Merge pull request '将统一应用 waterfall-wiki 重命名为 dashboard' (#51) from codex/rename-dashboard into main

Reviewed-on: #51

.dockerignore

@@ -1,24 +0,0 @@
-.git
-**/.next
-**/node_modules
-**/dist
-coverage
-.env
-.env.*
-!.env.example
-*.tsbuildinfo
-.DS_Store
-.agents
-.codex
-
-# Documentation and CI metadata are not application build inputs.
-/docs
-/.gitea
-/README.md
-/AGENTS.md
-
-**/__pycache__
-**/.venv
-
-# Local authoring assets are uploaded via APIs, never application build inputs.
-/content

.gitea/workflows/python.yml

@@ -1,23 +0,0 @@
-name: python CI and deployment
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'apps/python/**'
-      - 'scripts/deploy-python.sh'
-      - '.gitea/workflows/python.yml'
-
-jobs:
-  verify-and-deploy:
-    if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
-    runs-on: ces-control
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Build and verify python
-        run: docker build -f apps/python/Dockerfile -t "prompt-python:${{ gitea.sha }}" .
-      - name: Release python
-        if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
-        run: bash scripts/deploy-python.sh "${{ gitea.sha }}"

.gitea/workflows/studio.yml

@@ -1,51 +0,0 @@
-name: studio CI and deployment
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'apps/studio/**'
-      - 'scripts/deploy-studio.sh'
-      - 'scripts/verify-studio-production.sh'
-      - 'scripts/verify-studio-library.mjs'
-      - 'scripts/verify-studio-visual.cjs'
-      - '.gitea/workflows/studio.yml'
-      - 'scripts/*studio*'
-      - 'content/studio-examples/**'
-      - 'content/studio-tools/layouts-api.md'
-      - 'pnpm-workspace.yaml'
-
-jobs:
-  verify-and-deploy:
-    if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
-    runs-on: ces-control
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Check shared content and documentation contracts
-        run: |
-          node scripts/check-studio-contracts.mjs
-          node --check scripts/export-studio-series.cjs
-          node --check scripts/save-studio-series.mjs
-          bash -n scripts/publish-studio-guide.sh scripts/deliver-studio-series.sh
-      - name: Build and verify studio
-        run: docker build -f apps/studio/Dockerfile -t "prompt-studio:${{ gitea.sha }}" .
-      - name: Release studio
-        if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
-        run: bash scripts/deploy-studio.sh "${{ gitea.sha }}"
-      - name: Verify the deployed Studio API and native pages
-        if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
-        run: bash scripts/verify-studio-production.sh
-      - name: Save server acceptance evidence
-        id: acceptance_evidence
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: studio-production-acceptance
-          path: artifacts/studio-acceptance/
-          if-no-files-found: ignore
-          retention-days: 7
-      - name: Remove temporary acceptance output after upload
-        if: always() && steps.acceptance_evidence.outcome == 'success'
-        run: rm -rf artifacts/studio-acceptance

.gitea/workflows/waterfall-wiki.yml

@@ -1,34 +0,0 @@
-name: waterfall-wiki CI and deployment
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'apps/waterfall-wiki/**'
-      - '.gitea/workflows/waterfall-wiki.yml'
-      - 'Dockerfile'
-      - 'compose.yml'
-      - 'scripts/deploy.sh'
-      - 'scripts/wiki-image-lifecycle.py'
-      - 'scripts/infra.sh'
-      - 'scripts/auth-admin.sh'
-      - 'scripts/integration.sh'
-      - 'pnpm-workspace.yaml'
-
-jobs:
-  verify-and-deploy:
-    if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
-    runs-on: ces-control
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Build, verify, deploy and retain wiki images
-        env:
-          RELEASE_SHA: ${{ gitea.sha }}
-        run: |
-          if [ "$(id -u)" -eq 0 ]; then
-            python3 scripts/wiki-image-lifecycle.py ci --sha "$RELEASE_SHA"
-          else
-            sudo -n python3 scripts/wiki-image-lifecycle.py ci --sha "$RELEASE_SHA"
-          fi

.gitea/workflows/wiki-image-retention-checks.yml

@@ -1,19 +0,0 @@
-name: Wiki image retention checks
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'scripts/wiki-image-lifecycle.py'
-      - 'tests/test_wiki_image_lifecycle.py'
-      - '.gitea/workflows/wiki-image-retention-checks.yml'
-jobs:
-  retention-policy:
-    if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
-    runs-on: ces-control
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check retention without building or accessing the Docker daemon
-        run: |
-          bash -n scripts/deploy.sh
-          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p 'test_wiki_image_lifecycle.py' -v

.gitignore

@@ -1,4 +1,6 @@
 node_modules/
+.pnpm-store/
+.turbo/
 .next/
 coverage/
 .env*
@@ -10,3 +12,21 @@ dist/
 __pycache__/
 *.egg-info/
 .venv/
+
+# Content images belong in S3; metadata lives in managed-media.json.
+*.png
+*.jpg
+*.jpeg
+*.webp
+*.gif
+*.avif
+
+# Approved, versioned brand resources are package source assets.
+!packages/brand/assets/**/*.png
+!packages/brand/docs/logo-preview.png
+/apps/studio/public/brand/
+/apps/studio/public/favicon.ico
+/apps/studio/public/apple-touch-icon.png
+/apps/dashboard/public/brand/
+/apps/dashboard/public/favicon.ico
+/apps/dashboard/public/apple-touch-icon.png

AGENTS.md

@@ -8,9 +8,6 @@ This block is written and re-added by `next dev` — verify at `node_modules/nex
 
 <!-- END:nextjs-agent-rules -->
 
-## 交付与视觉验收
+## 项目维护
 
-- 用户指定服务器为唯一运行与验收入口：http://8.211.154.134:18131/。
-- 页面改动必须先 push，等待 ces-control 的 CI/CD 成功部署，再直接访问服务器检查效果。
-- 不启动本地网页预览，不使用 localhost / 127.0.0.1 页面进行视觉验收，也不把本地预览链接交付给用户。
-- 类型检查、单元测试等不提供网页预览的检查可以本地执行；完整运行检查由 Docker CI 完成。
+- Wiki 和 Studio 共用 `apps/dashboard` 的 Pages Router、登录保护和品牌包。保留已发布的路由、媒体标识和数据库迁移。

Dockerfile

@@ -1,39 +0,0 @@
-FROM node:24-bookworm-slim AS base
-LABEL io.entroia.project="waterfall-wiki"
-ENV NEXT_TELEMETRY_DISABLED=1
-WORKDIR /app
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends ffmpeg ca-certificates chromium fonts-noto-cjk \
-    && rm -rf /var/lib/apt/lists/*
-
-FROM base AS dependencies
-LABEL io.entroia.wiki.build="true"
-RUN corepack enable && corepack prepare pnpm@11.25.0 --activate
-COPY apps/waterfall-wiki/pnpm-lock.yaml ./
-COPY pnpm-workspace.yaml /tmp/monorepo-policy.yaml
-RUN node -e "const fs=require('fs');const text=fs.readFileSync('/tmp/monorepo-policy.yaml','utf8');fs.writeFileSync('pnpm-workspace.yaml', text.slice(text.indexOf('allowBuilds:')));"
-RUN pnpm fetch --frozen-lockfile --fetch-timeout=300000 --network-concurrency=8
-COPY apps/waterfall-wiki/package.json ./
-RUN pnpm install --offline --frozen-lockfile
-
-FROM dependencies AS build
-# .dockerignore excludes docs and operational notes without extra legacy COPY snapshots.
-COPY apps/waterfall-wiki/ .
-RUN pnpm typecheck && pnpm test && pnpm build && pnpm test:smoke
-
-FROM build AS integration
-USER node
-CMD ["npm", "run", "test:integration"]
-
-FROM base AS runtime
-ENV NODE_ENV=production HOSTNAME=0.0.0.0 PORT=3000 \
-    FFMPEG_PATH=/usr/bin/ffmpeg FFPROBE_PATH=/usr/bin/ffprobe
-COPY --from=build --chown=node:node /app/.next/standalone/ ./
-COPY --from=build --chown=node:node /app/dist/worker.cjs /app/dist/bootstrap.cjs /app/dist/publish-learning-series.cjs /app/dist/auth-cli.cjs ./
-COPY --from=build --chown=node:node /app/db/ ./db/
-COPY --chown=node:node apps/waterfall-wiki/scripts/container-health.mjs ./
-COPY --chown=node:node apps/waterfall-wiki/scripts/import-character-packs.mjs apps/waterfall-wiki/scripts/verify-character-pack.mjs ./scripts/
-COPY --chown=node:node apps/waterfall-wiki/seed/characters/ ./seed/characters/
-USER node
-EXPOSE 3000
-CMD ["node", "server.js"]

README.md

@@ -1,104 +1,38 @@
-# PROMPT
+# 啡跃 Endoleap
 
-把提示词、参考图、分步文档和创作工具收进同一个可连接的知识库。人可以浏览瀑布流、搜索和编辑；AI 可以从同一篇 post 读取纯文本、图片与 API 说明，再调用 Studio 生成作品。
+啡跃把笔记、参考素材和创作工作台放在同一个 Next.js 应用里。应用位于 `apps/dashboard`，共享主题与品牌资源位于 `packages/brand`。
 
-**PROMPT 是网站与项目品牌；`waterfall-wiki` 是知识库应用的内部名称。** 目录、包、CI、镜像和 Compose 服务使用内部名称，网站导航与页面标题使用 PROMPT。
-
-线上入口：[PROMPT](http://8.211.154.134:18131/)。内容、媒体、API 与 Studio 共用登录入口。
-
-## 从一篇 post 开始
-
-每篇内容都有稳定的 `/explore/<id>` 地址。标题、标签、正文和封面可以修改，链接保持不变。数据库内容可以保留 24 位 public ID，内部仍使用 UUID；旧 `/p/<slug>`、`/skills/...` 等地址保留兼容跳转。
-
-- **浏览**：首页按不同笔记的反向引用数优先排序。重复引用和自引用不重复计数，代码、图片与外站链接不冒充笔记引用。详情可以查看引用来源。
-- **搜索**：标题、简介、正文、普通标签和系统标签共同匹配。支持多个关键词及双引号短语，先按相关性、再按引用数和时间排序；先筛选再分页。
-- **标签**：普通标签使用 `#中国风`、`#贴纸` 等名称，可以创建、添加或移除。系统标签是固定列表，目前为“文档入口”和“参考图”，只能搜索并勾选，不能通过 `#` 创建。系统标签显示在图片角标，普通标签显示在文字区；分类页顶部按系统标签筛选。
-- **编辑**：卡片与详情都能直接编辑标签；完整编辑器可以修改标题、简介、Markdown。保存使用 revision 检测并发冲突，避免旧窗口覆盖新修改。
-- **素材**：原件和加工结果都是普通资产，可被多篇 post 引用。文档封面与实际参考素材分开，子文档可以有自己的封面，同时保留原参考图。
-
-## 给 AI 的入口
-
-在同一个 post 地址加 `?agent_mode=True` 可以读取纯文本正文和媒体链接。业务 API 的相同参数会先返回接口说明；已有查询参数时使用 `&agent_mode=True`。这些入口同样需要登录或有效 Bearer JWT。
-
-| 地址 | 用途 |
+| 入口 | 用途 |
 | --- | --- |
-| `/explore/<id>` | 人看的 post；加 `?agent_mode=True` 读纯文本 |
+| `/` | 浏览内容，打开 `/explore/<id>` 查看笔记 |
+| `/guide` | 浏览指导文档 |
+| `/graphic` | 图文排版 |
+| `/infinite_canvas` | 无限画布 |
 | `/api?agent_mode=True` | 业务 API 目录 |
-| `/api/explore-feed` | 统一搜索、系统/普通标签筛选与分页 |
-| `/api/notes/<id>` | GET 读取；PUT 编辑全文；PATCH 仅更新标签 |
-| `/api/tags` | GET 查看普通/系统标签；POST 创建或复用普通标签 |
-| `/api/upload` | 上传媒体；`assetOnly=true` 独立保存，不创建 post |
-| `/api/posts` | 用正文和已有资产创建普通 post |
-| `/api/media/<id>` | 媒体原件与衍生文件，支持 Range |
-| `/api/preview` | 有尺寸上限的 WebP 预览，不接受任意远程 URL |
+| `/studio/api` | Studio API 目录 |
 
-标签 PATCH 请求为 `{ "tags": ["标签 UUID"], "revision": "GET 返回的 revision" }`。它不会要求用户重输正文。Tag 对象的 `kind` 为 `normal` 或 `system`；系统标签还有稳定的 `system_key`。普通创建接口不允许提交 `kind` 或 `system_key`。
+## 运行
 
-Wiki 中的教程是普通 post 与媒体数据，不需要为每份资料增加专用网页路由、JSON 文件端点或代码注册。
+准备 Node.js 24、pnpm 11.25.0、PostgreSQL、S3 兼容对象存储和 FFmpeg。参考 [环境变量示例](apps/dashboard/.env.example)，将变量注入 Web、初始化和媒体 worker 进程。邮箱注册与找回密码需要可用的 SMTP 服务。
 
-## Studio：从教程进入工具
-
-Studio 负责交互式排版与无状态渲染，知识库负责教程、来源和入口。`/studio` 返回 PROMPT 首页；请从对应 post 打开具体工具。
-
-27 套排版工具：`/studio/layouts/ref-01` 至 `/studio/layouts/ref-27`，每套对应原图 T/I/D 构件。目录与参数 API 为 `/studio/api/layouts` 和 `/studio/api/layouts/<id>`；POST 参数生成 SVG。效果通过 `/api/studio/designs` 存入 Wiki 现有 PostgreSQL，返回独立 ID，`/studio/designs/<id>` 可再次打开；PATCH 携带 revision 更新同一效果。Studio 不需要数据库连接或第二套数据库。详见 [27 套排版 API 教程](content/studio-tools/layouts-api.md)。
-
-其他试版工具：
-
-- `/studio/ideas/learning-skills-template`：ref-17 同一母版的四张占位封面。
-- `/studio/ideas/layout-selection`：ref-01、ref-07、ref-26 三种构图；可修改文字与配色，核对构件边界。
-- `/studio/api/export/<slug>`：GET 读取方案或初始 SVG；POST 校验自定义参数并生成 SVG/JSON。详细说明读取该地址的 `?agent_mode=True`。
-
-渲染不自动保存作品，也不自动发布 post。需要保留的结果应下载后再通过普通媒体和 post API 发布。原图的 T/I/D 构件、画板比例与来源保留为可读取数据；文字替换和矢量重建的范围应在教程中明确。
-
-## 仓库结构
-
-| 路径 | 职责 |
-| --- | --- |
-| `apps/waterfall-wiki` | Next.js Pages Router 知识库、搜索、标签、媒体 API、认证与后台视频加工 |
-| `apps/studio` | 独立 Next.js 创作工具与封面渲染 API |
-| `apps/python` | 按需运行的 PNG/视频导出 CLI，没有常驻网络服务 |
-| `content` | 本地作者资料、教程及排版源图，不打入 Wiki 运行镜像 |
-| `scripts` | CI 部署、运维、API 发布与作者工具 |
-| `docs` | 数据模型、接口、认证与部署说明 |
-
-两个 JavaScript 应用分别维护冻结的 pnpm 锁文件。根 Dockerfile 是 waterfall-wiki 的构建入口；应用目录的 Dockerfile 与它保持一致。
-
-## 环境与检查
-
-运行环境：Node.js 24、pnpm 11.25.0、PostgreSQL 17、S3 兼容对象存储；视频处理使用 FFmpeg，部分导出使用 Chromium。Python 工具需要 Python 3.12+。
+在仓库根目录运行 `pnpm install --frozen-lockfile` 和 `pnpm build`。然后在 `apps/dashboard` 目录准备数据库和存储，初始化管理员认证并启动 Web。
 
 ```sh
-pnpm install
-pnpm --dir apps/waterfall-wiki typecheck
-pnpm --dir apps/waterfall-wiki test
-pnpm --dir apps/studio typecheck
-bash -n scripts/deploy.sh scripts/integration.sh scripts/deploy-studio.sh
+node dist/bootstrap.cjs
+node dist/auth-cli.cjs init
+pnpm start
 ```
 
-完整集成测试只针对显式隔离的数据库、对象存储和生产容器运行，覆盖存储、视频加工、编辑冲突、真实搜索与引用、标签规则和登录保护。不要把生产存储配置拿来运行集成测试。
+媒体 worker 在同一目录作为独立进程运行 `node dist/worker.cjs`。绑定管理员验证器时，在远程交互终端执行 `node dist/auth-cli.cjs qr`。已有实例复用原数据库、对象存储和私有认证文件。
 
-本项目以指定服务器为唯一网页运行与验收入口：先推送，再等待 ces-control CI/CD，最后直接检查服务器。不要启动本地网页预览，不用 localhost 页面作为视觉验收或交付入口。具体约定见 [AGENTS.md](AGENTS.md)。
+## Monorepo 与 Turborepo
 
-## 部署与持久化
+仓库在现有 pnpm workspace 上接入 Turborepo，无需运行面向新项目的 `npx create-turbo@latest`。应用仍位于 `apps/dashboard`，源码品牌包仍位于 `packages/brand`；子包脚本和应用产物路径保持原样。依赖统一锁定在根目录 `pnpm-lock.yaml`，安装从仓库根目录执行。
 
-Gitea 工作流按应用路径触发：`waterfall-wiki.yml`、`studio.yml` 和 `python.yml`。waterfall-wiki 完成类型检查、单元测试、生产构建、冒烟和真实 PostgreSQL/S3 集成测试后部署；Studio 独立构建和部署。文档与作者数据本身不触发应用部署。
+根目录命令由 Turbo 调度：`pnpm dev` 启动开发任务，`pnpm dev:dashboard` 仅启动 Wiki，`pnpm build` 构建应用及 worker/CLI，`pnpm typecheck` 生成 Next.js 类型并检查 TypeScript。`pnpm start` 继续直接启动现有应用。也可以在子包目录使用原有命令。
 
-| 服务 | 入口/端口 |
-| --- | --- |
-| `waterfall-wiki` | 公网 `18131`，也是 Studio 的统一入口 |
-| PostgreSQL | `127.0.0.1:18132` |
-| 对象存储 | `127.0.0.1:18133` |
-| Studio | `127.0.0.1:18134`；公网通过 `/studio` 代理 |
-| Python | 无网络端口，按需运行 |
+锁文件合并保留应用原有依赖解析。唯一重叠差异是 `@tailwindcss/postcss` 的间接 PostCSS 依赖：品牌包原为 8.5.32，现在沿用应用的 8.5.31；品牌包直接声明的 PostCSS 8.5.6 不变。
 
-生产 Compose 项目仍为 `prompt`，部署根目录仍为 `/opt/prompt`。既有 `prompt_postgres_data`、`prompt_objects`、`prompt_auth_data` 卷与数据库身份保留；应用更名不会重新创建一套空存储。Compose 应用服务改为 `waterfall-wiki` 和 `waterfall-wiki-worker`，镜像参数为 `WATERFALL_WIKI_IMAGE` / `WATERFALL_WIKI_TEST_IMAGE`。
+迁移阶段所有任务禁用缓存，根命令使用 `--env-mode=loose` 透传既有环境变量，保留品牌资源准备步骤的每次执行。后续启用缓存前，需明确环境变量输入、跨包资源和所有输出。当前不配置 CI/CD，也不自动发布。
 
-部署在停止写入后备份数据库，再运行迁移和启动新版。失败时恢复兼容旧镜像的备份并回滚服务。生产不执行 `down -v`，也不清空对象文件。早期合集验证会遍历分页，不假定旧文章一定在第一页。
-
-## 登录与自动化
-
-共享验证器的 6 位 TOTP 动态码登录，JWT 保存在 HttpOnly Cookie 中；这属于单因素动态码登录，不是 2FA。密钥保存在服务器认证卷，不进入 Git、镜像或 HTTP 二维码接口。
-
-服务器管理员在交互式 SSH 终端运行 `sudo /opt/prompt/auth qr` 绑定验证器。不要把二维码、动态密钥或 JWT 粘贴到聊天、日志和仓库。服务端自动化可使用 `node auth-cli.cjs run <脚本>`，在进程内为本机 API 请求附加短期凭据，不输出令牌。
-
-更多说明：[登录与 SSH 绑定](docs/dynamic-code-login.md) · [API](docs/api.md) · [数据模型](docs/data-model.md) · [项目结构与部署](docs/monorepo.md)。
+仅检查任务计划、不执行编译或生成应用产物时，可运行 `pnpm build --dry=json` 和 `pnpm typecheck --dry=json`。完整构建与运行验证另行执行。

apps/dashboard/.env.example

@@ -0,0 +1,18 @@
+# Export to the web, storage bootstrap and worker processes.
+DATABASE_URL=postgresql://endoleap:replace-me@127.0.0.1:5432/endoleap
+S3_ENDPOINT=http://127.0.0.1:9000
+S3_ACCESS_KEY=replace-me
+S3_SECRET_KEY=replace-me
+S3_BUCKET=prompt
+PORT=3000
+AUTH_CONFIG_FILE=/path/to/private/auth.json
+AUTH_COOKIE_SECURE=true
+ACCOUNT_PUBLIC_ORIGIN=https://endoleap.example
+ACCOUNT_TRUST_PROXY=false
+
+# Email verification and recovery
+SMTP_HOST=
+SMTP_PORT=465
+SMTP_USERNAME=
+SMTP_FROM=
+SMTP_PASSWORD=

apps/dashboard/db/016_canvas_workspace.sql

@@ -0,0 +1,23 @@
+BEGIN;
+CREATE TABLE canvas_documents (
+ id uuid PRIMARY KEY, owner_id uuid NOT NULL REFERENCES account_users(id) ON DELETE CASCADE,
+ name text NOT NULL DEFAULT '未命名画布' CHECK(length(name) BETWEEN 1 AND 200),
+ revision integer NOT NULL DEFAULT 1 CHECK(revision>0), document_key text NOT NULL,
+ updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX canvas_owner_updated ON canvas_documents(owner_id,updated_at DESC);
+CREATE TABLE canvas_agent_links (
+ digest text PRIMARY KEY, canvas_id uuid NOT NULL REFERENCES canvas_documents(id) ON DELETE CASCADE,
+ expires_at timestamptz NOT NULL, last_seen_at timestamptz
+);
+CREATE INDEX canvas_link_expiry ON canvas_agent_links(canvas_id,expires_at);
+CREATE TABLE canvas_tasks (
+ id uuid PRIMARY KEY, canvas_id uuid NOT NULL REFERENCES canvas_documents(id) ON DELETE CASCADE,
+ target_id text NOT NULL, source_revision integer NOT NULL,
+ status text NOT NULL DEFAULT 'queued' CHECK(status IN ('queued','running','succeeded','failed')),
+ request_key text NOT NULL, result_digest text, error text,
+ created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX canvas_target_active_task ON canvas_tasks(canvas_id,target_id) WHERE status IN ('queued','running');
+INSERT INTO schema_migrations(version) VALUES ('016_canvas_workspace');
+COMMIT;

apps/dashboard/db/017_password_reset.sql

@@ -0,0 +1,5 @@
+BEGIN;
+ALTER TABLE account_tokens DROP CONSTRAINT account_tokens_kind_check;
+ALTER TABLE account_tokens ADD CONSTRAINT account_tokens_kind_check CHECK (kind IN ('verify','session','reset'));
+INSERT INTO schema_migrations(version) VALUES ('017_password_reset');
+COMMIT;

apps/dashboard/next.config.ts

@@ -0,0 +1,29 @@
+import { resolve } from "node:path";
+import type { NextConfig } from "next";
+import managedMedia from "./src/content/managed-media.json";
+
+const nextConfig: NextConfig = {
+  turbopack: { root: resolve(process.cwd(), "../..") },
+  serverExternalPackages: ["playwright-core"],
+  async redirects(){return [
+    {source:'/studio/graphic',destination:'/graphic',permanent:true},
+    {source:'/studio/infinite_canvas',destination:'/infinite_canvas',permanent:true},
+    {source:'/studio',destination:'/workspace',permanent:false},
+  ]},
+  async rewrites(){return [
+    ...Object.entries(managedMedia).filter(([path])=>path.startsWith("apps/dashboard/public/")).map(([path,asset])=>({source:"/"+path.slice("apps/dashboard/public/".length),destination:"/api/media/"+asset.id})),
+    {source:"/studio/api/:path*",destination:"/api/studio-ui/:path*"},
+    {source:"/studio/brand/:path*",destination:"/brand/:path*"},
+    {source:"/studio/favicon.ico",destination:"/favicon.ico"},
+    {source:"/studio/apple-touch-icon.png",destination:"/apple-touch-icon.png"},
+    {source:"/index.md",destination:"/api/agent-index"},
+    {source:"/skills/index.md",destination:"/api/guidance/skills"},
+    {source:"/skills/:path+/index.md",destination:"/api/guidance/skills/:path+"},
+    {source:"/agent",destination:"/api/agent-index"},
+    {source:"/agent/index.md",destination:"/api/agent-index"},
+    {source:"/skills/:skill/:doc.md",destination:"/api/skill-docs/:skill/:doc"},
+  ]},
+  poweredByHeader: false,
+};
+
+export default nextConfig;

apps/dashboard/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@prompt/dashboard",
+  "version": "0.1.0",
+  "private": true,
+  "engines": {
+    "node": ">=24 <25"
+  },
+  "scripts": {
+    "dev": "pnpm brand:prepare && next dev",
+    "build": "pnpm brand:prepare && next build && esbuild src/worker.ts --bundle --platform=node --format=cjs --external:pg-native --external:playwright-core --outfile=dist/worker.cjs && esbuild scripts/bootstrap.ts --bundle --platform=node --format=cjs --external:pg-native --external:playwright-core --outfile=dist/bootstrap.cjs && esbuild scripts/auth-cli.ts --bundle --platform=node --format=cjs --external:pg-native --outfile=dist/auth-cli.cjs",
+    "start": "next start",
+    "typecheck": "next typegen && tsc --noEmit",
+    "storage:prepare": "tsx scripts/bootstrap.ts",
+    "worker": "tsx src/worker.ts",
+    "brand:prepare": "node ../../packages/brand/scripts/prepare-app.mjs"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "3.1155.0",
+    "formidable": "3.5.4",
+    "lucide-react": "1.61.0",
+    "mdast-util-from-markdown": "2.1.0",
+    "next": "16.4.2",
+    "nodemailer": "10.2.1",
+    "pg": "8.23.1",
+    "playwright-core": "1.56.1",
+    "qrcode": "1.5.4",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
+    "react-markdown": "10.1.0",
+    "remark-gfm": "4.0.1",
+    "sharp": "0.35.5",
+    "zod": "4.6.7",
+    "@endoleap/brand": "workspace:*"
+  },
+  "devDependencies": {
+    "@tailwindcss/postcss": "4.3.3",
+    "@types/formidable": "3.5.1",
+    "@types/node": "24.19.2",
+    "@types/nodemailer": "7.0.4",
+    "@types/pg": "8.23.1",
+    "@types/qrcode": "1.5.6",
+    "@types/react": "19.3.0",
+    "@types/react-dom": "19.3.0",
+    "esbuild": "0.28.2",
+    "tailwindcss": "4.3.3",
+    "tsx": "4.23.15",
+    "typescript": "5.9.3"
+  },
+  "packageManager": "pnpm@11.25.0"
+}

apps/dashboard/scripts/auth-cli.ts

@@ -47,13 +47,16 @@ async function main() {
  if (command === 'verify' || command === 'exercise') {
   const request = (path:string,init:RequestInit={}) => fetch(base+path,{...init,redirect:'manual'});
   const buildId = readFileSync('.next/BUILD_ID','utf8').trim();
-  assert.equal((await request('/')).status,200,'Public knowledge homepage');
+  for(const path of ['/','/workspace','/documents','/account'])assert.equal((await request(path)).status,200,'Public shell '+path);
+  for(const path of ['/favicon.ico','/brand/logo-light.svg','/brand/logo-dark.svg','/brand/icon-dark.svg','/apple-touch-icon.png']) assert.equal((await request(path)).status,200,'Public brand asset '+path);
+  const studio=await request('/studio');assert.equal(studio.status,307);assert.equal(studio.headers.get('location'),'/workspace');
+  for(const [from,to] of [['/studio/graphic','/graphic'],['/studio/infinite_canvas','/infinite_canvas']]){const r=await request(from);assert.equal(r.status,308);assert.equal(r.headers.get('location'),to)}
   assert.equal((await request('/account')).status,200,'Public account page');
   const homeData = await request(`/_next/data/${buildId}/index.json`);
   assert.ok([200,404].includes(homeData.status),'Public homepage data is readable or absent for static pages');
   assert.ok(!isLoginRedirect(homeData.headers.get('location') || homeData.headers.get('x-nextjs-redirect'),base));
   assert.equal((await request('/api/posts',{method:'POST',headers:{Cookie:'wiki_account='+ 'a'.repeat(64)},body:'{}'})).status,401,'Account cookies never grant admin rights');
-  for (const path of ['/library/import','/skills/shadow-puppet/egret-example.png','/studio',`/_next/data/${buildId}/library/import.json`]) {
+  for (const path of ['/library/import','/skills/shadow-puppet/egret-example.png','/studio/layouts/ref-01',`/_next/data/${buildId}/library/import.json`]) {
    const response = await request(path); assert.equal(response.status,307,path); const destination = response.headers.get('location') || response.headers.get('x-nextjs-redirect'); assert.ok(isLoginRedirect(destination,base),path+' must redirect to login: '+destination);
   }
   for (const path of ['/api/feed','/api/upload','/studio/api/export/test','/api/media/missing']) assert.equal((await request(path)).status,401,path);

apps/dashboard/src/components/Brand.tsx

@@ -0,0 +1,4 @@
+/** The approved mark is copied from @endoleap/brand during the remote build. */
+export function Brand({ compact = false }: { compact?: boolean }) {
+  return <span className="endoleap-brand"><img src="/brand/logo-light.svg" className="endoleap-mark endoleap-mark-light" alt="" width={32} height={32}/><img src="/brand/logo-dark.svg" className="endoleap-mark endoleap-mark-dark" alt="" width={32} height={32}/><span className="endoleap-wordmark">啡跃{!compact && <small>Endoleap</small>}</span></span>;
+}

apps/dashboard/src/components/ExploreDetail.tsx

@@ -35,7 +35,7 @@ export function ExploreDetail({entry:initial,background}:{entry:ExploreEntry;bac
  async function archive(){
   setArchiveBusy(true);setCopyError('');try{const r=await fetch('/api/posts/'+entry.id+'/archive',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({archived:!entry.archived})});const d=await r.json();if(!r.ok)throw Error(d.error||'操作失败');const state=await fetch('/api/notes/'+entry.id).then(r=>r.json());setEntry(state.entry);void router.replace(router.asPath,undefined,{scroll:false})}catch(e){setCopyError(e instanceof Error?e.message:'操作失败')}finally{setArchiveBusy(false)}
  }
- return <Shell><Head><title>{entry.title} · PROMPT</title><link rel="canonical" href={exploreUrl(entry.id)}/><link rel="alternate" type="text/plain" href={exploreUrl(entry.id)+'?agent_mode=True'}/></Head>
+ return <Shell><Head><title>{entry.title} · 啡跃 Endoleap</title><link rel="canonical" href={exploreUrl(entry.id)}/><link rel="alternate" type="text/plain" href={exploreUrl(entry.id)+'?agent_mode=True'}/></Head>
  <div aria-hidden="true" inert><ExploreFeed key={entry.revision} initial={background.map(e=>e.id===entry.id?entry:e)}/></div>
  <div className="note-overlay" onClick={()=>{if(!editing)close()}}><div className="note-dialog" ref={detailRef} role="dialog" aria-modal="true" aria-labelledby="note-title" onClick={e=>e.stopPropagation()}>
  <button className="note-close" ref={closeRef} aria-label={editing?'取消编辑':'关闭详情'} onClick={close}><X/></button>

apps/dashboard/src/components/Feed.tsx

@@ -31,12 +31,12 @@ export function Feed({initial,section='',tagPath=''}:{initial:FeedData;section?:
  useEffect(()=>{generation.current++;setPosts(initial.posts);setCursor(initial.nextCursor);setError('');setBusy(false);},[initial,router.query.q]);
  const current=sections.find(s=>s.path===section);const target=initial.tags.find(t=>t.path===tagPath);const children=initial.tags;
  async function load(){const gen=generation.current;setBusy(true);setError('');try{const q=new URLSearchParams({section,path:tagPath,cursor:cursor||'',q:String(router.query.q||'')});const res=await fetch('/api/feed?'+q);const d=await res.json();if(!res.ok)throw new Error(d.error);if(gen===generation.current){setPosts(old=>[...old,...d.posts.filter((p:Post)=>!old.some(a=>a.id===p.id))]);setCursor(d.nextCursor);}}catch{if(gen===generation.current)setError('加载没有完成，点击重试。');}finally{if(gen===generation.current)setBusy(false);}}
- return <Shell><Head><title>{target?.name||current?.name||'灵感首页'} · PROMPT</title><meta name="description" content="自己的图文、视频与声音创作空间"/><link rel="alternate" type="text/markdown" href="/index.md" title="Agent 文档入口"/></Head>
+ return <Shell><Head><title>{target?.name||current?.name||'灵感首页'} · 啡跃 Endoleap</title><meta name="description" content="自己的图文、视频与声音创作空间"/><link rel="alternate" type="text/markdown" href="/index.md" title="Agent 文档入口"/></Head>
   {current&&<header className="page-header feed-heading"><div><h1>{target?.name||current.name}</h1><p>{current.hint}</p></div></header>}
   {tagPath&&<div className="breadcrumbs"><Link href={`/${section}`}>全部{current?.name}</Link>{tagPath.split('/').map((_,i)=>{const path=tagPath.split('/').slice(0,i+1).join('/');return <span key={path}> / <Link href={`/${section}/${path}`}>{initial.tags.find(t=>t.path===path)?.name}</Link></span>;})}</div>}
   <div className="feed-toolbar"><div className="feed-tabs">{!section?<><Link className="selected" href="/">全部</Link>{sections.map(s=><Link key={s.path} href={`/${s.path}`}>{s.name}</Link>)}</>:<><Link className={!tagPath?'selected':''} href={`/${section}`}>全部</Link>{children.map(t=><Link key={t.id} href={`/${section}/${t.path}`}>{t.name}</Link>)}</>}</div><span className="sort-label"><ArrowDown size={13}/>最近收录</span></div>
   {initial.unavailable?<div className="empty-state"><Layers/><h2>素材库暂时没有连接上</h2><p>请稍后刷新，已保存的内容不会因此丢失。</p></div>:(posts.length||(!section&&skillCatalog.some(s=>(s.title+s.description+s.category).toLowerCase().includes(String(router.query.q||'').toLowerCase()))))?<Masonry posts={posts} includeSkills={!section} q={String(router.query.q||'')}/>:<div className="empty-state"><div className="empty-art"><span/><ImageIcon size={42} strokeWidth={1.2}/><i><AudioLines size={18}/></i><b><Film size={19}/></b></div><span className="eyebrow">A LITTLE SPACE FOR SOMETHING GOOD</span><h2>{router.query.q?'还没有找到这份灵感':'这里还没有内容'}</h2><p>{router.query.q?'换一个词试试看。':'导入图片、视频或声音，开始整理你的素材。'}</p><Link className="primary-button" href={`/library/import${current&&['image','video','audio'].includes(current.kind)?'?kind='+current.kind:''}`}><Upload size={16}/>导入素材<ArrowUpRight size={16}/></Link><small>图文和动态作品通过代码加入，自由决定每一个像素。</small></div>}
   {cursor&&<div className="load-more"><button disabled={busy} onClick={load}>{busy?'正在翻找…':error||'再看一些'}<ArrowDown size={14}/></button></div>}
-  <footer className="page-footer">PROMPT <span>·</span> PROBABLY RENDERING ONE MORE PIXEL TONIGHT</footer>
+  <footer className="page-footer">啡跃 <span>·</span> Endoleap</footer>
  </Shell>;
 }

apps/dashboard/src/components/GuidanceIndex.tsx

@@ -4,7 +4,7 @@ import {Shell} from './Shell';
 import {SkillCard} from './SkillCard';
 import {skillCatalog} from '@/content/skills/catalog';
 import {guidanceDocuments,humanDocumentUrl} from '@/content/skills/guidance';
-export function GuidanceIndex(){return <Shell><Head><title>指导文档 · PROMPT</title><link rel="canonical" href="/skills"/><link rel="alternate" type="text/markdown" href="/skills/index.md" title="指导文档"/></Head>
+export function GuidanceIndex(){return <Shell><Head><title>指导文档 · 啡跃 Endoleap</title><link rel="canonical" href="/skills"/><link rel="alternate" type="text/markdown" href="/skills/index.md" title="指导文档"/></Head>
  <header className="page-header"><div><h1>指导文档</h1><p>每篇都有独立地址，网页与 Markdown 一一对应。沿着引用，找到需要的方法。</p></div></header>
  <article className="docs-body"><h2>全部文档</h2><p>这些分组只帮助浏览。任何一篇都可以独立进入，也可以引用其他文档。</p><div className="guidance-directory">{guidanceDocuments.map(doc=><div key={doc.path}><Link href={humanDocumentUrl(doc.path)}>{doc.title}</Link><small>{doc.collection}</small><a href={`${humanDocumentUrl(doc.path)}/index.md`}>Markdown ↗</a></div>)}</div></article>
  <h2>按创作主题浏览</h2>

apps/dashboard/src/components/GuidanceReader.tsx

@@ -333,7 +333,7 @@ export default function GuidanceReader({
                 <dt>来源</dt>
                 <dd>
                   {source === "example"
-                    ? "织页协议样例"
+                    ? "啡跃协议样例"
                     : canEdit
                       ? "你的文档"
                       : "社区作者"}

apps/dashboard/src/components/GuidanceShell.tsx

@@ -1,3 +1,6 @@
+import a from "@/styles/account.module.css";
+import { ThemeToggle } from "./ThemeToggle";
+import { Brand } from "./Brand";
 import Head from "next/head";
 import Link from "next/link";
 import { useRouter } from "next/router";
@@ -46,9 +49,11 @@ export const useGuidanceAccount = () => useContext(AccountContext);
 export default function GuidanceShell({
   children,
   title = "探索文档",
+  standalone = false,
 }: {
   children: ReactNode;
   title?: string;
+  standalone?: boolean;
 }) {
   const router = useRouter();
   const dialog = useRef<HTMLDialogElement>(null);
@@ -110,12 +115,7 @@ export default function GuidanceShell({
           href="/"
           onClick={() => dialog.current?.close()}
         >
-          <span className={s.brandMark}>
-            <Waypoints size={22} strokeWidth={2.2} />
-          </span>
-          <span>
-            织页<small>KNOWLEDGE FOR AGENTS</small>
-          </span>
+          <Brand/>
         </Link>
         <div className={s.workspaceLabel}>
           <Globe2 size={16} />
@@ -190,11 +190,23 @@ export default function GuidanceShell({
       </>
     );
   }
+  if (standalone) return (
+    <AccountContext.Provider value={{ user, loading, error, refresh }}>
+      <div className={a.page}>
+        <Head><title>{`${title} · 啡跃`}</title></Head>
+        <a className={s.skipLink} href="#account-content">跳到正文</a>
+        <header className={a.header}>
+          <div><Link href="/">返回首页</Link><ThemeToggle /></div>
+        </header>
+        <main id="account-content">{children}</main>
+      </div>
+    </AccountContext.Provider>
+  );
   return (
     <AccountContext.Provider value={{ user, loading, error, refresh }}>
       <div className={s.site}>
         <Head>
-          <title>{`${title} · 织页`}</title>
+          <title>{`${title} · 啡跃`}</title>
           <meta
             name="description"
             content="为 Agent 编写、发现和连接可独立使用的指导文档。"
@@ -230,7 +242,7 @@ export default function GuidanceShell({
               <ChevronRight size={14} />
               <strong>{title}</strong>
             </div>
-            <div className={s.topbarActions}>
+            <div className={s.topbarActions}><ThemeToggle/>
               <Link className={s.topbarProtocol} href="/protocol">
                 <span className={s.statusDot} />
                 Linked Guidance 0.1
@@ -253,7 +265,7 @@ export default function GuidanceShell({
             {children}
           </main>
           <footer className={s.workspaceFooter}>
-            <span>织页 · 让知识按需连接</span>
+            <span>啡跃 · 让知识按需连接</span>
             <Link href="/protocol">
               文档协议 <ArrowUpRight size={12} />
             </Link>

apps/dashboard/src/components/LandingSketches.tsx

@@ -0,0 +1,25 @@
+type Pose = "idea" | "read" | "make" | "collect" | "dream";
+
+/** Original theme-aware line drawings, independent of the fixed brand mark. */
+export function CreatorSketch({ pose }: { pose: Pose }) {
+  return <svg viewBox="0 0 200 220" fill="none" stroke="currentColor" strokeWidth="2.2" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
+    <path d="M13 17 185 14l3 176-174 3ZM17 202q42-3 86 0m-85 8 62 1" strokeWidth="1.5" />
+    <path d="M42 188q3-46 31-60l42 1q28 16 42 59" fill="var(--selection)" />
+    <path d="M78 64q-20-3-15-20 5-15 21-11 11-15 29-6 20 7 11 31l-18-10-15 18Z" fill="currentColor" />
+    <path d="M79 63q-11 5-5 17l8 2q1 27 21 29 21-4 21-39l-3-15m-34 52-5 20m24-18 7 18m-17-58-2 13 8 2m-9 13q9 5 17-3m-23-23h1m24-1h1" />
+    {pose === "idea" && <><path d="m117 135 17-38 13-48 11 3-7 53-14 49M68 143l-5 27 37 15" fill="var(--background)" /><path d="m141 70-8-31 26-9 11 29Z" fill="var(--selection)" /><path d="m142 42 14-5m-11 14 13-5m-10 13 12-5M151 22V12m16 14 8-7m-41 12-9-4" /></>}
+    {pose === "read" && <><path d="m49 132 49 16 46-20-4 58-41 15-46-15Z" fill="var(--background)" /><path d="m98 148 1 53m-35-54 23 8m-22 3 20 7m-19 3 16 6m28-16 20-8m-20 19 18-7m-18 17 15-6" /><path d="m50 162 12-5q8 1 5 8l-14 13m89-17-12-4q-9 0-6 7l15 12" fill="var(--background)" /></>}
+    {pose === "make" && <><path d="m99 143 65-7 15 51-68 5Z" fill="var(--background)" /><path d="m101 150-22 3-8 19 32 5m-39-6 16 7 29-2m21-12h13m-28 29H37" /><path d="m151 46 5-14 8 12 15 2-11 9 1 15-13-8-13 5 4-13-10-10Z" fill="var(--selection)" /></>}
+    {pose === "collect" && <><path d="m60 156 15-18 53 7-5 40-62-5Z" fill="var(--background)" /><path d="m76 138 8-11 19 3 7 13m-12 9a12 12 0 1 0 1 24 12 12 0 0 0-1-24m-36 10-11-5-8 8 15 15m64-21 15 9-13 11" /><path d="m143 68 25-7 7 31-25 7Zm7 14 6-6 10 9m-8-14h1" stroke="var(--primary)" /></>}
+    {pose === "dream" && <><path d="m82 136 16 30 26-6 12-36m-18 38 18 11 11-35-7-20q-4-7-8-3l-2 14-6-7m-46 26-9 25 28 14 37-13" fill="var(--background)" /><path d="m142 32 29-10-13 25-4-12-12-3 12 3 17-13m-36 25q-21 4-15 17t25 2" stroke="var(--primary)" /></>}
+  </svg>;
+}
+
+export function IdeaSketch({ kind }: { kind: "collect" | "connect" | "read" | "make" }) {
+  return <svg viewBox="0 0 140 110" fill="none" stroke="currentColor" strokeWidth="2.1" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
+    {kind === "collect" && <><path d="m43 25 49-5 7 64-53 6Z" fill="var(--selection)" /><path d="m54 39 25-2m-24 14 30-3m-28 14 21-2m20-23 18-20 7 7-20 21-9 3ZM34 18l-6-8m19 3-1-10m61 62 8 3m-81 2-10 2" /></>}
+    {kind === "connect" && <><path d="M42 37q27-31 50-1m-48 8q27-17 47-1M45 62q23 28 46 2" /><path d="m18 32 29-3 3 34-31 2Zm72-8 32 4-3 33-30-3ZM52 73l32-1 2 25-32 2Z" fill="var(--selection)" /><path d="m26 43 14-1m-13 9 10-1m62-13 13 2m-13 7 11 1M62 83h13m-12 7h9" /></>}
+    {kind === "read" && <><path d="M20 30q25-8 49 7 24-17 51-10l-3 56q-24-5-48 10-22-13-47-7Z" fill="var(--selection)" /><path d="m69 37 0 56M32 42q13-1 25 5m-23 8 21 5m-21 8 20 4m27-27 24-6m-23 19 21-6m-20 18 18-4m-35-44-2-11m17 10 6-10" /></>}
+    {kind === "make" && <><path d="m24 29 85-3 5 63-86 4ZM31 41h71M45 34h1m-10 0h1m20-1h1m-18 21 21-2 1 26-22 1Zm31 0 27-1m-26 12 20-1m-19 13 24-1" /><path d="m103 14 7-11 4 12 13 2-10 8 2 11-10-6-10 7 2-12-10-7Z" fill="var(--selection)" /></>}
+  </svg>;
+}

apps/dashboard/src/components/Shell.tsx

@@ -1,3 +1,5 @@
+import { ThemeToggle } from "./ThemeToggle";
+import { Brand } from "./Brand";
 import Link from "next/link";
 import { useRouter } from "next/router";
 import { Grid2X2,Image,Film,AudioLines,BookOpen,Clapperboard,Sparkles,ArrowUpRight,Layers,Tags,Upload,Menu,X,Search } from "lucide-react";
@@ -7,9 +9,9 @@ export function Shell({children}:{children:ReactNode}){
  const router=useRouter();const [open,setOpen]=useState(false);const [query,setQuery]=useState(String(router.query.q||''));
  useEffect(()=>setQuery(String(router.query.q||'')),[router.query.q]);
  return <div className="app-shell"><button className="mobile-menu icon-button" aria-label={open?"关闭导航":"展开导航"} aria-expanded={open} onClick={()=>setOpen(!open)}>{open?<X size={22}/>:<Menu size={22}/>}</button>
-  <aside className={`sidebar ${open?'is-open':''}`}><Link href="/" className="brand" aria-label="PROMPT 首页" onClick={()=>setOpen(false)}><img className="brand-mark" src="/brand-mark.svg" width={40} height={40} alt=""/><strong>PROMPT</strong></Link>
+  <aside className={`sidebar ${open?'is-open':''}`}><Link href="/" className="brand" aria-label="啡跃 Endoleap 首页" onClick={()=>setOpen(false)}><Brand/></Link>
    <nav>{groups.map((g,i)=><div className="nav-group" key={i}>{g.label&&<p>{g.label}</p>}{g.items.map(item=>{const active=item.href==='/'?router.asPath.split('?')[0]==='/':router.asPath.split('?')[0].startsWith(item.href);return <Link key={item.href} href={item.href} title={item.label} className={`nav-item ${active?'active':''}`} onClick={()=>setOpen(false)}><item.icon size={24} strokeWidth={active?2.2:1.8}/><span>{item.label}</span></Link>;})}</div>)}</nav>
 
-  <button className="auth-logout" onClick={async()=>{const response=await fetch('/api/auth/logout',{method:'POST'});if(response.ok)window.location.assign('/login');}}>退出登录</button></aside><main className="main-content"><div className="global-topbar"><form className="global-search" role="search" onSubmit={e=>{e.preventDefault();const path=router.asPath.split('?')[0];const destination=path==='/categories'?path:'/';void router.push({pathname:destination,query:{...(destination==='/categories'&&router.query.category?{category:router.query.category}:{}),...(query.trim()?{q:query.trim()}:{})}});}}><Search size={24}/><input aria-label="搜索笔记全文" placeholder="搜索知识、灵感和素材" value={query} onChange={e=>setQuery(e.target.value)}/>{query&&<button type="button" aria-label="清空搜索" onClick={()=>{setQuery('');void router.push({pathname:router.pathname==='/categories'?'/categories':'/',query:router.query.category?{category:router.query.category}:{}})}}><X size={20}/></button>}<button type="submit" className="search-submit">搜索</button></form></div>{children}</main>{open&&<button className="nav-scrim" aria-label="关闭导航" onClick={()=>setOpen(false)}/>}
+  <button className="auth-logout" onClick={async()=>{const response=await fetch('/api/auth/logout',{method:'POST'});if(response.ok)window.location.assign('/login');}}>退出登录</button></aside><main className="main-content"><div className="global-topbar"><ThemeToggle/><form className="global-search" role="search" onSubmit={e=>{e.preventDefault();const path=router.asPath.split('?')[0];const destination=path==='/categories'?path:'/';void router.push({pathname:destination,query:{...(destination==='/categories'&&router.query.category?{category:router.query.category}:{}),...(query.trim()?{q:query.trim()}:{})}});}}><Search size={24}/><input aria-label="搜索笔记全文" placeholder="搜索知识、灵感和素材" value={query} onChange={e=>setQuery(e.target.value)}/>{query&&<button type="button" aria-label="清空搜索" onClick={()=>{setQuery('');void router.push({pathname:router.pathname==='/categories'?'/categories':'/',query:router.query.category?{category:router.query.category}:{}})}}><X size={20}/></button>}<button type="submit" className="search-submit">搜索</button></form></div>{children}</main>{open&&<button className="nav-scrim" aria-label="关闭导航" onClick={()=>setOpen(false)}/>}
  </div>;
 }

apps/dashboard/src/components/SkillDocs.tsx

@@ -26,7 +26,7 @@ export function SkillDocs({documentPath,documentId='index',skillId='street-peopl
    setCopied(true);
   }catch{setCopied(false)}
  }
- return <Shell><Head><title>{doc.title} · 指导文档 · PROMPT</title><link rel="canonical" href={humanDocumentUrl(path)}/><link rel="alternate" type="text/markdown" href={markdownDocumentUrl(path)} title={doc.title}/></Head>
+ return <Shell><Head><title>{doc.title} · 指导文档 · 啡跃 Endoleap</title><link rel="canonical" href={humanDocumentUrl(path)}/><link rel="alternate" type="text/markdown" href={markdownDocumentUrl(path)} title={doc.title}/></Head>
   <div className="docs-top"><Link href="/skills">← 全部指导文档</Link><button onClick={()=>setOpen(v=>!v)} aria-expanded={open}><PanelRight size={16}/>文档与来源 · {doc.resources.length}</button></div>
   <div className={`docs-layout ${open?'with-sources':''}`}><article className="docs-body">
    <div className="docs-eyebrow">{doc.collection} / 指导文档</div><h1>{doc.title}</h1>

apps/dashboard/src/components/ThemeToggle.tsx

@@ -0,0 +1,7 @@
+import { useEffect, useState } from 'react';
+export function ThemeToggle() {
+  const [dark, setDark] = useState(false);
+  const [ready, setReady] = useState(false);
+  useEffect(() => { const sync = () => setDark(document.documentElement.dataset.mode === 'dark'); sync(); setReady(true); window.addEventListener('endoleap-theme', sync); return () => window.removeEventListener('endoleap-theme', sync); }, []);
+  return <button type="button" data-theme-ready={ready} className="endoleap-theme-toggle" aria-label="切换明暗主题" title={dark ? '切换浅色模式' : '切换深色模式'} onClick={() => { const mode = document.documentElement.dataset.mode === 'dark' ? 'light' : 'dark'; const scope = document.documentElement.dataset.theme?.startsWith('canvas-') ? 'canvas' : 'home'; document.documentElement.dataset.mode = mode; document.documentElement.dataset.theme = `${scope}-${mode}`; try { localStorage.setItem('endoleap.theme', mode); } catch {} window.dispatchEvent(new Event('endoleap-theme')); }}><span aria-hidden="true">◐</span></button>;
+}

apps/dashboard/src/lib/account-handler.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from 'next/server';
 import { normalizeEmail,validPassword, trustedOrigin,accountCookie } from './account-crypto';
-import { rateLimit,registerAccount,resendVerification,verifyAccount,loginAccount,currentAccount,logoutAccount } from './account';
+import { requestPasswordReset,resetPassword,rateLimit,registerAccount,resendVerification,verifyAccount,loginAccount,currentAccount,logoutAccount } from './account';
 export const runtime = 'nodejs';
 const headers = {'Cache-Control':'private, no-store','Referrer-Policy':'no-referrer'};
 const json = (body: object,status=200) => NextResponse.json(body,{status,headers});
@@ -12,7 +12,7 @@ export async function GET(request: Request,context: Context) {
 export async function POST(request: Request,context: Context) {
  if (!trustedOrigin(request)) return json({error:'请求来源不受信任'},403);
  const {action} = await context.params;
- if (!['register','resend','verify','login','logout'].includes(action)) return json({error:'不存在'},404);
+ if (!['register','resend','verify','login','logout','forgot','reset'].includes(action)) return json({error:'不存在'},404);
  try {
   // Revocation remains available even when login or mail limits are exhausted.
   if (action === 'logout') { await logoutAccount(request); const r=json({ok:true});r.headers.set('Set-Cookie',accountCookie('',true));return r; }
@@ -27,6 +27,19 @@ export async function POST(request: Request,context: Context) {
    if(typeof body.token!=='string'||! /^[a-f0-9]{64}$/.test(body.token))return json({error:'验证链接无效或已过期'},400);
    return await verifyAccount(body.token) ? json({ok:true,message:'邮箱已验证，请登录'}) : json({error:'验证链接无效或已过期'},400);
   }
+  if(action==='reset') {
+   if(typeof body.token!=='string'||!/^[a-f0-9]{64}$/.test(body.token)||!validPassword(body.password))return json({error:'重设链接无效，或密码不符合要求'},400);
+   if(!await rateLimit('reset:'+body.token,5))return json({error:'请求过于频繁，请稍后再试'},429);
+   if(!await resetPassword(body.token,body.password))return json({error:'重设链接无效或已过期，请重新申请'},400);
+   const r=json({ok:true,message:'密码已更新，请使用新密码登录'});r.headers.set('Set-Cookie',accountCookie('',true));return r;
+  }
+  if(action==='forgot') {
+   const email=normalizeEmail(body.email);
+   if(!email)return json({error:'请输入有效邮箱'},400);
+   if(!await rateLimit('forgot:'+email,3))return json({error:'请求过于频繁，请 15 分钟后再试'},429);
+   await requestPasswordReset(email);
+   return json({ok:true,message:'若该邮箱对应已验证账户，重设链接将发送至邮箱，有效期 30 分钟。'});
+  }
   const email=normalizeEmail(body.email);
   if(!email||!validPassword(body.password))return json({error:'请输入有效邮箱及 12–256 字节密码'},400);
   if(!await rateLimit(action+':'+email,action==='login'?10:3))return json({error:'请求过于频繁，请 15 分钟后再试'},429);

apps/dashboard/src/lib/account.ts

@@ -1,20 +1,44 @@
 import { randomUUID } from 'node:crypto';
 import nodemailer from 'nodemailer';
 import { db, transaction } from './db';
-import { ACCOUNT_COOKIE, SESSION_TTL, newToken, tokenDigest, hashPassword, checkPassword } from './account-crypto';
+import { ACCOUNT_COOKIE, SESSION_TTL, newToken, tokenDigest, hashPassword, checkPassword, validPassword } from './account-crypto';
 export async function rateLimit(key: string, limit: number) {
  const result = await db().query(`INSERT INTO account_limits(key,attempts,window_start) VALUES ($1,1,now())
  ON CONFLICT(key) DO UPDATE SET attempts=CASE WHEN account_limits.window_start < now()-interval '15 minutes' THEN 1 ELSE account_limits.attempts+1 END,
  window_start=CASE WHEN account_limits.window_start < now()-interval '15 minutes' THEN now() ELSE account_limits.window_start END RETURNING attempts`,[tokenDigest(key)]);
  return result.rows[0].attempts <= limit;
 }
-export async function sendVerification(email: string, token: string) {
+async function sendAccountMail(email: string, token: string, kind: 'verify' | 'reset') {
  const origin = process.env.ACCOUNT_PUBLIC_ORIGIN;
  if (!origin || !process.env.SMTP_PASSWORD || !process.env.SMTP_USERNAME) throw Error('SMTP unavailable');
- const url = new URL('/account',origin); url.searchParams.set('verify',token);
+ const url = new URL('/account',origin); url.searchParams.set(kind,token);
  const smtp = nodemailer.createTransport({host:process.env.SMTP_HOST || 'smtpdm.aliyun.com',port:Number(process.env.SMTP_PORT || 465),secure:true,
  auth:{user:process.env.SMTP_USERNAME,pass:process.env.SMTP_PASSWORD},connectionTimeout:10000,socketTimeout:15000});
- await smtp.sendMail({from:process.env.SMTP_FROM || process.env.SMTP_USERNAME,to:email,subject:'验证你的知识站邮箱',text:`请在 30 分钟内打开链接并点击确认验证邮箱：\n${url.href}\n如果你没有注册，请忽略。`});
+ await smtp.sendMail({from:process.env.SMTP_FROM || process.env.SMTP_USERNAME,to:email,subject:kind==='reset'?'重设你的啡跃账户密码':'验证你的知识站邮箱',text:kind==='reset'?`请在 30 分钟内打开链接，由你设置新的密码：\n${url.href}\n如果你没有请求重设密码，请忽略；你的密码不会改变。`:`请在 30 分钟内打开链接并点击确认验证邮箱：\n${url.href}\n如果你没有注册，请忽略。`});
+}
+export async function sendVerification(email: string,token: string) { await sendAccountMail(email,token,'verify'); }
+export async function requestPasswordReset(email: string) {
+ const result=await db().query('SELECT id FROM account_users WHERE email=$1 AND verified_at IS NOT NULL',[email]);
+ if(!result.rowCount)return;
+ const token=newToken(),digest=tokenDigest(token);
+ await db().query("INSERT INTO account_tokens(digest,user_id,kind,expires_at) VALUES ($1,$2,'reset',now()+interval '30 minutes')",[digest,result.rows[0].id]);
+ try { await sendAccountMail(email,token,'reset'); } catch { await db().query('DELETE FROM account_tokens WHERE digest=$1',[digest]);throw Error('SMTP unavailable'); }
+}
+export async function resetPassword(token: string,password: string) {
+ if(!/^[a-f0-9]{64}$/.test(token)||!validPassword(password))return false;
+ const hash=await hashPassword(password),digest=tokenDigest(token);
+ return transaction(async client=>{
+  const lookup=await client.query("SELECT user_id FROM account_tokens WHERE digest=$1 AND kind='reset' AND expires_at>now()",[digest]);
+  if(!lookup.rowCount)return false;
+  const id=lookup.rows[0].user_id;
+  // Serialize all reset links for one account, then recheck after acquiring the lock.
+  await client.query('SELECT id FROM account_users WHERE id=$1 FOR UPDATE',[id]);
+  const consumed=await client.query("DELETE FROM account_tokens WHERE digest=$1 AND kind='reset' AND expires_at>now() RETURNING user_id",[digest]);
+  if(!consumed.rowCount)return false;
+  await client.query('UPDATE account_users SET password_hash=$1 WHERE id=$2',[hash,id]);
+  await client.query('DELETE FROM account_tokens WHERE user_id=$1',[id]);
+  return true;
+ });
 }
 export async function registerAccount(email: string,password: string) {
  const hash = await hashPassword(password);
@@ -42,14 +66,16 @@ export async function verifyAccount(token: string) {
  });
 }
 export async function loginAccount(email: string,password: string) {
- const result = await db().query('SELECT * FROM account_users WHERE email=$1',[email]);
+ return transaction(async client=>{
+ const result = await client.query('SELECT * FROM account_users WHERE email=$1 FOR UPDATE',[email]);
  const user = result.rows[0];
  // A fixed dummy hash makes unknown accounts perform the same expensive KDF.
  const hash = user?.password_hash || 'scrypt:00000000000000000000000000000000:'+'0'.repeat(128);
  if (!await checkPassword(password,hash) || !user?.verified_at) return null;
  const token = newToken();
- await db().query("INSERT INTO account_tokens(digest,user_id,kind,expires_at) VALUES ($1,$2,'session',now()+$3*interval '1 second')",[tokenDigest(token),user.id,SESSION_TTL]);
+ await client.query("INSERT INTO account_tokens(digest,user_id,kind,expires_at) VALUES ($1,$2,'session',now()+$3*interval '1 second')",[tokenDigest(token),user.id,SESSION_TTL]);
  return token;
+ });
 }
 export function requestToken(request: Request) {
  const value = request.headers.get('cookie')?.split(';').map(s=>s.trim()).find(s=>s.startsWith(ACCOUNT_COOKIE+'='))?.slice(ACCOUNT_COOKIE.length+1);

apps/dashboard/src/lib/api-documentation.ts

@@ -2,6 +2,14 @@ import type {NextApiRequest,NextApiResponse} from 'next';
 
 // Read documentation before business validation or storage access. Mutations never enter this branch.
 export const apiDocuments:Record<string,readonly string[]>={
+ "/api/canvases/{...path}": [
+  "在线画布与 coding agent", "GET, POST, PUT, PATCH, DELETE",
+  "参数：POST /api/canvases {name?,document} 创建本人画布；GET 列出本人画布。GET /api/canvases/{id} 返回 document、revision 和 tasks；PUT {revision,document} 更新，冲突返回 409。所有者使用已验证邮箱会话，写入要求同源 Origin。",
+  "连接：所有者 POST /api/canvases/{id}/link 创建仅限此画布、有效一小时的 token（只返回一次，旧 token 同时撤销）。Agent 使用 Authorization: Bearer <token>。DELETE 同一路径并发送 {} 撤销；GET 读取 expiresAt/lastSeenAt。不要将 token 放入 URL、日志或作品中。",
+  "任务：POST /api/canvases/{id}/tasks {revision,targetId} 保存当前引用和指令快照；GET /api/canvases/{id}/tasks/{taskId} 读取 request（instruction、references、可选 sourceImage）。PATCH 先发送 {status:running} 领取任务，执行实际生成后发送 {status:succeeded,result:{text?,image?}}，或 {status:failed,error:原因}。image 仅允许嵌入式 PNG/JPEG/WebP data URL（小于 3MB）；正文最多 10000 字符。结果只写回该任务的目标节点，不能改写节点标识和引用。",
+  "返回：任务状态 queued/running/succeeded/failed，画布版本为正整数。任务期间画布变动则结果回写返回 409，先读取新画布并重新派发任务；相同成功结果重复提交幂等。请求快照和画布内容保存在 S3；访问凭据仅在数据库保存摘要。",
+  "401 未登录；403 来源或权限不足；404 画布/任务不存在或不可访问；409 版本/任务冲突；413 文件过大；503 服务不可用。"
+ ],
   "/api/posts/{id}/archive": [
     "归档或恢复笔记", "POST",
     "路径参数 id 为存储 UUID 或24位 publicId。JSON 参数：{archived:true} 归档，{archived:false} 恢复。重复调用幂等，不删除 post、正文、媒体、标签或页面记录。",

apps/dashboard/src/lib/canvas-document.ts

@@ -0,0 +1,78 @@
+export type NodeKind = 'text' | 'image' | 'prompt' | 'script';
+export type TextStyle = {bold?:boolean;italic?:boolean;color?:string;size?:number};
+export type CanvasNode = {
+ id:string;kind:NodeKind;title:string;text:string;x:number;y:number;
+ image?:string;width?:number;height?:number;style?:TextStyle;
+ instruction?:string;
+ operation?:'generate'|'upscale'|'script';
+};
+export type CanvasDocument = {version:1;cards:CanvasNode[];links:[string,string][]};
+const kinds:NodeKind[]=['text','image','prompt','script'];
+const object=(v:unknown):v is Record<string,unknown>=>!!v&&typeof v==='object'&&!Array.isArray(v);
+const bounded=(v:unknown,min:number,max:number)=>typeof v==='number'&&Number.isFinite(v)&&v>=min&&v<=max;
+const text=(v:unknown,max:number)=>typeof v==='string'&&v.length<=max;
+const image=(v:unknown)=>typeof v==='string'&&v.length<3000000&&/^data:image\/(png|jpeg|webp);base64,[A-Za-z0-9+/=]+$/.test(v);
+
+export function parseCanvasDocument(value:unknown):CanvasDocument {
+ const d=typeof value==='string'?JSON.parse(value):value;
+ if(!object(d)||d.version!==1||!Array.isArray(d.cards)||d.cards.length>80||!Array.isArray(d.links)||d.links.length>200)throw Error('画布格式不正确');
+ const ids=new Set<string>();
+ const cards:CanvasNode[]=d.cards.map((n:unknown)=>{
+  if(!object(n)||!text(n.id,100)||!n.id||ids.has(n.id as string)||!kinds.includes(n.kind as NodeKind)||!text(n.title,200)||!text(n.text,10000)||!bounded(n.x,-100000,100000)||!bounded(n.y,-100000,100000))throw Error('节点格式不正确');
+  if(n.width!==undefined&&!bounded(n.width,180,1200)||n.height!==undefined&&!bounded(n.height,160,1200)||n.image!==undefined&&!image(n.image))throw Error('节点尺寸或图片不正确');
+  if(n.instruction!==undefined&&!text(n.instruction,10000))throw Error('创作要求格式不正确');
+  if(n.operation!==undefined&&!['generate','upscale','script'].includes(n.operation as string))throw Error('生成任务类型不正确');
+  let style:TextStyle|undefined;
+  if(n.style!==undefined){
+   if(!object(n.style)||n.style.bold!==undefined&&typeof n.style.bold!=='boolean'||n.style.italic!==undefined&&typeof n.style.italic!=='boolean'||n.style.color!==undefined&&(typeof n.style.color!=='string'||!/^#[a-f\d]{6}$/i.test(n.style.color))||n.style.size!==undefined&&!bounded(n.style.size,10,72))throw Error('文字样式不正确');
+   style={...(n.style.bold===undefined?{}:{bold:n.style.bold as boolean}),...(n.style.italic===undefined?{}:{italic:n.style.italic as boolean}),...(n.style.color===undefined?{}:{color:n.style.color as string}),...(n.style.size===undefined?{}:{size:n.style.size as number})};
+  }
+  ids.add(n.id as string);
+  return {id:n.id as string,kind:n.kind as NodeKind,title:n.title as string,text:n.text as string,x:n.x as number,y:n.y as number,...(n.width===undefined?{}:{width:n.width as number}),...(n.height===undefined?{}:{height:n.height as number}),...(n.image===undefined?{}:{image:n.image as string}),...(style?{style}:{}),...(n.instruction===undefined?{}:{instruction:n.instruction as string}),...(n.operation===undefined?{}:{operation:n.operation as CanvasNode['operation']})};
+ });
+ const pairs=new Set<string>();
+ const links:[string,string][]=d.links.map((l:unknown)=>{
+  if(!Array.isArray(l)||l.length!==2||l[0]===l[1]||!l.every(id=>typeof id==='string'&&ids.has(id)))throw Error('引用节点不存在');
+  const key=JSON.stringify(l);if(pairs.has(key))throw Error('引用重复');pairs.add(key);return [l[0],l[1]];
+ });
+ const outgoing=new Map<string,string[]>(),indegree=new Map(cards.map(n=>[n.id,0]));
+ for(const [from,to] of links){outgoing.set(from,[...(outgoing.get(from)||[]),to]);indegree.set(to,indegree.get(to)!+1)}
+ const roots=cards.filter(n=>indegree.get(n.id)===0).map(n=>n.id);let visited=0;
+ while(roots.length){const id=roots.pop()!;visited++;for(const to of outgoing.get(id)||[]){const count=indegree.get(to)!-1;indegree.set(to,count);if(!count)roots.push(to)}}
+ if(visited!==cards.length)throw Error('引用不能形成循环');
+ return {version:1,cards,links};
+}
+
+export function referencedNodes(doc:CanvasDocument,target:string):CanvasNode[]{
+ return doc.links.filter(([,to])=>to===target).map(([from])=>doc.cards.find(n=>n.id===from)!).filter(Boolean);
+}
+export function connectNodes(doc:CanvasDocument,from:string,to:string):CanvasDocument {
+ if(from===to||![from,to].every(id=>doc.cards.some(n=>n.id===id)))throw Error('请选择不同的有效节点');
+ if(doc.links.some(([a,b])=>a===from&&b===to))return doc;
+ if(doc.links.length>=200)throw Error('最多 200 条引用');
+ const seen=new Set<string>();const pending=[to];
+ while(pending.length){const id=pending.pop()!;if(id===from)throw Error('引用不能形成循环');if(seen.has(id))continue;seen.add(id);pending.push(...doc.links.filter(([a])=>a===id).map(([,b])=>b));}
+ return {...doc,links:[...doc.links,[from,to]]};
+}
+export function removeCanvasNode(doc:CanvasDocument,id:string):CanvasDocument {
+ return {...doc,cards:doc.cards.filter(n=>n.id!==id),links:doc.links.filter(l=>!l.includes(id))};
+}
+export function deriveNode(doc:CanvasDocument,source:string,node:CanvasNode):CanvasDocument {
+ if(doc.cards.length>=80||doc.cards.some(n=>n.id===node.id))throw Error('节点数量或标识不正确');
+ const target=parseCanvasDocument({version:1,cards:[node],links:[]}).cards[0];
+ for(let attempt=0;attempt<=doc.cards.length+1;attempt++){
+  const blockers=doc.cards.filter(n=>target.x<n.x+(n.width||320)+64&&target.x+(target.width||320)+64>n.x&&target.y<n.y+(n.height||350)+64&&target.y+(target.height||350)+64>n.y);
+  if(!blockers.length)return parseCanvasDocument(connectNodes({...doc,cards:[...doc.cards,target]},source,target.id));
+  const nextY=Math.max(...blockers.map(n=>n.y+(n.height||350)+64));
+  target.y=nextY>100000?-100000:nextY;
+ }
+ throw Error('请移动现有节点后再创建引用节点');
+}
+export function agentTask(doc:CanvasDocument,id:string){
+ const node=doc.cards.find(n=>n.id===id);if(!node)throw Error('目标节点不存在');
+ const instruction=node.instruction??node.text;
+ if(!instruction.trim()&&node.operation!=='upscale')throw Error('请先填写创作要求');
+ const references=referencedNodes(doc,id);
+ if(node.operation==='upscale'&&!references.some(n=>n.kind==='image'&&n.image))throw Error('请先引用一张图片');
+ return {schema:'studio.canvas-task/1',target:{id:node.id,kind:node.kind,title:node.title},operation:node.operation||'generate',instruction,...(node.image?{sourceImage:node.image}:{}),references:references.map(n=>({id:n.id,kind:n.kind,title:n.title,text:n.text,...(n.image?{image:n.image}:{}),...(n.style?{style:n.style}:{})})),result:{targetId:node.id,allowedFields:node.kind==='image'?['image','text']:['text']}};
+}

apps/dashboard/src/lib/canvas-store.ts

@@ -0,0 +1,81 @@
+import {randomUUID,createHash} from 'node:crypto';
+import {PutObjectCommand} from '@aws-sdk/client-s3';
+import {db,transaction} from './db';
+import {storage,bucket,getObject,removeObject} from './storage';
+import {newToken,tokenDigest} from './account-crypto';
+import {parseCanvasDocument,agentTask,type CanvasDocument} from './canvas-document';
+export class CanvasError extends Error { constructor(public status:number,message:string){super(message)} }
+const inputDocument=(input:unknown)=>{try{return parseCanvasDocument(input)}catch{throw new CanvasError(400,'画布或结果参数无效')}};
+export const uuid=(v:unknown):v is string=>typeof v==='string'&&/^[a-f\d]{8}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{12}$/i.test(v);
+export const revision=(v:unknown):v is number=>typeof v==='number'&&Number.isSafeInteger(v)&&v>0&&v<2147483647;
+export async function readCanvasBody(key:string):Promise<CanvasDocument>{const o=await getObject(key);return parseCanvasDocument(await o.Body!.transformToString())}
+async function putJson(canvas:string,value:unknown){const key=`canvases/${canvas}/${randomUUID()}.json`,body=JSON.stringify(value);if(Buffer.byteLength(body)>15000000)throw new CanvasError(413,'画布不能超过 15MB');await storage().send(new PutObjectCommand({Bucket:bucket(),Key:key,Body:body,ContentType:'application/json'}));return key}
+export async function authorizeCanvas(id:string,owner:string|null,bearer:string|null){
+ const record=await db().query('SELECT * FROM canvas_documents WHERE id=$1',[id]);const doc=record.rows[0];
+ if(!doc)throw new CanvasError(404,'画布不存在');
+ if(owner===doc.owner_id)return doc;
+ if(bearer&&/^[a-f\d]{64}$/.test(bearer)){
+  const auth=await db().query('UPDATE canvas_agent_links SET last_seen_at=now() WHERE canvas_id=$1 AND digest=$2 AND expires_at>now() RETURNING canvas_id',[id,tokenDigest(bearer)]);
+  if(auth.rowCount)return doc;
+ }
+ throw new CanvasError(404,'画布不存在或无访问权限');
+}
+export async function canvasState(record:{id:string;revision:number;name:string;document_key:string}){
+ const tasks=await db().query('SELECT id,target_id AS "targetId",status,error,source_revision AS "sourceRevision",created_at AS "createdAt" FROM canvas_tasks WHERE canvas_id=$1 ORDER BY created_at DESC LIMIT 80',[record.id]);
+ return {id:record.id,name:record.name,revision:record.revision,document:await readCanvasBody(record.document_key),tasks:tasks.rows};
+}
+export async function createCanvas(owner:string,input:unknown,name='未命名画布'){
+ if(typeof name!=='string'||!name.trim()||name.length>200)throw new CanvasError(400,'画布名称无效');
+ const document=inputDocument(input),id=randomUUID(),key=await putJson(id,document);
+ try{const r=await db().query('INSERT INTO canvas_documents(id,owner_id,name,document_key) VALUES($1,$2,$3,$4) RETURNING *',[id,owner,name.trim(),key]);return canvasState(r.rows[0])}catch(e){await removeObject(key).catch(()=>{});throw e}
+}
+export async function saveCanvas(id:string,expected:number,input:unknown){
+ if(!revision(expected))throw new CanvasError(400,'版本无效');const document=inputDocument(input),key=await putJson(id,document);
+ try{return await transaction(async client=>{const r=await client.query('UPDATE canvas_documents SET document_key=$3,revision=revision+1,updated_at=now() WHERE id=$1 AND revision=$2 RETURNING *',[id,expected,key]);if(!r.rowCount)throw new CanvasError(409,'在线画布已有更新，请先读取新版本');return r.rows[0]})}catch(e){await removeObject(key).catch(()=>{});throw e}
+}
+export async function createCanvasLink(id:string){
+ const token=newToken(),expiresAt=new Date(Date.now()+3600000).toISOString();
+ await transaction(async client=>{await client.query('SELECT id FROM canvas_documents WHERE id=$1 FOR UPDATE',[id]);await client.query('DELETE FROM canvas_agent_links WHERE canvas_id=$1',[id]);await client.query('INSERT INTO canvas_agent_links(digest,canvas_id,expires_at) VALUES($1,$2,$3)',[tokenDigest(token),id,expiresAt])});
+ return {token,expiresAt};
+}
+export async function queueCanvasTask(id:string,expected:number,target:string){
+ if(!revision(expected)||typeof target!=='string'||target.length>100)throw new CanvasError(400,'任务参数无效');
+ let key:string|undefined;
+ try{return await transaction(async client=>{
+  const row=(await client.query('SELECT * FROM canvas_documents WHERE id=$1 FOR UPDATE',[id])).rows[0];if(!row)throw new CanvasError(404,'画布不存在');if(row.revision!==expected)throw new CanvasError(409,'画布已有更新，请先同步');
+  const body=await readCanvasBody(row.document_key);let request;try{request=agentTask(body,target)}catch(e){throw new CanvasError(400,e instanceof Error?e.message:'创作要求无效')}key=await putJson(id,request);
+  const result=await client.query('INSERT INTO canvas_tasks(id,canvas_id,target_id,source_revision,request_key) VALUES($1,$2,$3,$4,$5) RETURNING id,status,target_id AS "targetId"',[randomUUID(),id,target,expected,key]);return result.rows[0];
+ })}catch(e){if(key)await removeObject(key).catch(()=>{});if((e as {code?:string}).code==='23505')throw new CanvasError(409,'该节点已有待处理任务');throw e}
+}
+export async function readCanvasTask(id:string,task:string){
+ const r=await db().query('SELECT * FROM canvas_tasks WHERE canvas_id=$1 AND id=$2',[id,task]);if(!r.rowCount)throw new CanvasError(404,'任务不存在');const row=r.rows[0],o=await getObject(row.request_key);return {id:row.id,targetId:row.target_id,status:row.status,sourceRevision:row.source_revision,error:row.error,request:JSON.parse(await o.Body!.transformToString())};
+}
+export async function updateCanvasTask(id:string,task:string,input:{status?:unknown;result?:unknown;error?:unknown}){
+ let key:string|undefined;
+ try{return await transaction(async client=>{
+  const record=(await client.query('SELECT * FROM canvas_documents WHERE id=$1 FOR UPDATE',[id])).rows[0];
+  const row=(await client.query('SELECT * FROM canvas_tasks WHERE canvas_id=$1 AND id=$2 FOR UPDATE',[id,task])).rows[0];
+  if(!record||!row)throw new CanvasError(404,'任务不存在');
+  if(input.status==='running'){
+   if(!['queued','running'].includes(row.status))throw new CanvasError(409,'任务已经结束');
+   await client.query("UPDATE canvas_tasks SET status='running',updated_at=now() WHERE id=$1",[task]);return {id:task,status:'running',revision:record.revision};
+  }
+  if(input.status==='failed'){
+   if(!['queued','running'].includes(row.status))throw new CanvasError(409,'任务已经结束');
+   if(typeof input.error!=='string'||!input.error.trim()||input.error.length>1000)throw new CanvasError(400,'请提供任务失败原因');
+   await client.query("UPDATE canvas_tasks SET status='failed',error=$2,updated_at=now() WHERE id=$1",[task,input.error]);return {id:task,status:'failed',revision:record.revision};
+  }
+  if(input.status!=='succeeded'||!input.result||typeof input.result!=='object'||Array.isArray(input.result))throw new CanvasError(400,'任务更新格式不正确');
+  const result=input.result as {text?:unknown;image?:unknown};
+  if(result.text===undefined&&result.image===undefined)throw new CanvasError(400,'没有返回结果');
+  const digest=createHash('sha256').update(JSON.stringify({text:result.text,image:result.image})).digest('hex');
+  if(row.status==='succeeded'&&row.result_digest===digest)return {id:task,status:'succeeded',revision:record.revision};
+  if(row.status!=='running')throw new CanvasError(409,'请先领取任务，已结束的任务不能改写');
+  if(record.revision!==row.source_revision)throw new CanvasError(409,'画布在任务创建后已修改，请重新派发任务');
+  const doc=await readCanvasBody(record.document_key),node=doc.cards.find(n=>n.id===row.target_id);if(!node)throw new CanvasError(409,'目标节点已移除');
+  if(result.image!==undefined&&node.kind!=='image')throw new CanvasError(400,'该节点不接收图片结果');
+  const next=inputDocument({...doc,cards:doc.cards.map(n=>n.id===node.id?{...n,...(result.text===undefined?{}:{text:result.text}),...(result.image===undefined?{}:{image:result.image})}:n)});
+  key=await putJson(id,next);await client.query('UPDATE canvas_documents SET document_key=$2,revision=revision+1,updated_at=now() WHERE id=$1',[id,key]);
+  await client.query("UPDATE canvas_tasks SET status='succeeded',result_digest=$2,error=NULL,updated_at=now() WHERE id=$1",[task,digest]);return {id:task,status:'succeeded',revision:record.revision+1};
+ })}catch(e){if(key)await removeObject(key).catch(()=>{});throw e}
+}

apps/dashboard/src/lib/preview.ts

@@ -1,4 +1,6 @@
 import sharp from 'sharp';
+import managedMedia from '../content/managed-media.json';
+import {getObject} from './storage';
 import {createHash} from 'node:crypto';
 import {mkdir,readFile,writeFile,rename,stat,readdir,unlink,realpath} from 'node:fs/promises';
 import {resolve,sep,join} from 'node:path';
@@ -11,4 +13,7 @@ async function limited<T>(work:()=>Promise<T>){if(active>=3){if(waiting.length>=
 const pending=new Map<string,Promise<Buffer>>();const cache=join(tmpdir(),'prompt-previews-v1');let writes=0;
 export async function compressPreview(input:Buffer,width:number){const max=width<=480?100_000:220_000;let size=width,quality=72;let output:Buffer;do{output=await sharp(input,{limitInputPixels:40_000_000,animated:false}).rotate().resize({width:size,withoutEnlargement:true}).webp({quality,effort:3}).toBuffer();if(output.length<=max)return output;size=Math.max(240,Math.floor(size*.8));quality=Math.max(30,quality-10);}while(size>240||quality>30);return sharp(input,{limitInputPixels:40_000_000}).rotate().resize({width:240,withoutEnlargement:true}).webp({quality:30}).toBuffer();}
 export async function cachedPreview(identity:string,width:number,load:()=>Promise<Buffer>,quality=false){const key=createHash('sha256').update(identity+':'+width+(quality?':export-v1':':webp-v1')).digest('hex');const file=join(cache,key+'.webp');try{return {bytes:await readFile(file),etag:'"'+key+'"'};}catch{/* cache miss */}let task=pending.get(key);if(!task){task=limited(async()=>{await mkdir(cache,{recursive:true});const input=await load();const bytes=quality?await sharp(input,{limitInputPixels:40_000_000,animated:false}).rotate().resize({width,withoutEnlargement:true}).webp({quality:95,effort:4}).toBuffer():await compressPreview(input,width);const temp=file+'.'+process.pid+'.tmp';await writeFile(temp,bytes);await rename(temp,file);if(++writes%32===0){const files=await readdir(cache);if(files.length>1024){const dates=await Promise.all(files.map(async name=>({name,time:(await stat(join(cache,name)).catch(()=>({mtimeMs:0}))).mtimeMs})));await Promise.all(dates.sort((a,b)=>a.time-b.time).slice(0,files.length-1024).map(f=>unlink(join(cache,f.name)).catch(()=>{})));}}return bytes;});pending.set(key,task);}try{return {bytes:await task,etag:'"'+key+'"'};}finally{pending.delete(key);}}
-export async function loadStaticPreview(source:string){const root=await realpath(join(process.cwd(),'public'));const file=await realpath(staticPreviewPath(source,root));if(!file.startsWith(root+sep))throw Error('Invalid source');const info=await stat(file);if(info.size>64*1024*1024)throw Error('Image too large');return {identity:file+':'+info.mtimeMs,load:()=>readFile(file)};}
+export async function loadStaticPreview(source:string){
+ const asset=(managedMedia as Record<string,{key:string;sha256:string;bytes:number}>)["apps/dashboard/public"+source];
+ if(asset){return {identity:asset.key,load:async()=>{const object=await getObject(asset.key);if(asset.bytes>64*1024*1024)throw Error("Image too large");const bytes=Buffer.from(await object.Body!.transformToByteArray());if(bytes.length!==asset.bytes||createHash("sha256").update(bytes).digest("hex")!==asset.sha256)throw Error("Stored image checksum mismatch");return bytes;}};}
+const root=await realpath(join(process.cwd(),'public'));const file=await realpath(staticPreviewPath(source,root));if(!file.startsWith(root+sep))throw Error('Invalid source');const info=await stat(file);if(info.size>64*1024*1024)throw Error('Image too large');return {identity:file+':'+info.mtimeMs,load:()=>readFile(file)};}

apps/dashboard/src/lib/publish-learning-series.ts

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
+import managedMedia from "../content/managed-media.json";
 import {guidanceDocuments} from "../content/skills/guidance";
 import {wikiPages} from "../content/wiki";
 import { chapters } from "../content/learning-skills/data";
 import { transaction } from "./db";
-import { putFile } from "./storage";
+import { getObject } from "./storage";
 
 function stableId(name: string) {
   const bytes=createHash("sha256").update(`prompt:learning-series:${name}`).digest().subarray(0,16);
@@ -13,12 +13,13 @@ function stableId(name: string) {
 }
 // Explicit editorial publication, never part of the generic storage bootstrap.
 // Re-running updates these three authored posts without duplicating posts or media.
-export async function publishLearningSeries() {
-  const path="public/learning-skills/cover.png";
-  const cover=await readFile(path);const digest=createHash("sha256").update(cover).digest("hex");
-  const storageKey=`editorial/learning-skills/${digest}.png`;
-  const coverId=stableId("cover");
-  await putFile(storageKey,path,"image/png");
+export async function publishLearningSeries(asset=managedMedia["apps/dashboard/public/learning-skills/cover.png"]) {
+  const object=await getObject(asset.key);
+  const cover=Buffer.from(await object.Body!.transformToByteArray());
+  const digest=createHash("sha256").update(cover).digest("hex");
+  if(digest!==asset.sha256||cover.length!==asset.bytes)throw Error("Learning cover checksum mismatch");
+  const storageKey=asset.key;
+  const coverId=asset.id;
   return transaction(async client=>{
     await client.query("SELECT pg_advisory_xact_lock(18131002)");
     await client.query(`INSERT INTO assets(id,kind,filename,storage_key,mime_type,byte_size,sha256,width,height)