# Task Plan: Platform-Owned Account System

## Goal
Replace the external OAuth2 account dependency with a platform-owned phone/password account system using three roles: super administrator, organization administrator, and ordinary user. Preserve legacy account identity and business history through an import/mapping path while enforcing one account per organization.

## Current Phase
Phase 77 - Alibaba Cloud RDS PostgreSQL Adapter complete

## Phases

### Phase 1: Trace Current Settings and Provider Flow
- [x] Restore project planning context
- [x] Inspect settings API and settings panel
- [x] Inspect image generation submission/sync flow
- **Status:** complete

### Phase 2: Add EvoLink Provider Adapter
- [x] Create EvoLink image client with submit/query helpers
- [x] Add provider selection helpers and payload mapping
- [x] Route image job submission/sync through selected provider
- **Status:** complete

### Phase 3: Expose Engine Settings
- [x] Add settings fields for image engine and EvoLink credentials/model options
- [x] Update settings status/capability display
- [x] Document new env vars
- **Status:** complete

### Phase 4: Verification
- [x] Add or update focused tests
- [x] Run relevant tests/build checks
- [x] Browser-check the settings UI
- **Status:** complete

### Phase 5: Full Product UI/UX and Motion Polish
- [x] Add GSAP as the frontend motion dependency
- [x] Add a scoped client motion utility layer with reduced-motion handling and cleanup
- [x] Refresh global design tokens, focus states, navigation, mobile layout, and core page hierarchy
- [x] Polish `/create`, `/assets`, `/settings`, and image editing flows without changing backend APIs
- **Status:** complete

### Phase 6: Header and Module Cleanup
- [x] Compact the top title bar
- [x] Remove visible English module eyebrows and helper descriptions
- [x] Remove right-side title badges from modules
- [x] Reduce mobile horizontal scrolling in the lower create controls
- **Status:** complete

### Phase 7: Seedance API Limits Alignment
- [x] Verify official Seedance docs for current duration, ratio, and resolution constraints
- [x] Change video duration from free numeric input to official `4` to `15` second choices
- [x] Add server-side normalization for duration, ratio, and resolution
- [x] Document Seedance duration, ratio, and fast-model resolution restrictions
- **Status:** complete

### Phase 8: Product Branding
- [x] Replace generated text mark with logo assets from `/Users/inmanx/Documents/icon/logo`
- [x] Rename product surfaces to `智念AIGC平台`
- [x] Remove logo frame/background after visual feedback
- [x] Verify desktop and mobile header rendering
- **Status:** complete

### Phase 9: Server Deployment Support
- [x] Add Dockerfile for production image builds
- [x] Add Docker Compose service with runtime persistence and healthcheck
- [x] Add setup/deploy scripts
- [x] Document one-command server deployment in Chinese README
- [x] Verify shell syntax, unit tests, production build, and local health
- **Status:** complete

### Phase 10: Task Management and Public API v1
- [x] Extend generation job fields for task ownership, idempotency, locking, retry, timing, and webhook delivery
- [x] Split task creation from provider execution so page/API submits enqueue only
- [x] Add task management service, worker loop, API key auth, webhook delivery, and OpenAPI output
- [x] Add `/api/v1` capabilities, assets, jobs, cancel, and openapi routes
- [x] Add Docker Compose worker service, npm worker script, docs, and env examples
- [x] Add focused tests and run verification commands
- **Status:** complete

### Phase 11: Deployable Handoff and Integration Surface
- [x] Add operations-facing deployment documentation
- [x] Add partner-facing API integration documentation
- [x] Expand OpenAPI output for task, asset, upload, download, and webhook flows
- [x] Add authenticated public asset detail and download endpoints
- [x] Tag API-generated assets by client for stable follow-up access
- [x] Verify real HTTP API calls, Worker task processing, tests, and production build
- **Status:** complete

### Phase 12: Engine-Aware Image Tuning
- [x] Replace the free text-influence slider with user-facing option presets
- [x] Detect the active image generation engine from `/api/health`
- [x] Send Jimeng `scale` only when the active engine is Jimeng
- [x] Send EvoLink `quality` only when the active engine is EvoLink
- [x] Verify tests, production build, and desktop/mobile create-page layout
- **Status:** complete

### Phase 13: Account Login and SSO Protection
- [x] Trace existing page/API access and data ownership boundaries
- [x] Add OAuth2 Authorization Code login, callback, logout, and current-user session helpers
- [x] Verify JWT locally with JWKS and validate issuer/client/scope claims
- [x] Protect browser pages and first-party UI APIs while preserving public API key and worker endpoints
- [x] Thread authenticated owner IDs through assets and generation jobs
- [x] Add focused tests, docs, env examples, and run verification
- **Status:** complete

### Phase 14: Password Captcha Login
- [x] Verify auth captcha endpoint and password grant response shape without printing tokens
- [x] Add `/api/auth/captcha` proxy and `/api/auth/password` session-issuing login endpoint
- [x] Add account/password/captcha form to `/auth/login`
- [x] Verify login creates a session and logout returns to the login page
- **Status:** complete

### Phase 15: Standalone Login Page Polish
- [x] Remove the shared top bar from `/auth/*` pages
- [x] Keep only the logo, platform name, and account login form on the login page
- [x] Remove the visible unified-auth/SSO login entry from the login page
- [x] Apply the existing GSAP motion helper layer to the standalone login layout
- [x] Verify desktop and mobile login layout has no horizontal overflow
- **Status:** complete

### Phase 16: Repository Sync and Local Startup Status
- [x] Overwrite local workspace with the latest `origin/main`
- [x] Confirm the repository is clean at `d98e58a docs: update public api docs`
- [x] Verify the Next.js dev server can start locally on an alternate port
- [x] Record current process/port status after the dev session ended
- **Status:** complete

### Phase 17: Account ID Data Partitioning for Public API
- [x] Trace current owner/client/account boundaries
- [x] Add stable account-owner mapping for API clients
- [x] Route public API jobs/assets through the account owner
- [x] Add focused isolation tests and docs
- **Status:** complete

### Phase 18: Internal RBAC and Account Management Integration
- [x] Inspect current auth/session/nav/admin page boundaries
- [x] Attempt to read operations organization external API guide
- [x] Add admin/ordinary user permission model
- [x] Protect admin pages and admin APIs
- [x] Add account-management integration from the updated organization/user API guide
- [x] Verify tests/build and local behavior
- **Status:** complete

### Phase 19: Account Management Route Compatibility
- [x] Trace `/accounts` 404 from local logs to the upstream member-list route
- [x] Add configurable organization/member path overrides
- [x] Degrade missing member-list routes to page warnings instead of API 404
- [x] Update docs and focused tests
- **Status:** complete

### Phase 20: Account-Scoped Image Generation Templates
- [x] Trace current image generation, settings, auth owner, and data persistence paths
- [x] Design account-scoped template data with prompt presets and preview metadata
- [x] Add backend storage helpers and first-party template API routes
- [x] Add template configuration to settings and template selection to image generation
- [x] Add focused tests and run verification
- **Status:** complete

### Phase 21: Account Management Upstream Permission Degradation
- [x] Confirm the updated member-list path reaches `hotelStaff`
- [x] Identify the current failure as upstream administrator-role denial, not route/configuration miss
- [x] Degrade member-list permission denial to an account-page warning with an empty member list
- [x] Keep organization, role, group, account creation, and password maintenance flows available when configured
- [x] Add focused permission-denial classification test and run verification
- **Status:** complete

### Phase 22: Image Template Placement and In-Module Configuration
- [x] Remove template management from the global settings page
- [x] Move image template selection to the right side of the image generation console
- [x] Add template configuration flow inside the image generation module
- [x] Verify desktop/mobile layout, tests, and build
- **Status:** complete

### Phase 23: Large Auth Session Cookie Compatibility
- [x] Trace new-account login loop from `/api/auth/password` success back to `/auth/login`
- [x] Add chunked session cookie helpers for large JWT/authority payloads
- [x] Read chunked session cookies in middleware and server-side current-user helpers
- [x] Write chunked cookies from password and OAuth login, and clear all chunks on logout
- [x] Add focused session-cookie reassembly test and run verification
- **Status:** complete

### Phase 24: Left Template Rail for Image Generation
- [x] Move template selection into a left vertical scroll rail
- [x] Put the add-template icon button under the template rail heading
- [x] Keep template cards to thumbnail plus name with selected state
- [x] Apply selected template parameters into the right generation console
- [x] Verify layout, tests, and build
- **Status:** complete

### Phase 25: Independent Template Column for Image Generation
- [x] Split template selection out of the generation panel frame
- [x] Render templates as an independent left column panel
- [x] Keep the right panel dedicated to generation inputs and settings
- [x] Verify desktop and narrow viewport geometry
- [x] Run tests and production build
- **Status:** complete

### Phase 26: Generation Console Owns Mode Switch
- [x] Move the image/video/edit mode switch into the generation console panel
- [x] Keep the template module as the far-left independent module
- [x] Remove global/sticky mode-switch styling that visually spans modules
- [x] Verify the mode switch is contained by the generation panel, not the template panel
- [x] Run tests and production build
- **Status:** complete

### Phase 27: Template Upload Placeholders
- [x] Reuse the existing asset upload/OSS flow for template preview images
- [x] Remove template category/remark UI and expose an intro field instead
- [x] Parse `@图片1` style prompt placeholders into visible required upload slots
- [x] Keep selected-template parameters flowing into the generation console
- [x] Verify tests, build, and local server restart
- **Status:** complete

### Phase 28: Add Template Modal UX Polish
- [x] Apply UI/UX skill recommendations to the add-template modal
- [x] Reorganize the modal into preview, form, and action regions
- [x] Show parsed placeholder chips while editing preset prompt
- [x] Verify responsive layout, tests, build, and local server status
- **Status:** complete

### Phase 29: Template Engine-Specific Parameters
- [x] Add image generation engine and engine-specific parameters to template settings
- [x] Allow per-request image engine override when submitting image jobs
- [x] Add engine selection and conditional parameter controls to the add-template modal
- [x] Apply selected template engine/parameters into the generation console
- [x] Verify tests, build, browser layout, and local server restart
- **Status:** complete

### Phase 30: Template Rail Editing and Placeholder Confirmation
- [x] Tighten material placeholder parsing so unfinished `@图片` text is not treated as a completed token
- [x] Add explicit placeholder insertion controls in template prompt editing
- [x] Support editing existing templates through the in-module modal and PATCH API
- [x] Widen the left template module and split image preview, selection, and edit actions
- [x] Verify tests, build, browser layout, and local server restart
- **Status:** complete

### Phase 31: Confirmed Material Draft Slot
- [x] Open a temporary material slot when a user types `@`
- [x] Confirm the slot into prompt text only on Enter/explicit selection
- [x] Keep invalid long text out of the prompt body and placeholder chips
- [x] Render confirmed tokens through the existing independent token/chip UI
- [x] Verify tests, build, browser interaction, mobile layout, and local server restart
- **Status:** complete

### Phase 32: Inline Floating Material Draft Slot
- [x] Float the temporary material draft slot inside the prompt editor surface
- [x] Add the same token overlay to template preset prompts
- [x] Keep confirmed `@图片1` / `@视频1` placeholders visibly colored inside the input area
- [x] Verify main prompt and template prompt interactions in the browser
- [x] Run tests, production build, and normal server restart checks
- **Status:** complete

### Phase 33: Wider Template Rail and Explicit Select Button
- [x] Widen the image template selection column another 1.5x on desktop and tablet layouts
- [x] Keep 9:16 and 16:9 template reference images visible without cropping
- [x] Make template application require a dedicated `选择模板` button instead of clicking the card text
- [x] Verify desktop/mobile geometry, click behavior, focused tests, and production build
- **Status:** complete

### Phase 34: Fixed Template Cards and Internal Rail Scroll
- [x] Make each template card a smaller fixed-size item
- [x] Match the template rail height to the right generation panel height
- [x] Keep the `模板选择` header and `添加模板` button fixed while only the template list scrolls
- [x] Verify desktop/mobile geometry, internal scroll behavior, focused tests, and production build
- **Status:** complete

### Phase 35: Full-Bleed Glass Template Cards
- [x] Use the template image as the full-card visual surface
- [x] Move title, description, and select action into a translucent glass panel floating at the card bottom
- [x] Remove the zoom icon while keeping the edit action at the top right
- [x] Add a stronger elevated selected-card shadow
- [x] Verify browser geometry, focused tests, and production build
- **Status:** complete

### Phase 36: Template Toggle Cancel and No Intro Field
- [x] Remove the template intro field from the template card and editor UI
- [x] Move the template edit icon into the frosted-glass card overlay
- [x] Make the selected template button toggle off on a second click
- [x] Restore the right-side generation prompt and image parameters when canceling template selection
- [x] Verify browser interaction, focused tests, and production build
- **Status:** complete

### Phase 37: Template Card UI Density Polish
- [x] Reduce the fixed template card size while preserving full-bleed image previews
- [x] Let the widened desktop rail fit three compact template cards per row
- [x] Reflow the frosted-glass footer so the title owns the first row and select/edit controls share the second row
- [x] Remove the remaining frontend template description field from the create-studio type surface
- [x] Verify geometry, focused tests, and production build
- **Status:** complete

### Phase 38: Right-Side Create Task Module
- [x] Add an independent right-side task module to the creation console
- [x] Show generated asset thumbnail, task name, status, elapsed time, and detail entry
- [x] Link detail entry to the results task page with the matching task expanded
- [x] Add responsive desktop/tablet/mobile layout behavior
- [x] Verify focused tests, TypeScript, production build, and browser layout
- **Status:** complete

### Phase 39: Task Module Width and Preview Polish
- [x] Widen the right-side task module up to roughly double the original width on wide screens
- [x] Keep task card information on one horizontal row without wrapping status/time/action
- [x] Show a `生成中` placeholder thumbnail for queued/running tasks without output assets
- [x] Allow completed image thumbnails to open a large preview directly from the create page
- [x] Verify TypeScript, build, focused tests, and browser desktop/mobile behavior
- **Status:** complete

## Key Questions
1. How should the selected image engine be stored and exposed in settings?
2. Which current capabilities should EvoLink handle first?
3. How do EvoLink task statuses map to the local GenerationJob statuses?
4. How can the fallback/mock behavior remain friendly for local development?

## Decisions Made
| Decision | Rationale |
|----------|-----------|
| Keep planning files in the project root for this exploration | The planning-with-files skill requires persistent context for multi-step repository research |
| Keep Jimeng as the default image engine | Preserves current behavior unless the user opts into EvoLink |
| Treat EvoLink as a provider inside the existing async job/asset pipeline | EvoLink returns async task ids and result URLs, matching the current job sync architecture |
| Use GSAP through local helpers instead of scattering animation calls in components | Keeps motion cleanup, reduced-motion behavior, and animation timing consistent |
| Keep UI polish scoped to frontend surfaces and avoid backend API/schema changes | Matches the requested product polish while preserving current workflows |
| Follow official Seedance 2.0 duration range `4~15` seconds in the UI | Prevents the user from selecting values the API rejects |
| Preserve `-1` Seedance auto duration only in backend/env normalization, not in the default UI dropdown | Keeps the UI predictable while still supporting advanced configuration |
| Use the black/blue transparent NIANXX logo on the light top bar | Makes the logo visible without adding a frame that changes the brand feel |
| Use Docker Compose as the primary server deployment path | Gives server operators one command, persistent local runtime data, and a restart policy |
| Implement multi-task support as task management, not an external message queue | Matches user preference and keeps deployment simpler for this server product |
| Use API Key auth for public API v1 | Fastest stable server-to-server integration model for other AI systems |
| Use OAuth2 Authorization Code for the browser UI login | Matches the provided SSO guide and keeps `client_secret` on the server |
| Derive first-party owner ids from verified JWT claims as `auth:<clientId>:<user_id/sub>` | Gives logged-in users isolated assets and jobs without changing the storage schema |
| Keep `/api/v1/*` outside SSO middleware | Existing partner integrations authenticate with API keys and must not be redirected to browser login |
| Add password grant login as a first-class browser login path | The provided auth service currently accepts `customPC` password login with image captcha while `/oauth2/authorize` returns 400 for the local callback |
| Hide the unified-auth/SSO entry from the login page | The user wants a focused branded login screen with only logo, platform name, and the account login form |
| Use an alternate local dev port when `3000` is occupied | Existing local Next processes may already bind common ports; startup verification should use a free port and record the actual URL |
| Partition public API records by an owner id derived from the API account id | Avoids storing all partner API jobs/assets under `demo-merchant` and makes account boundaries explicit in the data layer |
| Use JWT authorities as the RBAC source of truth | Auth center already issues authorities; this keeps ordinary/admin access controlled by the organization identity system |
| Add image templates as account-owned app data instead of environment settings | Templates include business prompts and preview metadata, so they should follow the authenticated owner boundary rather than global deployment config |
| Keep image template configuration inside the image generation module instead of global settings | Templates are part of the image creation workflow, and users should configure them where they select and apply them |
| Split oversized auth sessions across multiple cookies | Some real accounts can receive larger JWT/authority payloads; chunking avoids successful password login immediately losing the browser session |
| Use a left template rail for image mode | The user expects template selection to behave like a vertical picker beside the generation console, with the generation controls on the right reflecting the selected template |
| Make the image template rail its own panel | The user clarified the template picker should be an independent column, not merged inside the generation console frame |
| Keep the mode switch inside the generation console | The user clarified the image/video filter belongs to the generation console, while templates should remain a separate far-left module |
| Reuse `/api/assets/upload` for template preview images | The existing upload route already stores assets through the configured OSS/local storage layer under the authenticated owner boundary |
| Treat `@图片N` as a required upload placeholder | Template prompts should make missing source images visible in the generation console before users submit a job |
| Use a preview-first add-template modal layout | UI/UX skill guidance favors a focused form with a strong preview and clear submit action for this kind of template creation flow |
| Store engine-specific image template parameters in template settings | Jimeng and EvoLink Image2 use different request parameters, so templates must preserve the intended engine and the matching tuning option |
| Require numbered material placeholder tokens | `@图片1` is an explicit completed placeholder; bare `@图片` remains ordinary text/search state so later Chinese input is not swallowed as the placeholder name |
| Keep the temporary material draft slot inside prompt editor bounds | The user expects `@` entry to feel like an inline input affordance, while confirmed placeholders should remain visually distinct inside the same input surface |

## Errors Encountered
| Error | Attempt | Resolution |
|-------|---------|------------|
| `git status --short` failed because this is not a Git repository | 1 | Continue as a plain project folder and inspect files directly |
| zsh expanded unquoted `[id]` route paths | 1 | Quote bracketed route paths |
| Initial `curl` requests hit a local proxy and returned 502/empty output | 1 | Re-ran direct requests with `curl --noproxy '*'` |
| Browser text wait hit a transient detached element after clicking the EvoLink tab | 1 | Re-read page body and confirmed the EvoLink settings tab rendered correctly |
| `npm start` failed when `.next` contained only dev cache and no production `BUILD_ID` | 1 | Added `prestart` to build automatically and pinned `next start` to `127.0.0.1:3000` |
| Settings page briefly showed a client exception after rebuilding while the old production server was still running | 1 | Restarted the production server on the fresh build and confirmed the status page rendered |
| `npm run build` failed after Seedance settings update because TypeScript narrowed fast-model resolution choices too aggressively | 1 | Changed resolution `includes` checks to readonly string arrays and rebuilt successfully |
| Running `npm run build` while an old dev server was active caused stale Next dev chunks in prior verification | 1 | Stop dev server before production builds, then restart it afterward |
| White transparent logo was invisible on the light top bar unless wrapped in a dark frame | 1 | Switched to the black/blue logo variant, generated a cropped transparent PNG, and removed frame/background styling |
| Current local machine does not expose Docker CLI | 1 | Verified script syntax, Next build, tests, and health locally; Docker build should be run on the deployment server |
| Docker CLI is still unavailable while validating Phase 10 | 1 | Verified npm tests, production build, local health, API v1 calls, and worker tick locally; Compose container startup should be validated on the deployment server |
| Local ports `3000`, `3001`, and `3002` were already occupied during startup verification | 1 | Started the current project on `127.0.0.1:3003` and verified it redirected to `/auth/login?next=%2F` |
| zsh expanded unquoted `[id]` API route paths during Phase 17 inspection | 1 | Re-read those dynamic route files with quoted paths |
| `/Users/inmanx/Desktop/organization-external-api.md` was not present | 1 | User provided updated `/Users/inmanx/Desktop/organization-external-api(1).md`; wired the account-management endpoints from that version |
| Logged-in `/api/admin/accounts` returned 404 for `organizationMember/organizationMemberList` | 1 | Added `ZHINIAN_ORG_MEMBER_LIST_PATH` override support and degraded missing member-list routes to a warning so `/accounts` returns 200 |
| Running `npm run build` while the dev server was active caused the dev server to miss `.next/server/vendor-chunks/next.js` for the new dynamic template route | 1 | Restarted the dev server, confirmed it rebuilt the route, deleted the temporary verification template, then restarted the server under the normal auth-enabled environment |
| Updated `hotelStaff` member-list proxy returned `仅管理员角色允许调用` for the current token | 1 | Classified the upstream permission denial and degraded only the member list to a warning/empty page instead of failing the whole accounts screen |
| New account login returned 200 from `/api/auth/password` but was redirected back to `/auth/login?next=/create` | 1 | Added chunked session cookies so larger JWT/authority payloads are preserved across the browser redirect |
| Initial Phase 51 planning append did not match the stale task-plan/progress headings | 1 | Read the actual file tails and applied smaller header/append patches against current content |
| Existing auth regression tests still asserted external OAuth password grants | 1 | Replaced them with platform phone/password, unified-role, and lockout assertions |
| First TypeScript check rejected a test-only import of a non-exported local type | 1 | Imported `PlatformUserRecord` from the shared types module |
| A combined zsh HTTP smoke command had a quoting parse error | 1 | Re-ran the smoke checks as small, isolated curl commands |
| The old dev process served a corrupted `.next` chunk after the production build | 1 | Stopped the stale process, rebuilt, restarted dev on `127.0.0.1:3000`, and verified health/login pages |

## Notes
- EvoLink docs: submit `POST /v1/images/generations`, query `GET /v1/tasks/{task_id}`, completed task exposes `results[]`.
- EvoLink `resolution` is only effective when `size` is a ratio, so the adapter maps current UI dimensions to supported ratio values where possible.
- Engine selection now lives in the settings status tab as per-capability assignments: image generate and inpaint are configurable, upscale and video are fixed to their current engines.
- Current local dev server convention: screen session `zhinian-dev-ui`, `127.0.0.1:3000`, logs at `/tmp/zhinian-dev-server.log`.
- Before production build verification, stop the dev server first to avoid stale `.next` dev chunk references.
- Latest product name is `智念AIGC平台`.
- Current header logo asset is `public/logo/zhinian-logo.png`, generated from `/Users/inmanx/Documents/icon/logo/2d5b992caa14db16f594c4933e92e37e.png`.
- Server one-command deployment entrypoint is `bash scripts/deploy.sh`.
- Docker Compose persists local uploads/results/state through the bind mount `./.runtime:/app/.runtime`.
- Public API v1 endpoints are under `/api/v1` and require `ZHINIAN_API_KEYS`.
- Public API account data is partitioned by the API key account id as `ownerId = api:<accountId>`.
- Task processing is handled by `npm run worker` or the `zhinian-worker` Compose service through `/api/internal/worker/tick`.
- Latest repository sync status: `main` tracks `origin/main` and is clean at `d98e58a docs: update public api docs`.
- Latest local startup verification used `npm run dev -- --hostname 127.0.0.1 --port 3003`; the server reached Ready and `/` returned a login redirect.
- Current status check on 2026-06-09: no `next dev` / `next-server` process is listening on `3003`, so the dev server is not currently running.
- Image templates are now account-scoped records exposed through `/api/image-templates`; the image creation page shows and manages them inside the image module.

### Phase 51: Platform-Owned Account System
- [x] Establish platform user, organization, role, account-status, archive, and migration data models
- [x] Replace external OAuth2 password/authorization-code login with local phone/password authentication and signed sessions
- [x] Implement super-admin, organization-admin, and ordinary-user permission boundaries
- [x] Add organization-scoped account management, password changes/resets, disable/delete/archive behavior, and bootstrap super-admin initialization
- [x] Add legacy account/owner mapping import path keyed by old phone/account identity
- [x] Add brute-force protection, focused tests, migration documentation, and runtime verification
- **Status:** complete

### Phase 52: Enterprise Billing and Organization Wallet
- [x] Confirm billing unit, pricing precision, and insufficient-balance behavior
- [x] Trace current generation submission, usage event, role boundaries, persistence, and UI entry points
- [x] Design and implement provider cost catalog, markup snapshots, organization wallet, recharge requests, and immutable ledger
- [x] Integrate atomic pre-charge/refund/settlement behavior into image and video generation, retry, cancellation, deletion, and public API paths
- [x] Add super-admin billing management, organization wallet/recharge management, and user/organization usage views
- [x] Add migration/backward compatibility for existing usage records and local/Supabase stores
- [x] Verify focused tests, full tests, production build, and authenticated route flows
- **Status:** complete

### Phase 53: Provider Pricing Catalog and Variant Matching
- [x] Add official-source base pricing for the connected Bailian, EvoLink, Jimeng, and Seedance routes
- [x] Add source metadata, fixed FX conversion, model keys, and resolution variants to price rules and billing snapshots
- [x] Seed defaults without overwriting existing administrator rules and expose base/user prices in `/billing`
- [x] Extend local/Supabase persistence and migration indexes for price variants and source metadata
- [x] Verify focused tests, full tests, TypeScript, production build, and diff hygiene
- **Status:** complete

### Phase 54: Billing Center Taste Redesign
- [x] Audit the current billing page hierarchy across super-admin and member actions
- [x] Rebuild the billing center around balance-first organization context and compact finance lists
- [x] Separate member recharge actions from super-admin pricing, account, wallet, and review controls
- [x] Add responsive, accessible, loading, focus, and reduced-motion states
- [x] Verify desktop/mobile visual smoke, TypeScript, full tests, production build, and diff hygiene
- **Status:** complete

### Phase 55: Tabbed Billing Operations
- [x] Replace the long billing stack with role-specific keyboard-accessible task tabs
- [x] Add super-admin inline corporate account configuration from the billing center
- [x] Add organization wallet manual credit/debit adjustments with immutable ledger attribution
- [x] Expose organization members and per-user net consumption for quick ledger attribution
- [x] Verify responsive tab behavior, API payloads, tests, TypeScript, production build, and diff hygiene
- **Status:** complete

### Phase 56: Billing Error Recovery
- [x] Trace the reported `Internal Server Error` against local page/API responses and runtime logs
- [x] Make missing Supabase billing schema errors actionable instead of returning an opaque server failure
- [x] Safely handle non-JSON 500 responses in billing actions and add a billing route error boundary
- [x] Verify the recovery changes with TypeScript, tests, production build, and browser smoke
- **Status:** complete

### Phase 57: Super-Admin Billing Blank State
- [x] Reproduce the blank super-admin billing page with an unbound super-admin account
- [x] Render a platform-wide billing overview from the super-admin payload without requiring personal organization membership
- [x] Verify all super-admin tabs render in a production build
- **Status:** complete

### Phase 58: Parameterized Billing Rules
- [x] Extend billing rules with structured request conditions and quantity sources while preserving legacy `variantKey` rules
- [x] Normalize image/video request parameters and deterministically select the most specific matching rule
- [x] Add a server-side quote endpoint and use the same matcher during task submission
- [x] Upgrade the super-admin price editor to configure parameter conditions and show match scope
- [x] Snapshot normalized parameters, matched rule, quantity, and final amount in billing quotes/ledger metadata
- [x] Verify focused pricing tests, full tests, TypeScript, production build, and browser smoke
- **Status:** complete

### Phase 59: Task Detail Modal and Result Directory Consolidation
- [x] Confirm that only the visible `/assets` result page/navigation is removed; physical result storage remains intact
- [x] Replace the task-module result-page link with an in-place task detail modal
- [x] Show prompt, input elements/materials, generation parameters, task metadata, status/error, and available outputs in the modal
- [x] Add a direct download action to each completed task card without requiring the result page
- [x] Preserve result storage and download APIs while keeping `/assets` as a compatibility redirect to `/create`
- [x] Verify the desktop layout, full tests, TypeScript, production build, and browser behavior
- **Status:** complete

### Phase 60: Direct Billing Top-ups
- [x] Trace all recharge-request and review dependencies
- [x] Remove the user-submitted recharge/review workflow and pending-review UI
- [x] Keep administrator balance adjustments as the current direct top-up path
- [x] Make the billing payload and documentation describe direct posting and future automatic posting
- [x] Verify type checks, tests, production build, and local billing routes
- **Status:** complete

### Phase 61: Simplified Billing Price Controls
- [x] Inspect the current price catalog editor and admin price API
- [x] Replace multi-field rule creation/editing with read-only standards and multiplier-only updates
- [x] Prevent super-admin price APIs from changing provider costs, parameters, or rule structure
- [x] Verify the compact billing UI, type checks, tests, production build, and local server
- **Status:** complete

### Phase 63: Parameterized Billing Catalog
- [x] Define platform-owned parameter dimensions and factor-based quote semantics
- [x] Extend billing catalog/storage/API to expose parameter tiers with standard costs and editable multipliers
- [x] Seed provider/model parameter tiers from the existing catalog and documented provider options
- [x] Replace the flat price list with grouped service and parameter-tier controls
- [x] Verify quote matching, admin multiplier updates, type checks, tests, production build, and browser behavior
- **Status:** complete

### Phase 64: Inline Generation Cost Estimate
- [x] Move the generation cost preview beside the live parameter controls
- [x] Reuse the server quote path and expose loading, unavailable, quantity, multiplier, and matched-tier states
- [x] Align the parameter bar and estimate card with a container-aware desktop layout and safe narrow-width stacking
- [x] Verify quote changes, video duration estimates, type checks, tests, production build, and document overflow
- **Status:** complete

### Phase 65: Billing UI Alignment and Native Multiplier Dialog
- [x] Align price-source actions and notes on a shared baseline without adding maintenance fields
- [x] Tighten the generation estimate card title and parameter-row composition at desktop width
- [x] Replace browser prompt editing with an accessible in-app multiplier dialog, validation, preview, and Escape dismissal
- [x] Verify desktop browser behavior, quote refresh, type checks, tests, production build, and local-server health
- **Status:** complete

### Phase 66: Fixed EvoLink 1K Quote and User-Facing Estimate
- [x] Fix the hidden EvoLink resolution to the platform-approved 1K request and billing baseline
- [x] Keep visible quality pricing consistent: standard ¥0.51/image and high-quality ¥2.04/image at the configured multiplier
- [x] Reduce the ordinary-user estimate card to the final amount only, removing internal multiplier, tier, quantity, and helper copy
- [x] Verify the live standard/high quote, stale-copy removal, type checks, tests, and diff hygiene
- **Status:** complete

### Phase 67: Unified Default Billing Multiplier
- [x] Change the platform default markup multiplier from 1.50× to 1.20× across all built-in services and parameter tiers
- [x] Synchronize the local initialized billing catalog so existing default rules charge at 1.20×
- [x] Update built-in quote expectations and billing documentation
- [x] Verify image/video quote amounts, type checks, tests, production build, and server health
- **Status:** complete

### Phase 68: Cross-Provider Pricing Audit
- [x] Compare every active provider's standard cost and billing unit with its current official pricing source
- [x] Verify parameter-dependent cost dimensions, quantity extraction, and one-time platform markup application
- [x] Record confirmed matches, approximation boundaries, and any provider pricing gaps before proposing changes
- [x] Present the audit result and obtain confirmation before making material pricing-model changes
- **Status:** complete

### Phase 69: Seedance Native Usage Settlement
- [x] Add official Seedance token-price dimensions for resolution and input-video presence
- [x] Freeze a conservative estimate at submission, including the maximum input-video duration when metadata is absent
- [x] Extract `usage.completion_tokens` from provider responses and settle the final amount exactly once
- [x] Refund or charge only the difference; preserve the frozen amount when upstream usage is absent
- [x] Verify idempotency, persistence compatibility, docs, type checks, tests, and production build
- **Status:** complete

### Phase 70: Unbound Account Quote Preview
- [x] Trace the empty estimate state for the current super-admin session
- [x] Allow quote-only requests without an organization while keeping real submission organization-gated
- [x] Add regression coverage for the preview/charge boundary
- [x] Verify the exact Image2 / 9:16 / high-quality quote in the browser and run full checks
- **Status:** complete

### Phase 61: Account Directory and Password Settings Consolidation
- [x] Audit the current account directory, settings password flow, account APIs, roles, and existing visual tokens
- [x] Move password change into the account directory while preserving the password API contract and admin API permissions
- [x] Redesign the account directory with a modern, restrained desktop-first layout using the taste-skill audit principles
- [x] Preserve account management actions, loading/error/empty states, keyboard access, and existing API contracts
- [x] Verify desktop browser behavior, settings separation, type checks, tests, production build, and diff hygiene
- **Status:** complete

### Phase 62: Account Workspace Information Architecture Correction
- [x] Remove duplicate identity surfaces and consolidate current-user information into one header summary
- [x] Replace scattered account/profile/admin cards with one continuous account workspace
- [x] Keep the ordered flow of security, administrator operations, and member directory without changing API behavior
- [x] Verify the desktop screenshot, identity duplication, document width, type checks, production build, and diff hygiene
- **Status:** complete

### Phase 70: Organization-Only Billing Top-ups
- [x] Remove personal attribution from administrator recharge and balance-adjustment inputs
- [x] Keep generation charge/refund actor attribution for member consumption reporting, while making all new organization balance entries organization-owned
- [x] Remove member selection and “归属上账” actions from the billing center
- [x] Update billing tests and documentation to state the shared organization quota model
- [x] Verify focused/full tests, TypeScript, production build, and diff hygiene
- **Status:** complete

### Phase 71: Frontend Encoding Diagnosis
- [x] Check source-file encoding and response charset
- [x] Check rendered text in the login page and billing page with headless browser automation
- [ ] Reproduce the user's exact garbled page/browser state and apply a targeted fix
- **Status:** awaiting reproduction details

### Phase 72: Autofilled Login Submission
- [x] Trace the login button disabled condition and browser autofill interaction
- [x] Read phone/password from native form controls at submit time
- [x] Keep required-field and server-side validation in place
- [x] Verify focused/full tests, TypeScript, production build, and browser click behavior
- **Status:** complete

### Phase 73: Next Development Cache Recovery
- [x] Confirm the missing `9971.js` module is absent from the active `.next` cache
- [x] Stop duplicate Next development servers for this workspace
- [x] Move the corrupted cache to a recoverable backup and start one clean dev server
- [x] Verify the login page, login request path, and core page compilation
- **Status:** complete

### Phase 74: Dev/Production Cache Isolation
- [x] Separate Next development output into `.next-dev` while retaining `.next` for production builds
- [x] Move the partially generated `.next-dev` cache to a recoverable backup before restarting
- [x] Start one clean development server and verify login rendering, health, and protected-route behavior
- [x] Run TypeScript and diff checks after the configuration change
- **Status:** complete

### Phase 75: Local Super-Admin Credential Recovery
- [x] Confirm the requested account is the local super administrator
- [x] Replace the unreadable password hash with a generated strong password through the admin password API
- [x] Save the credential in the project browser vault without writing the password into source or tracking files
- [x] Verify the saved credential can log in and reaches the protected creation workspace
- **Status:** complete

### Phase 76: Quota Guard and Super-Admin Billing Exemption
- [x] Thread the super-admin role through the generation usage context and billing snapshot
- [x] Reject ordinary generation submissions before provider dispatch when the organization balance is insufficient
- [x] Let super-admins calculate and record generation cost without checking, freezing, or refunding organization quota
- [x] Add regression coverage for insufficient balance, unbound super-admin submission, and Seedance settlement without a wallet ledger
- [x] Verify focused/full tests, TypeScript, production build, and diff hygiene
- **Status:** complete

### Phase 77: Alibaba Cloud RDS PostgreSQL Adapter
- [x] Add one server-only PostgreSQL module for explicit backend selection, pool lifecycle, validated TLS/timeouts, parameterized queries, transactions, and readiness.
- [x] Replace Supabase/PostgREST access in data, account, and billing stores while preserving their exported interfaces and local JSON development backend.
- [x] Migrate bootstrap/import tooling and package dependencies from `@supabase/supabase-js` to `pg`.
- [x] Add versioned, advisory-locked database migration tooling and an RDS-compatible baseline schema preserving atomic claim and wallet functions.
- [x] Add database readiness, Docker migration support, and production-oriented ACK Web/Worker/Service/Ingress/ConfigMap/Secret/migration manifests.
- [x] Update environment/deployment guidance and add focused regression coverage.
- [x] Run focused tests, full tests, TypeScript, production build, migration validation, diff hygiene, and final read-only Sol review.
- **Status:** complete

### Phase 78: Production Billing Runtime and Mock Removal
- [x] Remove provider Mock fallback and fail clearly when required production credentials are missing
- [x] Keep billing quote calculation available through the real provider/model catalog
- [x] Make Docker Compose run the static Web and Go API together with one same-origin `/api` boundary
- [x] Align runtime environment examples and deployment documentation with the formal production path
- [x] Add focused regression coverage for provider configuration and quote availability
- [x] Verify Go tests, frontend tests/typecheck/build, Compose/deployment static checks, and diff hygiene
- **Status:** complete; Docker/real-provider rollout verification remains deployment-time

### Phase 79: Production Bootstrap Without Provider Credentials
- [x] Add an explicit temporary production bootstrap flag that bypasses only startup credential validation
- [x] Reject generation and quote requests clearly when the selected provider is still unconfigured
- [x] Preserve restart-required behavior after settings are saved and document the rollout sequence
- [x] Add focused regression coverage and run Go/frontend/documentation checks
- **Status:** complete; live database/provider rollout remains deployment-time

## Errors Encountered
| Error | Attempt | Resolution |
| --- | --- | --- |
| Go module downloads timed out through `proxy.golang.org` over IPv6 | Phase 79 focused test attempt 1 | Retry with the `goproxy.cn` proxy used by `backend/Dockerfile.alpine`; no source failure reached yet |
| Go 1.21.13 test binaries aborted with macOS `dyld: missing LC_UUID` | Phase 79 focused test attempt 2 | Retry with `CGO_ENABLED=0`; if needed use a newer official Go toolchain |
| Follow-up `gofmt` path repeated `backend/` from the backend directory | Phase 79 focused verification | Run final `gofmt` from the project root; tests were unaffected |