:{user:process.env.SMTP_USERNAME,pass:process.env.SMTP_PASSWORD},connectionTimeout:10000,socketTimeout:15000});
- await smtp.sendMail({from:process.env.SMTP_FROM || process.env.SMTP_USERNAME,to:email,subject:'验证你的知识站邮箱',text:`请在 30 分钟内打开链接并点击确认验证邮箱：\n${url.href}\n如果你没有注册，请忽略。`});
+ await smtp.sendMail({from:process.env.SMTP_FROM || process.env.SMTP_USERNAME,to:email,subject:kind==='reset'?'重设你的啡跃账户密码':'验证你的知识站邮箱',text:kind==='reset'?`请在 30 分钟内打开链接，由你设置新的密码：\n${url.href}\n如果你没有请求重设密码，请忽略；你的密码不会改变。`:`请在 30 分钟内打开链接并点击确认验证邮箱：\n${url.href}\n如果你没有注册，请忽略。`});
 }
 export async function sendVerification(email: string,token: string) { await sendAccountMail(email,token,'verify'); }
 export async function requestPasswordReset(email: string) {
 const result=await db().query('SELECT id FROM account_users WHERE email=$1 AND verified_at IS NOT NULL',[email]);
 if(!result.rowCount)return;
 const token=newToken(),digest=tokenDigest(token);
 await db().query("INSERT INTO account_tokens(digest,user_id,kind,expires_at) VALUES ($1,$2,'reset',now()+interval '30 minutes')",[digest,result.rows[0].id]);
 try { await sendAccountMail(email,token,'reset'); } catch { await db().query('DELETE FROM account_tokens WHERE digest=$1',[digest]);throw Error('SMTP unavailable'); }
 }
 export async function resetPassword(token: string,password: string) {
 if(!/^[a-f0-9]{64}$/.test(token)||!validPassword(password))return false;
 const hash=await hashPassword(password),digest=tokenDigest(token);
 return transaction(async client=>{
  const lookup=await client.query("SELECT user_id FROM account_tokens WHERE digest=$1 AND kind='reset' AND expires_at>now()",[digest]);
  if(!lookup.rowCount)return false;
  const id=lookup.rows[0].user_id;
  // Serialize all reset links for one account, then recheck after acquiring the lock.
  await client.query('SELECT id FROM account_users WHERE id=$1 FOR UPDATE',[id]);
  const consumed=await client.query("DELETE FROM account_tokens WHERE digest=$1 AND kind='reset' AND expires_at>now() RETURNING user_id",[digest]);
  if(!consumed.rowCount)return false;
  await client.query('UPDATE account_users SET password_hash=$1 WHERE id=$2',[hash,id]);
  await client.query('DELETE FROM account_tokens WHERE user_id=$1',[id]);
  return true;
 });
 }
 export async function registerAccount(email: string,password: string) {
 const hash = await hashPassword(password);
@@ -42,14 +66,16 @@ export async function verifyAccount(token: string) {
 });
 }
 export async function loginAccount(email: string,password: string) {
- const result = await db().query('SELECT * FROM account_users WHERE email=$1',[email]);
+ return transaction(async client=>{
 const result = await client.query('SELECT * FROM account_users WHERE email=$1 FOR UPDATE',[email]);
 const user = result.rows[0];
 // A fixed dummy hash makes unknown accounts perform the same expensive KDF.
 const hash = user?.password_hash || 'scrypt:00000000000000000000000000000000:'+'0'.repeat(128);
 if (!await checkPassword(password,hash) || !user?.verified_at) return null;
 const token = newToken();
- await db().query("INSERT INTO account_tokens(digest,user_id,kind,expires_at) VALUES ($1,$2,'session',now()+$3*interval '1 second')",[tokenDigest(token),user.id,SESSION_TTL]);
+ await client.query("INSERT INTO account_tokens(digest,user_id,kind,expires_at) VALUES ($1,$2,'session',now()+$3*interval '1 second')",[tokenDigest(token),user.id,SESSION_TTL]);
 return token;
 });
 }
 export function requestToken(request: Request) {
 const value = request.headers.get('cookie')?.split(';').map(s=>s.trim()).find(s=>s.startsWith(ACCOUNT_COOKIE+'='))?.slice(ACCOUNT_COOKIE.length+1);
@@ -1,7 +1,8 @@
 import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 import { readFileSync } from 'node:fs';
-export const SESSION_COOKIE = 'prompt_session';
+export const SESSION_COOKIE = process.env.AUTH_COOKIE_NAME || 'prompt_session';
 if (!/^[A-Za-z0-9_-]{1,64}$/.test(SESSION_COOKIE)) throw Error('Invalid AUTH_COOKIE_NAME');
 export const SESSION_SECONDS = 7 * 24 * 60 * 60;
 export type AuthConfig = { secret: string; jwtKey: string };
 export function authConfig(): AuthConfig | null {
@@ -59,8 +59,14 @@ export function removeCanvasNode(doc:CanvasDocument,id:string):CanvasDocument {
 }
 export function deriveNode(doc:CanvasDocument,source:string,node:CanvasNode):CanvasDocument {
 if(doc.cards.length>=80||doc.cards.some(n=>n.id===node.id))throw Error('节点数量或标识不正确');
- const result=connectNodes({...doc,cards:[...doc.cards,node]},source,node.id);
+ const target=parseCanvasDocument({version:1,cards:[node],links:[]}).cards[0];
- return parseCanvasDocument(result);
+ for(let attempt=0;attempt<=doc.cards.length+1;attempt++){
  const blockers=doc.cards.filter(n=>target.x<n.x+(n.width||320)+64&&target.x+(target.width||320)+64>n.x&&target.y<n.y+(n.height||350)+64&&target.y+(target.height||350)+64>n.y);
  if(!blockers.length)return parseCanvasDocument(connectNodes({...doc,cards:[...doc.cards,target]},source,target.id));
  const nextY=Math.max(...blockers.map(n=>n.y+(n.height||350)+64));
  target.y=nextY>100000?-100000:nextY;
 }
 throw Error('请移动现有节点后再创建引用节点');
 }
 export function agentTask(doc:CanvasDocument,id:string){
 const node=doc.cards.find(n=>n.id===id);if(!node)throw Error('目标节点不存在');
--- a/Show More
+++ b/Show More