commit 5fa1bd35e97cd21b8ffa618369ac9dd344d128af
Author: hectorzhao <hectorzhao@users.noreply.local>
Date:   Mon Jun 22 10:56:38 2026 +0800

    Initial LisgloSIPS V2 implementation

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..2bd18ef
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,16 @@
+NODE_ENV=development
+LISGLOSIPS_SERVICE_NAME=api
+LISGLOSIPS_HOST=127.0.0.1
+LISGLOSIPS_PORT=3000
+LISGLOSIPS_LOG_LEVEL=info
+LISGLOSIPS_REQUEST_ID_HEADER=x-request-id
+DATABASE_URL=mysql://lisglosips_app:<PASSWORD>@127.0.0.1:3306/lisglosips
+REDIS_URL=redis://127.0.0.1:6379/0
+AUTH_ACCESS_TOKEN_SECRET=<MIN_32_CHAR_RANDOM_SECRET>
+AUTH_ACCESS_TOKEN_TTL_SECONDS=900
+AUTH_REFRESH_TOKEN_TTL_DAYS=7
+AUTH_LOCK_MAX_FAILURES=5
+AUTH_LOCK_WINDOW_SECONDS=900
+AUTH_COOKIE_SECURE=true
+AUTH_TOKEN_ISSUER=lisglosips-api
+AUTH_TOKEN_AUDIENCE=lisglosips-web
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..8dd18ec
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,19 @@
+* text=auto
+
+*.sh text eol=lf
+*.py text eol=lf
+*.service text eol=lf
+*.timer text eol=lf
+*.conf text eol=lf
+*.cfg text eol=lf
+*.nft text eol=lf
+*.lua text eol=lf
+*.mjs text eol=lf
+*.ts text eol=lf
+*.tsx text eol=lf
+*.js text eol=lf
+*.jsx text eol=lf
+*.json text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.md text eol=lf
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..3919a76
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,12 @@
+.codex-private/
+.codex-runtime/
+node_modules/
+dist/
+**/dist/
+*.tsbuildinfo
+coverage/
+.env
+.env.*
+!.env.example
+*.log
+cookies.txt
diff --git a/IMPLEMENTATION_STATUS.md b/IMPLEMENTATION_STATUS.md
new file mode 100644
index 0000000..07a5e9d
--- /dev/null
+++ b/IMPLEMENTATION_STATUS.md
@@ -0,0 +1,568 @@
+# LisgloSIPS V2 实施状态
+
+> 本文件用于跨 Codex 会话持续交接。每次新会话开始必须先读取本文件和 `SOFTSWITCH_PLATFORM_DESIGN_V2.md`；每次任务完成、失败或被阻塞后必须更新本文件。
+
+## 当前状态
+
+- 当前任务：无，S00-S30 本地 V2 闭环已完成
+- 总体状态：S30 已完成；本地 KVM 开发环境 V2 闭环冻结在 `s28-v2-20260621220924`，阿里云迁移前需按 S30 Runbook 重新演练
+- 最后更新：2026-06-22 10:35 +08:00
+- 当前阻塞：无。遗留风险为 Redis 恢复后 OpenSIPS 热路径可能需要重启 `opensips` 才恢复，已纳入 S30 Runbook，根因级修复需后续单独处理。
+- 当前环境：A/B/T 为本地 KVM 开发服务器，通过 Tailscale 联调；开发完成后再迁移阿里云
+- 私密访问资料：`.codex-private/SERVER_ACCESS.md`，只在实际连接时读取，禁止回显
+
+## 服务器索引
+
+| 代号 | 地址 | 用户 | 用途 |
+| --- | --- | --- | --- |
+| A | `100.90.90.90` | `hector` | OpenSIPS、RTPEngine、录音内存盘、HEP、Exporter |
+| B | `100.90.90.91` | `hector` | API、Worker、Redis、MySQL、录音、HOMER、Prometheus/Grafana |
+| T | `100.93.185.30` | `hector` | 已安装 OpenSIPS，模拟客户 SIP 注册与呼叫 |
+
+## 任务状态表
+
+状态只能使用：`待开始`、`进行中`、`已完成`、`已阻塞`、`已跳过`。
+
+| ID | 任务 | 状态 | 主要产物/验收 |
+| --- | --- | --- | --- |
+| S00 | SSH 安全接入与凭据迁移 | 已完成 | 三机 SSH Key、密码轮换、访问验证、访问 Runbook；后续 SSH 加固只调整管理端口并保留 Key 登录 |
+| S01 | 三机只读资产盘点 | 已完成 | `docs/inventory-A.md`、`inventory-B.md`、`inventory-T.md`、汇总报告 |
+| S02 | 网络与安全组验收 | 已完成 | `docs/infra-check.md`，含本地端口矩阵和未来阿里云安全组清单 |
+| S03 | Server B 基础系统初始化 | 已完成 | `docs/SERVER_B_BASELINE_RUNBOOK.md`、`infra/server-b/s03/`、远端备份 |
+| S04 | Server B MySQL 与 Redis | 已完成 | `docs/SERVER_B_DATA_SERVICES_RUNBOOK.md`、`infra/server-b/s04/`、备份恢复演练 |
+| S05 | Server B Node.js、Nginx 与 TLS 基线 | 已完成 | `docs/SERVER_B_WEB_RUNTIME_RUNBOOK.md`、`infra/server-b/s05/`、HTTPS 与重启验收 |
+| S06 | Server B HOMER 与基础监控 | 已完成 | HEP 接收、HOMER API、Prometheus、Grafana、exporters、A Node Exporter |
+| S07 | V2 后端 Monorepo 骨架 | 已完成 | NestJS/Fastify/Prisma、日志、配置、健康检查、测试框架；本地和 B 均可构建 |
+| S08 | 数据库 Schema 与迁移 | 已完成 | Prisma Schema、初始化迁移、内置角色/权限种子、B 临时空库迁移和备份恢复测试 |
+| S09 | 登录认证基础 | 已完成 | 登录、刷新、退出、Argon2id、Session/Token 安全 |
+| S10 | 用户、角色、权限与审计 | 已完成 | RBAC、内置角色保护、重置密码、审计拦截器 |
+| S11 | 客户管理 API | 已完成 | 客户 CRUD、启停、余额/授信读取、单元与集成测试 |
+| S12 | 充值与不可变余额流水 | 已完成 | 客户/供应商充值、幂等、事务、审计、并发测试 |
+| S13 | 客户网关 API | 已完成 | IP/SIP 注册认证配置、启停、密码安全存储 |
+| S14 | 客户网关策略与 Redis 配置发布 | 已完成 | 主被叫匹配、优先级、Outbox、配置版本和回滚 |
+| S15 | 供应商管理 API | 已完成 | 供应商 CRUD、余额/授信、启停 |
+| S16 | 落地网关 API | 已完成 | CPS/并发/时段/编码/号码转换/周期费率/启停 |
+| S17 | 落地线路组 API | 已完成 | 成员增删、优先级重排、并发汇总、完整性校验 |
+| S18 | Server A OpenSIPS 基线 | 已完成 | 15060、认证、防扫描、MI 本地绑定、Redis/HEP 模块 |
+| S19 | Server A RTPEngine 与录音 tmpfs | 已完成 | 内核转发、RTP 端口段、3 GiB tmpfs、录音 ready 规则 |
+| S20 | Server A Redis 热路径与 HEP/指标 | 已完成 | Lua 原子检查、配置读取、HEP 9060、Node Exporter |
+| S21 | Server T 客户模拟配置 | 已完成 | IP/SIP 注册两套测试账号、呼叫脚本、失败场景脚本 |
+| S22 | CDR Redis Stream | 已完成 | 标准事件、XADD/XREADGROUP、ACK、Pending、死信、幂等 |
+| S23 | 最小计费与余额扣减 | 已完成 | Decimal 计费、客户费用/成本、重复 CDR 不重复扣费 |
+| S24 | 录音搬运与播放 | 已完成 | A->B 私网搬运、校验、Range、权限、源文件安全删除 |
+| S25 | 质检后端 | 已完成 | 抽检规则、稳定抽样、录音详情、质检保存和审计 |
+| S26 | Dashboard 聚合 | 已完成 | 实时占位/聚合指标、趋势、失败码、异常网关、待质检 |
+| S27 | React Demo 接入真实 API | 已完成 | API Client、核心运营页真实 API、错误/加载/空状态 |
+| S28 | 三机端到端联调 | 已完成 | T 发起呼叫，A 转发录音，B 出 CDR/费用/信令/质检 |
+| S29 | 性能、故障与安全测试 | 已完成 | CPS/并发/录音、Redis/MySQL/Worker 故障、越权与重放 |
+| S30 | 备份、Runbook、灰度与上线 | 已完成 | 恢复演练、上线/回滚脚本、灰度记录、验收报告 |
+
+## 每次新会话的固定开场指令
+
+可直接向 Codex 发送：
+
+```text
+请先读取 SOFTSWITCH_PLATFORM_DESIGN_V2.md、IMPLEMENTATION_STATUS.md，
+以及本任务关联的现有脚本/代码。只执行状态文件里的当前任务，不提前执行后续任务。
+开始前复核上次交接记录；涉及服务器写操作、服务重启、防火墙、密码、数据库迁移或数据删除时先说明影响和回滚点。
+完成后运行验收检查，并更新 IMPLEMENTATION_STATUS.md 的任务状态、产物、验证结果、遗留问题和下一任务。
+```
+
+## 单任务交接记录模板
+
+每完成一个任务，在本节顶部新增记录：
+
+```markdown
+### YYYY-MM-DD HH:mm - Sxx 任务名称
+
+- 状态：已完成 / 已阻塞
+- 操作服务器：A / B / T / 本地
+- 完成内容：
+- 修改文件：
+- 安装软件及固定版本：
+- 执行的关键命令：只记录无密码版本
+- 验证结果：
+- 回滚方式：
+- 未解决问题：
+- 下一任务：Sxx
+```
+
+## 交接记录
+
+### 2026-06-22 10:35 - S30 备份、Runbook、灰度与上线完成
+
+- 状态：已完成
+- 操作服务器：A、B、T、本地
+- 完成内容：完成 S30 本地 KVM 开发环境上线前冻结与演练。新增 S30 总控 Runbook、最终验收报告、B release preflight/rollback 脚本和 A OpenSIPS 配置恢复脚本；触发 B MySQL/Redis 新备份并完成隔离恢复演练；使用 T 发起灰度呼叫并核对 B raw CDR、rated CDR 和 READY 录音；实际运行 B preflight；A OpenSIPS 当前配置语法检查通过；三机关键服务最终复核 active。
+- 修改文件：`IMPLEMENTATION_STATUS.md`、`docs/S30_RELEASE_BACKUP_RUNBOOK.md`、`docs/S30_FINAL_ACCEPTANCE_REPORT.md`、`infra/server-b/s30/lisglosips-release-preflight.sh`、`infra/server-b/s30/lisglosips-release-rollback.sh`、`infra/server-a/s30/lisglosips-opensips-config-restore.sh`
+- 安装软件及固定版本：未安装新系统软件；继续使用 OpenSIPS `3.6.x`、RTPEngine `11.5.1.18-1ubuntu1.2`、Node.js `v22.22.2`、pnpm `10.33.0`、Prisma `6.19.0`、MySQL `8.0.46`、Redis `7.0.15`
+- 执行的关键命令：B `systemctl start lisglosips-backup.service`、MySQL 备份恢复到临时库 `lisglosips_s30_restore`、Redis RDB 恢复到隔离 Unix socket 临时实例、`bash -n` 检查 S30 脚本、`/tmp/lisglosips-release-preflight.sh` preflight；A `opensips -C -f /etc/opensips/opensips.cfg`；T `/opt/lisglosips-s28/lisglosips-s28-sip.py invite --timeout 12 --hold 3`。所有 sudo/数据库/API secret 均从 `.codex-private/` 或远端 env 读取并只在进程内使用，未写入文档。
+- 验证结果：MySQL 备份 `/data/backups/mysql/20260622T022811Z` 的 `all-databases.sql.gz`、`lisglosips.sql.gz`、`metadata.tsv` 校验通过，临时库恢复计数 `raw_cdrs=33`、`recordings=27`、`customer_recharges=34`、`users=2` 后已删除；Redis 备份 `/data/backups/redis/20260622T022812Z` 的 `dump.rdb`、`metadata.txt` 校验通过，隔离实例核对 `DBSIZE=51`、`stream:cdr_payload=54`、`cfg:active_version=s28-v1` 后已关闭并清理。灰度 Call-ID `s28-1782095548702-luppqjd4@lisglosips-t` 收到 SIP `100/200/BYE 200`，B 生成 raw `raw_7a6356cc76974652aa30a9d7a350041b`、rated `rated_e0eb8cbe1b90454cb3cf2d9a3bbc9290`、`billSec=6`、客户费用/供应商成本均 `0.012000`、录音 `rec_5fdf599d679f493a83fc7a2d205a128a` 为 `READY` 且 55758 bytes。B preflight 通过，A/B/T 关键服务最终 active，S30 文档/脚本未检出待补充或明文 secret。
+- 回滚方式：B 应用按 `docs/S30_RELEASE_BACKUP_RUNBOOK.md` 使用 `infra/server-b/s30/lisglosips-release-rollback.sh /opt/lisglosips/releases/<previous-release>` 切回上一 release；A OpenSIPS 配置按 `infra/server-a/s30/lisglosips-opensips-config-restore.sh <backup-opensips.cfg>` 先语法检查再恢复；Redis 配置切回上一 `cfg:active_version`，不删除 Stream；数据库优先向前修复迁移，只有完整备份和维护窗口下才恢复数据。S30 产生的测试 CDR、录音和备份作为验收证据保留。
+- 未解决问题：本地开发环境不是阿里云生产环境；正式迁移前必须重新完成 VPC/安全组、正式 DNS/TLS、独立数据盘、备份恢复、故障注入和端到端呼叫验收。S29 遗留 Redis 恢复后 OpenSIPS 热路径可能需要重启 `opensips` 的根因级修复仍需后续单独处理；真实多 A、多 B、高可用和完整生产路由不属于本地 S30 闭环。
+- 下一任务：无；S00-S30 本地 V2 闭环完成，后续应按 S30 Runbook 进入阿里云迁移/生产化专项
+
+### 2026-06-22 10:25 - S29 性能、故障与安全测试完成
+
+- 状态：已完成
+- 操作服务器：A、B、T、本地
+- 完成内容：完成本地 KVM 开发环境内的 S29 小规模性能、故障与安全测试。5 路并发和 12 路短突发呼叫均完成 SIP 100/200/BYE 200、CDR、计费、录音 READY 入库；Recording Worker 停止期间的录音恢复、CDR Worker 停止期间的 Redis pending 恢复均通过；Redis 停止期间 A 正确返回 `503 Redis Unavailable`，恢复后发现 OpenSIPS 热路径连接不自动恢复，已通过重启 A `opensips` 做运行时恢复并复测成功；MySQL 停止期间发现 CDR 被 deadletter 的可恢复性缺陷，已修复并部署到 B 当前 release，复测 MySQL 恢复后 pending CDR 自动入库且无新增 deadletter；完成 API 未认证、RBAC 越权、录音播放保护、充值幂等重放和 SIP 非法来源探针。S29 报告已写入 `docs/S29_PERFORMANCE_FAULT_SECURITY_REPORT.md`。
+- 修改文件：`IMPLEMENTATION_STATUS.md`、`docs/S29_PERFORMANCE_FAULT_SECURITY_REPORT.md`、`infra/server-t/s28/lisglosips-s28-sip.py`、`packages/redis/src/cdr-stream.ts`、`packages/redis/src/cdr-stream.spec.ts`、`apps/worker-cdr/src/main.ts`、`apps/worker-cdr/src/rating.ts`；T 的 `/opt/lisglosips-s28/lisglosips-s28-sip.py`；B 当前 release `/opt/lisglosips/releases/s28-v2-20260621220924/apps/worker-cdr/` 与 `/opt/lisglosips/releases/s28-v2-20260621220924/packages/redis/`
+- 安装软件及固定版本：未安装新系统软件；继续使用 OpenSIPS `3.6.x`、RTPEngine `11.5.1.18-1ubuntu1.2`、Node.js `v22.22.2`、pnpm `10.33.0`、Prisma `6.19.0`
+- 执行的关键命令：本地 `corepack pnpm@10.33.0 exec vitest run packages/redis/src/cdr-stream.spec.ts apps/worker-cdr/src/rating.spec.ts`、`corepack pnpm@10.33.0 --filter @lisglosips/redis build`、`corepack pnpm@10.33.0 --filter @lisglosips/worker-cdr build`；T 多路 `/opt/lisglosips-s28/lisglosips-s28-sip.py invite --timeout 10 --hold 1/3`；B/A 使用 `systemctl stop/start/restart` 做受控故障注入和恢复；B 通过 API 与 Prisma 只读/小额写入探针核对 RBAC、录音播放保护和充值幂等。所有 sudo/数据库/API secret 均从 `.codex-private/` 或远端 env 读取并只在进程内使用，未写入文档。
+- 验证结果：5 路并发生成 5 条 raw CDR、5 条 rated CDR、5 条 READY 录音；12 路短突发生成 `raws=12`、`rated=12`、`recordingsReady=12`、`totalDuration=72`、录音大小 `55758-56078` bytes；Recording Worker 恢复后补搬运录音；CDR Worker 恢复后 Redis `pending=0`、`lag=0` 并入库；MySQL 故障修复后复测 Call-ID `s28-1782093477852-a8bqqohb@lisglosips-t` 自动入库 raw/rated CDR，无新增 deadletter；API `/api/v2/users` 未认证返回 `401 AUTH_REQUIRED`，质检角色访问用户管理返回 `403 RBAC_FORBIDDEN`，录音播放未认证返回 `401 AUTH_REQUIRED`，伪造录音 ID 播放返回 `404 RECORDING_NOT_READY`；充值重放两次返回同一充值 ID `rch_da0bba1c7b1d44428ab92d77a55e503d`，数据库 `customer_recharges.rows=1`、`idempotency_keys.rows=1`，余额只增加 `0.000001` 一次；B 实际 Prometheus 服务 `lisglosips-prometheus.service` active 且 ready；A/B/T 关键服务复核 active。
+- 回滚方式：T 可恢复 S29 前 `/opt/lisglosips-s28/lisglosips-s28-sip.py` 或继续使用修复后的动态端口脚本；B 可用本次部署前保留在 `/tmp/s29-worker-cdr-backup-*` 与 `/tmp/s29-redis-backup-*` 的备份恢复 worker-cdr 与 packages/redis 后重启 `lisglosips@cdr-worker`；A Redis 故障恢复只做过服务重启，无配置文件改动。S29 产生的测试 CDR、录音、充值、幂等键和测试用户作为审计证据保留，不直接删除；如需清理应单独说明影响与回滚点。
+- 未解决问题：Redis 恢复后 A/OpenSIPS 热路径不会自动从 `Redis Unavailable` 恢复，当前运行时修复是重启 A `opensips`，根因级修复需继续排查 OpenSIPS Redis 连接池/重连策略；SIP 非法来源探针表现为无响应且未进入 OpenSIPS 日志，后续建议增加明确拒绝日志/指标；S29 期间 Tailscale 管理链路出现短时高延迟/丢包，记录为开发环境风险；真实多 A、多 B 和完整生产路由仍不在本任务范围。
+- 下一任务：`S30 - 备份、Runbook、灰度与上线`，尚未开始
+
+### 2026-06-22 09:32 - S28 三机端到端联调完成
+
+- 状态：已完成
+- 操作服务器：A、B、T、本地
+- 完成内容：补齐 S28 剩余录音与质检闭环。T 呼叫脚本新增双向 PCMU RTP 发送，UAS 在 200 OK 后向 A/RTPEngine 回送 RTP，主叫侧在 ACK 后向应答 SDP 媒体地址发送 RTP；A 的 S28 OpenSIPS 路由启用 `record-call=on`，保持 INVITE/ACK/BYE 经原 A，仍绑定本机 RTPEngine；修正 A `/dev/shm/voip_rec` 历史 root-owned 日期目录权限；修复 A recording finalizer 过早搬运问题，跳过 0 字节、仍被打开或未稳定的录音文件；B Recording Worker 新增按 RTPEngine 文件名反解 Call-ID 的 fallback 关联逻辑，使录音可自动关联 `raw_cdrs`，从而让质检抽样按客户/线路组命中。新增 S28 质检测试用户 `usr_s28_quality`、抽检规则 `qs_s28_e2e_20260622`，并通过 API 保存最新录音质检记录。
+- 修改文件：`infra/server-t/s28/lisglosips-s28-sip.py`、`infra/server-a/s28/opensips.cfg`、`infra/server-a/s19/scripts/lisglosips-recording-finalize`、`apps/worker-recording/src/transfer.ts`、`apps/worker-recording/src/transfer.spec.ts`、`IMPLEMENTATION_STATUS.md`；A 的 `/etc/opensips/opensips.cfg`、`/usr/local/sbin/lisglosips-recording-finalize` 和 `/dev/shm/voip_rec` 目录属主/权限；T 的 `/opt/lisglosips-s28/lisglosips-s28-sip.py`；B 当前 release `/opt/lisglosips/releases/s28-v2-20260621220924/apps/worker-recording/` 的源码与 dist 产物
+- 安装软件及固定版本：未安装新系统软件；继续使用 OpenSIPS `3.6.x`、RTPEngine `11.5.1.18-1ubuntu1.2`、Node.js `v22.22.2`、pnpm `10.33.0`、Prisma `6.19.0`
+- 执行的关键命令：本地 `corepack pnpm@10.33.0 exec vitest run apps/worker-recording/src/transfer.spec.ts`、`corepack pnpm@10.33.0 --filter @lisglosips/worker-recording build`；A `opensips -C -f /tmp/opensips-s28.rendered.cfg` 后重启 `opensips`，更新 finalizer 后保持 timer active；T `/opt/lisglosips-s28/lisglosips-s28-sip.py invite --timeout 10 --hold 3`；B 替换 worker-recording 产物并重启 `lisglosips@recording-worker`，通过 MySQL 和 API 只读/写入测试核对。所有 sudo/数据库/API secret 均从 `.codex-private/` 或远端 env 读取并只在进程内使用，未输出或写入明文密码。
+- 验证结果：最终验收 Call-ID `s28-1782091725991-ewqrpe7w@lisglosips-t`；T 收到 `100 Giving it a try`、`200 OK`、BYE `200 OK`；B `raw_cdrs` 生成 `raw_aa6cbaf7758f41ea895a2889f558559d`，`duration_sec=6`、`rating_status=RATED`；`rated_cdrs` 对应客户费用和供应商成本均为 `0.012000`、`bill_sec=6`；B `recordings` 生成 `rec_24b56d60dfd14937ae2e4c09802a91be`，自动关联该 raw CDR，`status=READY`、`bytes=55758`、SHA-256 前缀 `e2cfaf8c7bbc6023`；API `/api/v2/health/ready` 返回 ok，`GET /api/v2/recordings/rec_24b56d60dfd14937ae2e4c09802a91be` 返回 customer/lineGroup/callId/CDR 摘要，抽样规则 `qs_s28_e2e_20260622` 命中 `selected=true`，`PUT /api/v2/recordings/:id/review` 成功保存 `qrev_9672ee20119049a1a56082c35dc42e0f`，`GET /play` 返回 `200`、`content-type: audio/wav` 和内部 `x-accel-redirect`。A `opensips`、`rtpengine-daemon`、`rtpengine-recording-daemon`、`lisglosips-recording-finalize.timer` active；B `lisglosips@api`、`lisglosips@cdr-worker`、`lisglosips@recording-worker`、`mysql`、`redis-server`、`heplify-server` active；T `lisglosips-s28-uas`、`opensips` active。
+- 回滚方式：T 回滚恢复或删除 `/opt/lisglosips-s28/lisglosips-s28-sip.py`，停止 `lisglosips-s28-uas.service`；A 回滚可用 `/var/backups/lisglosips-s28/20260621T145920Z/opensips.cfg` 恢复 `/etc/opensips/opensips.cfg` 并语法检查后重启 `opensips`，finalizer 可恢复 S24 备份 `/var/backups/lisglosips-s24/20260621T121130Z/lisglosips-recording-finalize`，但旧脚本会重现提前搬运风险；B 回滚可将 worker-recording 产物恢复到本次替换前的 release 版本或把 `/opt/lisglosips/current` 指回前一 release 后重启相关服务。测试 CDR、余额流水、录音和质检记录作为验收证据保留，不直接删除；如必须清理，应另开维护步骤并先说明影响与回滚点。
+- 未解决问题：A 当前仍是 S28 单一测试落地端最小路由，不是完整多落地网关生产路由；录音 `duration_sec` 仍为 0，后续可在 Recording Worker 中读取 WAV 时长或由媒体侧补充；S28 调试期间存在一条 0 字节早期录音 `rec_f9b1457861444d4ebbddc11adb208d13` 作为问题证据保留；多 A 真实部署和多 B 高可用仍留给后续阶段。
+- 下一任务：S29 - 性能、故障与安全测试
+
+### 2026-06-21 23:06 - S28 三机端到端联调推进
+
+- 状态：进行中
+- 操作服务器：A、B、T、本地
+- 完成内容：将 B 从 S05 placeholder 发布为完整 V2 release `/opt/lisglosips/releases/s28-v2-20260621220924`，`/opt/lisglosips/current` 已切换到该 release；执行业务库迁移，补齐 `20260621093000_auth_sessions` additive 迁移记录，权限/角色种子已落库；`lisglosips@api` 和 `lisglosips@cdr-worker` active，API `/api/v2/health/live` 与 `/api/v2/health/ready` 返回 ok；补齐 B 录音拉取 `/etc/lisglosips/recording/ssh_config`，`lisglosips@recording-worker` 已恢复 active。新增 S28 测试业务数据：客户 `cus_s28_t`、客户网关 `cgw_s28_t_ip`、供应商 `ven_s28_t`、落地网关 `vgw_s28_t_uas`、线路组 `llg_s28_t` 和策略 `cgp_s28_t_default`；Redis 热路径配置版本为 `s28-v1`。在 T 部署专用落地模拟服务 `lisglosips-s28-uas.service`，监听 `100.93.185.30:50620`，只终结呼叫不回送 A，避免循环。A 部署 S28 最小真实路由：Lua 热路径 allow 后执行 RTPEngine offer/answer、转发到 T 专用落地端、写成功 CDR 到 Redis Stream，并为 T 源 IP 的 ACK/BYE 添加 fallback，确保回到原 A 后转给 T 落地端。
+- 修改文件：`infra/server-t/s28/lisglosips-s28-sip.py`、`infra/server-a/s28/opensips.cfg`、`pnpm-lock.yaml`、`IMPLEMENTATION_STATUS.md`；B 的 `/opt/lisglosips/releases/s28-v2-20260621220924`、`/etc/lisglosips/api.env`、`/etc/lisglosips/cdr-worker.env`、`/etc/lisglosips/recording-worker.env`、`/etc/lisglosips/recording/ssh_config`、`/etc/systemd/system/lisglosips@recording-worker.service.d/10-s28-recording.conf`；T 的 `/opt/lisglosips-s28/lisglosips-s28-sip.py` 和 `/etc/systemd/system/lisglosips-s28-uas.service`；A 的 `/etc/opensips/opensips.cfg`
+- 安装软件及固定版本：未安装新系统软件；B 继续使用 Node.js `v22.22.2`、Corepack `0.34.6`、pnpm `10.33.0`、Prisma `6.19.0`
+- 执行的关键命令：本地 `corepack pnpm@10.33.0 install --lockfile-only`、`corepack pnpm@10.33.0 build`、`corepack pnpm@10.33.0 prisma:validate`、`corepack pnpm@10.33.0 fetch`；B 端离线 `pnpm install --frozen-lockfile --offline --ignore-scripts`、MySQL 迁移/种子、systemd restart/enable；A `opensips -C -f /tmp/opensips-s28.rendered.cfg` 后重启 `opensips`；T 启动 `lisglosips-s28-uas.service`。凭据均从 `.codex-private/` 读取并通过 stdin/base64 参数传递，未写入文档或输出明文密码。
+- 验证结果：最终候选呼叫 Call-ID `s28-1782054233152-f4eiz799@lisglosips-t`；T 收到 `100 Giving it a try`、`200 OK`，随后 BYE 返回 `200 OK`；A 日志显示 hotpath allow、成功 CDR XADD `1782054232944-0`、ACK/BYE 均从 T 回到 A；RTPEngine session 最终回到 0；B MySQL `raw_cdrs` 生成 `raw_2903404fa10b47a6a4b7968e3662cdd5`，`sip_code=200`、`hangup_reason=NORMAL_CLEARING`、`customer_id=cus_s28_t`、`vendor_gateway_id=vgw_s28_t_uas`、`duration_sec=6`；`rated_cdrs` 生成客户费用/供应商成本 `0.012000`、计费秒数 `6`；客户 `cus_s28_t` 余额扣减到 `99.928000`（包含本次和前面 S28 调试成功 CDR）；HOMER `hep_proto_1_call` 可查到该 Call-ID 的 `INVITE`、`ACK`、`BYE`；B API ready ok，`lisglosips@api`、`lisglosips@cdr-worker`、`lisglosips@recording-worker` 均 active；T S28 UAS active。
+- 回滚方式：B 回滚先停止 `lisglosips@cdr-worker` 和 `lisglosips@recording-worker`，将 `/opt/lisglosips/current` 指回备份记录中的 S05 placeholder release，并重启 `lisglosips@api`；B 迁移前备份位于 `/var/backups/lisglosips-s28/20260621T140940Z`，如需撤回数据库写入应走备份恢复或受控反向账务处理，不直接删除 CDR/余额流水。A 回滚使用 `/var/backups/lisglosips-s28/20260621T145920Z/opensips.cfg` 恢复 `/etc/opensips/opensips.cfg`，语法检查后重启 `opensips`。T 回滚停止并删除 `lisglosips-s28-uas.service` 和 `/opt/lisglosips-s28`。Redis 配置可将 `cfg:active_version` 切回 `cfg:previous_version` 或清理 `s28-v1` 测试 keys，清理前需确认没有后续测试依赖。
+- 未解决问题：本次 T 脚本只做 SIP/SDP，不发送 RTP 音频包，因此 RTPEngine 未产生真实录音文件；Recording Worker 虽已 active，但尚未完成真实通话 `.ready` 文件搬运、`recordings` 入库和质检抽样/保存核对。S28 仍需补“RTP 音频生成 -> A 录音 ready -> B Recording Worker 入库 -> 质检接口核对”后才能标记已完成。当前 A 配置中的 S28 路由是单一测试落地端 fallback，不是完整多落地网关生产路由。
+- 下一任务：继续 `S28 - 三机端到端联调`，补齐录音和质检闭环；不得进入 S29。
+
+### 2026-06-21 21:47 - S28 三机端到端联调
+
+- 状态：已阻塞
+- 操作服务器：A、B、T；仅执行一次 S28 测试 INVITE 和只读核对，未修改服务器配置，未重启服务，未执行数据库迁移、数据删除或防火墙变更
+- 完成内容：按 S28 目标先做三机链路探针。T 使用 S21 脚本向 A `100.90.90.90:15060` 发起 IP 认证 INVITE，Call-ID 为 `s21-invite-1782049439554-088rul75@lisglosips-t`；A 返回 `SIP/2.0 503 Config Missing`；A OpenSIPS 日志确认热路径拒绝原因为 `CONFIG_MISSING`，并成功向 B Redis Stream 写入失败 CDR；B Redis Stream `stream:cdr_payload` 可按 Call-ID 查到该事件，字段包含 `node_id=a1`、`opensips_instance=opensips-a1`、`ingress_a_ip=100.90.90.90`、`rtpengine_node=a1`、`sip_code=503`、`hangup_reason=CONFIG_MISSING`；B HOMER `hep_proto_1_call` 最近记录的 `sid` 与 `data_header.callid` 均为该 Call-ID，`data_header.method=INVITE`，说明 HEP 信令镜像入库正常。
+- 修改文件：`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新软件
+- 执行的关键命令：T `/opt/lisglosips-s21/s21-call-a-ip`；A `journalctl -u opensips --since '10 minutes ago'` 按 Call-ID 查询；B `redis-cli XREVRANGE stream:cdr_payload` 按 Call-ID 查询；B PostgreSQL `homer_data.hep_proto_1_call` 只读查询；B 本机 API/数据库只读探针。所有凭据均从 `.codex-private/` 读取并通过 stdin 使用，未输出明文密码。
+- 验证结果：T->A SIP 输入、A->B Redis Stream 失败 CDR、A->B HOMER HEP 信令三段可按 Call-ID 串联；但未进入真实路由、媒体、录音、计费或质检闭环。B 当前 `/api/v2/health/live` 返回 HTTP 404，`lisglosips` 业务库表数为 `0`，说明 current release 仍不是完整 V2 API/Worker；A 当前 `/etc/opensips/opensips.cfg` 仍为 S20/S22 占位逻辑，配置缺失时返回 `Config Missing`，即便配置 allow 也会返回 `Routing Not Ready`，没有真实落地网关选择、RTPEngine offer/answer、t_relay 和对话内 ACK/BYE/re-INVITE 路由。
+- 回滚方式：本次未修改服务器配置和数据库结构，无需服务回滚；产生的一条测试 INVITE、HOMER 记录和 Redis Stream 失败 CDR 作为联调证据保留，不做直接删除。若后续需要清理测试数据，应先单独说明影响和回滚点。
+- 未解决问题：S28 阻塞在两个前置缺口：一是 B 需要受控发布完整 V2 API、Web 和 CDR/Recording Worker，并在空业务库上执行迁移/种子和健康检查；二是 A 需要新增真实呼叫路由配置，至少包含从 Redis 配置读取线路组/落地网关、供应商目标地址、RTPEngine offer/answer、t_relay、onreply/failure/dialog 内路由和成功/失败 CDR 事件。当前不能进入 S29。
+- 下一任务：继续 `S28 - 三机端到端联调`，先解除上述阻塞；不得提前执行 S29。
+
+### 2026-06-21 21:32 - S27 React Demo 接入真实 API
+
+- 状态：已完成
+- 操作服务器：本地；未连接 A/B/T，未执行服务器写操作、服务重启、数据库迁移或数据删除
+- 完成内容：新增 Web API Client，默认使用 `/api/v2`，开发环境通过 Vite proxy 转发到本地 API `127.0.0.1:3000`，可选从浏览器 `localStorage` 读取 `lisglosips.accessToken` 作为 Bearer Token，不写入或输出任何明文凭据；Dashboard 接入 `dashboard/summary` 和 `dashboard/trends`；客户、供应商、充值记录、用户、角色、操作日志接入真实列表 API；客户/供应商新增、编辑、充值调用真实 API 并在成功后重新拉取数据；页面新增统一加载、错误和空状态，未登录或无权限时显示鉴权提示；顶部状态从“纯前端 Mock”改为真实 API 状态。CDR、计费、SIP 运维、监控告警、系统设置仍保留为未完成业务页面/静态运维原型，等待对应后端查询接口或后续延期页面设计，不在本任务伪造真实数据。
+- 修改文件：`apps/web/src/api.js`、`apps/web/src/App.jsx`、`apps/web/src/styles.css`、`apps/web/vite.config.js`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新软件；继续使用 React `18.2.0`、Vite `5.4.21`、pnpm `10.33.0`
+- 执行的关键命令：`corepack pnpm@10.33.0 --filter @lisglosips/web build`、`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`、本地启动 `corepack pnpm@10.33.0 --filter @lisglosips/web dev`
+- 验证结果：Web 单包 build 通过；全 workspace `typecheck`、`lint`、`build` 均通过；本地 Vite 页面 `http://127.0.0.1:5173/` 返回 HTTP 200。API 服务若未启动或未登录，前端会展示错误态而不是回退到静态运营数据。
+- 回滚方式：删除 `apps/web/src/api.js`，恢复 `apps/web/src/App.jsx` 中本次 API 数据加载、真实接口操作、空状态和顶部 API 状态改动，恢复 `apps/web/src/styles.css` 的空状态样式和 `apps/web/vite.config.js` proxy 配置，重新执行 `corepack pnpm@10.33.0 --filter @lisglosips/web build`；S27 未修改远端服务或数据库，无远端数据需回滚。
+- 未解决问题：B 当前 `/opt/lisglosips/current` 仍是 S05 placeholder release，本次未部署到 B 当前 Web/API 服务；前端尚无登录页，真实接口需要已有 Bearer Token 或同源 Cookie 才能返回业务数据；CDR 查询、计费页面、自研 SIP 运维、监控告警、系统设置仍缺少对应产品化后端页面接口或属于延期页面，S27 未提前实现。
+- 下一任务：`S28 - 三机端到端联调`
+
+### 2026-06-21 21:20 - S26 Dashboard 聚合
+
+- 状态：已完成
+- 操作服务器：本地；未连接 A/B/T，未执行服务器写操作、服务重启、数据库迁移或数据删除
+- 完成内容：新增 `DashboardModule`，实现 `GET /api/v2/dashboard/summary` 和 `GET /api/v2/dashboard/trends`；接口统一要求 `dashboard.view` 权限；summary 按 `Asia/Shanghai` 今日窗口聚合 raw CDR、rated CDR、启用客户/网关、待质检数量、失败响应码和失败落地网关 Top 10；trends 支持 `hours=1..168`、`bucketMinutes=5|15|60`，按固定桶返回通话、接通率、时长、客户费用、供应商成本和毛利；实时在线通话和注册数当前返回 `0` 并标记 `source: "not_configured"`，等待后续接入 Redis/OpenSIPS 指标。未新增预聚合表，未做 `worker-metrics`，未进入 S27 前端接入。
+- 修改文件：`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/dashboard/`、`docs/DASHBOARD_AGGREGATION_RUNBOOK.md`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新软件；继续使用既有 NestJS/Fastify、Prisma `6.19.0`、Vitest `4.0.14`、TypeScript `5.9.3`
+- 执行的关键命令：`corepack pnpm@10.33.0 exec vitest run apps/api/src/modules/dashboard/dashboard.service.spec.ts`、`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`
+- 验证结果：S26 聚焦测试 1 个文件 4 条通过，覆盖上海自然日边界、接通率、趋势桶和参数校验；全 workspace `typecheck`、`lint`、`build` 均通过
+- 回滚方式：从 `AppModule` 移除 `DashboardModule`，删除 `apps/api/src/modules/dashboard/` 和 `docs/DASHBOARD_AGGREGATION_RUNBOOK.md`，重新执行 `corepack pnpm@10.33.0 build`；S26 未对远端数据库写入，无远端数据需清理
+- 未解决问题：B 当前 `/opt/lisglosips/current` 仍是 S05 placeholder release，本次未部署到 B 当前 API 服务；Dashboard 设计要求的真正实时在线通话/注册数仍需后续接入 Redis/OpenSIPS 指标；24 小时趋势最终应由 `worker-metrics` 或 CDR Worker 增量写入预聚合表，本次只做时间窗口受限查询，避免扫描全量 CDR。
+- 下一任务：`S27 - React Demo 接入真实 API`
+
+### 2026-06-21 21:05 - S25 质检后端
+
+- 状态：已完成
+- 操作服务器：本地；未连接 A/B/T，未执行服务器写操作、服务重启、数据库迁移或数据删除
+- 完成内容：新增 `QualityModule`，实现 `GET/POST/PATCH/DELETE /api/v2/quality/rules` 及规则启停，支持按客户、线路组、比例、生效时间和过期时间配置抽检规则；新增稳定抽样算法 `sha256(rule_id:recording_id)`，同一规则与录音重复查询结果稳定；扩展 `RecordingsModule`，实现 `GET /api/v2/recordings`、`GET /api/v2/recordings/:id`、`PUT /api/v2/recordings/:id/review`，返回录音 CDR 摘要、最新质检、历史质检、上下条导航和抽样命中信息；保存质检结果写入 `quality_reviews`，不覆盖历史；规则变更和质检保存均接入 `AuditAction` 元数据；权限使用 `quality.view`、`quality.manage`、`recordings.play`。未做 Dashboard 聚合，未扩展 S26 内容。
+- 修改文件：`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/quality/`、`apps/api/src/modules/recordings/recordings.controller.ts`、`apps/api/src/modules/recordings/recordings.repository.ts`、`apps/api/src/modules/recordings/recordings.service.ts`、`apps/api/src/modules/recordings/recordings.module.ts`、`apps/api/src/modules/recordings/recordings.service.spec.ts`、`docs/QUALITY_BACKEND_RUNBOOK.md`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新软件；继续使用既有 NestJS/Fastify、Prisma `6.19.0`、Vitest `4.0.14`、TypeScript `5.9.3`
+- 执行的关键命令：`corepack pnpm@10.33.0 exec vitest run apps/api/src/modules/quality/sampling.spec.ts apps/api/src/modules/recordings/recordings.service.spec.ts`、`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`
+- 验证结果：S25 聚焦测试 2 个文件 6 条通过，覆盖稳定抽样可重复、比例边界、录音列表抽样状态、保存质检输入校验和 S24 内部播放路径安全；全 workspace `typecheck`、`lint`、`build` 均通过
+- 回滚方式：删除或恢复 `apps/api/src/modules/quality/`，将 `apps/api/src/modules/recordings/` 恢复到 S24 版本，从 `AppModule` 移除 `QualityModule`，重新执行 `corepack pnpm@10.33.0 build`；S25 未对远端数据库写入，无远端数据需清理；若后续已运行 API 并产生 `quality_reviews`，不直接删除历史记录，应通过审计可见的更正记录或受控维护窗口处理
+- 未解决问题：B 当前 `/opt/lisglosips/current` 仍是 S05 placeholder release，本次未部署到 B 当前 API 服务；真实录音和 raw CDR 关联仍依赖 S28 端到端闭环产生；Dashboard 的待质检数量、趋势和聚合指标留给 S26。
+- 下一任务：`S26 - Dashboard 聚合`
+
+### 2026-06-21 20:20 - S24 录音搬运与播放
+
+- 状态：已完成
+- 操作服务器：A、B、本地；T 未操作
+- 完成内容：新增 Recording Worker 搬运服务，支持扫描 A `/dev/shm/voip_rec/ready/**/*.ready`、SSH 私网拉取、文件大小校验、SHA-256、B 端 `.part-*` 临时文件原子改名、写入 `recordings` 表、校验成功后才删除 A 源 `.ready`；新增 `GET /api/v2/recordings/:id/play`，要求 `recordings.play` 权限，状态必须为 `READY`，通过 `X-Accel-Redirect` 转发到 Nginx 内部 `/_recordings/`，不暴露真实 `/data/recordings` 路径；A 端 finalizer ready 目录改为 `0770`，使专用拉取用户可在校验后删除源文件；B 建立专用拉取 key 和 known_hosts；A 建立专用低权限用户 `lisglo-rec-pull` 并加入 `rtpengine` 组。未调整 SSH 管理端口，未禁止 SSH key 登录，未重启 OpenSIPS、RTPEngine、Nginx 或 API。
+- 修改文件：`apps/worker-recording/src/main.ts`、`apps/worker-recording/src/transfer.ts`、`apps/worker-recording/src/transfer.spec.ts`、`apps/worker-recording/package.json`、`apps/worker-recording/tsconfig.json`、`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/recordings/`、`pnpm-lock.yaml`、`infra/server-a/s19/scripts/lisglosips-recording-finalize`、`docs/RECORDING_TRANSFER_PLAYBACK_RUNBOOK.md`、`IMPLEMENTATION_STATUS.md`；A 的 `/usr/local/sbin/lisglosips-recording-finalize`、`/var/lib/lisglo-rec-pull/.ssh/authorized_keys` 和 `/dev/shm/voip_rec/ready` 权限；B 的 `/etc/lisglosips/recording/` 和 `/data/recordings/s24-smoke/s24-smoke.wav`
+- 安装软件及固定版本：未安装新软件；继续使用既有 OpenSSH、Node.js `v22.22.2`、pnpm `10.33.0`、Nginx `1.24.0-2ubuntu7.12`。新增系统用户 `lisglo-rec-pull`，未新增系统包。
+- 执行的关键命令：本地 `corepack pnpm@10.33.0 exec vitest run apps/worker-recording/src/transfer.spec.ts apps/api/src/modules/recordings/recordings.service.spec.ts`、`corepack pnpm@10.33.0 --filter @lisglosips/worker-recording build`、`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`；A `bash -n /usr/local/sbin/lisglosips-recording-finalize`、创建 S24 测试 incoming 文件并运行 finalizer；B 使用 `lisglo-recorder` 通过专用 key 从 A 拉取、校验、落盘、删除测试源文件。sudo 凭据通过 `.codex-private/` 读取并经 stdin 使用，未回显。
+- 验证结果：本地 2 个测试文件 5 条测试通过，覆盖路径安全、`.ready` 转 storage key、复制/哈希/落盘/源删除、大小不匹配不删除源文件、API 内部路径穿越防护；`worker-recording` 单包 build、全 workspace `typecheck`、`lint`、`build` 均通过；A 测试文件从 `incoming` 进入 `ready`，B 私网拉取到 `/data/recordings/s24-smoke/s24-smoke.wav`，大小 `31`，属主 `lisglo-recorder:lisglosips`，SHA-256 为 `c72dd3909a317ad55817435b7ed5a0db6947455ffc66e09a2dde787fe4a8c348`，校验后 A 源 `.ready` 已删除；外部直接访问 `https://127.0.0.1/_recordings/s24-smoke/s24-smoke.wav` 返回 `404`，Nginx 内部录音 location 未暴露。
+- 回滚方式：A 备份目录 `/var/backups/lisglosips-s24/20260621T121130Z`，可恢复 `lisglosips-recording-finalize`、删除 `lisglo-rec-pull` 用户并将 `/dev/shm/voip_rec/ready` 恢复 `0750`；B 备份目录 `/var/backups/lisglosips-s24/20260621T121100Z`，可删除 `/etc/lisglosips/recording` 和 `/data/recordings/s24-smoke`；代码回滚恢复本次新增/修改文件后重新 build。详见 `docs/RECORDING_TRANSFER_PLAYBACK_RUNBOOK.md`。
+- 未解决问题：B 当前 `/opt/lisglosips/current` 仍是 S05 placeholder release，尚未切换完整 monorepo API/Worker release，因此本次未启用正式 `lisglosips@recording-worker.service`，API 播放入口完成代码与构建但未在 B 当前 release 对外提供；真实通话录音字段仍依赖后续 S28 端到端路由/媒体闭环产生。
+- 下一任务：`S25 - 质检后端`
+
+### 2026-06-21 20:02 - B sudo 凭据复验
+
+- 状态：已完成
+- 操作服务器：B、本地；仅执行只读 SSH 与 sudo 校验，未修改服务器配置、未重启服务、未执行数据库写入或数据删除
+- 完成内容：读取 `.codex-private/` 中 DPAPI 保存的 B 凭据且未回显密码；复验 B SSH Key 登录正常；确认 `hector` 属于 `sudo` 组；使用保存的 sudo 凭据执行 `sudo -v` 成功；使用 sudo 执行只读权限检查成功
+- 修改文件：`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：无
+- 执行的关键命令：`ssh -F .codex-private\ssh\config lisglosips-b ...`；PowerShell `Import-Clixml .codex-private\SERVER_CREDENTIALS.clixml` 后通过 stdin 向远端 `sudo -S` 提供凭据，命令与输出均未包含明文密码
+- 验证结果：B 返回主机名 `YanZi`，用户 `hector` 在 `sudo` 组；`sudo -v` 退出码为 0；只读 sudo 检查退出码为 0
+- 回滚方式：无服务器变更无需回滚；如需撤销本地状态记录，恢复本文件本节和顶部阻塞说明
+- 未解决问题：S13-S17 历史任务仍未补做 B 临时库冒烟；若后续补验会涉及数据库写入，应在执行前单独说明影响与回滚点
+- 下一任务：`S24 - 录音搬运与播放`
+
+### 2026-06-21 19:55 - S23 最小计费与余额扣减
+
+- 状态：已完成
+- 操作服务器：本地；未连接 A/B/T，未执行服务器写操作、服务重启、数据库迁移或数据删除
+- 完成内容：在 `worker-cdr` 中接入最小计费服务，Redis Stream CDR 消费后写入 `raw_cdrs`、成功通话写入 `rated_cdrs`、按落地网关周期秒数和周期费率计算费用、扣减客户余额，并用负数 `customer_recharges` 记录不可变扣费流水；同一 `event_id` 或同一 `raw_cdr_id` 不重复扣费；失败 CDR、零时长 CDR、缺少客户或落地网关 ID 的 CDR 标记 `SKIPPED` 且不扣费。当前尚无客户侧费率表，S23 采用落地网关费率临时镜像为客户费用，供应商成本相同，毛利为 0，后续真实计费版本再扩展客户费率和利润计算。
+- 修改文件：`apps/worker-cdr/src/main.ts`、`apps/worker-cdr/src/billing.ts`、`apps/worker-cdr/src/rating.ts`、`apps/worker-cdr/src/rating.spec.ts`、`apps/worker-cdr/package.json`、`apps/worker-cdr/tsconfig.json`、`apps/worker-cdr/dist/`、`docs/CDR_MINIMAL_BILLING_RUNBOOK.md`、`IMPLEMENTATION_STATUS.md`；本地因 `pnpm install` 受 registry DNS/metadata 影响，手工补齐 `apps/worker-cdr/node_modules/@lisglosips/database` 到 `packages/database` 的开发 junction
+- 安装软件及固定版本：未安装新软件；继续使用既有 Node.js/pnpm、Prisma `6.19.0`、Vitest `4.0.14`、TypeScript `5.9.3`
+- 执行的关键命令：`corepack pnpm@10.33.0 exec vitest run apps/worker-cdr/src/rating.spec.ts`、`corepack pnpm@10.33.0 --filter @lisglosips/worker-cdr build`、`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`；尝试 `corepack pnpm@10.33.0 install` 与 `install --offline` 时被 npm registry DNS/本地 metadata 问题阻塞，未作为验收依据
+- 验证结果：`apps/worker-cdr/src/rating.spec.ts` 3 条测试通过，覆盖周期计费、成功 CDR 扣费幂等、失败/零时长 CDR 不扣费；`worker-cdr` 单包 build 通过；全 workspace `typecheck`、`lint`、`build` 均通过
+- 回滚方式：恢复 `apps/worker-cdr/src/main.ts` 到 S22 只记录 CDR 的版本，删除或恢复 S23 新增的 `billing.ts`、`rating.ts`、`rating.spec.ts`，恢复 `apps/worker-cdr/package.json` 和 `tsconfig.json` 后重新执行 `corepack pnpm@10.33.0 build`；S23 未执行真实数据库写入验证，无远端数据需要清理；若后续已运行 worker 并产生扣费，必须先停止 worker，再通过受控反向流水或备份恢复处理，不直接删除余额流水
+- 未解决问题：B sudo 凭据仍不可用，本次未部署 B systemd worker、未对真实 B MySQL 执行写入式冒烟；当前最小计费暂时镜像落地网关费率为客户费用，客户费率表、利润规则、低余额拦截和 Dashboard 聚合留给后续任务；`pnpm install` 当前受 registry DNS/metadata 影响，后续若新增依赖需优先修复本地包管理器联网或缓存
+- 下一任务：`S24 - 录音搬运与播放`
+
+### 2026-06-21 19:34 - S22 CDR Redis Stream
+
+- 状态：已完成
+- 操作服务器：A、T、本地；B 仅通过 A 的 Redis AUTH proxy 写入 Redis Stream Consumer Group 元数据，未使用 B sudo，未改 B 服务
+- 完成内容：新增 CDR Stream schema v1 和可靠消费库，支持 `stream:cdr_payload`、`stream:cdr_deadletter`、`billing-workers` Consumer Group、`XREADGROUP`、`XACK`、`XAUTOCLAIM` Pending 重领、死信写入和 `lock:cdr:{event_id}` 幂等占位；`worker-cdr` 从骨架改为 Redis Stream Worker，启动时确保 Consumer Group，循环先处理 Pending 再读取新消息，当前 handler 只接收/记录原始 CDR，不做计费和余额扣减；按多 A 后续演进预留 `node_id`、`opensips_instance`、`ingress_a_ip`、`rtpengine_node` 字段，当前单 A 值为 `a1`、`opensips-a1`、`100.90.90.90`、`a1`；升级 Server A OpenSIPS `route[S20_CDR_XADD]`，从 S20 冒烟 XADD 改为 S22 正式事件字段；在 Redis 创建 `billing-workers` Consumer Group。未调整 SSH 管理端口或密钥登录策略，未写入明文密码。
+- 修改文件：`packages/redis/src/index.ts`、`packages/redis/src/cdr-stream.ts`、`packages/redis/src/cdr-stream.spec.ts`、`apps/worker-cdr/src/main.ts`、`packages/redis/dist/`、`apps/worker-cdr/dist/`、`infra/server-a/s22/opensips/opensips.cfg`、`docs/CDR_REDIS_STREAM_RUNBOOK.md`、`SOFTSWITCH_PLATFORM_DESIGN_V2.md`、`IMPLEMENTATION_STATUS.md`；A 的 `/etc/opensips/opensips.cfg`；Redis `stream:cdr_payload` Consumer Group `billing-workers`
+- 安装软件及固定版本：未安装新系统软件；继续使用既有 Node.js/pnpm、OpenSIPS `3.6.7-1`、Redis `7.0.15`。新增代码复用既有 `ioredis 5.8.2`。
+- 执行的关键命令：本地 `corepack pnpm@10.33.0 exec vitest run packages/redis/src/cdr-stream.spec.ts`、`corepack pnpm@10.33.0 lint/typecheck/build`；A `opensips -C -f /etc/opensips/opensips.cfg`、`systemctl restart opensips`；A 经本地 Redis proxy 执行 `XGROUP CREATE stream:cdr_payload billing-workers 0 MKSTREAM`、`XINFO GROUPS`、`XREVRANGE`；T 执行 `/opt/lisglosips-s21/lisglosips-s21-sip.py invite --timeout 8`。sudo 凭据通过 `.codex-private/` 读取且未回显。
+- 验证结果：Redis Stream 单元测试 6 条通过，覆盖发布/解析、Consumer Group 幂等创建、`XREADGROUP`/`XACK`、重复 `event_id` 幂等、死信、`XAUTOCLAIM` Pending 重领；`lint`、`typecheck`、全 workspace `build` 均通过；A OpenSIPS 配置语法检查通过并重启后 active；Redis `XINFO GROUPS stream:cdr_payload` 显示 `billing-workers`，pending 为 0；T 发 INVITE 后 A 返回 `SIP/2.0 503 Config Missing`，A 日志显示 CDR XADD 成功，Redis 最新事件包含 `schema_version=1`、`idempotency_key`、`node_id=a1`、`opensips_instance=opensips-a1`、`ingress_a_ip=100.90.90.90`、`rtpengine_node=a1`、`sip_code=503`、`hangup_reason=CONFIG_MISSING`。一次使用 S21 默认 3 秒超时的探针未收到响应，但 A 已写入 CDR；随后使用 8 秒超时复测收到预期 `503 Config Missing`。
+- 回滚方式：A 备份目录为 `/var/backups/lisglosips-s22/20260621T113157Z`，恢复其中 `opensips.cfg` 后执行 `opensips -C -f /etc/opensips/opensips.cfg` 并重启 `opensips`；代码回滚恢复本次新增/修改的 Redis/worker 文件后重新 build；Redis Consumer Group 可保留，停止 worker 即可，不删除 `stream:cdr_payload` 数据。详见 `docs/CDR_REDIS_STREAM_RUNBOOK.md`。
+- 未解决问题：S22 只完成原始 CDR Stream 契约和可靠消费基础，不写 MySQL raw/rated CDR、不计费、不扣余额，这些留给 S23；A 端当前仍未发布真实路由配置，因此测试 CDR 为 `CONFIG_MISSING` 失败事件；B sudo 凭据仍不可用，本次未执行 B 端服务部署或 systemd worker 验收；多 A 仅完成字段预留和 A1 默认值，真实 3A 部署留到单 A 闭环之后。
+- 下一任务：`S23 - 最小计费与余额扣减`
+
+### 2026-06-21 15:28 - S21 Server T 客户模拟配置
+
+- 状态：已完成
+- 操作服务器：T、本地；A 仅接收 T 发起的 SIP 探针，未写入；B 未操作
+- 完成内容：在 Server T 建立 S21 客户模拟环境；新增测试域 `s21.lisglosips.test`；新增两套 SIP 注册测试账号 `s21-reg-1001`、`s21-reg-1002`，OpenSIPS 改为 HA1 鉴权，`subscriber.password` 为空且不保存 SIP 明文密码；新增两套 IP 认证测试条目 `s21-ip-1001`、`s21-ip-1002` 指向 T `100.93.185.30/32`；部署 `/opt/lisglosips-s21` 自包含 SIP 脚本，支持注册成功、错误鉴权、向 A 发起 IP/SIP 模拟 INVITE、本地成功/忙/拒绝/超时场景和突发 CPS 探针；收敛 T 的 MI FIFO 权限为 `0660`，TLS 私钥权限为 `0600`。未调整 SSH 管理端口或密钥登录策略，未写入明文密码。
+- 修改文件：T 的 `/etc/opensips/opensips.cfg`、OpenSIPS `opensips` 数据库 `domain/subscriber/address/location` 测试数据、`/opt/lisglosips-s21/`、`/etc/lisglosips-s21/sip-accounts.env`；本地 `infra/server-t/s21/`、`docs/SERVER_T_CUSTOMER_SIMULATION_RUNBOOK.md`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；继续使用 T 既有 OpenSIPS `3.6.6`、RTPEngine `11.5.1.18`、MariaDB `10.11.14` 和系统 Python 3。新增 SIP 测试脚本无第三方依赖。
+- 执行的关键命令：`mysqldump --single-transaction --routines --events opensips`、`opensips -C -f /etc/opensips/opensips.cfg`、`systemctl restart opensips`、`mysql --protocol=socket -uroot`、`python3 -m py_compile`、`/opt/lisglosips-s21/s21-register-*`、`s21-local-*`、`s21-call-a-*`、`s21-over-cps-a`。sudo 凭据通过 `.codex-private/` 读取且未回显。
+- 验证结果：备份目录 `/var/backups/lisglosips-s21/20260621T072316Z` 已生成并含 OpenSIPS 配置和数据库 dump；OpenSIPS 配置语法检查通过，`opensips.service` active；`s21-register-primary` 和 `s21-register-secondary` 均先收到 `401 Unauthorized` challenge 后最终 `200 OK`，`s21-register-wrong-ha1` 最终 `401 Unauthorized`；`location` 表已有 `s21-reg-1001`、`s21-reg-1002` 注册位置；`subscriber.password` 长度为 0，`ha1` 长度为 32；本地脚本分别返回 `200 OK`、`486 Busy Here`、`603 Decline` 和 `NO RESPONSE`；从 T 到 A 的 `s21-call-a-ip`、`s21-call-a-sip` 与 5 次 `s21-over-cps-a` 均稳定输出 Call-ID 并收到 A 当前预期的 `SIP/2.0 503 Config Missing`；MI FIFO 为 `660 opensips:opensips`，TLS 私钥文件为 `600 root:root`。
+- 回滚方式：停止 T 的 `opensips`，从 `/var/backups/lisglosips-s21/20260621T072316Z/opensips` 恢复 `/etc/opensips`，用该目录 `opensips.sql` 恢复 OpenSIPS 数据库，删除 `/opt/lisglosips-s21` 和 `/etc/lisglosips-s21`，执行 `opensips -C -f /etc/opensips/opensips.cfg` 后启动 `opensips`。详见 `docs/SERVER_T_CUSTOMER_SIMULATION_RUNBOOK.md`。
+- 未解决问题：A 端尚未发布真实客户/路由配置，因此 T 到 A 的 INVITE 当前按 S20 逻辑返回 `503 Config Missing`，真实路由、双向媒体、正式 CDR 和扣费留给 S22/S28；T 的 RTPEngine 仍无内核加速，防火墙默认放行、Apache/rpcbind 暴露和克隆身份问题仍为历史风险，未在 S21 扩大处理。
+- 下一任务：`S22 - CDR Redis Stream`
+
+### 2026-06-21 15:05 - S20 Server A Redis 热路径与 HEP/指标
+
+- 状态：已完成
+- 操作服务器：A、B、T、本地
+- 完成内容：在 Server A 部署 Redis 热路径 Lua 原子检查，基于 `cfg:active_version` 和版本化 `cfg:v:{version}:*` 配置读取客户、客户网关、IP 认证、策略与线路组；OpenSIPS `INVITE` 接入 Lua 热路径，配置缺失返回 `503 Config Missing`，Redis 不可用返回 `503 Redis Unavailable`，策略允许但路由未进入 S21/S28 前返回 `503 Routing Not Ready`；新增 CDR 冒烟 XADD 到 `stream:cdr_payload`；新增本地 Redis AUTH 代理，凭据通过 systemd encrypted credential 加载，OpenSIPS 只连接 `127.0.0.1:6380`；修正 HEP socket 为 `100.90.90.90:9061` 并发送至 B `100.90.90.91:9060`；新增 OpenSIPS Prometheus `script:` 指标和 Node Exporter textfile 指标；新增 S20 nftables 表阻断非本地 Redis 代理和非既有连接访问 HEP socket；未调整 SSH 管理端口或密钥登录策略，未写入明文密码。
+- 修改文件：A 的 `/etc/opensips/opensips.cfg`、`/etc/opensips/lisglosips_hotpath.lua`、`/usr/local/sbin/lisglosips-redis-auth-proxy`、`/usr/local/sbin/lisglosips-redis-load-hotpath`、`/usr/local/sbin/lisglosips-opensips-preprocess`、`/usr/local/sbin/lisglosips-s20-metrics`、`/etc/systemd/system/lisglosips-redis-auth-proxy.service`、`/etc/systemd/system/lisglosips-redis-hotpath-load.service`、`/etc/systemd/system/opensips.service.d/20-lisglosips-s20.conf`、`/etc/systemd/system/lisglosips-s20-metrics.service`、`/etc/systemd/system/lisglosips-s20-metrics.timer`、`/etc/default/lisglosips-node-exporter`、`/etc/nftables.d/lisglosips-s20-observability.nft`、`/etc/systemd/system/lisglosips-a-firewall.service`；本地 `infra/server-a/s20/`、`docs/SERVER_A_REDIS_HEP_METRICS_RUNBOOK.md`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；继续使用 OpenSIPS `3.6.7-1`、Redis Server B 既有 `7.0.15`、Node Exporter `1.7.0`、RTPEngine `11.5.1.18-1ubuntu1.2`。新增 systemd encrypted credential 文件 `/etc/credstore.encrypted/lisglosips-redis-password.cred`，未写明文凭据。
+- 执行的关键命令：`opensips -C -f /etc/opensips/opensips.cfg`、`systemctl daemon-reload/enable/restart/start/stop`、`nft -c/-f`、`curl http://127.0.0.1:8888/metrics`、`curl http://100.90.90.90:9100/metrics`、从 T 发送 SIP `INVITE`，A/B Redis RESP 冒烟，A `tcpdump` 观察 HEP，B `journalctl -u heplify-server` 查询 HEP 统计。所有凭据均通过 `.codex-private/` 读取并已避免回显。
+- 验证结果：A `systemctl is-system-running` 为 `running`；`opensips`、`lisglosips-redis-auth-proxy`、`lisglosips-s20-metrics.timer`、`lisglosips-node-exporter`、`lisglosips-a-firewall`、`rtpengine-daemon`、`rtpengine-recording-daemon` 均 active，S20 新增服务均 enabled；`lisglosips-redis-hotpath-load.service` oneshot 结果为 `success`；监听端口为 `100.90.90.90:15060/udp`、`100.90.90.90:9061/udp`、`127.0.0.1:6380/tcp`、`127.0.0.1:8888/tcp`、`100.90.90.90:9100/tcp`；S20 nftables 表存在；A 到 B Redis PING/AUTH 通过；无配置版本时 T 发 INVITE 返回 `SIP/2.0 503 Config Missing`，OpenSIPS 记录热路径拒绝且 CDR XADD 成功；临时 Redis 冒烟配置下 T 发 INVITE 返回 `SIP/2.0 503 Routing Not Ready`，返回字段含配置版本、客户网关、策略和线路组，测试 Redis keys 与 CDR 事件已清理；短暂停止 Redis 代理后 T 发 INVITE 返回 `SIP/2.0 503 Redis Unavailable`，日志明确记录 Redis 热路径不可用和 CDR XADD 失败，代理与 Lua loader 随后恢复；OpenSIPS Prometheus 暴露 `lisglosips_opensips_s20_*`，B 可抓取 A Node Exporter textfile 指标 `lisglosips_redis_proxy_up`、录音 tmpfs、ready/part 文件数和 RTPEngine sessions；HEP 绑定修正后 A 侧抓包看到发往 B `9060/udp` 的 HEP，B heplify 统计显示 HEP 收包且 Error 为 0，修正后 A 无新增 HEP 发送错误；S20 本地产物敏感扫描未发现明文凭据，命中的仅为 credential 名称或历史文档中的安全术语。
+- 回滚方式：A 备份目录为 `/var/backups/lisglosips-s20/20260621T061900Z`，验证阶段的 OpenSIPS 配置副本位于该目录 `post-verify/` 下；回滚时停止 S20 metrics timer 和 Redis AUTH proxy，从备份恢复 `/etc/opensips/opensips.cfg`、S20 systemd/drop-in、Node Exporter 默认文件和 nftables 文件，执行 `opensips -C -f /etc/opensips/opensips.cfg` 后重启 `opensips`、`lisglosips-node-exporter`、`lisglosips-a-firewall`，不删除 Redis Stream 历史数据。详细步骤见 `docs/SERVER_A_REDIS_HEP_METRICS_RUNBOOK.md`。
+- 未解决问题：S20 只完成热路径检查、HEP 和指标，不实现真实落地路由、SIP 注册账号、双向媒体、正式 CDR 契约和计费；这些留给 S21/S22/S28。B sudo 凭据仍无法通过校验，本次 B 侧仅使用免 sudo 的只读 heplify 日志和已有服务凭据做验证；HOMER 数据库未稳定查到本次 OpenSIPS HEP Call-ID 行，但 heplify 已确认收包，后续 S28 端到端联调需继续核对 HOMER UI/库内 Call-ID。
+- 下一任务：`S21 - Server T 客户模拟配置`
+
+### 2026-06-21 14:00 - S19 Server A RTPEngine 与录音 tmpfs
+
+- 状态：已完成
+- 操作服务器：A、T、本地
+- 完成内容：在 Server A 安装并固定 RTPEngine `11.5.1.18-1ubuntu1.2` 及 kernel DKMS/recording 组件；加载 `xt_RTPENGINE` 内核模块，DKMS 已为 `6.17.0-22-generic` 与 `6.17.0-35-generic` 构建；配置 RTPEngine 媒体地址 `100.90.90.90`、RTP `30000-40000/udp`、本地 NG/CLI/HTTP 控制口 `127.0.0.1:2223/2224/2225`；创建 `/dev/shm/voip_rec` 3 GiB tmpfs 与 `spool/incoming/ready/failed/tmp` 目录；部署录音 finalizer，按 `incoming -> ready/*.part -> ready/*.ready` 原子规则生成 ready 文件；新增 `lisglosips-a-firewall.service` 保障 S18/S19 nftables 表重启后自动加载；新增 OpenSIPS systemd drop-in 等待 Tailscale 地址后启动；覆盖 `rtpengine-recording-daemon.service`，移除包默认 NFS/rpcbind 依赖；停止并 mask S19 不使用的 `rpcbind.service/socket`。未调整 SSH 管理端口或密钥登录策略。
+- 修改文件：A 的 `/etc/rtpengine/rtpengine.conf`、`/etc/rtpengine/rtpengine-recording.conf`、`/etc/default/rtpengine-daemon`、`/etc/default/rtpengine-recording-daemon`、`/etc/fstab`、`/etc/nftables.d/lisglosips-s19-rtpengine.nft`、`/etc/systemd/system/lisglosips-a-firewall.service`、`/etc/systemd/system/opensips.service.d/10-lisglosips-wait-tailscale.conf`、`/etc/systemd/system/rtpengine-recording-daemon.service`、`/etc/systemd/system/lisglosips-recording-finalize.service`、`/etc/systemd/system/lisglosips-recording-finalize.timer`、`/etc/tmpfiles.d/lisglosips-voip-rec.conf`、`/usr/local/sbin/lisglosips-recording-finalize`；本地 `infra/server-a/s19/`、`docs/SERVER_A_RTPENGINE_RECORDING_RUNBOOK.md`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：`rtpengine`、`rtpengine-daemon`、`rtpengine-recording-daemon`、`rtpengine-iptables`、`rtpengine-kernel-dkms`、`rtpengine-utils` 均为 `11.5.1.18-1ubuntu1.2` 并已 `apt-mark hold`；安装匹配内核 headers。未新增明文凭据。
+- 执行的关键命令：`apt-get install`、`apt-mark hold`、`modprobe xt_RTPENGINE`、`dkms status`、`nft -c/-f`、`systemctl daemon-reload/enable/restart/reboot`、`systemd-tmpfiles --create`、`rtpengine-ctl -ip 127.0.0.1 -port 2224 list numsessions/interfaces`、`tcpdump`、从 T 发送 RTP UDP 与 SIP `OPTIONS`/`REGISTER` 测试包。
+- 验证结果：A 二次重启后 `systemctl is-system-running` 为 `running` 且 0 failed unit；`opensips`、`rtpengine-daemon`、`rtpengine-recording-daemon`、`lisglosips-recording-finalize.timer`、`lisglosips-a-firewall.service`、`lisglosips-node-exporter.service` 全部 active/enabled；`/dev/shm/voip_rec` 为 3.0 GiB tmpfs，子目录均为 `rtpengine:rtpengine 0750`；`xt_RTPENGINE` 已加载，DKMS 状态 installed；`rtpengine-ctl` 显示接口 `100.90.90.90` 和端口段 `30000 - 40000`；nftables S18/S19 表重启后存在；从 T 到 A `30000/udp`、`40000/udp` 的 RTP 探针在 A `tailscale0` 抓包可见；从 T 发 SIP `OPTIONS` 返回 `SIP/2.0 200 Keepalive`，`REGISTER` 返回 `SIP/2.0 401 Authentication Required` 和 `WWW-Authenticate`；录音 finalizer 冒烟将测试 `.wav` 生成 `ready/...wav.ready`，权限 `0640`，无 `.part` 残留，测试文件已删除；本地 S19 产物敏感信息扫描未命中。
+- 回滚方式：A 备份目录为 `/var/backups/lisglosips-s19/20260621T054645Z`；回滚时停止 `rtpengine-recording-daemon`、`lisglosips-recording-finalize.timer`、`rtpengine-daemon`，从备份恢复 `/etc/rtpengine/`、`/etc/default/`、`/etc/fstab` 等配置，删除 `inet lisglosips_s19_rtpengine` nftables 表，停用并删除 S19 systemd/tmpfiles/finalizer 文件，必要时 `apt-mark unhold` 后卸载 RTPEngine 包；详细步骤见 `docs/SERVER_A_RTPENGINE_RECORDING_RUNBOOK.md`。
+- 未解决问题：S19 尚未把 OpenSIPS 呼叫路由接入 RTPEngine，真实双向音频、NAT 媒体锚定和完整通话录音需在 S20/S21/S28 完成；Tailscale APT 源在 A 上仍有 DNS 解析失败历史但当前 Tailscale 网络和服务运行正常；B sudo 凭据阻塞仍未解决，不影响本次 A 端 S19。
+- 下一任务：`S20 - Server A Redis 热路径与 HEP/指标`
+
+### 2026-06-21 13:29 - S18 Server A OpenSIPS 基线
+
+- 状态：已完成
+- 操作服务器：A、本地
+- 完成内容：在 Server A 添加 OpenSIPS 官方 APT 源并安装固定 OpenSIPS `3.6.7-1`；安装并 hold `opensips`、`opensips-cli`、`opensips-auth-modules`、`opensips-redis-module`、`opensips-http-modules`、`opensips-json-module`、`opensips-restclient-module`、`opensips-prometheus-module`、`opensips-tlsmgm-module`、`opensips-tls-module`、`opensips-tls-openssl-module`；部署 `/etc/opensips/opensips.cfg`，OpenSIPS 仅监听 `100.90.90.90:15060/udp`，HEP transport 占位监听 `127.0.0.1:9061/udp`，MI HTTP 仅监听 `127.0.0.1:8888/tcp`；加载 `auth`、`pike`、`ratelimit`、`cachedb_redis`、`proto_hep`、`tracer`、`mi_http` 等模块；实现 S18 保守路由基线：`OPTIONS` 返回 `200 Keepalive`，`REGISTER` 返回带 Digest challenge 的 `401 Authentication Required`，`INVITE` 在 S20/S21 前返回 `503 Routing Not Ready`，避免开放中继；新增 `inet lisglosips_s18_opensips` nftables 表，只允许 T `100.93.185.30` 访问 A 的 UDP `15060`，丢弃其他 15060 来源，并阻断非本地 MI HTTP；未调整 SSH 管理端口或密钥登录策略。
+- 修改文件：A 的 `/etc/apt/sources.list.d/opensips.list`、`/etc/apt/sources.list.d/opensips-cli.list`、`/etc/opensips/opensips.cfg`、`/etc/default/opensips`、`/etc/nftables.d/lisglosips-s18-opensips.nft`；本地 `infra/server-a/s18/`、`docs/SERVER_A_OPENSIPS_BASELINE_RUNBOOK.md`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：OpenSIPS `3.6.7-1`；OpenSIPS CLI `0.4.0~20260522~570a9a9-1`；所有 S18 OpenSIPS 包已 `apt-mark hold`。未新增明文凭据。
+- 执行的关键命令：`apt-get update`、`apt-get install`、`apt-mark hold`、`opensips -C -f /etc/opensips/opensips.cfg`、`systemctl enable --now/restart opensips`、`nft -c -f /etc/nftables.d/lisglosips-s18-opensips.nft`、`nft -f /etc/nftables.d/lisglosips-s18-opensips.nft`、`curl -X POST http://127.0.0.1:8888/mi`、从 T 发送 SIP `OPTIONS`/`REGISTER` 测试包。
+- 验证结果：A 系统状态 `running`；`opensips.service` active/enabled；OpenSIPS 配置语法检查通过；监听端口为 `100.90.90.90:15060/udp`、`127.0.0.1:9061/udp`、`127.0.0.1:8888/tcp`，S06 的 `100.90.90.90:9100/tcp` 保持；MI HTTP JSON-RPC `version` 返回 `OpenSIPS (3.6.7 (x86_64/linux))`；从 T `100.93.185.30` 发往 A `15060/udp` 的 SIP `OPTIONS` 返回 `SIP/2.0 200 Keepalive`；SIP `REGISTER` 返回 `SIP/2.0 401 Authentication Required` 且包含 `WWW-Authenticate`；nftables S18 表加载成功；本地 S18 产物敏感信息扫描未命中。
+- 回滚方式：A 备份目录为 `/var/backups/lisglosips-s18/20260621T051403Z`；回滚时执行 `systemctl stop opensips`，从备份恢复 `/etc/opensips/` 和 `/etc/default/opensips`，删除 `inet lisglosips_s18_opensips` nftables 表，必要时 `apt-mark unhold` 并卸载 S18 OpenSIPS 包；详细步骤见 `docs/SERVER_A_OPENSIPS_BASELINE_RUNBOOK.md`。
+- 未解决问题：Tailscale APT 源在 A 上一度 DNS 解析失败，但 Tailscale 服务和当前连接未受影响；A 仍存在 S01 记录的本地 ens18 双地址/路由历史风险，S18 的 OpenSIPS 绑定 Tailscale 地址规避了 SIP 监听歧义；当前 HEP trace 已有目标配置但未查询 B 的 HOMER 入库，完整 HEP/Redis 热路径和指标留给 S20；RTPEngine、RTP 端口和录音 tmpfs 留给 S19。
+- 下一任务：`S19 - Server A RTPEngine 与录音 tmpfs`
+
+### 2026-06-21 13:06 - S17 落地线路组 API
+
+- 状态：已完成
+- 操作服务器：本地；B 未执行写操作
+- 完成内容：新增 LandingLineGroupsModule，提供 `GET /landing-line-groups`、`GET /landing-line-groups/:id`、`POST /landing-line-groups`、`PATCH /landing-line-groups/:id`、`POST /landing-line-groups/:id/enable`、`POST /landing-line-groups/:id/disable`、`DELETE /landing-line-groups/:id`、`POST /landing-line-groups/:id/items`、`PATCH /landing-line-groups/items/:itemId`、`DELETE /landing-line-groups/:id/items/:gatewayId`、`POST /landing-line-groups/:id/items/reorder`；支持线路组启停、软删除、成员增删改、成员优先级重排、权重、成员并发上限和成员状态；返回 `itemCount`、`enabledItemCount`、`concurrencyCapSum`、`gatewayConcurrencyLimitSum` 和 `policyCount`，用于组内并发汇总与引用可见性；新增引用校验，成员只能引用未删除落地网关，软删除线路组前阻止仍被未删除客户网关策略引用的线路组删除；读操作绑定 `line_groups.view`，写操作绑定 `line_groups.manage` 和审计动作；线路组与成员变更写入 `line_group_config` Outbox，Config Publisher 扩展线路组快照并发布 `cfg:v:{version}:line_group:*` 与 `line_group:*:items`。
+- 修改文件：`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/landing-line-groups/`、`apps/worker-config-publisher/src/publisher.ts`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；未新增 npm 包；继续使用 Node.js `v22.22.2`、Prisma `6.19.0`、pnpm `10.33.0`。
+- 执行的关键命令：`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 test -- landing-line-groups`、`corepack pnpm@10.33.0 test`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`。
+- 验证结果：typecheck 通过；S17 相关 Vitest 14 个测试文件 44 条测试通过，其中 `landing-line-groups.e2e.spec.ts` 覆盖线路组列表并发汇总、写权限拒绝、创建、成员新增/更新/删除、成员参数校验、优先级重排、启停、软删除和审计记录；全量 Vitest 14 个测试文件 44 条测试通过；lint 通过；workspace build 通过，包含 `apps/worker-config-publisher` 构建通过。
+- 回滚方式：移除 `LandingLineGroupsModule` 导入并删除 `apps/api/src/modules/landing-line-groups/`；恢复 `apps/worker-config-publisher/src/publisher.ts` 中 S17 新增的 `line_group_config` Outbox 处理和线路组快照发布逻辑。S17 未新增数据库迁移，B 端未创建临时库、未改服务、未写 Redis 或 MySQL。
+- 未解决问题：B 写入式临时库冒烟未执行，因为当前 B sudo 凭据仍无法通过校验，迁移账号也无权创建临时库；S17 不实现 OpenSIPS 呼叫路由或 Server A 配置，这些从 S18 开始。
+- 下一任务：`S18 - Server A OpenSIPS 基线`
+
+### 2026-06-21 11:57 - S16 落地网关 API
+
+- 状态：已完成
+- 操作服务器：本地；B 未执行写操作
+- 完成内容：新增 VendorGatewaysModule，提供 `GET /vendor-gateways`、`GET /vendor-gateways/:id`、`POST /vendor-gateways`、`PATCH /vendor-gateways/:id`、`POST /vendor-gateways/:id/enable`、`POST /vendor-gateways/:id/disable`；支持供应商落地网关 `IP`、`SIP_DIGEST`、`MIXED` 三种认证模式，创建和更新时校验 host/port/transport、SIP 用户名与密码强度，并以 `username:host:password` 生成 HA1，API 响应只返回 `hasSipCredential` 不返回明文密码或 HA1；支持 CPS、并发上限、禁呼时段、编码优先级、主叫/被叫号码前缀转换、计费周期秒数和周期费率，响应补充按分钟折算的 `minuteRate`；写操作绑定 `vendor_gateways.manage` 和审计动作，读操作绑定 `vendor_gateways.view`；落地网关创建、更新、启停写入 `vendor_gateway_config` Outbox，Config Publisher 扩展供应商落地网关快照并发布到 Redis 版本化配置。
+- 修改文件：`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/vendor-gateways/`、`apps/worker-config-publisher/src/publisher.ts`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；未新增 npm 包；继续使用 Node.js `v22.22.2`、Prisma `6.19.0`、pnpm `10.33.0`。
+- 执行的关键命令：`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 test -- vendor-gateways`、`corepack pnpm@10.33.0 test`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`。
+- 验证结果：typecheck 通过；S16 相关 Vitest 13 个测试文件 40 条测试通过，其中 `vendor-gateways.e2e.spec.ts` 覆盖列表脱敏、写权限拒绝、完整 SIP Digest 网关创建、审计敏感字段脱敏、切换 IP 模式清空 SIP 凭据、重复编码优先级校验和启停；全量 Vitest 13 个测试文件 40 条测试通过；lint 通过；workspace build 通过，包含 `apps/worker-config-publisher` 构建通过。
+- 回滚方式：移除 `VendorGatewaysModule` 导入并删除 `apps/api/src/modules/vendor-gateways/`；恢复 `apps/worker-config-publisher/src/publisher.ts` 中 S16 新增的 `vendor_gateway_config` Outbox 处理和落地网关快照发布逻辑。S16 未新增数据库迁移，B 端未创建临时库、未改服务、未写 Redis 或 MySQL。
+- 未解决问题：B 写入式临时库冒烟未执行，因为当前 B sudo 凭据仍无法通过校验，迁移账号也无权创建临时库；S16 不实现落地线路组成员、优先级重排或并发汇总，这些留给 S17。
+- 下一任务：`S17 - 落地线路组 API`
+
+### 2026-06-21 11:45 - S15 供应商管理 API
+
+- 状态：已完成
+- 操作服务器：本地；B 未执行写操作
+- 完成内容：新增 VendorsModule，提供 `GET /vendors`、`GET /vendors/:id`、`POST /vendors`、`PATCH /vendors/:id`、`POST /vendors/:id/enable`、`POST /vendors/:id/disable`、`DELETE /vendors/:id`；供应商返回余额、授信额度、可用余额和落地网关数量；余额保持只读，供应商充值仍通过 S12 的不可变充值流水；支持联系人、电话、邮箱、结算方式、备注、授信额度和启停状态维护；软删除前阻止仍有关联未删除落地网关的供应商删除；读操作绑定 `vendors.view`，写操作绑定 `vendors.manage` 和审计动作。
+- 修改文件：`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/vendors/`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；未新增 npm 包；继续使用 Node.js `v22.22.2`、Prisma `6.19.0`、pnpm `10.33.0`。
+- 执行的关键命令：`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 test -- vendors`、`corepack pnpm@10.33.0 test`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`。
+- 验证结果：typecheck 通过；S15 相关 Vitest 12 个测试文件 36 条测试通过；全量 Vitest 12 个测试文件 36 条测试通过，覆盖供应商余额/授信/网关数量读取、写权限拒绝、新增、编辑、启停、软删除和审计记录；lint 通过；workspace build 通过。
+- 回滚方式：移除 `VendorsModule` 导入并删除 `apps/api/src/modules/vendors/`；S15 未新增数据库迁移。B 端未创建临时库、未改服务、未写 Redis 或 MySQL。
+- 未解决问题：B 写入式临时库冒烟未执行，因为当前 B sudo 凭据仍无法通过校验，迁移账号也无权创建临时库；S15 不实现落地网关、费率、CPS/并发或号码转换，这些留给 S16。
+- 下一任务：`S16 - 落地网关 API`
+
+### 2026-06-21 11:39 - S14 客户网关策略与 Redis 配置发布
+
+- 状态：已完成
+- 操作服务器：本地；B 未执行写操作
+- 完成内容：新增 CustomerGatewayPoliciesModule，提供 `GET /customer-gateways/:id/policies`、`POST /customer-gateways/:id/policies`、`PATCH /customer-gateway-policies/:id`、`DELETE /customer-gateway-policies/:id`、`POST /customer-gateways/:id/policies/reorder`；支持主叫/被叫 `ANY`、`EQUALS`、`PREFIX` 匹配，校验非 `ANY` 模式必须提供匹配值；支持显式优先级和自动追加优先级，重排时要求一次提交全部有效策略 ID 并用两阶段负优先级避免唯一索引冲突；客户网关创建、更新、启停以及策略创建、更新、删除、重排均在同一事务内写入 `outbox_events`，不直接双写 Redis；Config Publisher 从骨架升级为处理 `customer_gateway_config` Outbox 的 worker，生成完整 Redis 配置快照，写入 `cfg:v:{version}:customer:*`、`customer_gateway:*`、`auth:ip:*`、`auth:sip:*` 和策略列表，原子切换 `cfg:active_version`，并维护 `cfg:previous_version` 作为回滚点；新增 `rollbackActiveConfig` 函数用于切回上一版本。
+- 修改文件：`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/customer-gateways/customer-gateways.repository.ts`、`apps/api/src/modules/customer-gateway-policies/`、`apps/worker-config-publisher/src/main.ts`、`apps/worker-config-publisher/src/publisher.ts`、`apps/worker-config-publisher/package.json`、`apps/worker-config-publisher/tsconfig.json`、`packages/redis/src/index.ts`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；未新增需要联网下载的 npm 包；继续使用 Node.js `v22.22.2`、Prisma `6.19.0`、pnpm `10.33.0`、ioredis `5.8.2`（由 `@lisglosips/redis` 继续提供）。
+- 执行的关键命令：`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 test -- customer-gateway`、`corepack pnpm@10.33.0 test`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`；曾尝试 `corepack pnpm@10.33.0 install`，因本机 DNS 无法解析 `registry.npmjs.org` 失败，随后移除新增联网依赖，最终无需更新锁文件。
+- 验证结果：typecheck 通过；S14 相关 Vitest 11 个测试文件 33 条测试通过；全量 Vitest 11 个测试文件 33 条测试通过，覆盖策略列表、权限拒绝、策略创建/更新/重排/删除、审计记录和匹配值校验；lint 通过；workspace build 通过，包含 `apps/worker-config-publisher` 构建通过。
+- 回滚方式：移除 `CustomerGatewayPoliciesModule` 导入并删除 `apps/api/src/modules/customer-gateway-policies/`；恢复 `apps/api/src/modules/customer-gateways/customer-gateways.repository.ts` 中的 Outbox 写入前版本；恢复 `apps/worker-config-publisher/src/main.ts` 为骨架并删除 `publisher.ts`；恢复 `packages/redis/src/index.ts` 的 S14 新增 Redis 常量和 helper。S14 未新增数据库迁移，B 端未创建临时库、未改服务、未写 Redis。
+- 未解决问题：B 写入式临时库/Redis 冒烟未执行，因为当前 B sudo 凭据仍无法通过校验，迁移账号也无权创建临时库；Config Publisher 当前完成客户/客户网关/策略快照发布，落地网关、线路组成员和供应商侧热路径会随 S15-S17 数据模型 API 补齐后扩展到快照。
+- 下一任务：`S15 - 供应商管理 API`
+
+### 2026-06-21 11:28 - S13 客户网关 API
+
+- 状态：已完成
+- 操作服务器：本地；B 仅读取 SSH/Node/pnpm 状态并尝试临时库验收，未修改正式库或服务
+- 完成内容：新增 CustomerGatewaysModule，提供 `GET /customer-gateways`、`GET /customer-gateways/:id`、`POST /customer-gateways`、`PATCH /customer-gateways/:id`、`POST /customer-gateways/:id/enable`、`POST /customer-gateways/:id/disable`；支持 `IP`、`SIP_DIGEST`、`MIXED` 三种认证模式；创建和更新时校验来源 IP、SIP 用户名、SIP 域和密码强度；SIP 注册密码仅用于生成 OpenSIPS Digest HA1，API 响应只返回 `hasSipCredential`，不返回 `sipPassword` 或 `sipHa1`；SIP 用户名或域名变更时要求同时提交新密码，避免旧 HA1 与新身份不匹配；所有写操作绑定 `customer_gateways.manage` 和审计动作，读操作绑定 `customer_gateways.view`；日志脱敏路径新增 `sipHa1`。
+- 修改文件：`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/customer-gateways/`、`packages/observability/src/index.ts`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；继续使用 Node.js `v22.22.2`、Prisma `6.19.0`、pnpm `10.33.0`。
+- 执行的关键命令：`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 test`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`；B 端执行只读 `hostname && node --version && pnpm --version`；尝试通过 SSH 隧道连接 B MySQL 并用 `MYSQL_MIGRATE` 创建 S13 临时库，因账号无 `mysql` 系统库访问权限返回 `P1010`；B sudo 凭据校验失败，未继续执行需要 sudo 的 MySQL 创建/清理命令。
+- 验证结果：本地 typecheck 通过；Vitest 10 个测试文件 29 条测试通过，新增覆盖客户网关只读权限、写权限拒绝、IP 网关返回脱敏、SIP Digest 网关创建、审计敏感字段脱敏、SIP 身份变更强制新密码、切换 IP 模式清空 SIP 凭据、启停接口；lint 通过；workspace build 通过；B 的 Node `v22.22.2` 和 pnpm `10.33.0` 只读确认通过；B 临时库冒烟未完成，未创建临时库，SSH 隧道、本地 S13 临时 SQL 和远端 `/tmp/lisglosips-s13-create-*.sql` 已清理。
+- 回滚方式：移除 `CustomerGatewaysModule` 导入并删除 `apps/api/src/modules/customer-gateways/`；从 `packages/observability/src/index.ts` 移除 `*.sipHa1` 脱敏项；S13 未新增数据库迁移。B 端未创建临时库、未修改服务，仅使用短时 SSH 隧道和 `/tmp` 临时 SQL 文件，已清理。
+- 未解决问题：S13 未执行 B 临时库冒烟，因为当前 `.codex-private` 中的 B sudo 凭据无法通过校验，`MYSQL_MIGRATE` 也无权在 `mysql` 系统库创建临时库；后续需要修复 B sudo 凭据或提供受控临时库创建账号。S13 不实现客户网关策略、Outbox 或 Redis 发布，这些留给 S14。
+- 下一任务：`S14 - 客户网关策略与 Redis 配置发布`
+
+### 2026-06-21 11:14 - S12 充值与不可变余额流水
+
+- 状态：已完成
+- 操作服务器：本地、B
+- 完成内容：新增 RechargesModule，提供 `POST /customers/:id/recharges`、`POST /vendors/:id/recharges` 和 `GET /recharges`；客户和供应商充值在同一数据库事务内完成账户行锁定、余额读取、不可变充值流水写入、余额更新和幂等结果保存；重复相同幂等键返回原充值结果，不重复加余额；同一幂等键不同请求返回冲突；充值写操作绑定 `recharges.manage` 和审计动作，查询绑定 `recharges.view`；并发写冲突和唯一键竞争只对 Prisma `P2034`/`P2002` 做短退避重试。
+- 修改文件：`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/recharges/`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；继续使用 Node.js `v22.22.2`、Prisma `6.19.0`、pnpm `10.33.0`。
+- 执行的关键命令：`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 test`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`；B 端通过 SSH 隧道连接临时 MySQL 库执行 `prisma migrate deploy`、`db:seed`、`prisma migrate status`，并使用编译后的充值仓库执行客户/供应商充值、幂等重放、幂等冲突和并发充值冒烟。
+- 验证结果：本地 typecheck 通过；Vitest 9 个测试文件 24 条测试通过，覆盖充值权限拒绝、客户充值、供应商充值、幂等重放、幂等冲突、流水查询和审计记录；lint 通过；workspace build 通过；B 临时空库 `lisglosips_s12_verify_20260621111322` 成功应用 S08/S09 共 2 个迁移，seed 执行成功，`migrate status` 显示 schema up to date；B 临时库验证客户充值前后余额、供应商充值前后余额、重复幂等不重复入账、幂等冲突拒绝、5 路并发客户充值后余额 `15.000000`、客户流水 6 条、供应商流水 1 条、成功幂等记录 7 条；B 残留检查确认无 S12 临时库、临时用户和 `/tmp/lisglosips-s12-*` 文件。
+- 回滚方式：移除 `RechargesModule` 导入并删除 `apps/api/src/modules/recharges/`；S12 未新增数据库迁移。B 端仅创建临时库、临时用户和 SSH 隧道，已删除或关闭。
+- 未解决问题：S12 只实现手工充值入账；CDR 扣费、余额扣减和扣费幂等留给 S22/S23；供应商管理 CRUD 仍按任务顺序留给 S15。
+- 下一任务：`S13 - 客户网关 API`
+
+### 2026-06-21 10:57 - S11 客户管理 API
+
+- 状态：已完成
+- 操作服务器：本地、B
+- 完成内容：新增 CustomersModule，提供客户列表、详情、新增、编辑、启用、停用和软删除 API；返回余额、授信额度、最低余额、可用余额和启用网关数量；客户余额只读，避免绕过 S12 充值流水；所有写操作均绑定 `customers.manage` 和审计动作，读操作绑定 `customers.view`；软删除前阻止仍有关联启用网关的客户删除。
+- 修改文件：`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/customers/`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；继续使用 Node.js `v22.22.2`、Prisma `6.19.0`、pnpm `10.33.0`。
+- 执行的关键命令：`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 test`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`；B 端通过 SSH 隧道连接临时 MySQL 库执行 `prisma migrate deploy`、`db:seed`、`prisma migrate status` 和客户 CRUD 冒烟脚本。
+- 验证结果：本地 typecheck 通过；Vitest 8 个测试文件 21 条测试通过，覆盖客户读权限、写权限拒绝、新增、启停、软删除、余额/授信字段和审计记录；lint 通过；workspace build 通过；B 临时空库 `lisglosips_s11_verify_20260621105537` 成功应用 S08/S09 共 2 个迁移，seed 执行成功，`migrate status` 显示 schema up to date；B 临时库客户创建、状态更新、Decimal 精度、网关计数和软删除冒烟通过；B 残留检查确认无 S11 临时库、临时用户和 `/tmp/lisglosips-s11-*` 文件。
+- 回滚方式：移除 `CustomersModule` 导入并删除 `apps/api/src/modules/customers/`；S11 未新增数据库迁移。B 端仅创建临时库、临时用户和 SSH 隧道，已删除或关闭。
+- 未解决问题：S11 不实现充值入账和余额变更事务，余额仍只能通过后续 S12 不可变流水更新；客户网关数量当前依赖后续 S13 的网关数据。
+- 下一任务：`S12 - 充值与不可变余额流水`
+
+### 2026-06-21 10:46 - S10 用户、角色、权限与审计
+
+- 状态：已完成
+- 操作服务器：本地、B
+- 完成内容：实现全局 Access Token 认证 Guard、RBAC Guard、`@Public`、`@RequirePermissions` 与当前用户注入；新增用户、角色、权限和审计日志查询 API；实现用户创建、资料更新、重置密码和角色权限维护；内置角色禁止改名、停用和变更权限；重置密码仅保存 Argon2id 哈希并要求下次改密；新增审计拦截器，按接口元数据记录 request_id、操作者、角色、IP、User-Agent、模块、动作、对象、成功/失败、错误码和脱敏后的 before/after 摘要。
+- 修改文件：`packages/auth/src/index.ts`、`packages/database/src/index.ts`、`apps/api/src/modules/app.module.ts`、`apps/api/src/modules/auth/auth.controller.ts`、`apps/api/src/modules/health/health.controller.ts`、`apps/api/src/modules/security/`、`apps/api/src/modules/audit/`、`apps/api/src/modules/audit-logs/`、`apps/api/src/modules/users/`、`apps/api/src/modules/roles/`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；继续使用 Node.js `v22.22.2`、Prisma `6.19.0`、pnpm `10.33.0`。
+- 执行的关键命令：`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 test`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 build`；B 端通过 SSH 隧道连接临时 MySQL 库执行 `prisma migrate deploy`、`db:seed`、`prisma migrate status`；B 端检查并清理 `lisglosips_s10_verify_*`、`s10v_*` 和 `/tmp/lisglosips-s10-*` 临时残留。
+- 验证结果：本地 typecheck 通过；Vitest 7 个测试文件 18 条测试通过，覆盖未认证拒绝、越权拒绝、重置密码审计脱敏、内置角色保护和审计日志查询；lint 通过；workspace build 通过；B 临时空库 `lisglosips_s10_verify_20260621104300` 成功应用 S08/S09 共 2 个迁移，seed 执行成功，`migrate status` 显示 schema up to date；B 残留检查确认无 S10 临时库、临时用户和 `/tmp/lisglosips-s10-*` 文件。
+- 回滚方式：恢复上述本地文件到 S10 前版本；S10 未新增数据库迁移，若需回滚只需移除新增模块导入和相关接口代码。B 端仅创建临时库、临时用户和 `/tmp` 临时文件，已删除。
+- 未解决问题：S10 只完成后端安全与审计基础；后续业务 API 必须继续显式标注权限和审计动作，客户、充值、网关等业务模块从 S11 开始实现。
+- 下一任务：`S11 - 客户管理 API`
+
+### 2026-06-21 10:15 - S09 登录认证基础
+
+- 状态：已完成
+- 操作服务器：本地、B
+- 完成内容：实现登录、刷新和退出接口；新增 Argon2id 密码哈希与校验，优先使用 Node 原生实现并在 Node 22 上回退到 vendored WASM；实现 HMAC access token、HttpOnly refresh cookie、refresh token SHA-256 摘要入库、会话撤销与轮换、失败计数和临时锁定；新增 Prisma `user_sessions` 模型和迁移；补充 Auth API、服务层、密码/Token 原语和 schema 合同测试。
+- 修改文件：`packages/auth/src/index.ts`、`packages/auth/src/index.spec.ts`、`packages/auth/vendor/argon2id/`、`apps/api/src/modules/auth/`、`apps/api/src/modules/database/`、`apps/api/src/modules/app.module.ts`、`apps/api/src/shared/config.ts`、`apps/api/tsconfig.json`、`apps/api/package.json`、`.env.example`、`eslint.config.mjs`、`prisma/schema.prisma`、`prisma/migrations/20260621093000_auth_sessions/migration.sql`、`packages/database/src/schema-contract.spec.ts`、`pnpm-lock.yaml`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；vendored npm 包 `argon2id` `1.0.1`，MIT 许可证，WASM 哈希记录于 `packages/auth/vendor/argon2id/UPSTREAM.md`；继续使用 Node.js `v22.22.2`、Prisma `6.19.0`、pnpm `10.33.0`。
+- 执行的关键命令：`corepack pnpm@10.33.0 prisma:validate`、`prisma:generate`、`typecheck`、`test`、`lint`、`build`；B 端通过临时 `/tmp` 包验证 Node 22 下 Argon2id WASM 哈希与校验；通过 SSH 隧道连接 B 的临时 MySQL 库执行 `prisma migrate deploy` 和 `prisma migrate status`。
+- 验证结果：本地 Prisma schema validate 通过；Prisma Client 生成通过；typecheck 通过；Vitest 6 个测试文件 15 条测试通过，覆盖 Argon2id、Token、登录成功、失败锁定、refresh 轮换、旧 refresh 拒绝、logout 后拒绝和健康检查；lint 通过；workspace build 通过；B Node `v22.22.2` 上 Argon2id WASM 校验结果为正确值通过、随机值拒绝；B 临时空库 `lisglosips_s09_verify_20260621101249` 成功应用 S08 与 S09 共 2 个迁移，`migrate status` 显示 schema up to date；B 残留检查确认临时库、临时用户和 `/tmp/lisglosips-s09-*` 文件已清理。
+- 回滚方式：恢复上述本地文件到 S09 前版本；删除 `prisma/migrations/20260621093000_auth_sessions/` 并从 `prisma/schema.prisma` 移除 `UserSession` 关系和模型。B 端仅创建临时库、临时用户和 `/tmp` 临时文件，已删除。
+- 未解决问题：生产 access token secret 必须由受控环境变量注入；当前 S09 只实现认证基础，RBAC Guard、内置角色保护、重置密码和审计拦截器留给 S10。
+- 下一任务：`S10 - 用户、角色、权限与审计`
+
+### 2026-06-21 09:28 - S08 数据库 Schema 与迁移
+
+- 状态：已完成
+- 操作服务器：本地、B
+- 完成内容：实现 V2 第 10 章核心数据模型，包括客户、客户网关、策略、供应商、落地网关、线路组、充值、CDR、录音、质检、用户、角色、权限、审计、Outbox 和幂等键；生成初始化迁移；新增内置权限/角色 seed；补充数据库 Schema Runbook 和 schema 合同测试；迁移 Prisma seed 配置到 `prisma.config.ts`。
+- 修改文件：`prisma/schema.prisma`、`prisma/migrations/20260621090000_init_v2_schema/migration.sql`、`prisma/seed.ts`、`prisma.config.ts`、`package.json`、`packages/database/src/schema-contract.spec.ts`、`docs/DATABASE_SCHEMA_RUNBOOK.md`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未安装新系统软件；继续使用 Prisma `6.19.0`、MySQL `8.0.46`、pnpm `10.33.0`。
+- 执行的关键命令：`prisma migrate diff --from-empty --to-schema-datamodel prisma/schema.prisma --script`、`corepack pnpm@10.33.0 prisma:generate`、`prisma:validate`、`typecheck`、`test`、`lint`、`build`；通过 SSH 隧道连接 B 的临时 MySQL 库执行 `prisma migrate deploy`、`prisma db seed`、重复 seed、重复 migrate deploy、`prisma migrate status`；使用 `mysqldump --no-tablespaces` 做临时库备份恢复验证。
+- 验证结果：本地 Prisma schema validate 通过；Prisma Client 生成通过；lint 通过；typecheck 通过；Vitest 3 个测试文件 6 条测试通过；workspace build 通过；B 上临时空库 `lisglosips_s08_verify_20260621091537` 成功应用 1 个迁移；seed 重复执行安全；重复 `migrate deploy` 显示无待迁移；`migrate status` 显示 schema up to date；备份恢复后计数为 `permissions=22`、`roles=5`、`role_permissions=53`、`_prisma_migrations=1`。
+- 回滚方式：恢复上述本地文件到 S08 前版本；删除 `prisma/migrations/20260621090000_init_v2_schema/`。B 端仅创建临时库和临时用户，已删除 `lisglosips_s08_verify_*`、`s08v_*`、`/tmp/lisglosips-s08-*.sh` 和临时 dump 文件。
+- 未解决问题：生产/准生产迁移仍需在正式发布窗口前做全量备份和恢复演练；本次只验证临时空库初始化、seed 幂等和 dump/restore。
+- 下一任务：`S09 - 登录认证基础`
+
+### 2026-06-21 08:55 - S07 V2 后端 Monorepo 骨架完成
+
+- 状态：已完成
+- 操作服务器：本地、B
+- 完成内容：恢复 B 开机后完成 S07 的 B 端构建验收；补充 `scripts/pnpm-run.mjs`，让根脚本复用当前 pnpm 运行器，兼容本机 Corepack 调用和 B 上已安装的 `/usr/bin/pnpm`；在 `package.json` 中声明允许固定依赖的 pnpm build scripts，并加入 Linux x64 glibc optional dependency 支持，便于 B 端验证 Rollup/esbuild/Prisma。
+- 修改文件：`package.json`、`pnpm-lock.yaml`、`scripts/pnpm-run.mjs`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：未在 B 安装新系统软件；B 使用既有 Node.js `v22.22.2`、Corepack `0.34.6`、pnpm `10.33.0`。本地和 B 的项目依赖仍按 `pnpm-lock.yaml` 固定。
+- 执行的关键命令：本地 `corepack pnpm@10.33.0 lint/typecheck/test/prisma:validate/build`；B `/tmp/lisglosips-s07-20260621081708` 中执行 `pnpm install --frozen-lockfile`、离线 store 安装、`pnpm lint`、`pnpm typecheck`、`pnpm test`、`pnpm prisma:validate`、`pnpm build`、临时 API `node apps/api/dist/main.js` 健康检查。
+- 验证结果：本地 lint、typecheck、Vitest 2 个测试文件 3 条测试、Prisma schema validate、workspace build 全部通过；B 端 lint、typecheck、Vitest 2 个测试文件 3 条测试、Prisma schema validate、workspace build 全部通过；B 本机临时 API `/api/v2/health/live` 返回 `ok`、`/api/v2/health/ready` 返回 `ok`、`/api/v2/openapi.json` 返回 HTTP 200。
+- 回滚方式：恢复本次新增/修改的 monorepo 文件；如需恢复旧前端结构，将 `apps/web/src` 移回根目录 `src`、`apps/web/index.html` 移回根目录，并恢复旧 `package.json`/`package-lock.json`。B 端仅使用 `/tmp` 临时目录和临时 pnpm store，已删除 `/tmp/lisglosips-s07-*`、`/tmp/lisglosips-s07-src-*.zip`、`/tmp/lisglosips-s07-pnpm-store-v10.tar.gz`、`/tmp/rollup-linux-x64-gnu-4.62.2.tgz` 及 API 冒烟临时文件。
+- 未解决问题：B 到 npm registry 的 TLS 连接不稳定，在线安装多次 `ECONNRESET`；本次通过本地 pnpm store 临时上传完成 B 端构建验收。后续正式部署建议使用内网 npm 缓存、制品仓库或在 CI 产出完整 release artifact。
+- 下一任务：`S08 - 数据库 Schema 与迁移`
+
+### 2026-06-21 08:10 - S07 V2 后端 Monorepo 骨架
+
+- 状态：已阻塞
+- 操作服务器：本地；Server B 仅尝试临时源码包上传和只读 SSH 连通性检查，未确认远端执行
+- 完成内容：将现有 React Demo 纳入 pnpm monorepo 的 `apps/web`；创建 `apps/api` NestJS + Fastify 后端骨架；创建 `apps/worker-cdr`、`apps/worker-recording`、`apps/worker-config-publisher` worker 入口；创建 `packages/contracts`、`domain`、`database`、`redis`、`auth`、`observability` 公共包；建立 Prisma MySQL schema 占位、结构化日志脱敏、配置校验、OpenAPI JSON/Swagger 入口、健康检查、Vitest/Supertest 测试和 lint/typecheck/build/ci 命令。
+- 修改文件：`package.json`、`pnpm-workspace.yaml`、`pnpm-lock.yaml`、`tsconfig.base.json`、`tsconfig.build.json`、`eslint.config.mjs`、`vitest.config.ts`、`.env.example`、`.gitignore`、`apps/`、`packages/`、`prisma/schema.prisma`；原 `src/` 和 `index.html` 已移动到 `apps/web/`。
+- 安装软件及固定版本：本地通过 Corepack 使用 pnpm `10.33.0`；关键依赖固定包括 NestJS `11.1.9`、Fastify `5.6.2`、Prisma `6.19.0`、ioredis `5.8.2`、pino `9.14.0`、Vitest `4.0.14`、TypeScript `5.9.3`、Vite `5.4.21`。
+- 执行的关键命令：`corepack pnpm@10.33.0 install`、`corepack pnpm@10.33.0 prisma:generate`、`corepack pnpm@10.33.0 lint`、`corepack pnpm@10.33.0 typecheck`、`corepack pnpm@10.33.0 test`、`corepack pnpm@10.33.0 prisma:validate`、`corepack pnpm@10.33.0 build`、本地 API `node apps/api/dist/main.js` 冒烟检查。
+- 验证结果：本地 `lint` 通过；`typecheck` 通过；Vitest 2 个测试文件 3 条测试通过；Prisma schema validate 通过；全 workspace build 通过；本地 API 冒烟 `/api/v2/health/live` 返回 `ok`、`/api/v2/health/ready` 返回 `ok`、`/api/v2/openapi.json` 返回 HTTP 200；测试和脚本只使用无密码占位连接串。
+- 回滚方式：恢复本次新增/修改的 monorepo 文件；如需恢复旧前端结构，将 `apps/web/src` 移回根目录 `src`、`apps/web/index.html` 移回根目录，并恢复旧 `package.json`/`package-lock.json`。
+- 未解决问题：未完成 B 端构建验收。本机到 `100.90.90.91:22` SSH 超时；本机无 `tailscale` CLI；`scp` 曾尝试上传 `/tmp/lisglosips-s07-src-20260621080628.zip`，返回码为 0 但随后提示连接关闭，因 SSH 不通无法确认远端是否存在该临时文件，恢复连通后应检查并删除。
+- 下一任务：恢复 Server B SSH/Tailscale 可达性后继续完成 `S07 - V2 后端 Monorepo 骨架` 的 B 端构建验收；不要进入 S08。
+
+### 2026-06-21 00:20 - SSH 策略文档修订
+
+- 状态：已完成
+- 操作服务器：本地
+- 完成内容：将 SSH 加固原则调整为“只调整 SSH 管理端口和允许来源，不禁止 SSH 密钥登录”；端口号统一使用 `<SSH_ADMIN_PORT>` 占位，待用户确认具体端口后再实施。
+- 修改文件：`SOFTSWITCH_PLATFORM_DESIGN_V2.md`、`IMPLEMENTATION_STATUS.md`、`docs/SSH_ACCESS_RUNBOOK.md`、`docs/LISGLOSIPS_DEPLOYMENT_GUIDE.md`、`docs/infra-check.md`、`docs/SERVER_B_BASELINE_RUNBOOK.md`
+- 安装软件及固定版本：无。
+- 执行的关键命令：`rg` 文档复查。
+- 验证结果：需求/部署文档中已无“仅 Key 登录”“禁用密码登录”作为强制策略的表述；历史盘点文件保留当时实际 `TCP 22` 快照，`docs/infra-check.md` 中历史验收项已标注后续迁移为 `<SSH_ADMIN_PORT>`。
+- 回滚方式：恢复上述文档至本次修改前版本。
+- 未解决问题：尚未确认 `<SSH_ADMIN_PORT>` 的具体端口号，未执行服务器侧 SSH 端口迁移。
+- 下一任务：`S07 - V2 后端 Monorepo 骨架`
+
+### 2026-06-20 23:20 - S06 Server B HOMER 与基础监控
+
+- 状态：已完成
+- 操作服务器：A、B、T、本地
+- 完成内容：在 B 部署 PostgreSQL 16 HOMER 数据库、Heplify HEP 接收、Homer App、Prometheus、Grafana、MySQL/PostgreSQL/Redis/Node/Heplify exporters 和 Nginx 监控入口；在 A 部署 Node Exporter，并用独立 nftables 表限制仅 B 可抓取；重新签发开发证书，增加 `grafana.lisglosips.local` 与 `homer.lisglosips.local`；补充 S06 Runbook 和可重复部署脚本。
+- 修改文件：B 的 `/etc/homer/`、`/etc/lisglosips/secrets/`、`/etc/prometheus/`、`/etc/grafana/`、`/etc/nginx/sites-available/monitoring.conf`、`/etc/systemd/system/` S06 服务、`/data/homer/postgresql`；A 的 `/etc/nftables.d/lisglosips-s06-exporter.nft`、`/etc/systemd/system/lisglosips-exporter-firewall.service`、`/etc/systemd/system/lisglosips-node-exporter.service`；本地 `infra/server-b/s06/`、`infra/server-a/s06/`、`docs/SERVER_B_HOMER_MONITORING_RUNBOOK.md`、`docs/LISGLOSIPS_DEPLOYMENT_GUIDE.md`、`.codex-private/SERVICE_CREDENTIALS.clixml`。
+- 安装软件及固定版本：PostgreSQL `16.14`、Prometheus `2.45.3`、Grafana `13.0.2`、Node Exporter `1.7.0`、MySQL Exporter `0.15.0`、PostgreSQL Exporter `0.15.0`、Redis Exporter `1.86.0`；Heplify Server `v1.60.2-0.20260512101233-c74dc3d216ac`；Homer App `v0.0.0-20251021161517-9b1336352aa0`；Docker `29.1.3` 与 Compose `2.40.3` 已安装但禁用，不作为 S06 运行时。
+- 执行的关键命令：`apt-get install`、Go `install/build`、`psql`、`mysql`、`redis-cli`、`promtool check config/rules`、`nginx -t`、`systemctl daemon-reload/enable/restart/reboot`、`curl`、`nft -c/-f`、HEPv3 UDP 测试脚本。
+- 验证结果：B 重启后系统 `running` 且 0 failed unit；A 重启后系统 `running` 且 0 failed unit；B 的 PostgreSQL、MySQL、Redis、Nginx、Heplify、Homer、Grafana、Prometheus 和 4 个 exporter 全部 active；Prometheus 7 个 target 全部 `up`；A Node Exporter 仅监听 `100.90.90.90:9100`，B 抓取返回 200，T 访问超时；HEPv3 `INVITE` 从 A 发往 B 后写入 `homer_data.hep_proto_1_call`，方法和源/目标 IP 正确；Grafana HTTPS health 通过，已加载 `Prometheus`、`HOMER PostgreSQL` datasource 和 `LisgloSIPS Infrastructure Overview` dashboard；Homer HTTPS 返回 200；Homer/Grafana/MySQL Exporter 近 10 分钟无错误日志。
+- 回滚方式：B 备份位于 `/var/backups/lisglosips-s06/20260620T132440Z`，A 备份位于 `/var/backups/lisglosips-s06/20260620225517`；停止 S06 服务、恢复配置、保留并单独备份 `/data/homer/postgresql` 后再处理数据目录；A 回滚只删除 `inet lisglosips_s06` 表和两个 S06 服务，不触碰 OpenSIPS/RTP。
+- 未解决问题：外部对象存储下载被代理链路阻断，未继续采用 HOMER10 Docker 架构；当前 HOMER Web 是最小状态页，HOMER API、HEP 入库和 Grafana 可用，完整 HOMER UI 静态包待网络条件稳定后补；A 的 9100 保护只是 S06 局部规则，完整 A 防火墙留到 S18/S20。
+- 下一任务：`S07 - V2 后端 Monorepo 骨架`
+
+### 2026-06-20 20:44 - S05 Server B Node.js、Nginx 与 TLS 基线
+
+- 状态：已完成
+- 操作服务器：B、T、本地
+- 完成内容：固定 Node.js 22 LTS、Corepack、pnpm 和 Nginx 版本；建立 `/opt/lisglosips/releases` 与原子 `current` 发布模型；部署受限 `lisglosips@.service` 模板和无依赖 API 健康占位服务；配置 Nginx 静态站点、API 代理、登录/API 限流、安全响应头、内部录音 Range 入口；签发仅供开发使用的私有 CA 证书；另建全项目独立部署指南。
+- 修改文件：B 的 `/etc/lisglosips/web-runtime-versions.env`、`/etc/lisglosips/api.env`、`/etc/lisglosips/pki/`、`/etc/nginx/` LisgloSIPS 配置、`/etc/systemd/system/lisglosips@.service`、`/usr/local/sbin/lisglosips-issue-dev-cert` 和 `/opt/lisglosips/releases/s05-placeholder-20260620`；本地 `infra/server-b/s05/`、`docs/SERVER_B_WEB_RUNTIME_RUNBOOK.md`、`docs/LISGLOSIPS_DEPLOYMENT_GUIDE.md`、`.codex-private/tls/lisglosips-dev-ca.crt`。
+- 安装软件及固定版本：Node.js `v22.22.2`（包 `22.22.2-1nodesource1`）、Corepack `0.34.6`、pnpm `10.33.0`、Nginx `1.24.0-2ubuntu7.12`；Node/Nginx 包已 hold，升级前必须复核安全公告与兼容性。
+- 执行的关键命令：`apt-get install`、`apt-mark hold`、`openssl`、`nginx -t`、`systemctl daemon-reload/enable/restart/reboot`、`curl`、`systemd-analyze security`、`sha256sum`。
+- 验证结果：内部和管理端 HTTPS 健康检查通过；证书链与 `100.90.90.91` SAN 校验通过；仅 TLS 1.2/1.3；首页 HSTS/CSP/防嵌套等安全头完整；登录限流测试出现预期 429；`/_recordings/` 外部访问为 404；应用只监听 `127.0.0.1:3000`，本地管理机和 T 均不能直连 3000，T 不能访问 443；systemd 安全评级为 OK；重启后 Nginx、API、MySQL、Redis 和备份 timer 正常，0 个 failed unit；11 个仓库配置与服务器文件哈希一致；文档敏感信息扫描通过。
+- 回滚方式：切换 `/opt/lisglosips/current` 可回滚应用；S05 变更前备份位于 `/var/backups/lisglosips-s05/20260620T123432Z`，配置/证书/服务恢复步骤见 `docs/SERVER_B_WEB_RUNTIME_RUNBOOK.md`。
+- 未解决问题：当前是开发私有 CA，迁移阿里云必须替换正式域名证书；80 已监听但仍由 nftables 拒绝，生产是否开放取决于 ACME 方案；NodeSource 在本地代理链路上偶发 TLS 握手中断，现有固定包和运行不受影响；当前 API 仅为 S05 健康占位服务，S07 替换。
+- 下一任务：`S06 - Server B HOMER 与基础监控`
+
+### 2026-06-20 20:22 - S04 Server B MySQL 与 Redis
+
+- 状态：已完成
+- 操作服务器：B、A、T、本地
+- 完成内容：在 B 安装并固定 MySQL 8.0.46 与 Redis 7.0.15；建立 `/data/mysql`、`/data/redis` bind mount；完成 MySQL binlog、UTC、utf8mb4、慢查询和最小权限账号配置；完成 Redis Tailscale 私网绑定、ACL、AOF/RDB 和 `noeviction` 配置；建立 Tailscale 地址就绪依赖，消除 Redis 开机绑定竞态；配置每日 MySQL/Redis 自动备份及 14 天保留。
+- 修改文件：B 的 `/etc/mysql/mysql.conf.d/99-lisglosips.cnf`、`/etc/redis/redis-lisglosips.conf`、`/etc/redis/users.acl`、`/etc/fstab`、相关 systemd unit/drop-in、备份脚本及 `/etc/lisglosips/secrets/`；本地 `docs/SERVER_B_DATA_SERVICES_RUNBOOK.md`、`infra/server-b/s04/`、`.codex-private/SERVICE_CREDENTIALS.clixml`。
+- 安装软件及固定版本：MySQL `8.0.46-0ubuntu0.24.04.2`；Redis `5:7.0.15-1ubuntu0.24.04.4`；相关 MySQL/Redis 包已 `apt-mark hold`，升级前须先评估安全公告与兼容性。
+- 执行的关键命令：`apt-get install`、`apt-mark hold`、`mysql`、`mysqlcheck`、`redis-cli`、`redis-check-rdb`、`systemctl`、`findmnt`、`sha256sum`、`systemctl reboot`。
+- 验证结果：MySQL 仅监听本机，应用账号 DML 通过且 DDL 被拒；Redis 未认证访问被拒，应用账号读写通过且危险命令被拒，A 可通过 Tailscale 认证访问，T 到 3306/6379 被防火墙拒绝；MySQL 与 Redis 备份哈希通过，并分别完成隔离恢复和数据一致性验证；重启后 mount、服务、数据和 timer 均正常，Redis `NRestarts=0`，0 个 failed unit；11 个仓库配置与服务器文件 SHA-256 完全一致；仓库敏感信息、私密文件忽略规则和 ACL 检查通过。
+- 回滚方式：变更前及迁移前数据保存在 B 的 `/var/backups/lisglosips-s04/20260620195847`；配置、数据目录和服务恢复步骤见 `docs/SERVER_B_DATA_SERVICES_RUNBOOK.md`。
+- 未解决问题：开发阶段 `/data` 仍位于根盘，正式上云需改为独立数据盘；固定版本需要纳入安全补丁复核；Tailscale 首次直连协商偶尔产生短时延迟，稳态访问正常。
+- 下一任务：`S05 - Server B Node.js、Nginx 与 TLS 基线`
+
+### 2026-06-20 19:01 - S03 Server B 基础系统初始化
+
+- 状态：已完成
+- 操作服务器：B、本地
+- 完成内容：升级 101 个系统包并启用 6.17.0-35 内核；安装基础工具；建立 chrony、nftables、fail2ban、sysstat；创建三个 LisgloSIPS 系统用户和 `/data` 目录基线；修复 NFS 为 Tailscale 就绪后的 automount；完成重启验收。
+- 修改文件：B 的 `/etc/fstab`、`/etc/nftables.conf`、`/etc/nftables.d/lisglosips.nft`、`/etc/chrony/chrony.conf`、`/etc/chrony/sources.d/lisglosips.sources`、`/etc/fail2ban/jail.d/lisglosips.local`、`/etc/tmpfiles.d/lisglosips.conf`；本地 `docs/SERVER_B_BASELINE_RUNBOOK.md`、`infra/server-b/s03/`。
+- 安装软件及固定版本：chrony 4.5-1ubuntu4.2、nftables 1.0.9-1ubuntu0.1、fail2ban 1.0.2-3ubuntu0.1；其余基础工具版本见 Runbook 和远端 post-change 包清单。
+- 执行的关键命令：`apt-get dist-upgrade/install`、`chronyc`、`nft`、`fail2ban-client`、`systemd-tmpfiles`、`findmnt`、`systemctl reboot`。
+- 验证结果：新内核启动；0 个 failed unit；无待升级包、无 reboot-required；chrony Stratum 3/Leap Normal；NFS automount 重启后可访问；fail2ban sshd jail active；nftables 重启后默认拒绝，开发机与 A 允许路径通过，T 到 B 的 22/443/6379/9060 被拒绝；远端配置与仓库副本哈希一致。
+- 回滚方式：变更前备份 `/var/backups/lisglosips-s03/20260620184404`；防火墙可执行其中 `rollback-firewall.sh`；其余恢复方式见 Runbook。
+- 未解决问题：开发阶段 `/data` 仍位于根盘；桌面/CUPS/Avahi/rpcbind 尚未精简但已被防火墙隔离；ens18 双地址/双默认路由和克隆 machine-id 仍待单独维护窗口处理。
+- 下一任务：`S04 - Server B MySQL 与 Redis`
+
+### 2026-06-20 18:37 - S02 网络与安全组验收
+
+- 状态：已完成
+- 操作服务器：A、B、T、本地
+- 完成内容：确认本地开发服务器和 Tailscale 专网边界；采集六个方向稳态 RTT；验证 SIP、RTP、Web、HEP、Redis、监控与 SSH 网络路径；形成开发最小暴露矩阵和未来阿里云安全组清单。
+- 修改文件：`docs/infra-check.md`、`docs/inventory-A.md`、`docs/inventory-B.md`、`docs/inventory-summary.md`、`SOFTSWITCH_PLATFORM_DESIGN_V2.md`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：无。
+- 执行的关键命令：`tailscale status/ping/netcheck`、`ping`、Python 短时 TCP/UDP 监听与 ACK、SIP OPTIONS、`ss`、OpenSIPS/MariaDB 只读核验。
+- 验证结果：A/B/T 六方向 0% 丢包，预热后平均 RTT 0.434-0.648 ms；1200 字节 DF 报文通过；T->A 15060/UDP 与 RTP 30000/40000 双向通过；A->T SIP 5060 返回合法 484；开发机->B 443、A->B 9060/6379、B->A 9100/22 通过；所有临时监听器均已退出。
+- 回滚方式：未修改远端持久配置；短时监听器已自动退出，无需回滚。
+- 未解决问题：主机防火墙尚未落地；Tailscale direct 路径曾短暂重新协商导致 SSH 超时；ens18 双地址/双默认路由仍存在；T 的权限与 RTPEngine 内核模块问题留待对应任务处理。
+- 测试数据：T 的 `sip_trace` 新增 1 条 S02 OPTIONS 记录，`acc` 和 `missed_calls` 未增加。
+- 下一任务：`S03 - Server B 基础系统初始化`
+
+### 2026-06-20 18:00 - S01 三机只读资产盘点
+
+- 状态：已完成
+- 操作服务器：A、B、T、本地
+- 完成内容：只读采集三机 OS、内核、CPU、内存、磁盘、网络、路由、时间、端口、服务、软件和防火墙；检查 T 的 OpenSIPS、RTPEngine、MariaDB、录音目录、配置结构与运行统计。
+- 修改文件：`docs/inventory-A.md`、`docs/inventory-B.md`、`docs/inventory-T.md`、`docs/inventory-summary.md`、`IMPLEMENTATION_STATUS.md`
+- 安装软件及固定版本：无。
+- 执行的关键命令：`hostnamectl`、`lscpu`、`lsblk`、`ip`、`ss`、`systemctl`、`ufw status`、`nft list ruleset`、`opensips -C`、`opensips-cli`、`rtpengine-ctl`、MariaDB 只读查询。
+- 验证结果：A/B/T SSH 复验通过；T 的 OpenSIPS、RTPEngine、录音守护进程、MariaDB、Apache 均 active；OpenSIPS 主配置哈希与盘点时一致；报告完整性及敏感信息扫描通过。
+- 回滚方式：S01 未修改远端配置、数据或服务，无需回滚。
+- 未解决问题：三机克隆身份相同；均有双 IPv4/双默认路由；UFW 未启用；B 的 NFS mount 失败；T 的 TLS 私钥为 0644、MI FIFO 为 0666、RTPEngine 无内核模块；当前 T 无注册账号和路由数据。
+- 下一任务：`S02 - 网络与安全组验收`
+
+### 2026-06-20 15:08 - S00 SSH 安全接入与凭据迁移
+
+- 状态：已完成
+- 操作服务器：A、B、T、本地
+- 完成内容：生成项目专用 Ed25519 Key；三机安装公钥；发现并修复克隆服务器共享 SSH host key；轮换 `hector` 密码；建立严格 known_hosts 和 SSH 别名。后续 SSH 变更按最新要求只调整管理端口，不禁止 SSH 密钥登录。
+- 修改文件：`.codex-private/ssh/lisglosips_codex_ed25519`、`.codex-private/ssh/config`、`.codex-private/ssh/known_hosts`、`.codex-private/SERVER_CREDENTIALS.clixml`、`docs/SSH_ACCESS_RUNBOOK.md`
+- 安装软件及固定版本：本地私密目录安装 Paramiko 5.0.0，仅用于首次安全接入自动化。
+- 验证结果：A/B/T 均通过 Key 新会话；`sshd -t` 通过；SSH 密钥登录保持开启；新 sudo 密码逐台验证通过。
+- 回滚方式：见 `docs/SSH_ACCESS_RUNBOOK.md`，三台服务器 `/var/backups/lisglosips-s00/` 保留轮换前和加固前备份。
+- 未解决问题：尚未盘点三机软件、磁盘、服务和网络；容量参数与 RTP 端口段仍未确认。
+- 下一任务：`S01 - 三机只读资产盘点`
+
+### 2026-06-20 - 计划初始化
+
+- 状态：已完成
+- 操作服务器：本地
+- 完成内容：建立 Codex 原子任务列表、服务器索引和跨会话交接规范。
+- 修改文件：`SOFTSWITCH_PLATFORM_DESIGN_V2.md`、`IMPLEMENTATION_STATUS.md`、`.gitignore`、`.codex-private/SERVER_ACCESS.md`
+- 验证结果：等待开始 S00。
+- 未解决问题：尚未连接服务器；尚未确认容量参数和 RTP 端口段。
+- 下一任务：`S00 - SSH 安全接入与凭据迁移`
diff --git a/OPENSIPS_INSTALL_NOTES.md b/OPENSIPS_INSTALL_NOTES.md
new file mode 100644
index 0000000..f7c4190
--- /dev/null
+++ b/OPENSIPS_INSTALL_NOTES.md
@@ -0,0 +1,836 @@
+# OpenSIPS installation notes
+
+中文说明：OpenSIPS 安装与修复备忘。
+
+This file records the installation performed on workstation `100.93.185.30`
+and the missing pieces found afterwards. Use `install-opensips-stack.sh` for a
+repeatable production install.
+
+中文说明：这个文件记录了 `100.93.185.30` 工作站上的安装过程、后来补齐的缺失模块，以及生产环境一键安装时应复用的脚本。
+
+## Target stack
+
+中文说明：目标软件栈。
+
+- OS: Ubuntu 24.04 Noble
+- OpenSIPS: 3.6.x from `https://apt.opensips.org`
+- OpenSIPS Control Panel: 9.3.6
+- RTPengine: Ubuntu `rtpengine-daemon`
+- Database: MariaDB
+- Web server: Apache + PHP
+
+## Production one-shot install
+
+中文说明：生产环境一键安装方式。
+
+Copy `install-opensips-stack.sh` to a fresh Ubuntu 24.04 server and run:
+
+中文说明：把 `install-opensips-stack.sh` 拷贝到一台全新的 Ubuntu 24.04 服务器上，然后执行下面命令。
+
+```bash
+sudo -E SIP_IP=YOUR_SERVER_IP DB_PASS='CHANGE_ME' bash install-opensips-stack.sh
+```
+
+Useful variables:
+
+中文说明：下面这些环境变量可以按生产环境修改，例如服务器 IP、数据库密码、MI 端口、RTPengine 端口范围、Monit 账号等。
+
+```bash
+SIP_IP=100.93.185.30
+SIP_DOMAIN=100.93.185.30
+DB_NAME=opensips
+DB_USER=opensips
+DB_PASS=opensipsrw
+CP_VERSION=9.3.6
+MI_HTTP_IP=127.0.0.1
+MI_HTTP_PORT=8888
+RTPENGINE_NG=127.0.0.1:2223
+RTPENGINE_PORT_MIN=30000
+RTPENGINE_PORT_MAX=40000
+MONIT_IP=127.0.0.1
+MONIT_PORT=2812
+MONIT_USER=admin
+MONIT_PASS=monit
+```
+
+After installation:
+
+中文说明：安装完成后，OpenSIPS-CP 管理页面和默认账号如下。
+
+```text
+OpenSIPS-CP: http://YOUR_SERVER_IP/cp/
+Default user: admin
+Default pass: opensips
+```
+
+Change the OpenSIPS-CP admin password before production use.
+
+中文说明：生产环境必须修改 OpenSIPS-CP 默认管理员密码，避免后台被默认口令登录。
+
+## Startup and boot enablement
+
+中文说明：服务启动和开机自启。
+
+OpenSIPS itself is a systemd service:
+
+中文说明：OpenSIPS 本体是 systemd 服务，下面命令用于设置开机自启、重启、查看是否运行和是否启用。
+
+```bash
+sudo systemctl enable opensips
+sudo systemctl restart opensips
+systemctl is-active opensips
+systemctl is-enabled opensips
+```
+
+Expected result:
+
+中文说明：期望看到 `active` 和 `enabled`，表示服务正在运行并已设置开机启动。
+
+```text
+active
+enabled
+```
+
+OpenSIPS-CP is the web control panel at:
+
+中文说明：OpenSIPS-CP 是 Web 管理后台，通过 `/cp/` 访问。
+
+```text
+http://YOUR_SERVER_IP/cp/
+```
+
+It is served by Apache and uses MariaDB, so there is no separate
+`opensips-cp.service` to enable. Enable and start these services instead:
+
+中文说明：OpenSIPS-CP 不是独立服务，它依赖 Apache 提供网页、MariaDB 存配置和数据，所以要启用的是 `apache2` 和 `mariadb`。
+
+```bash
+sudo systemctl enable apache2 mariadb
+sudo systemctl restart mariadb
+sudo systemctl restart apache2
+systemctl is-active apache2 mariadb
+systemctl is-enabled apache2 mariadb
+```
+
+Expected result:
+
+```text
+active
+active
+enabled
+enabled
+```
+
+Useful verification commands:
+
+中文说明：下面命令用于确认 SIP 端口、Web 端口、CP 页面和 MI HTTP 接口都正常。
+
+```bash
+ss -lunp | grep ':5060'
+ss -ltnp | grep ':80'
+curl -fsSI http://127.0.0.1/cp/
+curl -fsS -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"ps"}'
+```
+
+On the current workstation, the public access URL is:
+
+中文说明：当前这台工作站的访问地址如下。
+
+```text
+http://100.93.185.30/cp/
+```
+
+## Packages that must not be missed
+
+中文说明：容易漏装但必须安装的软件包。
+
+Base OpenSIPS packages:
+
+中文说明：OpenSIPS 主程序、CLI、MySQL、认证和 TLS 相关基础包。
+
+```bash
+opensips
+opensips-cli
+opensips-mysql-module
+opensips-auth-modules
+opensips-tls-module
+```
+
+Database schema package:
+
+中文说明：OpenSIPS 数据库建表脚本包。
+
+```bash
+opensips-mysql-dbschema
+```
+
+This one is easy to miss. Without it, `/usr/share/opensips/mysql/*.sql` is not
+available and `opensipsdbctl` may not exist on OpenSIPS 3.6 installs.
+
+中文说明：这个包很容易漏。没有它就找不到 `/usr/share/opensips/mysql/*.sql`，后续建表和导入模块表会很麻烦。
+
+OpenSIPS-CP MI support:
+
+中文说明：OpenSIPS-CP 通过 MI 接口控制 OpenSIPS，下面两个包提供 HTTP MI 和 JSON 支持。
+
+```bash
+opensips-http-modules
+opensips-json-module
+```
+
+These provide `httpd.so`, `mi_http.so` and JSON support. Without them,
+OpenSIPS-CP actions such as `Reload on Server` will fail when configured for
+`json:127.0.0.1:8888/mi`.
+
+中文说明：没有这些模块时，CP 页面里的 `Reload on Server` 会连不上 `127.0.0.1:8888/mi` 或提示 MI 命令不可用。
+
+SIP user authentication and database registration:
+
+中文说明：SIP 用户认证和注册落库需要的模块。
+
+```bash
+opensips-auth-modules
+opensips-mysql-module
+```
+
+Enable these modules in `opensips.cfg`:
+
+中文说明：在 `opensips.cfg` 中启用认证模块和位置服务模块，让用户可以用数据库账号注册到 OpenSIPS。
+
+```opensips
+loadmodule "auth.so"
+loadmodule "auth_db.so"
+modparam("auth_db", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
+modparam("auth_db", "calculate_ha1", 1)
+
+loadmodule "usrloc.so"
+modparam("usrloc", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
+modparam("usrloc", "working_mode_preset", "single-instance-sql-write-through")
+```
+
+Then protect REGISTER requests:
+
+中文说明：下面这段用于保护 REGISTER 请求；没有正确账号密码的终端不能注册。
+
+```opensips
+if (is_method("REGISTER")) {
+    if (!www_authorize("$fd", "subscriber")) {
+        www_challenge("$fd", "auth");
+        exit;
+    }
+
+    if (!save("location"))
+        xlog("failed to register AoR $tu\n");
+
+    exit;
+}
+```
+
+`calculate_ha1=1` lets OpenSIPS calculate the digest hash from the plain
+`subscriber.password` column created by OpenSIPS-CP.
+
+中文说明：`calculate_ha1=1` 表示 OpenSIPS 可以根据 `subscriber.password` 明文密码计算 SIP Digest 认证需要的 hash。
+
+Dialog tracking for the OpenSIPS-CP Dialog page:
+
+中文说明：Dialog 页面用于查看在线通话/会话状态，需要启用 `dialog.so`。
+
+```opensips
+loadmodule "dialog.so"
+modparam("dialog", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
+modparam("dialog", "profiles_no_value", "inbound;outbound")
+modparam("dialog", "profiles_with_value", "caller;callee")
+```
+
+Create dialog state for initial INVITEs:
+
+中文说明：初始 INVITE 到来时创建 dialog 状态，并把主叫、被叫等信息放进 profile，便于 CP 页面查看。
+
+```opensips
+if (is_method("INVITE")) {
+    create_dialog();
+    set_dlg_profile("outbound");
+    set_dlg_profile("caller", "$fU");
+    set_dlg_profile("callee", "$rU");
+    do_accounting("log");
+}
+```
+
+Without `dialog.so`, OpenSIPS-CP Dialog pages fail with:
+
+中文说明：如果没加载 `dialog.so`，Dialog 页面会报下面这个 MI 方法不存在。
+
+```text
+MI command failed with code -32601 (Method not found)
+```
+
+Validation:
+
+中文说明：验证 Dialog MI 命令是否可用。
+
+```bash
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"dlg_list"}'
+```
+
+Dispatcher support for the OpenSIPS-CP Dispatcher page:
+
+中文说明：Dispatcher 页面用于管理/查看后端服务器分发列表，需要启用 `dispatcher.so`。
+
+```opensips
+loadmodule "dispatcher.so"
+modparam("dispatcher", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
+modparam("dispatcher", "persistent_state", 1)
+```
+
+Without `dispatcher.so`, OpenSIPS-CP Dispatcher pages fail with:
+
+中文说明：如果没加载 `dispatcher.so`，Dispatcher 页面会报下面这个 MI 方法不存在。
+
+```text
+MI command failed with code -32601 (Method not found)
+```
+
+Validation:
+
+```bash
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"ds_list"}'
+
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":2,"method":"ds_reload"}'
+```
+
+Dynamic Routing support for the OpenSIPS-CP Dashboard and Dynamic Routing pages:
+
+中文说明：Dynamic Routing 是动态路由/LCR 能力，用于管理落地网关、路由规则、网关状态，也支撑 Dashboard 的动态路由小组件。
+
+```opensips
+loadmodule "drouting.so"
+modparam("drouting", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
+modparam("drouting", "drd_table", "dr_gateways")
+modparam("drouting", "drr_table", "dr_rules")
+modparam("drouting", "drg_table", "dr_groups")
+modparam("drouting", "drc_table", "dr_carriers")
+```
+
+The Dashboard `Dynamic Routing` widget calls MI commands such as
+`dr_gw_status` and `dr_reload_status`. Without `drouting.so`, Dashboard may show:
+
+中文说明：Dashboard 上的 `Dynamic Routing` 卡片会调用 `dr_gw_status` 等命令；如果没加载 `drouting.so`，Dashboard 会出现 Method not found。
+
+```text
+MI command failed with code -32601 (Method not found)
+```
+
+Validation:
+
+```bash
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"dr_gw_status"}'
+
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":2,"method":"dr_reload_status"}'
+```
+
+On a fresh system with no dynamic-routing gateways configured, `dr_gw_status`
+should return an empty `Gateways` list, not `Method not found`.
+
+中文说明：新系统没有配置网关时，返回空网关列表是正常的；错误是 `Method not found`，说明模块没加载。
+
+RTPengine:
+
+中文说明：RTPengine 是媒体代理，负责 RTP 媒体流转发、NAT 穿透，也可配合录音。
+
+```bash
+rtpengine-daemon
+```
+
+OpenSIPS-CP has two separate media relay pages:
+
+中文说明：OpenSIPS-CP 里 RTPProxy 和 RTPEngine 是两个不同页面，分别对应不同 OpenSIPS 模块。
+
+- `RTPProxy` uses the OpenSIPS `rtpproxy.so` module and MI commands such as
+  `rtpproxy_show`, `rtpproxy_reload`, and `rtpproxy_enable`.
+- `RTPEngine` uses the OpenSIPS `rtpengine.so` module and MI commands such as
+  `rtpengine_show`, `rtpengine_reload`, and `rtpengine_enable`.
+
+If either module is not loaded, its page fails with:
+
+中文说明：对应模块没加载时，页面会报 MI 命令不存在。
+
+```text
+MI command failed with code -32601 (Method not found)
+```
+
+For this workstation, RTPengine is the actual media proxy daemon. RTPProxy is
+loaded only so the OpenSIPS-CP RTPProxy page can call its MI commands; without
+RTPProxy sockets configured, the page should show an empty list instead of a
+Method not found error.
+
+中文说明：当前工作站实际使用的是 RTPengine。RTPProxy 模块只是为了让 CP 的 RTPProxy 页面不报错；没有配置 RTPProxy socket 时显示空列表是正常的。
+
+OpenSIPS module config:
+
+中文说明：下面配置同时启用 `rtpengine.so` 和 `rtpproxy.so`，分别对应两个 CP 页面。
+
+```opensips
+loadmodule "rtpengine.so"
+modparam("rtpengine", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
+modparam("rtpengine", "db_table", "rtpengine")
+
+loadmodule "rtpproxy.so"
+modparam("rtpproxy", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
+modparam("rtpproxy", "db_table", "rtpproxy_sockets")
+```
+
+RTPengine DB row used on the current workstation:
+
+中文说明：当前工作站的 RTPengine 控制 socket 是 `udp:127.0.0.1:2223`，需要写入 `rtpengine` 表。
+
+```sql
+INSERT INTO rtpengine (socket, set_id)
+SELECT 'udp:127.0.0.1:2223', 0
+WHERE NOT EXISTS (
+  SELECT 1 FROM rtpengine WHERE socket='udp:127.0.0.1:2223' AND set_id=0
+);
+```
+
+Validation:
+
+```bash
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"rtpengine_show"}'
+
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":2,"method":"rtpproxy_show"}'
+```
+
+## OpenSIPS-CP SIP Trace page
+
+中文说明：OpenSIPS-CP 的 SIP Trace 页面。
+
+The SIP Trace page displays SIP messages captured by OpenSIPS and stored in the
+`sip_trace` table. It is useful for troubleshooting registration, INVITE call
+setup, routing, authentication challenges, and failed SIP responses. It lets
+you filter by:
+
+中文说明：SIP Trace 用于查看 OpenSIPS 抓到的 SIP 报文，适合排查注册失败、呼叫不通、路由错误、认证失败和 SIP 响应异常。
+
+- `RegExp`: text or regex to search in captured SIP messages.
+- `Call ID`: one SIP dialog/transaction identifier.
+- `Traced User`: the trace attribute saved by the script, here `$fU`.
+- `Start Date` / `End Date`: time range.
+- `Group results by Call ID`: groups multiple SIP messages from the same call.
+
+If the page shows:
+
+中文说明：如果 SIP Trace 页面出现下面的错误，说明 `trace` MI 命令不存在。
+
+```text
+MI command failed with code -32601 (Method not found)
+```
+
+then OpenSIPS-CP called the `trace` MI command, but OpenSIPS did not load the
+`tracer.so` module.
+
+中文说明：原因是 CP 调用了 `trace` 命令，但 OpenSIPS 没加载 `tracer.so`。
+
+OpenSIPS module config:
+
+中文说明：下面配置开启 tracer 模块，并把 trace 数据写入 MySQL 的 `sip_trace` 表。
+
+```opensips
+loadmodule "tracer.so"
+modparam("tracer", "trace_on", 1)
+modparam("tracer", "trace_id", "[tid]uri=mysql://opensips:opensipsrw@localhost/opensips;table=sip_trace;")
+```
+
+Main route hook used on the current workstation:
+
+中文说明：仅启用模块还不会自动写入数据，路由脚本里需要调用 `trace()`。
+
+```opensips
+route{
+    trace("tid", "m", "sip", "$fU");
+```
+
+The `trace` MI command only toggles tracing on/off. The `trace()` call in the
+routing script is what actually writes messages to the `sip_trace` database
+table.
+
+中文说明：MI 的 `trace` 命令只是开关；真正把 SIP 消息写进数据库的是路由脚本中的 `trace()` 函数。
+
+Validation:
+
+```bash
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"trace"}'
+
+mysql -D opensips -e "SELECT COUNT(*) FROM sip_trace;"
+```
+
+SIP Trace can grow quickly on a busy server. In production, keep it disabled by
+default or clean old rows regularly.
+
+中文说明：生产环境要谨慎开启 SIP Trace，因为话务量大时 `sip_trace` 表会增长很快，应定期清理或只在排障时开启。
+
+Web/database dependencies:
+
+中文说明：Web 前端和数据库依赖包。
+
+```bash
+mariadb-server mariadb-client
+apache2 libapache2-mod-php
+php php-cli php-mysql php-gd php-pear php-apcu php-curl php-xml php-mbstring
+git unzip curl
+```
+
+Monit support for the OpenSIPS-CP Monit page:
+
+中文说明：Monit 页面用于查看服务器服务和系统状态，需要安装 `monit`。
+
+```bash
+monit
+```
+
+OpenSIPS-CP's Monit page is a proxy to Monit's own HTTP interface. If `monit`
+is not installed or the OpenSIPS-CP box has no `monit_conn`, the page may show:
+
+中文说明：CP 的 Monit 页面实际是代理访问 Monit 自带 HTTP 页面；如果 Monit 没装或 CP 的 box 没配置 `monit_conn`，就会报空地址。
+
+```text
+Failed to parse address ""
+Error: 1
+I can't connect!
+```
+
+Configure Monit to listen locally:
+
+中文说明：Monit 只监听本机 `127.0.0.1:2812`，避免暴露到外网。
+
+```monit
+set httpd port 2812 and
+    use address 127.0.0.1
+    allow 127.0.0.1
+    allow admin:monit
+```
+
+Enable it:
+
+```bash
+sudo monit -t
+sudo systemctl enable monit
+sudo systemctl restart monit
+```
+
+Configure the OpenSIPS-CP default box:
+
+中文说明：把 OpenSIPS-CP 默认 box 的 Monit 连接地址、账号和密码写入数据库。
+
+```sql
+UPDATE ocp_boxes_config
+   SET monit_conn='127.0.0.1:2812',
+       monit_user='admin',
+       monit_pass='monit',
+       monit_ssl=0
+ WHERE id=1;
+```
+
+Validation:
+
+```bash
+systemctl is-active monit
+systemctl is-enabled monit
+ss -ltnp | grep ':2812'
+curl -fsS -u admin:monit http://127.0.0.1:2812/ | grep -m1 Monit
+```
+
+On the current workstation, Monit is installed, enabled, and bound to
+`127.0.0.1:2812`. The OpenSIPS-CP default box uses `admin` / `monit`.
+
+中文说明：当前工作站已经安装并启用 Monit，CP 使用 `admin / monit` 连接本机 Monit。生产环境请修改密码。
+
+## OpenSIPS config added during the fix
+
+中文说明：安装后补加到 OpenSIPS 配置里的关键修复项。
+
+The initial installation only had `mi_fifo`. OpenSIPS-CP was configured to call:
+
+中文说明：最初只有 `mi_fifo`，但 CP 配置的是 JSON HTTP MI，所以页面 reload 会失败。
+
+```text
+json:127.0.0.1:8888/mi
+```
+
+So `Reload on Server` failed with:
+
+中文说明：因此 CP 页面点击 `Reload on Server` 时会连接不上 8888 端口。
+
+```text
+Failed to connect to 127.0.0.1 port 8888
+```
+
+The fix was to load HTTP MI:
+
+中文说明：修复方法是加载 `httpd.so` 和 `mi_http.so`，让 OpenSIPS 提供本地 HTTP MI 接口。
+
+```opensips
+loadmodule "httpd.so"
+modparam("httpd", "ip", "127.0.0.1")
+modparam("httpd", "port", 8888)
+
+loadmodule "mi_http.so"
+modparam("mi_http", "root", "mi")
+```
+
+After that, the MI endpoint worked, but `address_reload` returned:
+
+中文说明：HTTP MI 通了以后，`address_reload` 又报方法不存在，这是因为还没加载权限模块。
+
+```text
+Method not found
+```
+
+That command is provided by `permissions.so`, so the next fix was:
+
+中文说明：`address_reload` 由 `permissions.so` 提供，所以需要加载 permissions 模块并配置数据库。
+
+```opensips
+loadmodule "db_mysql.so"
+
+loadmodule "permissions.so"
+modparam("permissions", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
+modparam("permissions", "address_table", "address")
+```
+
+Validation command:
+
+```bash
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"address_reload"}'
+```
+
+Expected result:
+
+中文说明：期望返回 OK。
+
+```json
+{"jsonrpc":"2.0","result":"OK","id":1}
+```
+
+## OpenSIPS-CP Addresses page
+
+中文说明：OpenSIPS-CP 的 Addresses 页面。
+
+The Addresses page writes to the `address` table used by the `permissions`
+module.
+
+中文说明：Addresses 页面配置的是 IP 访问规则/白名单类规则，写入 `permissions` 模块使用的 `address` 表。
+
+It is not where the local OpenSIPS listening IP is configured. The listening IP
+belongs in:
+
+中文说明：这里不是配置 OpenSIPS 本机监听 IP 的地方；本机监听 IP 要写在 `opensips.cfg` 的 `socket`。
+
+```text
+/etc/opensips/opensips.cfg
+```
+
+Example:
+
+```opensips
+socket=udp:100.93.185.30:5060
+```
+
+Typical Address entry:
+
+中文说明：典型地址规则示例如下。
+
+```text
+Group: 1
+IP: 47.97.162.65
+Mask: 32
+Port: 5060
+Protocol: any
+Pattern:
+Context Info: lisglo
+```
+
+Notes:
+
+中文说明：字段注意事项。
+
+- `Group` must be numeric.
+- `Pattern` is an optional wildcard pattern used by `permissions` matching.
+- `Context Info` is returned to the OpenSIPS script when the rule matches.
+- Click `Reload on Server` after editing Addresses.
+
+## OpenSIPS-CP Domains validation issue
+
+中文说明：OpenSIPS-CP Domains 页面表单校验问题。
+
+On OpenSIPS-CP 9.3.6, the Domains page may reject both IP addresses and normal
+FQDNs in the `SIP Domain` field. The symptom is a red validation icon next to
+the field and the `Add New Domain` button stays disabled.
+
+中文说明：在 OpenSIPS-CP 9.3.6 中，Domains 页面可能错误拒绝 IP 和普通域名，表现为输入框旁边红色校验图标，添加按钮不可点。
+
+This is not a SIP limitation. SIP domains may be IPs or FQDNs, and the Domains
+tool itself says:
+
+中文说明：这不是 SIP 协议限制，SIP domain 可以是 IP，也可以是 FQDN 域名。
+
+```text
+A SIP Domain to be considered local by OpenSIPS - can be an IP or a FQDN
+```
+
+The issue is in the browser-side form validation generator:
+
+中文说明：问题在 CP 前端表单校验生成器。
+
+```text
+/var/www/html/opensips-cp/web/common/forms.php
+```
+
+The code uses `preg_quote()` when embedding validation regexes into JavaScript.
+That escapes the regex into a literal string, so JavaScript's `RegExp()` no
+longer receives the intended regex.
+
+中文说明：代码用 `preg_quote()` 把正则转给 JavaScript，导致正则被转义成普通字符串，浏览器端校验失效。
+
+Patch:
+
+中文说明：下面补丁把 `preg_quote()` 改成更适合 JS 字符串的 `addslashes()`。
+
+```bash
+sudo cp -a /var/www/html/opensips-cp/web/common/forms.php \
+  /var/www/html/opensips-cp/web/common/forms.php.bak.regexfix.$(date +%Y%m%d%H%M%S)
+
+sudo python3 - <<'PY'
+from pathlib import Path
+p = Path('/var/www/html/opensips-cp/web/common/forms.php')
+s = p.read_text()
+s = s.replace("preg_quote($re, '/')", "addslashes($re)")
+s = s.replace("preg_quote($value['validation_regex'], '/')", "addslashes($value['validation_regex'])")
+p.write_text(s)
+PY
+
+php -l /var/www/html/opensips-cp/web/common/forms.php
+```
+
+On some OpenSIPS-CP 9.3.6 installs, the Domains page can still reject input
+after the common form-generator patch because the Domains template ships its
+own over-escaped field regex. If both IPs and normal FQDNs still show a red
+validation icon, patch the Domains form itself:
+
+中文说明：有些安装即使修了通用表单生成器，Domains 页面自己的字段正则仍然会过度转义，需要单独修 Domains 模板。
+
+```bash
+sudo cp -a /var/www/html/opensips-cp/web/tools/system/domains/template/domains.form.php \
+  /var/www/html/opensips-cp/web/tools/system/domains/template/domains.form.php.bak.domain-regex.$(date +%Y%m%d%H%M%S)
+
+sudo python3 - <<'PY'
+from pathlib import Path
+p = Path('/var/www/html/opensips-cp/web/tools/system/domains/template/domains.form.php')
+s = p.read_text()
+lines = []
+for line in s.splitlines():
+    if '"domain", "n", $domain_form' in line:
+        indent = line[:len(line) - len(line.lstrip())]
+        lines.append(indent + '"domain", "n", $domain_form[\'domain\'], 128, null);')
+    else:
+        lines.append(line)
+p.write_text('\n'.join(lines) + '\n')
+PY
+
+php -l /var/www/html/opensips-cp/web/tools/system/domains/template/domains.form.php
+sudo systemctl reload apache2 || sudo systemctl restart apache2
+```
+
+This only disables the browser-side regex for the `SIP Domain` field; the field
+remains required, and the database/OpenSIPS domain module still determine what
+is actually usable. After patching, hard refresh the browser with `Ctrl+F5`.
+
+中文说明：这个修复只关闭 SIP Domain 字段的浏览器端正则，字段仍是必填；真正是否可用仍由数据库和 OpenSIPS domain 模块决定。修完后浏览器要 `Ctrl+F5` 强制刷新。
+
+The one-shot installer already applies both equivalent patches automatically.
+
+中文说明：一键安装脚本已经自动包含这两个补丁。
+
+For the current workstation, `100.93.185.30` was also inserted directly into the
+`domain` table to unblock user creation:
+
+中文说明：当前工作站为了先让用户创建功能可用，已经把 `100.93.185.30` 直接写入 `domain` 表。
+
+```sql
+INSERT INTO domain (domain, attrs, accept_subdomain, last_modified)
+SELECT '100.93.185.30', NULL, 0, NOW()
+WHERE NOT EXISTS (SELECT 1 FROM domain WHERE domain='100.93.185.30');
+```
+
+The `domain` runtime module was enabled:
+
+中文说明：同时启用了 OpenSIPS 的 `domain.so` 模块，并使用数据库模式。
+
+```opensips
+loadmodule "domain.so"
+modparam("domain", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
+modparam("domain", "db_mode", 1)
+```
+
+Validation:
+
+```bash
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"domain_reload"}'
+
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":2,"method":"domain_dump"}'
+```
+
+Expected `domain_dump` output includes:
+
+中文说明：期望 `domain_dump` 输出中包含当前服务器域名/IP。
+
+```text
+100.93.185.30
+```
+
+## Security notes
+
+中文说明：安全注意事项。
+
+- Keep MI HTTP bound to `127.0.0.1`.
+- Do not expose `0.0.0.0:8888` to the network.
+- Change the OpenSIPS-CP admin password.
+- Use a stronger database password in production.
+- Restrict SIP source IPs using `permissions` / `address` rules.
+- Open RTP port range only where needed, for example `30000-40000/udp`.
+
+## Runtime checks
+
+中文说明：运行状态检查命令。
+
+```bash
+systemctl is-active mariadb apache2 opensips rtpengine-daemon
+ss -ltnup | grep -E '(:80|:5060|:8888|:2223|:2812)'
+curl -I http://127.0.0.1/cp/
+curl -fsS -u admin:monit http://127.0.0.1:2812/ | grep -m1 Monit
+curl -X POST http://127.0.0.1:8888/mi \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"ps"}'
+```
diff --git a/SOFTSWITCH_PLATFORM_DESIGN_V1.md b/SOFTSWITCH_PLATFORM_DESIGN_V1.md
new file mode 100644
index 0000000..707123b
--- /dev/null
+++ b/SOFTSWITCH_PLATFORM_DESIGN_V1.md
@@ -0,0 +1,766 @@
+# 自研软交换运营平台 V1 产品设计文档
+
+## 1. 系统定位
+
+本系统定位为基于 OpenSIPS + RTPEngine 的软交换运营平台，用于支撑多客户、多供应商、多线路组、费率计费、话单查询、录音质检和 SIP 运维。
+
+OpenSIPS 负责 SIP 信令控制、注册鉴权、路由选择、话单基础数据和与媒体代理的协同。RTPEngine 负责 RTP 媒体转发、NAT 穿透和录音能力。自研平台负责客户、供应商、费率、账单、质检、权限、报表等业务运营能力。
+
+推荐定位：
+
+- OpenSIPS-CP：V1 保留，作为技术运维后台，用于排障和底层配置。
+- 自研平台：业务运营后台，用于客户、计费、线路、话单、质检和权限管理。
+
+## 2. 目标用户角色
+
+### 2.1 超级管理员
+
+负责全局配置、租户/客户管理、供应商管理、系统参数、权限和安全策略。
+
+### 2.2 运营管理员
+
+负责客户开通、线路组配置、路由策略、时段控制、话单查询和日常运营。
+
+### 2.3 财务人员
+
+负责客户费率、供应商费率、账单、成本、利润、充值、授信和对账。
+
+### 2.4 质检人员
+
+负责录音抽检、录音试听、质检标注、问题分类和质检报告。
+
+### 2.5 技术运维
+
+负责 SIP Trace、在线通话、注册状态、网关状态、OpenSIPS/RTPEngine 监控和故障排查。
+
+### 2.6 客户账号
+
+V1 不包含客户登录端。客户侧能力暂不开放独立门户，仅保留内部运营后台使用。
+
+## 3. 一级菜单设计
+
+```text
+运营平台
+├── 概览 Dashboard
+├── 客户管理
+├── 供应商管理
+├── 线路与路由
+├── 费率与计费
+├── 话单中心
+├── 质检中心
+├── SIP 运维
+├── 监控告警
+├── 系统设置
+└── 权限与审计
+```
+
+## 4. 页面功能设计
+
+## 4.1 概览 Dashboard
+
+用途：展示平台整体运行状态。
+
+核心卡片：
+
+- 今日通话数
+- 当前在线通话数
+- 今日接通率
+- 今日客户消费
+- 今日供应商成本
+- 今日毛利
+- 在线注册用户数
+- RTPengine 节点状态
+- OpenSIPS 节点状态
+- 异常网关数量
+- 质检待处理数量
+
+主要图表：
+
+- 最近 24 小时通话量趋势
+- 最近 24 小时接通率趋势
+- 客户消费 TOP 10
+- 供应商成本 TOP 10
+- 失败响应码分布
+
+OpenSIPS/RTPEngine 对接点：
+
+- OpenSIPS MI：`ps`、`get_statistics`、`dlg_list`
+- OpenSIPS DB：CDR 表、subscriber/location 表
+- RTPEngine 控制接口：节点状态
+
+## 4.2 客户管理
+
+### 客户列表
+
+字段：
+
+- 客户 ID
+- 客户名称
+- SIP 域名
+- 认证方式
+- 网关数量
+- 状态
+- 余额
+- 授信额度
+- 计费模式
+- 线路组
+- 创建时间
+
+操作：
+
+- 新增客户
+- 编辑客户
+- 禁用/启用客户
+- 配置费率
+- 配置线路组
+- 查看话单
+- 查看账单
+
+### 客户详情
+
+模块：
+
+- 基本信息
+- SIP 账号
+- 客户网关
+- IP 白名单
+- 费率方案
+- 线路组
+- 外呼时段
+- 余额/授信
+- 录音质检策略
+- 操作日志
+
+### 客户网关与业务策略
+
+设计要求：
+
+- 同一个客户可配置多个接入网关。
+- 每个客户网关可单独开启或关闭录音。
+- 同一个客户下，不同客户网关来源 IP + 不同被叫前缀，可映射到不同业务。
+- 每个业务映射项需绑定对应客户费率和落地网关组。
+
+建议字段：
+
+- 客户
+- 客户网关 ID
+- 来源 IP
+- 被叫前缀
+- 业务名称
+- 录音开关
+- 客户费率方案
+- 落地网关组
+- 优先级
+- 状态
+
+OpenSIPS 对接点：
+
+- `subscriber`：SIP 用户认证
+- `domain`：客户域名
+- `address`：客户 IP 白名单
+- `dr_groups`：客户所属路由组
+
+## 4.3 供应商管理
+
+### 供应商列表
+
+字段：
+
+- 供应商 ID
+- 供应商名称
+- 网关数量
+- 状态
+- 结算周期
+- 费率方案
+- 联系人
+- 创建时间
+
+操作：
+
+- 新增供应商
+- 编辑供应商
+- 禁用/启用供应商
+- 管理网关
+- 管理供应商费率
+- 查看成本话单
+
+### 落地网关
+
+字段：
+
+- 网关 ID
+- 供应商
+- SIP 地址
+- 端口
+- 协议
+- 权重
+- 优先级
+- 探测模式
+- 当前状态
+- 描述
+
+### 供应商网关业务策略
+
+设计要求：
+
+- 同一个供应商可配置多个落地网关。
+- 同一个网关下，可按不同被叫前缀区分业务。
+- 同一个网关下，也可按不同主叫号码或主叫号段区分业务。
+- 每个业务映射项需绑定对应供应商费率，用于成本结算。
+
+建议字段：
+
+- 供应商
+- 网关 ID
+- 主叫号码/号段
+- 被叫前缀
+- 业务名称
+- 供应商费率方案
+- 优先级
+- 状态
+
+OpenSIPS 对接点：
+
+- `dr_gateways`
+- `dispatcher`
+- `drouting` MI：`dr_gw_status`、`dr_reload`
+
+## 4.4 线路与路由
+
+### 线路组
+
+用途：把多个供应商网关组合成一个客户可使用的落地线路池。
+
+字段：
+
+- 线路组 ID
+- 线路组名称
+- 适用客户
+- 网关列表
+- 路由策略
+- 失败重试策略
+- 状态
+
+路由策略：
+
+- 按优先级
+- 按权重
+- 按成本最低
+- 按接通率
+- 按号码前缀
+- 按时段
+
+### 路由规则
+
+字段：
+
+- 规则 ID
+- 客户/客户组
+- 号码前缀
+- 线路组
+- 优先级
+- 生效时间
+- 状态
+- 备注
+
+补充规则：
+
+- 客户侧优先按客户网关 + 来源 IP 识别接入入口。
+- 在接入入口下继续按被叫前缀识别业务。
+- 识别出业务后绑定客户费率和落地网关组。
+- 供应商侧优先按供应商网关匹配，再按被叫前缀或主叫号码匹配成本业务和费率。
+
+OpenSIPS 对接点：
+
+- `dr_rules`
+- `dr_groups`
+- `dr_carriers`
+- `dialplan`
+
+## 4.5 费率与计费
+
+### 客户费率
+
+字段：
+
+- 客户
+- 业务名称
+- 客户网关（可选）
+- 国家/地区
+- 号码前缀
+- 单价
+- 计费周期
+- 首周期
+- 生效时间
+- 失效时间
+
+计费周期示例：
+
+- 1/1：按秒计费
+- 6/6：每 6 秒一个计费单位
+- 60/60：按分钟计费
+- 60/6：首分钟，之后每 6 秒
+
+### 供应商费率
+
+字段类似客户费率，但用于计算成本。
+
+补充维度：
+
+- 供应商
+- 供应商网关（可选）
+- 主叫号码/号段（可选）
+- 被叫前缀
+- 业务名称
+
+### Billing Worker
+
+职责：
+
+- 读取未计费 CDR
+- 识别客户业务
+- 匹配客户费率
+- 识别供应商业务
+- 匹配供应商费率
+- 按计费周期计算客户费用
+- 按计费周期计算供应商成本
+- 计算毛利
+- 写入已计费话单
+- 更新余额或授信占用
+
+计费公式示例：
+
+```text
+计费秒数 = ceil(实际通话秒数 / 计费周期) * 计费周期
+客户费用 = 计费秒数 / 60 * 客户分钟单价
+供应商成本 = 计费秒数 / 60 * 供应商分钟单价
+毛利 = 客户费用 - 供应商成本
+```
+
+OpenSIPS 对接点：
+
+- `acc`
+- `dialog`
+- CDR 表
+- 自研 billing 表
+
+## 4.6 话单中心
+
+### 原始 CDR
+
+字段：
+
+- Call-ID
+- 客户
+- 客户网关
+- 来源 IP
+- 主叫
+- 被叫
+- 业务名称
+- 开始时间
+- 接通时间
+- 结束时间
+- 通话时长
+- 计费时长
+- SIP 响应码
+- 供应商
+- 网关
+- 路由规则
+- 录音状态
+
+### 已计费话单
+
+字段：
+
+- 原始 CDR ID
+- 客户费率
+- 供应商费率
+- 客户费用
+- 供应商成本
+- 毛利
+- 计费状态
+- 计费时间
+
+操作：
+
+- 查询
+- 导出 CSV
+- 重新计费
+- 查看 SIP Trace
+- 查看录音
+- 页面内试听录音
+- 查看命中业务、客户费率、供应商费率和路由规则
+
+## 4.7 质检中心
+
+### 抽检规则
+
+字段：
+
+- 客户
+- 抽检比例
+- 指定号码
+- 指定线路
+- 最小时长
+- 最大时长
+- 是否录音
+- 生效时间
+
+### 录音列表
+
+字段：
+
+- Call-ID
+- 客户
+- 主叫
+- 被叫
+- 通话时间
+- 通话时长
+- 录音文件
+- 质检状态
+- 试听操作
+
+### 录音详情
+
+功能：
+
+- 播放录音
+- 查看录音基础信息
+- 标注问题
+- 打分
+- 导出质检报告
+
+RTPEngine 对接点：
+
+- RTPEngine 录音能力
+- recording daemon
+- 录音文件存储
+
+外部服务：
+
+- 对象存储，例如 MinIO/S3
+
+## 4.8 SIP 运维
+
+页面：
+
+- 在线注册
+- 在线通话
+- SIP Trace
+- 网关状态
+- Domain 管理
+- Address 白名单
+- Dispatcher
+- Dynamic Routing
+- RTPEngine 状态
+
+用途：
+
+- 给技术运维排障
+- 不建议直接暴露给普通业务人员
+
+OpenSIPS 对接点：
+
+- `usrloc`
+- `dialog`
+- `tracer`
+- `dispatcher`
+- `drouting`
+- `domain`
+- `permissions`
+- `rtpengine`
+
+## 4.9 监控告警
+
+监控项：
+
+- OpenSIPS 进程状态
+- OpenSIPS MI 是否可用
+- RTPEngine 节点是否可用
+- SIP 5060 是否监听
+- RTP 端口范围是否开放
+- 数据库连接
+- CDR 堆积
+- Billing Worker 堆积
+- 录音文件入库任务堆积
+- 磁盘空间
+
+告警方式：
+
+- 邮件
+- 企业微信/钉钉/飞书
+- 短信
+
+推荐工具：
+
+- Prometheus
+- Grafana
+- Loki 或 ELK
+- Alertmanager
+- Monit
+
+## 4.10 系统设置
+
+页面：
+
+- SIP 域名
+- 监听地址
+- MI 连接配置
+- RTPengine 节点
+- 录音存储
+- 全局计费参数
+- 时区与时间格式
+- 安全策略
+
+## 4.11 权限与审计
+
+### 角色权限
+
+角色示例：
+
+- 超级管理员
+- 运营管理员
+- 财务
+- 质检
+- 技术运维
+- 客户只读账号
+
+### 操作日志
+
+记录：
+
+- 登录
+- 新增/修改/删除客户
+- 修改费率
+- 修改路由
+- 手动重计费
+- 下载录音
+- 导出话单
+
+## 5. 核心业务流程
+
+## 5.1 客户开通流程
+
+```text
+新增客户
+  -> 分配 SIP 域名或账号
+  -> 配置 IP 白名单或 SIP 账号密码
+  -> 配置客户网关
+  -> 配置客户网关录音开关
+  -> 配置客户网关业务策略
+  -> 配置客户费率
+  -> 配置线路组
+  -> 配置外呼时段
+  -> 启用客户
+  -> OpenSIPS reload 对应模块
+```
+
+## 5.2 外呼流程
+
+```text
+客户发起 INVITE
+  -> OpenSIPS 判断来源 IP/账号
+  -> 识别客户
+  -> 识别客户网关
+  -> 检查客户状态和余额
+  -> 检查外呼时段
+  -> 按被叫前缀识别客户业务
+  -> 匹配客户费率
+  -> 选择落地网关组
+  -> 选择供应商网关
+  -> 按供应商网关 + 被叫前缀/主叫号码识别供应商业务
+  -> 调用 RTPEngine 处理媒体
+  -> 生成 Dialog/CDR
+  -> 通话结束后 Billing Worker 计费
+```
+
+## 5.3 呼入分发流程
+
+```text
+上游呼入到 SIP 域名
+  -> OpenSIPS domain 判断
+  -> 根据域名/DID/客户规则匹配目标
+  -> dispatcher 或 drouting 分发到后端服务器
+  -> 记录 CDR
+```
+
+## 5.4 计费流程
+
+```text
+通话结束
+  -> OpenSIPS 写入原始 CDR
+  -> Billing Worker 拉取未计费 CDR
+  -> 识别客户业务
+  -> 匹配客户费率
+  -> 识别供应商业务
+  -> 匹配供应商费率
+  -> 计算费用和成本
+  -> 写入已计费话单
+  -> 更新客户余额/授信
+  -> 生成账单统计
+```
+
+## 5.5 质检流程
+
+```text
+通话建立
+  -> 判断是否命中录音规则
+  -> OpenSIPS 控制 RTPEngine 录音
+  -> 通话结束生成录音文件
+  -> 录音入库
+  -> 质检人员页面试听录音
+  -> 标注问题并生成报告
+```
+
+## 6. 建议数据库模块
+
+业务库建议和 OpenSIPS 原生库分开，避免升级 OpenSIPS 时互相影响。
+
+```text
+opensips 原生库：
+- subscriber
+- location
+- domain
+- address
+- dialog
+- acc / cdr
+- dr_gateways
+- dr_rules
+- dr_groups
+- dispatcher
+- rtpengine
+- sip_trace
+
+业务库：
+- customers
+- customer_accounts
+- customer_rate_plans
+- customer_rates
+- customer_gateways
+- customer_gateway_policies
+- vendors
+- vendor_gateways
+- vendor_rate_plans
+- vendor_rates
+- vendor_gateway_policies
+- route_groups
+- route_group_items
+- outbound_time_policies
+- raw_cdrs
+- rated_cdrs
+- invoices
+- balances
+- recordings
+- quality_reviews
+- users
+- roles
+- permissions
+- audit_logs
+```
+
+## 7. 与 OpenSIPS/RTPEngine 的边界
+
+OpenSIPS 负责：
+
+- SIP 协议
+- 鉴权
+- 注册
+- 路由
+- 通话状态
+- MI 控制
+- CDR 基础数据
+
+RTPEngine 负责：
+
+- RTP 转发
+- NAT 穿透
+- 媒体锚定
+- 录音
+
+自研平台负责：
+
+- 客户管理
+- 供应商管理
+- 费率
+- 计费
+- 账单
+- 质检
+- 权限
+- 报表
+- 审计
+
+## 8. V1 优先级建议
+
+### P0：先跑通运营闭环
+
+- 客户管理
+- 供应商管理
+- 线路组
+- 客户费率
+- 供应商费率
+- 原始 CDR
+- Billing Worker
+- 已计费话单
+- 预付费余额实时控制
+- Dashboard 基础指标
+
+### P1：提升运营能力
+
+- 时段控制
+- 授信管理
+- 账单
+- 导出
+- 网关健康状态
+- SIP Trace 跳转
+
+### P2：质检和录音运营
+
+- 录音规则
+- 录音列表
+- 录音试听
+- 质检标注
+- 质检报表
+
+### P3：高可用和企业化
+
+- 多 OpenSIPS 节点
+- 多 RTPEngine 节点
+- 数据库高可用
+- 多角色权限
+- 审计日志
+- 告警中心
+
+## 9. Figma 原型页面清单
+
+建议优先画这些页面：
+
+1. Dashboard
+2. 客户列表
+3. 客户详情
+4. 客户费率
+5. 供应商列表
+6. 落地网关
+7. 线路组
+8. 路由规则
+9. 原始 CDR
+10. 已计费话单
+11. 账单详情
+12. 录音列表
+13. 录音详情
+14. SIP 运维概览
+15. 系统设置
+
+## 10. V1 范围确认
+
+已确认范围：
+
+- 不需要客户登录端。
+- 需要预付费余额实时控制。
+- 不需要多 OpenSIPS 节点，V1 按单节点设计。
+- 保留 OpenSIPS-CP，作为技术运维后台。
+
+按以上范围进入下一阶段：
+
+```text
+产品原型 -> 数据库设计 -> API 设计 -> OpenSIPS 脚本改造 -> Billing Worker -> 前端开发
+```
diff --git a/SOFTSWITCH_PLATFORM_DESIGN_V2.md b/SOFTSWITCH_PLATFORM_DESIGN_V2.md
new file mode 100644
index 0000000..96f712a
--- /dev/null
+++ b/SOFTSWITCH_PLATFORM_DESIGN_V2.md
@@ -0,0 +1,1163 @@
+# LisgloSIPS V2 项目设计与实施文档
+
+> 中文名：聆界SIP管理平台  
+> 文档版本：V2.0  
+> 编制日期：2026-06-20  
+> 文档状态：实施基线草案  
+> 依据：服务器架构图、`SOFTSWITCH_PLATFORM_DESIGN_V1.md`、当前 React Web Demo、`OPENSIPS_INSTALL_NOTES.md`
+
+## 1. 文档目的
+
+V2 的目标是把当前纯前端原型转化为可部署、可联调、可上线的软交换运营平台。本文不仅描述产品功能，还给出服务器部署、软件安装、后端代码、OpenSIPS/RTPEngine 对接、数据库、Redis、录音迁移、测试和上线方案。
+
+本文作为下一阶段执行基线，后续数据库 DDL、OpenAPI、OpenSIPS 脚本和部署脚本应从本文拆分并版本化管理。
+
+## 2. V2 范围
+
+### 2.1 本期实施页面
+
+以下菜单已在 Web Demo 中完成交互设计，纳入 V2 后端和联调范围：
+
+| 菜单 | V2 实施内容 |
+| --- | --- |
+| 概览 Dashboard | 通话、接通率、消费、成本、毛利、注册、节点、异常网关、质检指标 |
+| 客户管理 | 客户新增、编辑、启停、余额、授信、充值、网关数量 |
+| 客户网关管理 | IP/SIP 注册认证、启停、多个策略、优先级、主被叫匹配、线路组绑定 |
+| 充值记录 | 客户充值、供应商充值、余额前后值、操作人、备注 |
+| 供应商管理 | 供应商账户、余额、授信、充值 |
+| 落地网关管理 | 认证、并发、CPS、禁呼时段、编码、号码转换、计费周期、费率、启停 |
+| 落地线路组 | 线路组、组内网关、优先级、并发汇总 |
+| 话单中心 | 话单查询、挂断原因、费用、录音、信令入口、详情 |
+| 质检中心 | 抽检规则、录音列表、连续播放、自动播放、问题标注、评分 |
+| 用户管理 | 用户新增、编辑、启停、重置密码、角色绑定 |
+| 角色与权限 | 角色、权限矩阵、角色用户数、内置角色保护 |
+| 操作日志 | 条件查询、结果、详情、导出 |
+
+### 2.2 延期页面
+
+以下菜单在 Web Demo 中标记为“待设计”，本期不开发其业务页面：
+
+- 费率与计费
+- SIP 运维
+- 监控告警
+- 系统设置
+
+说明：页面延期不代表底层能力完全取消。V2 仍需实现：
+
+- 最小计费引擎，用于生成话单客户费用、成本费用并更新余额。
+- Prometheus/Grafana 基础设施监控，但不接入自研“监控告警”页面。
+- OpenSIPS/RTPEngine 配置文件和环境变量管理，但不开放自研“系统设置”页面。
+- HOMER 信令查询入口，但不开发自研“SIP 运维”页面。
+
+### 2.3 明确不做
+
+- 客户自助门户。
+- 多 OpenSIPS 节点和通话级高可用。
+- 完整账单、发票、对账和复杂费率管理页面。
+- 自研可视化 SIP Trace、监控告警和系统配置页面。
+- Kubernetes。双机阶段使用 systemd、Nginx 和 Docker Compose 的有限组合。
+
+## 3. 总体架构
+
+### 3.1 服务器规划
+
+环境分为两个阶段：
+
+- 当前开发阶段：A、B、T 均为本地 KVM 虚拟机，通过 Tailscale 专网联调。
+- 开发完成后：将 A、B 部署到阿里云，按下表建立 VPC、公网入口和安全组；T 保留为外部 SIP 测试端。
+
+下表为最终阿里云生产目标，不代表当前本地开发机已经位于阿里云：
+
+| 服务器 | 规格 | 定位 | 公网暴露 |
+| --- | --- | --- | --- |
+| Server A | 阿里云计算型 4C8G | 核心通信网关 | SIP `15060/UDP`、RTP UDP 端口段 |
+| Server B | 阿里云通用型 4C16G | 业务、缓存、数据库、录音、监控中心 | `443/TCP`，可选 `80/TCP` 跳转 HTTPS |
+
+两台服务器必须位于同一 VPC、同一可用区或低时延可用区，使用私网 IP 通信。目标私网 RTT 小于 1 ms。
+
+本地开发阶段的实测网络、端口矩阵和未来阿里云安全组清单见 `docs/infra-check.md`。
+
+### 3.2 逻辑拓扑
+
+```mermaid
+flowchart LR
+    UA["客户 SIP / 上游线路"] -->|"SIP 15060/UDP"| OS["Server A: OpenSIPS"]
+    UA <-->|"RTP UDP 端口段"| RTP["Server A: RTPEngine"]
+    OS <-->|"call-time Redis 查询"| REDIS["Server B: Redis"]
+    OS -->|"Redis Stream: CDR"| REDIS
+    OS -->|"HEP/9060 私网"| HEP["Server B: Heplify-server + HOMER"]
+    RTP --> TMP["Server A: /dev/shm/voip_rec"]
+    WORKER["Server B: Recording Worker"] -->|"私网拉取 ready 文件"| TMP
+    WORKER --> SSD["Server B: 录音数据盘"]
+    API["Server B: LisgloSIPS API"] --> MYSQL["Server B: MySQL"]
+    API --> REDIS
+    CDRW["Server B: CDR/Billing Worker"] --> REDIS
+    CDRW --> MYSQL
+    WEB["React Web + Nginx"] --> API
+    EXPORTER["Server A: Exporters"] --> PROM["Server B: Prometheus + Grafana"]
+```
+
+### 3.3 Server A 职责
+
+- OpenSIPS：SIP 鉴权、客户识别、策略匹配、路由、Dialog/CDR 事件。
+- RTPEngine：媒体锚定、NAT 穿透、双向录音、内核态转发。
+- `/dev/shm/voip_rec`：3 GiB tmpfs 录音缓冲区。
+- HEP 发送端：向 Server B 发送信令镜像。
+- Node Exporter 和自定义 textfile 指标。
+- Fail2ban、nftables、OpenSIPS `pike`/`ratelimit` 防护。
+
+“无状态”定义为不在 Server A 持久化业务主数据。OpenSIPS 运行时仍会维护事务和 Dialog 内存状态，服务重启会影响现有通话，V2 单节点接受此限制。
+
+### 3.4 Server B 职责
+
+- Nginx、React 静态资源、HTTPS 和 API 反向代理。
+- LisgloSIPS API、CDR Worker、Recording Worker、Config Publisher。
+- Redis：呼叫热数据、配置版本、锁、Redis Streams。
+- MySQL：业务主数据、充值流水、话单、质检、权限、审计。
+- 录音数据盘：保存迁移后的录音文件。
+- Heplify-server、HOMER UI 及其独立存储。
+- Prometheus、Grafana 及必要 exporters。
+
+## 4. 架构图必须修正的两点
+
+### 4.1 RTP 端口不能只开放 SIP 端口
+
+架构图写明 Server A 公网仅暴露 `15060/UDP`，这不足以完成 RTP 媒体通信。若 RTPEngine 负责公网媒体锚定，安全组和主机防火墙还必须开放 RTPEngine 配置的 UDP 端口范围，例如：
+
+```text
+SIP: 15060/UDP
+RTP: 30000-40000/UDP
+```
+
+端口范围应根据并发测算缩小，并尽量限制来源运营商或客户 IP 段。若上游 RTP 来源不可预知，需要保留公网 UDP 范围并强化速率限制和监控。
+
+### 4.2 CDR 使用 Redis Stream
+
+架构图中的 `queue:cdr_payload` 不应实现为无法确认消费的普通 Redis List。V2 使用 Redis Stream：
+
+```text
+stream:cdr_payload
+consumer group: billing-workers
+```
+
+要求支持：
+
+- 消息 ID 和业务幂等键。
+- `XREADGROUP` 消费。
+- MySQL 提交成功后 `XACK`。
+- Pending 消息重领。
+- 死信 Stream。
+- Redis 暂时不可用时 Server A 本地受限缓冲或告警降级。
+
+## 5. 技术栈与下载清单
+
+### 5.1 版本原则
+
+- 服务器统一 Ubuntu 24.04 LTS。
+- OpenSIPS 使用项目已验证的 3.6.x 分支。
+- 其他软件选择受支持稳定版，禁止部署时无条件升级“最新版”。
+- 所有版本写入 `versions.env`、部署脚本或容器镜像标签。
+- 先在预生产执行安装、通话和性能验证，再用于生产。
+
+### 5.2 Server A 软件
+
+| 软件 | 用途 | 安装来源 |
+| --- | --- | --- |
+| OpenSIPS 3.6.x | SIP 核心 | https://apt.opensips.org/ |
+| opensips-cli | 管理与检查 | OpenSIPS APT |
+| OpenSIPS Redis/HTTP/JSON 模块 | Redis 热路径、MI、事件 | OpenSIPS APT |
+| RTPEngine daemon + kernel module | RTP 转发与录音 | https://github.com/sipwise/rtpengine |
+| Heplify client 或 OpenSIPS tracer/HEP | 信令镜像 | https://github.com/sipcapture/heplify |
+| Node Exporter | 主机指标 | https://prometheus.io/docs/guides/node-exporter/ |
+| Fail2ban、nftables | 主机防护 | Ubuntu APT |
+| chrony | 时间同步 | Ubuntu APT |
+
+建议 OpenSIPS 包：
+
+```text
+opensips
+opensips-cli
+opensips-redis-module
+opensips-http-modules
+opensips-json-module
+opensips-tls-module
+opensips-auth-modules
+opensips-mysql-dbschema
+```
+
+实际包名以 OpenSIPS 3.6 Ubuntu 24.04 仓库为准，安装脚本执行前用 `apt-cache search opensips` 校验。
+
+### 5.3 Server B 软件
+
+| 软件 | 用途 | 安装来源 |
+| --- | --- | --- |
+| Node.js LTS | API 和 Worker | https://nodejs.org/en/about/previous-releases |
+| pnpm | Node.js 包管理 | Corepack |
+| Nginx | Web、HTTPS、反向代理 | https://nginx.org/en/linux_packages.html |
+| Redis | 热数据与 Streams | https://redis.io/docs/latest/operate/oss_and_stack/install/install-redis/ |
+| MySQL | 业务持久化 | https://dev.mysql.com/downloads/repo/apt/ |
+| Heplify-server + HOMER UI | 信令接收和排障 | https://github.com/sipcapture/heplify-server |
+| Prometheus | 指标存储 | https://prometheus.io/docs/prometheus/latest/installation/ |
+| Grafana | 监控大盘 | https://grafana.com/docs/grafana/latest/setup-grafana/installation/debian/ |
+| mysqld_exporter、redis_exporter | 数据库与缓存指标 | Prometheus Community |
+| Docker Engine/Compose | 仅用于 HOMER 组合服务 | https://docs.docker.com/engine/install/ubuntu/ |
+| ffmpeg | 录音格式校验与转换 | Ubuntu APT |
+
+HOMER 数据与业务 MySQL 必须逻辑隔离。优先使用 HOMER 官方 Compose 所要求的数据库，不把 HEP 海量信令写入业务库。
+
+## 6. 网络、安全组和端口
+
+### 6.1 Server A 入站
+
+| 端口 | 来源 | 说明 |
+| --- | --- | --- |
+| `15060/UDP` | 客户/供应商允许列表 | SIP |
+| `30000-40000/UDP` | RTP 对端或允许网段 | RTPEngine 媒体，最终按容量调整 |
+| `<SSH_ADMIN_PORT>/TCP` | 堡垒机或管理 VPN | SSH 管理端口，不对全网开放；保留密钥登录 |
+
+### 6.2 Server B 入站
+
+| 端口 | 来源 | 说明 |
+| --- | --- | --- |
+| `443/TCP` | 管理端用户 | LisgloSIPS HTTPS |
+| `80/TCP` | 可选 | 跳转 HTTPS，不承载登录 |
+| `9060/UDP` | Server A 私网 IP | HEP |
+| `<SSH_ADMIN_PORT>/TCP` | 堡垒机或管理 VPN | SSH 管理端口；保留密钥登录 |
+
+Redis `6379`、MySQL `3306`、Prometheus `9090`、Grafana `3000`、应用端口、HOMER 内部端口不得直接暴露公网。Redis 和 MySQL至少绑定私网 IP，并通过安全组仅允许明确来源；同机服务优先使用 `127.0.0.1`。
+
+### 6.3 安全要求
+
+- 全部服务器启用 chrony，CDR、HOMER 和审计日志时间必须一致。
+- Web 强制 HTTPS、HSTS、SameSite Cookie 和 CSRF 防护。
+- 管理员密码使用 Argon2id；不记录明文密码。
+- SIP 注册密码按 OpenSIPS Digest 需要保存 HA1 或受控密文，不直接返回前端。
+- MI HTTP 只绑定 Server A `127.0.0.1`。
+- 所有生产 Secret 放入权限为 `0600` 的环境文件或云 Secret 服务。
+- 操作日志不得记录密码、完整 Authorization、Cookie、录音签名 URL。
+
+## 7. 基础环境部署
+
+### 7.1 阿里云资源
+
+1. 创建 VPC 和私有子网。
+2. 创建 Server A 4C8G 计算型实例和 Server B 4C16G 通用型实例。
+3. Server B 挂载独立 ESSD 数据盘，业务数据库、录音和监控数据使用独立目录或分区。
+4. 配置安全组、EIP、DNS 和快照策略。
+5. 建议先创建同规格预生产环境，至少在上线前保留 3 天完整演练时间。
+
+### 7.2 两台服务器通用初始化
+
+```bash
+sudo apt update && sudo apt full-upgrade -y
+sudo apt install -y curl wget ca-certificates gnupg jq git unzip chrony \
+  nftables fail2ban vim htop iotop sysstat lsof net-tools tcpdump
+sudo timedatectl set-timezone Asia/Shanghai
+sudo systemctl enable --now chrony nftables fail2ban
+```
+
+生产环境推荐系统内部统一存 UTC，前端按 `Asia/Shanghai` 展示；若操作系统使用上海时区，数据库字段仍需明确 UTC 语义。
+
+### 7.3 Server A tmpfs
+
+```bash
+sudo mkdir -p /dev/shm/voip_rec
+sudo chown rtpengine:rtpengine /dev/shm/voip_rec
+sudo chmod 0750 /dev/shm/voip_rec
+```
+
+`/etc/fstab`：
+
+```fstab
+tmpfs /dev/shm/voip_rec tmpfs rw,nosuid,nodev,noexec,size=3G,mode=0750 0 0
+```
+
+3 GiB 缓冲不是长期存储。按双向 G.711 原始音频约 16 KiB/s 粗略估算，只能容纳约 53 个“并发小时”，未计算容器和文件头开销。100 路持续录音时缓冲可能不到 35 分钟。Recording Worker 建议 5-15 秒扫描一次，使用量超过 70% 告警，超过 85% 时停止接受新的非强制录音或触发紧急迁移。
+
+### 7.4 Server B 数据盘目录
+
+```text
+/data/mysql
+/data/redis
+/data/recordings/YYYY/MM/DD
+/data/prometheus
+/data/grafana
+/data/homer
+/data/backups
+```
+
+数据盘挂载参数、文件系统和 IOPS 规格需根据压测结果确认。录音目录和 MySQL 不建议共享同一个容易打满的根分区。
+
+## 8. OpenSIPS 与 RTPEngine 实施
+
+### 8.1 OpenSIPS 呼叫路径
+
+```text
+INVITE
+  -> 基础合法性与防扫描检查
+  -> IP 或 SIP Digest 认证
+  -> Redis 查询客户、客户网关、状态、余额门槛
+  -> Redis 查询客户网关策略（主叫条件 AND 被叫条件，按优先级）
+  -> 获得落地线路组
+  -> 按组内优先级、启用状态、并发/CPS 选择落地网关
+  -> 执行主被叫前缀转换、时段和编码限制
+  -> RTPEngine offer/answer
+  -> 转发到供应商
+  -> BYE/失败时生成标准化 CDR 事件
+```
+
+### 8.2 呼叫前原子检查
+
+Redis Lua 脚本一次完成：
+
+- 客户是否启用。
+- 客户网关是否启用。
+- IP/账号是否匹配。
+- 余额加授信是否大于最小通话门槛。
+- 网关 CPS 和并发是否超限。
+- 黑名单是否命中。
+- 返回配置版本、线路组和路由策略。
+
+金额禁止使用 Redis 浮点数，统一使用整数“微元”或其他固定精度最小单位。
+
+### 8.3 RTPEngine
+
+- 使用内核转发模块并在启动时校验。
+- 控制接口只在本机或私网监听。
+- RTP 端口段与安全组保持一致。
+- 录音先写 `.part`，完成后原子重命名为 `.ready`。
+- 文件名包含日期、Call-ID 哈希和方向，禁止直接拼接未清洗 SIP Header。
+
+### 8.4 CDR 标准事件
+
+```json
+{
+  "event_id": "uuid",
+  "idempotency_key": "call_id + ended_at 或 event_id",
+  "call_id": "sip-call-id",
+  "node_id": "a1",
+  "opensips_instance": "opensips-a1",
+  "ingress_a_ip": "100.90.90.90",
+  "rtpengine_node": "a1",
+  "customer_id": "C1001",
+  "customer_gateway_id": "CGW-001",
+  "source_ip": "10.10.1.11",
+  "caller": "02160010001",
+  "callee": "13800138000",
+  "vendor_id": "V1001",
+  "vendor_gateway_id": "VGW-001",
+  "line_group_id": "LG-001",
+  "started_at": "2026-06-20T02:14:22.123Z",
+  "answered_at": "2026-06-20T02:14:27.010Z",
+  "ended_at": "2026-06-20T02:17:30.445Z",
+  "duration_sec": 183,
+  "sip_code": 200,
+  "hangup_reason": "NORMAL_CLEARING",
+  "recording_key": "2026/06/20/xxx.ready",
+  "config_version": 1042
+}
+```
+
+`event_id` 和 `call_id + ended_at` 作为幂等依据。任何重试不得重复扣费或重复写充值/余额流水。
+
+## 9. Redis 设计
+
+### 9.1 Key 规范
+
+```text
+cfg:active_version
+cfg:customer:{customer_id}
+cfg:customer_gateway:{gateway_id}
+cfg:customer_gateway:{gateway_id}:policies
+cfg:vendor_gateway:{gateway_id}
+cfg:line_group:{group_id}:items
+auth:ip:{ip}
+auth:sip:{username}
+balance:customer:{customer_id}
+blacklist:caller
+blacklist:callee
+stream:cdr_payload
+stream:cdr_deadletter
+stream:recording_jobs
+lock:cdr:{event_id}
+```
+
+### 9.2 配置发布
+
+1. API 在 MySQL 事务中写业务表和 `outbox_events`。
+2. Config Publisher 读取 outbox，生成完整配置快照。
+3. 使用临时版本 Key 写入 Redis。
+4. 校验数量和哈希后原子切换 `cfg:active_version`。
+5. 发布成功后更新 outbox 状态。
+6. 保留上一个版本，故障时一键回滚。
+
+禁止 API 先改 Redis、后改 MySQL。MySQL 是唯一业务事实源，Redis 是呼叫热路径副本。
+
+### 9.3 Redis 持久化
+
+- 启用 AOF `appendfsync everysec`。
+- 配置 RDB 快照。
+- 限制 `maxmemory`，配置前评估淘汰策略；核心配置和队列不得被随机淘汰。
+- 监控 Stream 长度、Pending 数、消费延迟、内存和连接数。
+
+## 10. MySQL 数据模型
+
+### 10.1 业务核心表
+
+```text
+customers
+customer_gateways
+customer_gateway_policies
+customer_recharges
+vendors
+vendor_recharges
+vendor_gateways
+vendor_gateway_forbidden_periods
+vendor_gateway_codecs
+vendor_gateway_prefix_rules
+landing_line_groups
+landing_line_group_items
+raw_cdrs
+rated_cdrs
+recordings
+quality_sampling_rules
+quality_reviews
+users
+roles
+permissions
+user_roles
+role_permissions
+audit_logs
+outbox_events
+idempotency_keys
+```
+
+### 10.2 关键约束
+
+- ID 使用业务前缀 + 雪花 ID/UUID，禁止依赖前端生成。
+- 金额使用 `DECIMAL(20,6)`，应用层不得使用 JavaScript 浮点直接计算金额。
+- 充值使用不可变流水，余额变化必须与流水在同一事务提交。
+- 网关策略唯一索引至少包含 `gateway_id + priority`。
+- 线路组成员唯一索引包含 `line_group_id + vendor_gateway_id`。
+- CDR 使用 `event_id` 唯一索引。
+- 所有管理表包含 `created_at`、`updated_at`、`created_by`、`updated_by` 和乐观锁版本号。
+- 时间存 UTC；API 返回 ISO 8601。
+- 删除优先软删除；充值、CDR、审计日志不允许物理删除。
+
+### 10.3 余额事务
+
+充值事务：
+
+```text
+锁定客户/供应商账户行
+  -> 读取充值前余额
+  -> 插入充值流水
+  -> 更新余额
+  -> 插入审计日志/Outbox
+  -> 提交
+```
+
+CDR 扣费事务：
+
+```text
+检查 event_id 幂等
+  -> 写 raw_cdr
+  -> 计算最小计费结果
+  -> 写 rated_cdr
+  -> 锁定客户余额
+  -> 扣费并写余额流水
+  -> ACK Redis Stream
+```
+
+## 11. 后端工程设计
+
+### 11.1 技术选型
+
+- TypeScript + Node.js LTS。
+- NestJS + Fastify Adapter。
+- Prisma 管理 MySQL Schema 和迁移。
+- ioredis 访问 Redis 和 Streams。
+- OpenAPI/Swagger 生成 API 契约。
+- Pino 输出结构化 JSON 日志。
+- Vitest/Jest 做单元测试，Supertest 做 API 集成测试。
+- systemd 管理 API 和 Worker；HOMER 可使用 Docker Compose。
+
+### 11.2 推荐目录
+
+```text
+lisglosips/
+├── apps/
+│   ├── web/
+│   ├── api/
+│   ├── worker-cdr/
+│   ├── worker-recording/
+│   └── worker-config-publisher/
+├── packages/
+│   ├── contracts/
+│   ├── domain/
+│   ├── database/
+│   ├── redis/
+│   ├── auth/
+│   └── observability/
+├── prisma/
+│   ├── schema.prisma
+│   └── migrations/
+├── deploy/
+│   ├── server-a/
+│   ├── server-b/
+│   ├── nginx/
+│   ├── systemd/
+│   └── homer/
+├── opensips/
+│   ├── opensips.cfg
+│   ├── routes/
+│   └── scripts/
+├── docs/
+│   ├── openapi.yaml
+│   ├── redis-keys.md
+│   └── runbooks/
+└── tests/
+```
+
+### 11.3 后端模块
+
+```text
+AuthModule
+DashboardModule
+CustomersModule
+CustomerGatewaysModule
+CustomerGatewayPoliciesModule
+RechargesModule
+VendorsModule
+VendorGatewaysModule
+LandingLineGroupsModule
+CdrModule
+RecordingsModule
+QualityModule
+UsersModule
+RolesModule
+AuditModule
+ConfigPublisherModule
+HealthModule
+```
+
+### 11.4 API 清单
+
+```text
+POST   /api/v2/auth/login
+POST   /api/v2/auth/refresh
+POST   /api/v2/auth/logout
+GET    /api/v2/dashboard/summary
+GET    /api/v2/dashboard/trends
+
+GET    /api/v2/customers
+POST   /api/v2/customers
+PATCH  /api/v2/customers/:id
+POST   /api/v2/customers/:id/recharges
+
+GET    /api/v2/customer-gateways
+POST   /api/v2/customer-gateways
+PATCH  /api/v2/customer-gateways/:id
+POST   /api/v2/customer-gateways/:id/enable
+POST   /api/v2/customer-gateways/:id/disable
+GET    /api/v2/customer-gateways/:id/policies
+POST   /api/v2/customer-gateways/:id/policies
+PATCH  /api/v2/customer-gateway-policies/:id
+DELETE /api/v2/customer-gateway-policies/:id
+POST   /api/v2/customer-gateways/:id/policies/reorder
+
+GET    /api/v2/vendors
+POST   /api/v2/vendors
+PATCH  /api/v2/vendors/:id
+POST   /api/v2/vendors/:id/recharges
+GET    /api/v2/recharges
+
+GET    /api/v2/vendor-gateways
+POST   /api/v2/vendor-gateways
+PATCH  /api/v2/vendor-gateways/:id
+POST   /api/v2/vendor-gateways/:id/enable
+POST   /api/v2/vendor-gateways/:id/disable
+
+GET    /api/v2/landing-line-groups
+POST   /api/v2/landing-line-groups
+PATCH  /api/v2/landing-line-groups/:id
+POST   /api/v2/landing-line-groups/:id/items
+DELETE /api/v2/landing-line-groups/:id/items/:gatewayId
+POST   /api/v2/landing-line-groups/:id/items/reorder
+
+GET    /api/v2/cdrs
+GET    /api/v2/cdrs/:id
+GET    /api/v2/cdrs/:id/recording
+GET    /api/v2/cdrs/:id/signaling-link
+
+GET    /api/v2/quality/rules
+POST   /api/v2/quality/rules
+PATCH  /api/v2/quality/rules/:id
+DELETE /api/v2/quality/rules/:id
+POST   /api/v2/quality/rules/:id/enable
+POST   /api/v2/quality/rules/:id/disable
+GET    /api/v2/recordings
+GET    /api/v2/recordings/:id
+PUT    /api/v2/recordings/:id/review
+
+GET    /api/v2/users
+POST   /api/v2/users
+PATCH  /api/v2/users/:id
+POST   /api/v2/users/:id/reset-password
+GET    /api/v2/roles
+POST   /api/v2/roles
+PATCH  /api/v2/roles/:id
+PUT    /api/v2/roles/:id/permissions
+GET    /api/v2/audit-logs
+GET    /api/v2/audit-logs/:id
+```
+
+### 11.5 API 规范
+
+- 列表统一 `page`、`page_size`、`sort`、筛选参数。
+- 返回 `{ data, meta, request_id }`。
+- 错误返回稳定业务码，不把数据库错误直接返回前端。
+- 新增、充值、重置密码、策略重排支持 `Idempotency-Key`。
+- 写请求校验 `If-Match` 或版本字段，防止覆盖其他管理员修改。
+- 导出采用异步任务和短期下载地址，避免长请求占用 5 Mbps 公网带宽。
+
+## 12. 录音迁移和质检
+
+### 12.1 文件生命周期
+
+```text
+RTPEngine 写入 .part
+  -> 录音完成原子改名 .ready
+  -> Recording Worker 私网扫描
+  -> 拉取到 Server B 临时目录
+  -> 校验大小、SHA-256、音频时长
+  -> 原子移动到 /data/recordings/YYYY/MM/DD
+  -> 写 recordings 表
+  -> 删除 Server A 源文件
+```
+
+任何一步失败都不得先删除 Server A 文件。Worker 使用文件锁或 Redis 锁防止重复搬运，并对 `.part`、过期 `.ready`、孤儿文件分别处理。
+
+### 12.2 播放
+
+- API 先校验 `recording.play` 权限。
+- Nginx `X-Accel-Redirect` 发送文件，Node.js 不直接读取整段音频到内存。
+- 支持 HTTP Range，便于拖动播放。
+- 操作日志记录播放人、录音 ID、时间和 IP。
+- Server B 公网只有 5 Mbps 时需限制并发播放；后续可迁移至阿里云 OSS，使用短期签名 URL。
+
+### 12.3 抽检规则
+
+V2 字段与 Web Demo 保持一致：
+
+- 规则名称。
+- 客户。
+- 抽检比例。
+- 指定线路。
+- 生效时间。
+- 状态。
+
+Worker 在录音入库后根据客户、线路和稳定哈希进行抽样，避免重启导致随机结果变化。
+
+## 13. 权限与审计
+
+### 13.1 权限模型
+
+权限粒度采用 `resource.action`：
+
+```text
+customers.view
+customers.manage
+vendors.view
+vendors.manage
+gateways.view
+gateways.manage
+routes.view
+routes.manage
+recharge.manage
+cdr.view
+cdr.export
+recording.play
+quality.manage
+users.manage
+roles.manage
+logs.view
+```
+
+超级管理员、运营管理员、财务、质检和技术运维为内置角色。内置角色名称和关键权限禁止普通管理员修改。
+
+### 13.2 审计要求
+
+审计日志至少记录：
+
+- `request_id`、操作人、用户账号、角色。
+- 时间、IP、User-Agent。
+- 模块、动作、对象类型、对象 ID。
+- 修改前/后摘要，敏感字段脱敏。
+- 成功/失败和业务错误码。
+
+审计日志由服务端生成，前端传入的“操作人”不可信。
+
+## 14. Dashboard 数据策略
+
+- 实时在线通话和注册：Redis 热数据或 OpenSIPS 指标。
+- 今日通话、费用、成本、毛利：MySQL 聚合表。
+- 24 小时趋势：按 5 分钟或 1 小时预聚合，禁止首页扫描全量 CDR。
+- 失败响应码：CDR 聚合。
+- 异常网关：健康状态缓存。
+- 质检待处理：recordings/quality_reviews 聚合。
+
+创建定时聚合任务 `worker-metrics` 或复用 CDR Worker 增量写统计表。
+
+## 15. 最小计费实现
+
+虽然“费率与计费”页面延期，V2 仍需最小计费能力支持话单费用和余额。
+
+V2 首期仅支持落地网关上的：
+
+- 计费周期，单位秒，最大 60。
+- 周期费率。
+- 分钟费率展示值：`周期费率 * 60 / 计费周期`。
+
+计算使用 Decimal：
+
+```text
+计费周期数 = ceil(通话秒数 / 计费周期)
+费用 = 计费周期数 * 周期费率
+```
+
+客户侧费率在完整页面设计前可由受控配置表或迁移脚本维护，不对普通运营角色开放。所有费率变更必须留审计记录和生效时间。
+
+## 16. 监控、日志和备份
+
+### 16.1 基础监控
+
+即使自研“监控告警”页面延期，也必须部署：
+
+- Server A/B CPU、内存、磁盘、网络、负载。
+- OpenSIPS 进程、SIP 请求量、响应码、活动 Dialog。
+- RTPEngine 会话、丢包、端口使用率。
+- tmpfs 使用率和最老录音文件年龄。
+- Redis 内存、连接、Stream 长度、Pending。
+- MySQL 连接、慢查询、锁等待、磁盘。
+- API P95/P99、5xx、Worker 延迟。
+
+### 16.2 日志
+
+- 应用日志输出 JSON，包含 `request_id`、`call_id`、`event_id`。
+- journald 保留短期日志；可选 Loki/Promtail 后续集中化。
+- 禁止在普通日志输出 SIP 密码、Web Token 和录音内容。
+
+### 16.3 备份
+
+- MySQL：每日全量备份 + binlog，定期恢复演练。
+- Redis：AOF + RDB；Redis 不是业务主数据唯一副本。
+- 录音：数据盘快照，后续转 OSS 生命周期管理。
+- OpenSIPS、Nginx、systemd、Prometheus 配置进入 Git。
+- 备份密钥与业务数据分开保存。
+
+## 17. 开发与部署阶段
+
+### 阶段 0：确认技术决策（2-3 天）
+
+- 确认 SIP 公网端口、RTP 端口段和运营商 IP 范围。
+- 确认预估并发、CPS、日通话量、日录音小时数。
+- 确认客户余额实时控制规则和最低余额门槛。
+- 确认录音保存周期和是否接 OSS。
+- 确认 MySQL 还是 MariaDB。本文默认 MySQL；若沿用现有 MariaDB，需先验证 Prisma 和 SQL 兼容性。
+
+### 阶段 1：服务器和网络（3-4 天）
+
+- 创建 VPC、Server A/B、EIP、数据盘和安全组。
+- 安装基础工具、时间同步、防火墙。
+- 验证私网 RTT、带宽、磁盘吞吐和 DNS。
+- 输出 `infra-check.md` 和端口验收结果。
+
+### 阶段 2：Server A 通信栈（5-7 天）
+
+- 安装 OpenSIPS 3.6.x、RTPEngine 和内核模块。
+- 配置 SIP 15060、RTP 端口范围和 MI 本地端口。
+- 配置 Redis 连接、HEP、录音 tmpfs、指标和安全限制。
+- 完成 IP 认证、SIP 注册认证和基础呼叫。
+- 完成单通、双通、挂断、失败响应和录音测试。
+
+### 阶段 3：Server B 基础服务（4-5 天）
+
+- 安装 Nginx、Node.js、Redis、MySQL。
+- 部署 HOMER、Prometheus、Grafana 和 exporters。
+- 初始化数据盘、备份目录和 TLS。
+- 创建应用系统用户、systemd 服务账户和最小权限目录。
+
+### 阶段 4：后端骨架（5 天）
+
+- 初始化 monorepo、NestJS、Prisma、OpenAPI、日志和健康检查。
+- 完成认证、JWT 刷新、RBAC、审计拦截器。
+- 建立数据库迁移、种子数据和 CI。
+- 完成 Redis 客户端、Stream 基础库和 outbox publisher。
+
+### 阶段 5：运营业务 API（10-12 天）
+
+- 客户、客户网关、策略、充值。
+- 供应商、落地网关、落地线路组。
+- 用户、角色、权限、操作日志。
+- 接入当前 React Demo，移除 Mock 数据。
+
+### 阶段 6：通话、CDR 和录音闭环（8-10 天）
+
+- Redis 配置发布和回滚。
+- OpenSIPS 呼叫时查询和路由。
+- CDR Stream、幂等消费、最小计费、余额扣减。
+- Recording Worker、文件校验、Range 播放。
+- HOMER Call-ID 跳转。
+
+### 阶段 7：Dashboard 和质检（5-7 天）
+
+- Dashboard 聚合指标。
+- 抽检规则、录音列表、连续播放、质检结果。
+- 权限校验和播放审计。
+
+### 阶段 8：测试和上线（7-10 天）
+
+- 功能、集成、故障、性能、安全测试。
+- 全量上线演练和回滚演练。
+- 小流量客户灰度。
+- 观察 24-72 小时后扩大流量。
+
+预计总周期 8-10 周，建议至少配置：后端 1 人、SIP/媒体 1 人、前端 1 人、运维 0.5 人、测试 0.5 人。单人实施需要相应延长周期并优先保证呼叫、CDR、余额和录音闭环。
+
+## 18. 后端代码完成标准
+
+- 所有本期页面均使用真实 API，不再依赖硬编码 Mock。
+- OpenAPI 可生成前端类型或 API Client。
+- 数据库迁移可在空库一键执行，也能回滚最近一次变更。
+- 关键服务有 `/health/live` 和 `/health/ready`。
+- CDR 重复投递不会重复扣费。
+- 充值重复请求不会重复加余额。
+- 配置发布失败不会留下半套 Redis 配置。
+- 录音搬运失败不会删除源文件。
+- RBAC 在服务端生效，隐藏按钮不能替代权限校验。
+- 敏感操作全部进入审计日志。
+- 单元测试覆盖金额、优先级、主被叫条件、幂等和权限。
+
+## 19. 测试与验收
+
+### 19.1 功能验收
+
+- IP 和 SIP 注册两种客户网关认证成功/失败路径。
+- 主叫等于、主叫前缀、被叫等于、被叫前缀及组合条件。
+- 多策略优先级和多落地网关优先级。
+- 网关启停、禁呼时段、编码、号码前缀转换。
+- 充值、余额前后值、授信和审计。
+- CDR 字段、挂断原因、客户费用、成本费用。
+- 抽检规则、录音播放、上下条、自动播放、保存质检结果。
+- 用户、角色、权限和重置密码。
+
+### 19.2 性能验收
+
+压测目标必须在阶段 0 根据业务量确认。最低应覆盖：
+
+- 目标 CPS 的 1.5 倍持续 30 分钟。
+- 目标并发的 1.2 倍持续 2 小时。
+- Redis 呼叫时查询 P99。
+- CDR Worker 堆积恢复速度。
+- 100% 录音下 tmpfs 增长和迁移速度。
+- 多用户同时查询 CDR 和播放录音时 Server B 带宽。
+
+### 19.3 故障验收
+
+- Redis 短暂不可用。
+- MySQL 重启和事务回滚。
+- CDR Worker 异常退出后重领 Pending。
+- Recording Worker 重复执行。
+- Server B 数据盘接近满。
+- Server A tmpfs 达 70%/85%。
+- RTPEngine 重启。
+- 配置版本回滚。
+
+### 19.4 安全验收
+
+- SIP 扫描、暴力注册、非法来源 IP、超 CPS。
+- 越权访问其他模块 API。
+- 重放充值请求。
+- SQL 注入、XSS、CSRF、弱密码和 Session 失效。
+- 录音 URL 过期、Range 越权和路径穿越。
+
+## 20. 上线和回滚
+
+### 20.1 上线顺序
+
+1. 备份 MySQL、Redis、OpenSIPS 和 Nginx 配置。
+2. 部署 Server B 数据库迁移和后端，但暂不切流。
+3. 发布 Redis 配置快照并校验。
+4. 部署 Server A OpenSIPS/RTPEngine 配置。
+5. 使用测试账号完成真实呼叫、CDR、扣费和录音。
+6. 灰度一个低风险客户或一条线路。
+7. 观察指标、CDR 差异、余额和录音完整性。
+8. 逐步扩大流量。
+
+### 20.2 回滚
+
+- Web/API：切回上一个发布目录或镜像。
+- 数据库：使用向前兼容迁移；上线窗口不执行不可逆删列。
+- Redis 配置：切回上一个 `cfg:active_version`。
+- OpenSIPS：恢复上一版配置并执行语法检查后重载。
+- RTPEngine：恢复上一版 systemd 参数。
+- CDR：停止 Consumer，不删除 Stream；修复后重放。
+- 录音：停止删除 Server A 源文件，保留 B 端临时文件等待人工处理。
+
+## 21. 主要风险
+
+| 风险 | 影响 | 控制措施 |
+| --- | --- | --- |
+| Server A 单点 | 重启影响通话 | V2 接受；配置快速恢复；后续增加双节点 |
+| 仅开放 15060 | 无 RTP 或单通 | 必须开放并验证 RTP UDP 端口段 |
+| 3 GiB tmpfs 打满 | 录音丢失、进程异常 | 高频搬运、阈值告警、降级策略 |
+| Server B 5 Mbps | 多录音播放卡顿 | Range、限并发、后续 OSS/CDN |
+| Redis 成为呼叫热路径单点 | 新呼叫失败 | AOF/RDB、监控、后续主从/Sentinel |
+| CDR 重复消费 | 重复扣费 | Stream ACK、唯一索引、幂等事务 |
+| 配置半发布 | 路由不一致 | MySQL Outbox + Redis 版本原子切换 |
+| HOMER 数据膨胀 | 数据盘占满 | 独立存储、保留周期、容量告警 |
+| 金额浮点误差 | 对账差异 | Decimal/整数最小单位，禁止 JS Number 计费 |
+
+## 22. 下一步执行清单
+
+### 立即执行
+
+- [ ] 确认预计 CPS、并发、日话单、录音小时数。
+- [ ] 确认 Server A RTP 端口段和安全组来源范围。
+- [ ] 确认 Server B 数据盘容量、IOPS 和录音保留期。
+- [ ] 确认 MySQL/MariaDB 最终选择。
+- [ ] 申请域名和 TLS 证书。
+- [ ] 创建预生产 VPC 和两台服务器。
+
+### 服务器部署完成条件
+
+- [ ] Server A OpenSIPS、RTPEngine、Redis 私网连接、HEP、tmpfs、exporter 正常。
+- [ ] Server B Nginx、Node.js、Redis、MySQL、HOMER、Prometheus、Grafana 正常。
+- [ ] 安全组端口和主机防火墙验收。
+- [ ] 备份、日志轮转、时间同步和系统用户验收。
+- [ ] 完成端到端测试呼叫并在 HOMER 查询到信令。
+- [ ] 完成录音从 A 内存盘到 B 数据盘的搬运测试。
+
+### 后端开发启动条件
+
+- [ ] 创建 V2 monorepo 和 CI。
+- [ ] 提交 Prisma Schema V1 和初始化迁移。
+- [ ] 提交 OpenAPI V2 基线。
+- [ ] 提交 Redis Key 和 Stream 契约。
+- [ ] 完成 Auth/RBAC/Audit 骨架。
+- [ ] 先实现客户、网关、线路组和配置发布，再实现 CDR/录音。
+
+## 23. V2 交付物
+
+```text
+1. 阿里云双机部署记录和安全组清单
+2. Server A/Server B 幂等安装脚本
+3. OpenSIPS 和 RTPEngine 配置仓库
+4. MySQL DDL/Prisma migrations
+5. Redis Key/Stream 契约
+6. OpenAPI 文档
+7. LisgloSIPS API 和 Workers 源码
+8. React Web 与真实 API 集成版本
+9. Prometheus/Grafana/HOMER 部署配置
+10. 自动化测试、压测报告和安全检查报告
+11. 上线、回滚、备份恢复和故障处置 Runbook
+```
+
+## 24. 最终实施原则
+
+- 先打通“配置发布 -> 呼叫 -> CDR -> 计费 -> 余额 -> 录音 -> 质检”闭环，再扩展页面。
+- MySQL 是业务事实源，Redis 是呼叫热路径和队列，不反向替代主库。
+- 金额、CDR、充值和录音全部按可重试、可审计、幂等设计。
+- Server A 保持精简，Server B 承担业务复杂度。
+- 待设计菜单不阻塞底层必需能力，但不得在 V2 临时扩张为未确认的产品页面。
+- 所有部署和配置必须脚本化、版本化、可回滚。
+
+## 25. Codex 全流程分步实施规范
+
+### 25.1 目的
+
+本项目计划主要由 Codex 持续实施。为避免单次任务过大、上下文丢失、误操作和新会话重复工作，整个 V2 被拆分为 31 个原子任务 `S00-S30`。每个会话默认只完成一个任务，除非用户明确授权合并。
+
+详细实时状态记录在 `IMPLEMENTATION_STATUS.md`，服务器密码只保存在被 `.gitignore` 排除的 `.codex-private/SERVER_ACCESS.md`。
+
+### 25.2 服务器固定代号
+
+| 代号 | IP | SSH 用户 | 职责 |
+| --- | --- | --- | --- |
+| Server A | `100.90.90.90` | `hector` | 核心通信网关 |
+| Server B | `100.90.90.91` | `hector` | 业务、缓存与监控中心 |
+| Server T | `100.93.185.30` | `hector` | 已安装 OpenSIPS，模拟 SIP 客户 |
+
+主文档不保存明文密码。新会话只有在用户授权当前任务连接服务器后，才读取私密访问文件，并禁止在回复或日志中回显密码。
+
+### 25.3 单会话执行纪律
+
+1. 先读取 `SOFTSWITCH_PLATFORM_DESIGN_V2.md` 和 `IMPLEMENTATION_STATUS.md`。
+2. 只执行状态文件中的“当前任务”。
+3. 服务器任务先做只读检查，再做写操作。
+4. 修改配置前备份，记录绝对路径、时间戳和回滚命令。
+5. 服务重启、防火墙、SSH、数据库迁移、数据删除前说明影响。
+6. 不能因安装困难随意更换技术栈或扩大公网端口。
+7. 安装软件必须记录来源、版本和校验结果。
+8. 完成后执行该任务的验收，不以“命令无报错”代替功能验证。
+9. 更新状态文件后再结束会话。
+10. 出现阻塞时停止在安全状态，不绕过安全控制继续后续任务。
+
+### 25.4 原子任务顺序
+
+#### S00-S02：安全接入和资产盘点
+
+**S00 SSH 安全接入与凭据迁移**
+
+- 用户明确授权后连接 A/B/T。
+- 在本机生成项目专用 Ed25519 Key，不覆盖现有 Key。
+- 安装公钥并验证三个独立新会话。
+- 备份 `sshd_config`，确认不会锁死后只调整 SSH 管理端口，不禁止 SSH 密钥登录。
+- 轮换当前密码，私密文件同步更新或改为只记录 Key。
+- 验收：新端口 Key 登录成功；sudo 可用；现有会话保留到新会话验证完成。
+
+**S01 三机只读资产盘点**
+
+- 只读取 OS、内核、CPU、内存、磁盘、网卡、路由、时间、端口、服务、包版本。
+- 盘点 T 上现有 OpenSIPS 配置和测试能力，不修改。
+- 输出 `docs/inventory-A.md`、`inventory-B.md`、`inventory-T.md`。
+- 验收：报告包含差异、风险和安装前备份清单。
+
+**S02 网络与安全组验收**
+
+- 验证 A/B/T 双向可达性和实际私网 RTT。
+- 确认 A 的 SIP 15060/UDP、RTP 端口段；B 的 443/TCP、私网 HEP 9060/UDP。
+- 不通过 SSH 直接修改云安全组；生成阿里云控制台操作清单供用户确认。
+- 验收：形成端口矩阵和最小暴露方案。
+
+#### S03-S06：Server B 基础设施
+
+**S03 Server B 基础系统初始化**
+
+- 更新系统、安装基础包、chrony、nftables、fail2ban。
+- 检查并初始化数据盘目录，不格式化未知数据盘。
+- 创建应用、录音和监控系统用户与目录权限。
+- 验收：重启后时间、挂载、权限和防火墙正常。
+
+**S04 MySQL 与 Redis**
+
+- 固定版本安装并限制监听地址。
+- 创建业务库/用户，启用 MySQL binlog、Redis AOF/RDB。
+- 配置备份脚本和健康检查。
+- 验收：重启恢复、权限隔离、备份和恢复样例通过。
+
+**S05 Node.js、Nginx 与 TLS 基线**
+
+- 安装固定 Node.js LTS 和 pnpm。
+- 建立 `/opt/lisglosips/releases`、`current` 和 systemd 模板。
+- 配置 Nginx 静态站点、API 代理、Range、限流和 HTTPS 预案。
+- 验收：占位健康页通过 Nginx 访问，应用端口不暴露公网。
+
+**S06 HOMER 与基础监控**
+
+- 部署 Heplify-server/HOMER、Prometheus、Grafana、exporters。
+- HOMER 数据和业务 MySQL 分离。
+- 验收：B 私网 9060 接收测试 HEP；A/B 主机指标可见。
+
+#### S07-S10：后端基础
+
+**S07 后端 Monorepo 骨架**
+
+- 创建 NestJS/Fastify、Prisma、结构化日志、配置校验、健康检查和测试框架。
+- 建立 CI 命令：lint、typecheck、test、build。
+- 验收：本地和 B 均可构建；健康检查可用。
+
+**S08 数据库 Schema 与迁移**
+
+- 实现本文第 10 章表结构、索引、Decimal、审计列和 Outbox。
+- 提供空库迁移、种子和回滚/恢复说明。
+- 验收：空库一键初始化；重复执行安全；Schema 测试通过。
+
+**S09 登录认证基础**
+
+- 登录、刷新、退出、Argon2id、失败锁定、Token/Cookie 安全。
+- 验收：成功、失败、过期、刷新、注销和暴力尝试路径通过。
+
+**S10 用户、角色、权限与审计**
+
+- 实现用户、角色、权限矩阵、内置角色保护和重置密码。
+- 服务端 RBAC 和审计拦截器必须先于业务 API 完成。
+- 验收：越权被拒绝；敏感字段脱敏；审计详情可查询。
+
+#### S11-S17：运营业务 API
+
+**S11 客户管理**：客户 CRUD、启停、余额/授信读取。  
+**S12 充值流水**：客户/供应商充值、事务、幂等、并发。  
+**S13 客户网关**：IP/SIP 注册认证、启停、密码安全。  
+**S14 网关策略与配置发布**：主被叫条件、优先级、Outbox、Redis 版本。  
+**S15 供应商管理**：供应商 CRUD、余额、授信。  
+**S16 落地网关**：认证、CPS、并发、禁呼、编码、号码转换、周期费率。  
+**S17 落地线路组**：成员增删、优先级、并发汇总、引用校验。
+
+每个任务必须同时完成：数据库迁移、领域校验、API、权限、审计、单元测试、集成测试和 OpenAPI，不允许先堆积未测试接口后统一补测。
+
+#### S18-S21：通信栈和测试客户
+
+**S18 Server A OpenSIPS 基线**
+
+- 先备份现状，再安装/固定 OpenSIPS 3.6.x。
+- 配置 15060、认证、防扫描、MI 本地绑定和模块基线。
+- 每次改动先执行语法检查，验证失败立即回滚。
+
+**S19 RTPEngine 与录音 tmpfs**
+
+- 配置内核转发、RTP 端口段、3 GiB tmpfs 和 `.part -> .ready` 生命周期。
+- 验收：双向音频、NAT、录音、重启和 tmpfs 阈值。
+
+**S20 Redis 热路径、HEP 与指标**
+
+- 实现 Lua 原子检查、版本化配置读取、CDR XADD、HEP 发送和指标采集。
+- 验收：Redis 超时、配置缺失、HEP 中断均有明确降级和日志。
+
+**S21 Server T 客户模拟**
+
+- 在不破坏 T 现有 OpenSIPS 的前提下配置测试域、IP 认证和 SIP 注册账号。
+- 编写成功呼叫、忙、拒绝、超时、错误密码、超 CPS 测试脚本。
+- 验收：所有脚本可重复执行并输出 Call-ID。
+
+#### S22-S26：异步闭环
+
+**S22 CDR Redis Stream**：事件契约、Consumer Group、ACK、Pending、死信、幂等。  
+**S23 最小计费**：Decimal 周期计费、客户费用、成本、余额扣减。  
+**S24 录音搬运与播放**：私网拉取、哈希、原子移动、Range、权限和源文件删除保护。  
+**S25 质检后端**：规则、稳定抽样、连续录音查询、质检保存和审计。  
+**S26 Dashboard 聚合**：实时指标和预聚合趋势，避免扫描全量 CDR。
+
+#### S27-S30：联调和上线
+
+**S27 React 接入真实 API**
+
+- 按菜单逐页替换 Mock；每次只接入一个领域。
+- 增加加载、空状态、错误、权限隐藏和并发更新提示。
+- 待设计菜单继续保留标识，不接临时 API。
+
+**S28 三机端到端联调**
+
+- T 发起 SIP -> A 鉴权/路由/媒体/录音 -> B CDR/费用/信令/质检。
+- 按 Call-ID 核对 OpenSIPS、Redis Stream、MySQL、HOMER 和录音文件。
+
+**S29 性能、故障与安全测试**
+
+- 执行 CPS、并发、录音、Redis/MySQL/Worker 故障和 Web/SIP 安全测试。
+- 所有失败必须形成缺陷、修复和复测记录。
+
+**S30 备份、Runbook、灰度与上线**
+
+- 完成恢复演练、上线/回滚脚本和灰度。
+- 上线前冻结版本和数据库迁移，输出最终验收报告。
+
+### 25.5 Codex 新会话启动模板
+
+```text
+请先读取 SOFTSWITCH_PLATFORM_DESIGN_V2.md 和 IMPLEMENTATION_STATUS.md，
+只执行当前任务 Sxx，不提前执行下一任务。
+如任务需要服务器访问，读取 .codex-private/SERVER_ACCESS.md，但不要在回复、日志或文档中回显密码。
+所有服务器写操作先备份并给出回滚点；涉及重启、SSH、防火墙、数据库迁移或删除时先说明影响。
+完成后执行验收并更新 IMPLEMENTATION_STATUS.md，包括状态、产物、验证、回滚、遗留问题和下一任务。
+```
diff --git a/apps/api/package.json b/apps/api/package.json
new file mode 100644
index 0000000..3e163b4
--- /dev/null
+++ b/apps/api/package.json
@@ -0,0 +1,30 @@
+{
+  "name": "@lisglosips/api",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/main.js",
+  "scripts": {
+    "dev": "tsx watch src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/main.js"
+  },
+  "dependencies": {
+    "@fastify/helmet": "13.0.2",
+    "@fastify/static": "8.3.0",
+    "@lisglosips/auth": "workspace:*",
+    "@lisglosips/contracts": "workspace:*",
+    "@lisglosips/database": "workspace:*",
+    "@lisglosips/observability": "workspace:*",
+    "@nestjs/common": "11.1.9",
+    "@nestjs/config": "4.0.2",
+    "@nestjs/core": "11.1.9",
+    "@nestjs/platform-fastify": "11.1.9",
+    "@nestjs/swagger": "11.2.3",
+    "fastify": "5.6.2",
+    "joi": "18.0.2",
+    "nestjs-pino": "4.5.0",
+    "reflect-metadata": "0.2.2",
+    "rxjs": "7.8.2"
+  }
+}
diff --git a/apps/api/src/app.e2e.spec.ts b/apps/api/src/app.e2e.spec.ts
new file mode 100644
index 0000000..44ea5b2
--- /dev/null
+++ b/apps/api/src/app.e2e.spec.ts
@@ -0,0 +1,41 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+
+describe('LisgloSIPS API health', () => {
+  let app: NestFastifyApplication;
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+
+    const { AppModule } = await import('./modules/app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule]
+    }).compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('serves liveness', async () => {
+    const response = await request(app.getHttpServer()).get('/api/v2/health/live').expect(200);
+
+    expect(response.body.status).toBe('ok');
+  });
+
+  it('serves readiness', async () => {
+    const response = await request(app.getHttpServer()).get('/api/v2/health/ready').expect(200);
+
+    expect(response.body.status).toBe('ok');
+  });
+});
diff --git a/apps/api/src/main.ts b/apps/api/src/main.ts
new file mode 100644
index 0000000..c3c5222
--- /dev/null
+++ b/apps/api/src/main.ts
@@ -0,0 +1,35 @@
+import 'reflect-metadata';
+import helmet from '@fastify/helmet';
+import { NestFactory } from '@nestjs/core';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import { Logger } from 'nestjs-pino';
+import { AppModule } from './modules/app.module.js';
+import { buildOpenApiDocument } from './openapi.js';
+
+async function bootstrap(): Promise<void> {
+  const app = await NestFactory.create<NestFastifyApplication>(
+    AppModule,
+    new FastifyAdapter({
+      trustProxy: true,
+      logger: false
+    }),
+    {
+      bufferLogs: true
+    }
+  );
+
+  app.useLogger(app.get(Logger));
+  app.setGlobalPrefix('api/v2');
+  await app.register(helmet, {
+    contentSecurityPolicy: false
+  });
+
+  buildOpenApiDocument(app);
+
+  const host = process.env.LISGLOSIPS_HOST ?? '127.0.0.1';
+  const port = Number(process.env.LISGLOSIPS_PORT ?? 3000);
+
+  await app.listen({ host, port });
+}
+
+void bootstrap();
diff --git a/apps/api/src/modules/app.module.ts b/apps/api/src/modules/app.module.ts
new file mode 100644
index 0000000..1b6e44a
--- /dev/null
+++ b/apps/api/src/modules/app.module.ts
@@ -0,0 +1,74 @@
+import { Module } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
+import crypto from 'node:crypto';
+import { LoggerModule } from 'nestjs-pino';
+import { API_PREFIX } from '@lisglosips/contracts';
+import { LOG_REDACT_PATHS } from '@lisglosips/observability';
+import { appConfig, validationSchema } from '../shared/config.js';
+import { AuditLogsModule } from './audit-logs/audit-logs.module.js';
+import { AuditModule } from './audit/audit.module.js';
+import { AuthModule } from './auth/auth.module.js';
+import { CustomerGatewayPoliciesModule } from './customer-gateway-policies/customer-gateway-policies.module.js';
+import { CustomerGatewaysModule } from './customer-gateways/customer-gateways.module.js';
+import { CustomersModule } from './customers/customers.module.js';
+import { DashboardModule } from './dashboard/dashboard.module.js';
+import { DatabaseModule } from './database/database.module.js';
+import { HealthModule } from './health/health.module.js';
+import { LandingLineGroupsModule } from './landing-line-groups/landing-line-groups.module.js';
+import { RechargesModule } from './recharges/recharges.module.js';
+import { RecordingsModule } from './recordings/recordings.module.js';
+import { QualityModule } from './quality/quality.module.js';
+import { RolesModule } from './roles/roles.module.js';
+import { SecurityModule } from './security/security.module.js';
+import { UsersModule } from './users/users.module.js';
+import { VendorGatewaysModule } from './vendor-gateways/vendor-gateways.module.js';
+import { VendorsModule } from './vendors/vendors.module.js';
+
+@Module({
+  imports: [
+    ConfigModule.forRoot({
+      isGlobal: true,
+      cache: true,
+      load: [appConfig],
+      validationSchema,
+      validationOptions: {
+        abortEarly: false,
+        allowUnknown: true
+      }
+    }),
+    LoggerModule.forRoot({
+      pinoHttp: {
+        level: process.env.LISGLOSIPS_LOG_LEVEL ?? 'info',
+        name: process.env.LISGLOSIPS_SERVICE_NAME ?? 'api',
+        genReqId: (request) =>
+          request.headers[process.env.LISGLOSIPS_REQUEST_ID_HEADER ?? 'x-request-id']?.toString() ?? crypto.randomUUID(),
+        redact: {
+          paths: LOG_REDACT_PATHS,
+          censor: '[REDACTED]'
+        },
+        customProps: () => ({
+          apiPrefix: API_PREFIX
+        })
+      }
+    }),
+    DatabaseModule,
+    SecurityModule,
+    AuditModule,
+    AuthModule,
+    DashboardModule,
+    CustomersModule,
+    CustomerGatewaysModule,
+    CustomerGatewayPoliciesModule,
+    RechargesModule,
+    VendorsModule,
+    VendorGatewaysModule,
+    LandingLineGroupsModule,
+    QualityModule,
+    RecordingsModule,
+    UsersModule,
+    RolesModule,
+    AuditLogsModule,
+    HealthModule
+  ]
+})
+export class AppModule {}
diff --git a/apps/api/src/modules/audit-logs/audit-logs.controller.ts b/apps/api/src/modules/audit-logs/audit-logs.controller.ts
new file mode 100644
index 0000000..7a89e0a
--- /dev/null
+++ b/apps/api/src/modules/audit-logs/audit-logs.controller.ts
@@ -0,0 +1,22 @@
+import { Controller, Get, Inject, Param, Query } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { RequirePermissions } from '../security/security.metadata.js';
+import { AuditLogsService } from './audit-logs.service.js';
+
+@ApiTags('audit')
+@Controller('audit-logs')
+export class AuditLogsController {
+  constructor(@Inject(AuditLogsService) private readonly auditLogsService: AuditLogsService) {}
+
+  @Get()
+  @RequirePermissions('audit.view')
+  list(@Query() query: Record<string, unknown>) {
+    return this.auditLogsService.list(query);
+  }
+
+  @Get(':id')
+  @RequirePermissions('audit.view')
+  get(@Param('id') id: string) {
+    return this.auditLogsService.get(id);
+  }
+}
diff --git a/apps/api/src/modules/audit-logs/audit-logs.module.ts b/apps/api/src/modules/audit-logs/audit-logs.module.ts
new file mode 100644
index 0000000..daa8821
--- /dev/null
+++ b/apps/api/src/modules/audit-logs/audit-logs.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { AuditLogsController } from './audit-logs.controller.js';
+import { PrismaAuditLogsRepository, AUDIT_LOGS_REPOSITORY } from './audit-logs.repository.js';
+import { AuditLogsService } from './audit-logs.service.js';
+
+@Module({
+  controllers: [AuditLogsController],
+  providers: [
+    AuditLogsService,
+    PrismaAuditLogsRepository,
+    {
+      provide: AUDIT_LOGS_REPOSITORY,
+      useExisting: PrismaAuditLogsRepository
+    }
+  ]
+})
+export class AuditLogsModule {}
diff --git a/apps/api/src/modules/audit-logs/audit-logs.repository.ts b/apps/api/src/modules/audit-logs/audit-logs.repository.ts
new file mode 100644
index 0000000..e3d615c
--- /dev/null
+++ b/apps/api/src/modules/audit-logs/audit-logs.repository.ts
@@ -0,0 +1,80 @@
+import { Inject, Injectable, NotFoundException } from '@nestjs/common';
+import { PrismaService } from '../database/prisma.service.js';
+
+export interface AuditLogQuery {
+  module?: string;
+  action?: string;
+  userId?: string;
+  objectType?: string;
+  objectId?: string;
+  result?: 'SUCCESS' | 'FAILURE';
+  take: number;
+  skip: number;
+}
+
+export interface AuditLogSummary {
+  id: string;
+  requestId: string;
+  userId: string | null;
+  username: string | null;
+  roleNames: string | null;
+  ip: string | null;
+  userAgent: string | null;
+  module: string;
+  action: string;
+  objectType: string;
+  objectId: string | null;
+  result: 'SUCCESS' | 'FAILURE';
+  errorCode: string | null;
+  createdAt: Date;
+}
+
+export interface AuditLogDetail extends AuditLogSummary {
+  beforeSummary: unknown;
+  afterSummary: unknown;
+}
+
+export interface AuditLogsRepository {
+  list(query: AuditLogQuery): Promise<{ items: AuditLogSummary[]; total: number }>;
+  get(id: string): Promise<AuditLogDetail>;
+}
+
+export const AUDIT_LOGS_REPOSITORY = Symbol('AUDIT_LOGS_REPOSITORY');
+
+@Injectable()
+export class PrismaAuditLogsRepository implements AuditLogsRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async list(query: AuditLogQuery): Promise<{ items: AuditLogSummary[]; total: number }> {
+    const where = {
+      module: query.module,
+      action: query.action,
+      userId: query.userId,
+      objectType: query.objectType,
+      objectId: query.objectId,
+      result: query.result
+    };
+
+    const [items, total] = await this.prisma.$transaction([
+      this.prisma.auditLog.findMany({
+        where,
+        orderBy: [{ createdAt: 'desc' }],
+        take: query.take,
+        skip: query.skip
+      }),
+      this.prisma.auditLog.count({ where })
+    ]);
+
+    return { items, total };
+  }
+
+  async get(id: string): Promise<AuditLogDetail> {
+    const auditLog = await this.prisma.auditLog.findUnique({ where: { id } });
+
+    if (!auditLog) {
+      throw new NotFoundException({ code: 'AUDIT_LOG_NOT_FOUND', message: 'Audit log not found.' });
+    }
+
+    return auditLog;
+  }
+}
diff --git a/apps/api/src/modules/audit-logs/audit-logs.service.ts b/apps/api/src/modules/audit-logs/audit-logs.service.ts
new file mode 100644
index 0000000..cf78662
--- /dev/null
+++ b/apps/api/src/modules/audit-logs/audit-logs.service.ts
@@ -0,0 +1,59 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import { AUDIT_LOGS_REPOSITORY, type AuditLogQuery, type AuditLogsRepository } from './audit-logs.repository.js';
+
+@Injectable()
+export class AuditLogsService {
+  constructor(@Inject(AUDIT_LOGS_REPOSITORY) private readonly auditLogs: AuditLogsRepository) {}
+
+  list(rawQuery: Record<string, unknown>) {
+    const query: AuditLogQuery = {
+      module: this.optionalString(rawQuery.module),
+      action: this.optionalString(rawQuery.action),
+      userId: this.optionalString(rawQuery.userId),
+      objectType: this.optionalString(rawQuery.objectType),
+      objectId: this.optionalString(rawQuery.objectId),
+      result: rawQuery.result === undefined ? undefined : this.result(rawQuery.result),
+      take: this.positiveInt(rawQuery.take, 50, 100),
+      skip: this.positiveInt(rawQuery.skip, 0, 10_000)
+    };
+
+    return this.auditLogs.list(query);
+  }
+
+  get(id: string) {
+    return this.auditLogs.get(id);
+  }
+
+  private optionalString(value: unknown): string | undefined {
+    if (value === undefined) {
+      return undefined;
+    }
+
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'QUERY_INVALID', message: 'Query parameter is invalid.' });
+    }
+
+    return value.trim();
+  }
+
+  private result(value: unknown): 'SUCCESS' | 'FAILURE' {
+    if (value !== 'SUCCESS' && value !== 'FAILURE') {
+      throw new BadRequestException({ code: 'AUDIT_RESULT_INVALID', message: 'Audit result is invalid.' });
+    }
+
+    return value;
+  }
+
+  private positiveInt(value: unknown, defaultValue: number, max: number): number {
+    if (value === undefined) {
+      return defaultValue;
+    }
+
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 0 || parsed > max) {
+      throw new BadRequestException({ code: 'QUERY_INVALID', message: 'Query parameter is invalid.' });
+    }
+
+    return parsed;
+  }
+}
diff --git a/apps/api/src/modules/audit/audit.interceptor.ts b/apps/api/src/modules/audit/audit.interceptor.ts
new file mode 100644
index 0000000..7a93c05
--- /dev/null
+++ b/apps/api/src/modules/audit/audit.interceptor.ts
@@ -0,0 +1,81 @@
+import { CallHandler, ExecutionContext, Inject, Injectable, NestInterceptor } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { FastifyRequest } from 'fastify';
+import { catchError, from, map, mergeMap, Observable, of, throwError } from 'rxjs';
+import { AUDIT_METADATA_KEY, type AuditMetadata } from './audit.metadata.js';
+import { AuditService } from './audit.service.js';
+import { redactSensitive } from './redact.js';
+
+@Injectable()
+export class AuditInterceptor implements NestInterceptor {
+  constructor(
+    @Inject(Reflector) private readonly reflector: Reflector,
+    @Inject(AuditService) private readonly auditService: AuditService
+  ) {}
+
+  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
+    const metadata = this.reflector.getAllAndOverride<AuditMetadata>(AUDIT_METADATA_KEY, [context.getHandler(), context.getClass()]);
+    if (!metadata) {
+      return next.handle();
+    }
+
+    const request = context.switchToHttp().getRequest<FastifyRequest>();
+    const params = request.params as Record<string, string> | undefined;
+    const objectId = metadata.objectIdParam ? params?.[metadata.objectIdParam] : undefined;
+    const beforeSummary = {
+      method: request.method,
+      url: request.url,
+      params: request.params,
+      query: request.query,
+      body: request.body
+    };
+
+    return next.handle().pipe(
+      mergeMap((responseBody) =>
+        from(
+          this.auditService.write({
+          ...this.auditService.baseFromRequest(request),
+          module: metadata.module,
+          action: metadata.action,
+          objectType: metadata.objectType,
+          objectId,
+          beforeSummary,
+          afterSummary: redactSensitive(responseBody),
+          result: 'SUCCESS'
+          })
+        ).pipe(
+          catchError(() => of(undefined)),
+          map(() => responseBody)
+        )
+      ),
+      catchError((error: unknown) => {
+        const writeFailure = this.auditService.write({
+            ...this.auditService.baseFromRequest(request),
+            module: metadata.module,
+            action: metadata.action,
+            objectType: metadata.objectType,
+            objectId,
+            beforeSummary,
+            result: 'FAILURE',
+            errorCode: this.errorCode(error)
+          });
+
+        return from(writeFailure).pipe(
+          catchError(() => of(undefined)),
+          mergeMap(() => throwError(() => error))
+        );
+      })
+    );
+  }
+
+  private errorCode(error: unknown): string {
+    if (error && typeof error === 'object' && 'response' in error) {
+      const response = (error as { response?: unknown }).response;
+      if (response && typeof response === 'object' && 'code' in response) {
+        return String((response as { code: unknown }).code);
+      }
+    }
+
+    return error instanceof Error ? error.name : 'UNKNOWN_ERROR';
+  }
+}
diff --git a/apps/api/src/modules/audit/audit.metadata.ts b/apps/api/src/modules/audit/audit.metadata.ts
new file mode 100644
index 0000000..09e9201
--- /dev/null
+++ b/apps/api/src/modules/audit/audit.metadata.ts
@@ -0,0 +1,12 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const AUDIT_METADATA_KEY = 'lisglosips:audit';
+
+export interface AuditMetadata {
+  module: string;
+  action: string;
+  objectType: string;
+  objectIdParam?: string;
+}
+
+export const AuditAction = (metadata: AuditMetadata) => SetMetadata(AUDIT_METADATA_KEY, metadata);
diff --git a/apps/api/src/modules/audit/audit.module.ts b/apps/api/src/modules/audit/audit.module.ts
new file mode 100644
index 0000000..d80929b
--- /dev/null
+++ b/apps/api/src/modules/audit/audit.module.ts
@@ -0,0 +1,22 @@
+import { Module } from '@nestjs/common';
+import { APP_INTERCEPTOR } from '@nestjs/core';
+import { AuditInterceptor } from './audit.interceptor.js';
+import { PrismaAuditRepository, AUDIT_REPOSITORY } from './audit.repository.js';
+import { AuditService } from './audit.service.js';
+
+@Module({
+  providers: [
+    AuditService,
+    PrismaAuditRepository,
+    {
+      provide: AUDIT_REPOSITORY,
+      useExisting: PrismaAuditRepository
+    },
+    {
+      provide: APP_INTERCEPTOR,
+      useClass: AuditInterceptor
+    }
+  ],
+  exports: [AuditService, AUDIT_REPOSITORY]
+})
+export class AuditModule {}
diff --git a/apps/api/src/modules/audit/audit.repository.ts b/apps/api/src/modules/audit/audit.repository.ts
new file mode 100644
index 0000000..520e7d3
--- /dev/null
+++ b/apps/api/src/modules/audit/audit.repository.ts
@@ -0,0 +1,70 @@
+import { Inject, Injectable } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export interface AuditEntryInput {
+  requestId: string;
+  userId?: string;
+  username?: string;
+  roleNames?: string;
+  ip?: string;
+  userAgent?: string;
+  module: string;
+  action: string;
+  objectType: string;
+  objectId?: string;
+  beforeSummary?: unknown;
+  afterSummary?: unknown;
+  result: 'SUCCESS' | 'FAILURE';
+  errorCode?: string;
+}
+
+export interface AuditRepository {
+  write(input: AuditEntryInput): Promise<void>;
+}
+
+export const AUDIT_REPOSITORY = Symbol('AUDIT_REPOSITORY');
+
+function auditId(): string {
+  return `aud_${crypto.randomUUID().replaceAll('-', '')}`;
+}
+
+@Injectable()
+export class PrismaAuditRepository implements AuditRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async write(input: AuditEntryInput): Promise<void> {
+    await this.prisma.auditLog.create({
+      data: {
+        id: auditId(),
+        requestId: input.requestId,
+        userId: input.userId,
+        username: input.username,
+        roleNames: input.roleNames,
+        ip: input.ip,
+        userAgent: input.userAgent,
+        module: input.module,
+        action: input.action,
+        objectType: input.objectType,
+        objectId: input.objectId,
+        beforeSummary: this.json(input.beforeSummary),
+        afterSummary: this.json(input.afterSummary),
+        result: input.result,
+        errorCode: input.errorCode
+      }
+    });
+  }
+
+  private json(value: unknown): Prisma.InputJsonValue | typeof Prisma.JsonNull | undefined {
+    if (value === undefined) {
+      return undefined;
+    }
+
+    if (value === null) {
+      return Prisma.JsonNull;
+    }
+
+    return value as Prisma.InputJsonValue;
+  }
+}
diff --git a/apps/api/src/modules/audit/audit.service.ts b/apps/api/src/modules/audit/audit.service.ts
new file mode 100644
index 0000000..411af9b
--- /dev/null
+++ b/apps/api/src/modules/audit/audit.service.ts
@@ -0,0 +1,32 @@
+import { Inject, Injectable } from '@nestjs/common';
+import type { FastifyRequest } from 'fastify';
+import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from './audit.repository.js';
+import { redactSensitive } from './redact.js';
+import type { AuthenticatedRequest } from '../security/security.metadata.js';
+
+@Injectable()
+export class AuditService {
+  constructor(@Inject(AUDIT_REPOSITORY) private readonly repository: AuditRepository) {}
+
+  async write(input: AuditEntryInput): Promise<void> {
+    await this.repository.write({
+      ...input,
+      beforeSummary: redactSensitive(input.beforeSummary),
+      afterSummary: redactSensitive(input.afterSummary)
+    });
+  }
+
+  baseFromRequest(request: FastifyRequest): Pick<AuditEntryInput, 'requestId' | 'userId' | 'username' | 'roleNames' | 'ip' | 'userAgent'> {
+    const authRequest = request as AuthenticatedRequest;
+    const requestIdHeader = request.headers['x-request-id'];
+
+    return {
+      requestId: requestIdHeader?.toString() ?? request.id,
+      userId: authRequest.currentUser?.id,
+      username: authRequest.currentUser?.username,
+      roleNames: authRequest.currentUser?.roles.join(','),
+      ip: request.ip,
+      userAgent: request.headers['user-agent']
+    };
+  }
+}
diff --git a/apps/api/src/modules/audit/redact.ts b/apps/api/src/modules/audit/redact.ts
new file mode 100644
index 0000000..0e5c6c3
--- /dev/null
+++ b/apps/api/src/modules/audit/redact.ts
@@ -0,0 +1,23 @@
+const SENSITIVE_KEY_PATTERN = /password|token|authorization|cookie|secret|ha1|hash/i;
+
+export function redactSensitive(value: unknown, depth = 0): unknown {
+  if (depth > 5) {
+    return '[TRUNCATED]';
+  }
+
+  if (Array.isArray(value)) {
+    return value.map((item) => redactSensitive(item, depth + 1));
+  }
+
+  if (value && typeof value === 'object') {
+    const result: Record<string, unknown> = {};
+
+    for (const [key, nested] of Object.entries(value as Record<string, unknown>)) {
+      result[key] = SENSITIVE_KEY_PATTERN.test(key) ? '[REDACTED]' : redactSensitive(nested, depth + 1);
+    }
+
+    return result;
+  }
+
+  return value;
+}
diff --git a/apps/api/src/modules/auth/auth.controller.ts b/apps/api/src/modules/auth/auth.controller.ts
new file mode 100644
index 0000000..8198d85
--- /dev/null
+++ b/apps/api/src/modules/auth/auth.controller.ts
@@ -0,0 +1,93 @@
+import { Body, Controller, HttpCode, Inject, Post, Req, Res, UnauthorizedException } from '@nestjs/common';
+import { ApiOperation, ApiTags } from '@nestjs/swagger';
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import { Public } from '../security/security.metadata.js';
+import { AuthService } from './auth.service.js';
+import { parseCookie, serializeCookie } from './cookie.js';
+
+interface LoginBody {
+  username?: unknown;
+  password?: unknown;
+}
+
+@ApiTags('auth')
+@Public()
+@Controller('auth')
+export class AuthController {
+  constructor(@Inject(AuthService) private readonly authService: AuthService) {}
+
+  @Post('login')
+  @HttpCode(200)
+  @ApiOperation({ summary: 'Login with username and password' })
+  async login(@Body() body: LoginBody, @Req() request: FastifyRequest, @Res({ passthrough: true }) reply: FastifyReply) {
+    const { username, password } = this.readCredentials(body);
+    const result = await this.authService.login(username, password, this.requestContext(request));
+
+    this.setRefreshCookie(reply, result.tokens.refreshToken, result.tokens.refreshMaxAgeSeconds);
+
+    return result.response;
+  }
+
+  @Post('refresh')
+  @HttpCode(200)
+  @ApiOperation({ summary: 'Rotate refresh token and issue a new access token' })
+  async refresh(@Req() request: FastifyRequest, @Res({ passthrough: true }) reply: FastifyReply) {
+    const refreshToken = parseCookie(request.headers.cookie, this.authService.getRefreshCookieName());
+    const result = await this.authService.refresh(refreshToken, this.requestContext(request));
+
+    this.setRefreshCookie(reply, result.tokens.refreshToken, result.tokens.refreshMaxAgeSeconds);
+
+    return result.response;
+  }
+
+  @Post('logout')
+  @HttpCode(204)
+  @ApiOperation({ summary: 'Revoke the current refresh session' })
+  async logout(@Req() request: FastifyRequest, @Res({ passthrough: true }) reply: FastifyReply): Promise<void> {
+    const refreshToken = parseCookie(request.headers.cookie, this.authService.getRefreshCookieName());
+
+    await this.authService.logout(refreshToken);
+    reply.header(
+      'Set-Cookie',
+      serializeCookie(this.authService.getRefreshCookieName(), '', {
+        maxAgeSeconds: 0,
+        secure: this.cookieSecure()
+      })
+    );
+  }
+
+  private readCredentials(body: LoginBody): { username: string; password: string } {
+    if (typeof body.username !== 'string' || typeof body.password !== 'string' || !body.username.trim() || !body.password) {
+      throw new UnauthorizedException({
+        code: 'AUTH_INVALID_CREDENTIALS',
+        message: 'Invalid username or password.'
+      });
+    }
+
+    return {
+      username: body.username,
+      password: body.password
+    };
+  }
+
+  private requestContext(request: FastifyRequest): { ip?: string; userAgent?: string } {
+    return {
+      ip: request.ip,
+      userAgent: request.headers['user-agent']
+    };
+  }
+
+  private setRefreshCookie(reply: FastifyReply, refreshToken: string, maxAgeSeconds: number): void {
+    reply.header(
+      'Set-Cookie',
+      serializeCookie(this.authService.getRefreshCookieName(), refreshToken, {
+        maxAgeSeconds,
+        secure: this.cookieSecure()
+      })
+    );
+  }
+
+  private cookieSecure(): boolean {
+    return process.env.AUTH_COOKIE_SECURE !== 'false';
+  }
+}
diff --git a/apps/api/src/modules/auth/auth.e2e.spec.ts b/apps/api/src/modules/auth/auth.e2e.spec.ts
new file mode 100644
index 0000000..c402fce
--- /dev/null
+++ b/apps/api/src/modules/auth/auth.e2e.spec.ts
@@ -0,0 +1,132 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import crypto from 'node:crypto';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { hashPasswordArgon2id, sha256Token } from '@lisglosips/auth';
+import { AUTH_REPOSITORY, type AuthRepository, type AuthSessionRecord, type AuthUserRecord, type CreateSessionInput } from './auth.types.js';
+
+class E2eAuthRepository implements AuthRepository {
+  user: AuthUserRecord;
+  sessions = new Map<string, AuthSessionRecord>();
+
+  private constructor(passwordHash: string) {
+    this.user = {
+      id: 'usr_e2e',
+      username: 'operator',
+      displayName: 'Operator',
+      passwordHash,
+      passwordAlgo: 'argon2id',
+      status: 'ENABLED',
+      failedLoginCount: 0,
+      lockedUntil: null,
+      requirePasswordChange: false,
+      roles: ['admin']
+    };
+  }
+
+  static async create(secret: string): Promise<E2eAuthRepository> {
+    return new E2eAuthRepository(await hashPasswordArgon2id(secret, { memoryKiB: 1024, passes: 1 }));
+  }
+
+  async findUserByUsername(username: string): Promise<AuthUserRecord | null> {
+    return username === this.user.username ? { ...this.user, roles: [...this.user.roles] } : null;
+  }
+
+  async markLoginSuccess(): Promise<void> {
+    this.user.failedLoginCount = 0;
+    this.user.lockedUntil = null;
+  }
+
+  async markLoginFailure(_userId: string, failedLoginCount: number, lockedUntil: Date | null): Promise<void> {
+    this.user.failedLoginCount = failedLoginCount;
+    this.user.lockedUntil = lockedUntil;
+  }
+
+  async createSession(input: CreateSessionInput): Promise<AuthSessionRecord> {
+    const session: AuthSessionRecord = {
+      id: `ses_e2e_${this.sessions.size + 1}`,
+      userId: input.userId,
+      refreshTokenHash: input.refreshTokenHash,
+      expiresAt: input.expiresAt,
+      revokedAt: null,
+      user: { ...this.user, roles: [...this.user.roles] }
+    };
+
+    this.sessions.set(session.id, session);
+    return session;
+  }
+
+  async findActiveSessionByRefreshTokenHash(refreshTokenHash: string, now: Date): Promise<AuthSessionRecord | null> {
+    return (
+      [...this.sessions.values()].find(
+        (session) => session.refreshTokenHash === refreshTokenHash && !session.revokedAt && session.expiresAt > now
+      ) ?? null
+    );
+  }
+
+  async revokeSession(sessionId: string, revokedAt: Date): Promise<void> {
+    const session = this.sessions.get(sessionId);
+    if (session) {
+      session.revokedAt = revokedAt;
+    }
+  }
+}
+
+describe('LisgloSIPS Auth API', () => {
+  let app: NestFastifyApplication;
+  let repo: E2eAuthRepository;
+  let secret: string;
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+    process.env.AUTH_COOKIE_SECURE = 'false';
+    process.env.AUTH_ACCESS_TOKEN_SECRET = 'test-only-access-token-secret-min-32-bytes';
+
+    secret = crypto.randomUUID();
+    repo = await E2eAuthRepository.create(secret);
+
+    const { AppModule } = await import('../app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule]
+    })
+      .overrideProvider(AUTH_REPOSITORY)
+      .useValue(repo)
+      .compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('logs in, refreshes with cookie rotation, and logs out', async () => {
+    const login = await request(app.getHttpServer())
+      .post('/api/v2/auth/login')
+      .send({ username: 'operator', password: secret })
+      .expect(200);
+    const loginCookie = login.headers['set-cookie'][0];
+    const firstRefreshToken = /lisglosips_refresh=([^;]+)/.exec(loginCookie)?.[1] ?? '';
+
+    expect(login.body.accessToken).toBeTypeOf('string');
+    expect(loginCookie).toContain('HttpOnly');
+    expect([...repo.sessions.values()][0].refreshTokenHash).toBe(sha256Token(decodeURIComponent(firstRefreshToken)));
+
+    const refresh = await request(app.getHttpServer()).post('/api/v2/auth/refresh').set('Cookie', loginCookie).expect(200);
+    const refreshCookie = refresh.headers['set-cookie'][0];
+
+    expect(refresh.body.accessToken).toBeTypeOf('string');
+    expect([...repo.sessions.values()][0].revokedAt).toBeInstanceOf(Date);
+    await request(app.getHttpServer()).post('/api/v2/auth/refresh').set('Cookie', loginCookie).expect(401);
+
+    await request(app.getHttpServer()).post('/api/v2/auth/logout').set('Cookie', refreshCookie).expect(204);
+    await request(app.getHttpServer()).post('/api/v2/auth/refresh').set('Cookie', refreshCookie).expect(401);
+  });
+});
diff --git a/apps/api/src/modules/auth/auth.module.ts b/apps/api/src/modules/auth/auth.module.ts
new file mode 100644
index 0000000..bec72b1
--- /dev/null
+++ b/apps/api/src/modules/auth/auth.module.ts
@@ -0,0 +1,19 @@
+import { Module } from '@nestjs/common';
+import { AuthController } from './auth.controller.js';
+import { PrismaAuthRepository } from './auth.repository.js';
+import { AuthService } from './auth.service.js';
+import { AUTH_REPOSITORY } from './auth.types.js';
+
+@Module({
+  controllers: [AuthController],
+  providers: [
+    AuthService,
+    PrismaAuthRepository,
+    {
+      provide: AUTH_REPOSITORY,
+      useExisting: PrismaAuthRepository
+    }
+  ],
+  exports: [AuthService]
+})
+export class AuthModule {}
diff --git a/apps/api/src/modules/auth/auth.repository.ts b/apps/api/src/modules/auth/auth.repository.ts
new file mode 100644
index 0000000..d18429c
--- /dev/null
+++ b/apps/api/src/modules/auth/auth.repository.ts
@@ -0,0 +1,163 @@
+import { Inject, Injectable } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { PrismaService } from '../database/prisma.service.js';
+import type { AuthRepository, AuthSessionRecord, AuthUserRecord, CreateSessionInput } from './auth.types.js';
+
+function sessionId(): string {
+  return `ses_${crypto.randomUUID().replaceAll('-', '')}`;
+}
+
+@Injectable()
+export class PrismaAuthRepository implements AuthRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async findUserByUsername(username: string): Promise<AuthUserRecord | null> {
+    const user = await this.prisma.user.findUnique({
+      where: { username },
+      include: {
+        userRoles: {
+          include: {
+            role: true
+          }
+        }
+      }
+    });
+
+    if (!user || user.deletedAt) {
+      return null;
+    }
+
+    return {
+      id: user.id,
+      username: user.username,
+      displayName: user.displayName,
+      passwordHash: user.passwordHash,
+      passwordAlgo: user.passwordAlgo,
+      status: user.status,
+      failedLoginCount: user.failedLoginCount,
+      lockedUntil: user.lockedUntil,
+      requirePasswordChange: user.requirePasswordChange,
+      roles: user.userRoles.map((userRole) => userRole.role.name)
+    };
+  }
+
+  async markLoginSuccess(userId: string, ip?: string): Promise<void> {
+    await this.prisma.user.update({
+      where: { id: userId },
+      data: {
+        failedLoginCount: 0,
+        lockedUntil: null,
+        lastLoginAt: new Date(),
+        lastLoginIp: ip
+      }
+    });
+  }
+
+  async markLoginFailure(userId: string, failedLoginCount: number, lockedUntil: Date | null): Promise<void> {
+    await this.prisma.user.update({
+      where: { id: userId },
+      data: {
+        failedLoginCount,
+        lockedUntil
+      }
+    });
+  }
+
+  async createSession(input: CreateSessionInput): Promise<AuthSessionRecord> {
+    const session = await this.prisma.userSession.create({
+      data: {
+        id: sessionId(),
+        userId: input.userId,
+        refreshTokenHash: input.refreshTokenHash,
+        userAgent: input.userAgent,
+        ip: input.ip,
+        expiresAt: input.expiresAt,
+        rotatedFromId: input.rotatedFromId
+      },
+      include: {
+        user: {
+          include: {
+            userRoles: {
+              include: {
+                role: true
+              }
+            }
+          }
+        }
+      }
+    });
+
+    return {
+      id: session.id,
+      userId: session.userId,
+      refreshTokenHash: session.refreshTokenHash,
+      expiresAt: session.expiresAt,
+      revokedAt: session.revokedAt,
+      user: {
+        id: session.user.id,
+        username: session.user.username,
+        displayName: session.user.displayName,
+        passwordHash: session.user.passwordHash,
+        passwordAlgo: session.user.passwordAlgo,
+        status: session.user.status,
+        failedLoginCount: session.user.failedLoginCount,
+        lockedUntil: session.user.lockedUntil,
+        requirePasswordChange: session.user.requirePasswordChange,
+        roles: session.user.userRoles.map((userRole) => userRole.role.name)
+      }
+    };
+  }
+
+  async findActiveSessionByRefreshTokenHash(refreshTokenHash: string, now: Date): Promise<AuthSessionRecord | null> {
+    const session = await this.prisma.userSession.findUnique({
+      where: { refreshTokenHash },
+      include: {
+        user: {
+          include: {
+            userRoles: {
+              include: {
+                role: true
+              }
+            }
+          }
+        }
+      }
+    });
+
+    if (!session || session.revokedAt || session.expiresAt <= now || session.user.deletedAt) {
+      return null;
+    }
+
+    return {
+      id: session.id,
+      userId: session.userId,
+      refreshTokenHash: session.refreshTokenHash,
+      expiresAt: session.expiresAt,
+      revokedAt: session.revokedAt,
+      user: {
+        id: session.user.id,
+        username: session.user.username,
+        displayName: session.user.displayName,
+        passwordHash: session.user.passwordHash,
+        passwordAlgo: session.user.passwordAlgo,
+        status: session.user.status,
+        failedLoginCount: session.user.failedLoginCount,
+        lockedUntil: session.user.lockedUntil,
+        requirePasswordChange: session.user.requirePasswordChange,
+        roles: session.user.userRoles.map((userRole) => userRole.role.name)
+      }
+    };
+  }
+
+  async revokeSession(sessionId: string, revokedAt: Date): Promise<void> {
+    await this.prisma.userSession.updateMany({
+      where: {
+        id: sessionId,
+        revokedAt: null
+      },
+      data: {
+        revokedAt
+      }
+    });
+  }
+}
diff --git a/apps/api/src/modules/auth/auth.service.spec.ts b/apps/api/src/modules/auth/auth.service.spec.ts
new file mode 100644
index 0000000..1b63c0e
--- /dev/null
+++ b/apps/api/src/modules/auth/auth.service.spec.ts
@@ -0,0 +1,145 @@
+import 'reflect-metadata';
+import { beforeEach, describe, expect, it } from 'vitest';
+import crypto from 'node:crypto';
+import { hashPasswordArgon2id, sha256Token } from '@lisglosips/auth';
+import { AuthService } from './auth.service.js';
+import type { AuthRepository, AuthSessionRecord, AuthUserRecord, CreateSessionInput } from './auth.types.js';
+
+class MemoryAuthRepository implements AuthRepository {
+  user: AuthUserRecord;
+  sessions = new Map<string, AuthSessionRecord>();
+
+  private constructor(passwordHash: string) {
+    this.user = {
+      id: 'usr_test',
+      username: 'operator',
+      displayName: 'Operator',
+      passwordHash,
+      passwordAlgo: 'argon2id',
+      status: 'ENABLED',
+      failedLoginCount: 0,
+      lockedUntil: null,
+      requirePasswordChange: false,
+      roles: ['admin']
+    };
+  }
+
+  static async create(secret: string): Promise<MemoryAuthRepository> {
+    return new MemoryAuthRepository(
+      await hashPasswordArgon2id(secret, {
+        memoryKiB: 1024,
+        passes: 1
+      })
+    );
+  }
+
+  async findUserByUsername(username: string): Promise<AuthUserRecord | null> {
+    return username === this.user.username ? { ...this.user, roles: [...this.user.roles] } : null;
+  }
+
+  async markLoginSuccess(_userId: string, _ip?: string): Promise<void> {
+    this.user.failedLoginCount = 0;
+    this.user.lockedUntil = null;
+  }
+
+  async markLoginFailure(_userId: string, failedLoginCount: number, lockedUntil: Date | null): Promise<void> {
+    this.user.failedLoginCount = failedLoginCount;
+    this.user.lockedUntil = lockedUntil;
+  }
+
+  async createSession(input: CreateSessionInput): Promise<AuthSessionRecord> {
+    const session: AuthSessionRecord = {
+      id: `ses_${this.sessions.size + 1}`,
+      userId: input.userId,
+      refreshTokenHash: input.refreshTokenHash,
+      expiresAt: input.expiresAt,
+      revokedAt: null,
+      user: { ...this.user, roles: [...this.user.roles] }
+    };
+
+    this.sessions.set(session.id, session);
+    return session;
+  }
+
+  async findActiveSessionByRefreshTokenHash(refreshTokenHash: string, now: Date): Promise<AuthSessionRecord | null> {
+    return (
+      [...this.sessions.values()].find(
+        (session) => session.refreshTokenHash === refreshTokenHash && !session.revokedAt && session.expiresAt > now
+      ) ?? null
+    );
+  }
+
+  async revokeSession(sessionId: string, revokedAt: Date): Promise<void> {
+    const session = this.sessions.get(sessionId);
+    if (session) {
+      session.revokedAt = revokedAt;
+    }
+  }
+}
+
+function config() {
+  const values = new Map<string, unknown>([
+    ['auth.accessTokenSecret', 'test-only-access-token-secret-min-32-bytes'],
+    ['auth.accessTokenTtlSeconds', 900],
+    ['auth.refreshTokenTtlDays', 7],
+    ['auth.lockMaxFailures', 3],
+    ['auth.lockWindowSeconds', 60],
+    ['auth.tokenIssuer', 'lisglosips-api'],
+    ['auth.tokenAudience', 'lisglosips-web']
+  ]);
+
+  return {
+    get: (key: string) => values.get(key)
+  };
+}
+
+describe('AuthService', () => {
+  let repo: MemoryAuthRepository;
+  let service: AuthService;
+  let secret: string;
+
+  beforeEach(async () => {
+    secret = crypto.randomUUID();
+    repo = await MemoryAuthRepository.create(secret);
+    service = new AuthService(repo, config() as never);
+  });
+
+  it('logs in and stores only the refresh token digest', async () => {
+    const result = await service.login(' OPERATOR ', secret, { ip: '127.0.0.1', userAgent: 'vitest' });
+    const session = [...repo.sessions.values()][0];
+
+    expect(result.response.user.username).toBe('operator');
+    expect(result.response.accessToken.split('.')).toHaveLength(3);
+    expect(session.refreshTokenHash).toBe(sha256Token(result.tokens.refreshToken));
+    expect(session.refreshTokenHash).not.toBe(result.tokens.refreshToken);
+  });
+
+  it('locks the user after repeated failures', async () => {
+    await expect(service.login('operator', crypto.randomUUID())).rejects.toMatchObject({ status: 401 });
+    await expect(service.login('operator', crypto.randomUUID())).rejects.toMatchObject({ status: 401 });
+    await expect(service.login('operator', crypto.randomUUID())).rejects.toMatchObject({ status: 401 });
+
+    expect(repo.user.failedLoginCount).toBe(3);
+    expect(repo.user.lockedUntil).toBeInstanceOf(Date);
+    await expect(service.login('operator', secret)).rejects.toMatchObject({ status: 401 });
+  });
+
+  it('rotates refresh sessions and rejects reuse', async () => {
+    const login = await service.login('operator', secret);
+    const refresh = await service.refresh(login.tokens.refreshToken);
+    const [firstSession, secondSession] = [...repo.sessions.values()];
+
+    expect(firstSession.revokedAt).toBeInstanceOf(Date);
+    expect(secondSession.refreshTokenHash).toBe(sha256Token(refresh.tokens.refreshToken));
+    await expect(service.refresh(login.tokens.refreshToken)).rejects.toMatchObject({ status: 401 });
+  });
+
+  it('revokes refresh session on logout', async () => {
+    const login = await service.login('operator', secret);
+
+    await service.logout(login.tokens.refreshToken);
+
+    expect([...repo.sessions.values()][0].revokedAt).toBeInstanceOf(Date);
+    await expect(service.refresh(login.tokens.refreshToken)).rejects.toMatchObject({ status: 401 });
+  });
+});
diff --git a/apps/api/src/modules/auth/auth.service.ts b/apps/api/src/modules/auth/auth.service.ts
new file mode 100644
index 0000000..322b8ca
--- /dev/null
+++ b/apps/api/src/modules/auth/auth.service.ts
@@ -0,0 +1,184 @@
+import { Inject, Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import {
+  ACCESS_TOKEN_TYPE,
+  PASSWORD_ALGO_ARGON2ID,
+  REFRESH_COOKIE_NAME,
+  randomToken,
+  sha256Token,
+  signAccessToken,
+  verifyPasswordArgon2id
+} from '@lisglosips/auth';
+import type { RuntimeConfig } from '../../shared/config.js';
+import { AUTH_REPOSITORY, type AuthRepository, type AuthUserRecord } from './auth.types.js';
+
+export interface AuthRequestContext {
+  ip?: string;
+  userAgent?: string;
+}
+
+export interface AuthTokens {
+  accessToken: string;
+  refreshToken: string;
+  refreshMaxAgeSeconds: number;
+}
+
+export interface AuthResponse {
+  tokenType: typeof ACCESS_TOKEN_TYPE;
+  accessToken: string;
+  expiresIn: number;
+  user: {
+    id: string;
+    username: string;
+    displayName: string;
+    roles: string[];
+    requirePasswordChange: boolean;
+  };
+}
+
+@Injectable()
+export class AuthService {
+  constructor(
+    @Inject(AUTH_REPOSITORY) private readonly repository: AuthRepository,
+    @Inject(ConfigService) private readonly config: ConfigService<RuntimeConfig, true>
+  ) {}
+
+  async login(username: string, password: string, context: AuthRequestContext = {}): Promise<{ response: AuthResponse; tokens: AuthTokens }> {
+    const normalizedUsername = username.trim().toLowerCase();
+    const user = await this.repository.findUserByUsername(normalizedUsername);
+    const now = new Date();
+
+    if (!user) {
+      throw this.invalidCredentials();
+    }
+
+    if (this.isLocked(user, now) || user.status !== 'ENABLED' || !user.passwordHash || user.passwordAlgo !== PASSWORD_ALGO_ARGON2ID) {
+      await this.registerFailure(user, now);
+      throw this.invalidCredentials();
+    }
+
+    if (!(await verifyPasswordArgon2id(password, user.passwordHash))) {
+      await this.registerFailure(user, now);
+      throw this.invalidCredentials();
+    }
+
+    await this.repository.markLoginSuccess(user.id, context.ip);
+    const tokens = await this.issueTokens(user, context);
+
+    return {
+      response: this.buildResponse(user, tokens.accessToken),
+      tokens
+    };
+  }
+
+  async refresh(refreshToken: string | null, context: AuthRequestContext = {}): Promise<{ response: AuthResponse; tokens: AuthTokens }> {
+    if (!refreshToken) {
+      throw this.invalidCredentials();
+    }
+
+    const now = new Date();
+    const session = await this.repository.findActiveSessionByRefreshTokenHash(sha256Token(refreshToken), now);
+
+    if (!session || session.user.status !== 'ENABLED') {
+      throw this.invalidCredentials();
+    }
+
+    await this.repository.revokeSession(session.id, now);
+    const tokens = await this.issueTokens(session.user, context, session.id);
+
+    return {
+      response: this.buildResponse(session.user, tokens.accessToken),
+      tokens
+    };
+  }
+
+  async logout(refreshToken: string | null): Promise<void> {
+    if (!refreshToken) {
+      return;
+    }
+
+    const now = new Date();
+    const session = await this.repository.findActiveSessionByRefreshTokenHash(sha256Token(refreshToken), now);
+
+    if (session) {
+      await this.repository.revokeSession(session.id, now);
+    }
+  }
+
+  getRefreshCookieName(): string {
+    return REFRESH_COOKIE_NAME;
+  }
+
+  private async issueTokens(user: AuthUserRecord, context: AuthRequestContext, rotatedFromId?: string): Promise<AuthTokens> {
+    const accessTtlSeconds = this.config.get('auth.accessTokenTtlSeconds', { infer: true });
+    const refreshTtlDays = this.config.get('auth.refreshTokenTtlDays', { infer: true });
+    const refreshMaxAgeSeconds = refreshTtlDays * 24 * 60 * 60;
+    const refreshToken = randomToken();
+    const expiresAt = new Date(Date.now() + refreshMaxAgeSeconds * 1000);
+
+    await this.repository.createSession({
+      userId: user.id,
+      refreshTokenHash: sha256Token(refreshToken),
+      userAgent: context.userAgent,
+      ip: context.ip,
+      expiresAt,
+      rotatedFromId
+    });
+
+    const accessToken = signAccessToken(
+      {
+        sub: user.id,
+        username: user.username,
+        roles: user.roles,
+        typ: 'access'
+      },
+      {
+        secret: this.config.get('auth.accessTokenSecret', { infer: true }),
+        issuer: this.config.get('auth.tokenIssuer', { infer: true }),
+        audience: this.config.get('auth.tokenAudience', { infer: true }),
+        ttlSeconds: accessTtlSeconds
+      }
+    );
+
+    return {
+      accessToken,
+      refreshToken,
+      refreshMaxAgeSeconds
+    };
+  }
+
+  private buildResponse(user: AuthUserRecord, accessToken: string): AuthResponse {
+    return {
+      tokenType: ACCESS_TOKEN_TYPE,
+      accessToken,
+      expiresIn: this.config.get('auth.accessTokenTtlSeconds', { infer: true }),
+      user: {
+        id: user.id,
+        username: user.username,
+        displayName: user.displayName,
+        roles: user.roles,
+        requirePasswordChange: user.requirePasswordChange
+      }
+    };
+  }
+
+  private async registerFailure(user: AuthUserRecord, now: Date): Promise<void> {
+    const maxFailures = this.config.get('auth.lockMaxFailures', { infer: true });
+    const lockWindowSeconds = this.config.get('auth.lockWindowSeconds', { infer: true });
+    const failedLoginCount = user.failedLoginCount + 1;
+    const lockedUntil = failedLoginCount >= maxFailures ? new Date(now.getTime() + lockWindowSeconds * 1000) : null;
+
+    await this.repository.markLoginFailure(user.id, failedLoginCount, lockedUntil);
+  }
+
+  private isLocked(user: AuthUserRecord, now: Date): boolean {
+    return Boolean(user.lockedUntil && user.lockedUntil > now);
+  }
+
+  private invalidCredentials(): UnauthorizedException {
+    return new UnauthorizedException({
+      code: 'AUTH_INVALID_CREDENTIALS',
+      message: 'Invalid username or password.'
+    });
+  }
+}
diff --git a/apps/api/src/modules/auth/auth.types.ts b/apps/api/src/modules/auth/auth.types.ts
new file mode 100644
index 0000000..861cb0f
--- /dev/null
+++ b/apps/api/src/modules/auth/auth.types.ts
@@ -0,0 +1,41 @@
+export interface AuthUserRecord {
+  id: string;
+  username: string;
+  displayName: string;
+  passwordHash: string | null;
+  passwordAlgo: string | null;
+  status: 'ENABLED' | 'DISABLED';
+  failedLoginCount: number;
+  lockedUntil: Date | null;
+  requirePasswordChange: boolean;
+  roles: string[];
+}
+
+export interface AuthSessionRecord {
+  id: string;
+  userId: string;
+  refreshTokenHash: string;
+  expiresAt: Date;
+  revokedAt: Date | null;
+  user: AuthUserRecord;
+}
+
+export interface CreateSessionInput {
+  userId: string;
+  refreshTokenHash: string;
+  userAgent?: string;
+  ip?: string;
+  expiresAt: Date;
+  rotatedFromId?: string;
+}
+
+export interface AuthRepository {
+  findUserByUsername(username: string): Promise<AuthUserRecord | null>;
+  markLoginSuccess(userId: string, ip?: string): Promise<void>;
+  markLoginFailure(userId: string, failedLoginCount: number, lockedUntil: Date | null): Promise<void>;
+  createSession(input: CreateSessionInput): Promise<AuthSessionRecord>;
+  findActiveSessionByRefreshTokenHash(refreshTokenHash: string, now: Date): Promise<AuthSessionRecord | null>;
+  revokeSession(sessionId: string, revokedAt: Date): Promise<void>;
+}
+
+export const AUTH_REPOSITORY = Symbol('AUTH_REPOSITORY');
diff --git a/apps/api/src/modules/auth/cookie.ts b/apps/api/src/modules/auth/cookie.ts
new file mode 100644
index 0000000..455722d
--- /dev/null
+++ b/apps/api/src/modules/auth/cookie.ts
@@ -0,0 +1,42 @@
+export function parseCookie(header: string | undefined, name: string): string | null {
+  if (!header) {
+    return null;
+  }
+
+  for (const part of header.split(';')) {
+    const [rawKey, ...rawValue] = part.trim().split('=');
+    if (rawKey === name) {
+      return decodeURIComponent(rawValue.join('='));
+    }
+  }
+
+  return null;
+}
+
+export function serializeCookie(
+  name: string,
+  value: string,
+  options: {
+    maxAgeSeconds?: number;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'Strict' | 'Lax';
+    path?: string;
+  } = {}
+): string {
+  const segments = [`${name}=${encodeURIComponent(value)}`, `Path=${options.path ?? '/api/v2/auth'}`, 'SameSite=' + (options.sameSite ?? 'Strict')];
+
+  if (options.maxAgeSeconds !== undefined) {
+    segments.push(`Max-Age=${Math.max(0, Math.floor(options.maxAgeSeconds))}`);
+  }
+
+  if (options.httpOnly ?? true) {
+    segments.push('HttpOnly');
+  }
+
+  if (options.secure ?? true) {
+    segments.push('Secure');
+  }
+
+  return segments.join('; ');
+}
diff --git a/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.controller.ts b/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.controller.ts
new file mode 100644
index 0000000..a20c00c
--- /dev/null
+++ b/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.controller.ts
@@ -0,0 +1,45 @@
+import { Body, Controller, Delete, Get, Inject, Param, Patch, Post } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { CustomerGatewayPoliciesService } from './customer-gateway-policies.service.js';
+
+@ApiTags('customer-gateway-policies')
+@Controller()
+export class CustomerGatewayPoliciesController {
+  constructor(@Inject(CustomerGatewayPoliciesService) private readonly policiesService: CustomerGatewayPoliciesService) {}
+
+  @Get('customer-gateways/:id/policies')
+  @RequirePermissions('customer_gateways.view')
+  list(@Param('id') gatewayId: string) {
+    return this.policiesService.list(gatewayId);
+  }
+
+  @Post('customer-gateways/:id/policies')
+  @RequirePermissions('customer_gateways.manage')
+  @AuditAction({ module: 'customer_gateways', action: 'policy_create', objectType: 'customer_gateway', objectIdParam: 'id' })
+  create(@Param('id') gatewayId: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.policiesService.create(gatewayId, body as never, currentUser?.id);
+  }
+
+  @Patch('customer-gateway-policies/:id')
+  @RequirePermissions('customer_gateways.manage')
+  @AuditAction({ module: 'customer_gateways', action: 'policy_update', objectType: 'customer_gateway_policy', objectIdParam: 'id' })
+  update(@Param('id') policyId: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.policiesService.update(policyId, body as never, currentUser?.id);
+  }
+
+  @Delete('customer-gateway-policies/:id')
+  @RequirePermissions('customer_gateways.manage')
+  @AuditAction({ module: 'customer_gateways', action: 'policy_delete', objectType: 'customer_gateway_policy', objectIdParam: 'id' })
+  remove(@Param('id') policyId: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.policiesService.remove(policyId, currentUser?.id);
+  }
+
+  @Post('customer-gateways/:id/policies/reorder')
+  @RequirePermissions('customer_gateways.manage')
+  @AuditAction({ module: 'customer_gateways', action: 'policy_reorder', objectType: 'customer_gateway', objectIdParam: 'id' })
+  reorder(@Param('id') gatewayId: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.policiesService.reorder(gatewayId, body as never, currentUser?.id);
+  }
+}
diff --git a/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.e2e.spec.ts b/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.e2e.spec.ts
new file mode 100644
index 0000000..578f5c1
--- /dev/null
+++ b/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.e2e.spec.ts
@@ -0,0 +1,256 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { signAccessToken, type PermissionKey } from '@lisglosips/auth';
+import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from '../audit/audit.repository.js';
+import { IDENTITY_REPOSITORY, type IdentityRepository } from '../security/identity.repository.js';
+import type { CurrentUser } from '../security/security.metadata.js';
+import {
+  CUSTOMER_GATEWAY_POLICIES_REPOSITORY,
+  type CreatePolicyInput,
+  type CustomerGatewayPoliciesRepository,
+  type CustomerGatewayPolicySummary,
+  type UpdatePolicyInput
+} from './customer-gateway-policies.repository.js';
+
+class MemoryIdentityRepository implements IdentityRepository {
+  users = new Map<string, CurrentUser>();
+
+  async findCurrentUserById(userId: string): Promise<CurrentUser | null> {
+    return this.users.get(userId) ?? null;
+  }
+}
+
+class MemoryAuditRepository implements AuditRepository {
+  entries: AuditEntryInput[] = [];
+
+  async write(input: AuditEntryInput): Promise<void> {
+    this.entries.push(input);
+  }
+}
+
+class MemoryPoliciesRepository implements CustomerGatewayPoliciesRepository {
+  policies: CustomerGatewayPolicySummary[] = [
+    this.summary({ id: 'cgp_1', name: 'Mobile prefix', priority: 1, callerMode: 'PREFIX', callerValue: '021' }),
+    this.summary({ id: 'cgp_2', name: 'Fallback', priority: 2 })
+  ];
+  outboxEvents = 0;
+
+  async list(gatewayId: string): Promise<CustomerGatewayPolicySummary[]> {
+    return this.policies.filter((policy) => policy.gatewayId === gatewayId).sort((left, right) => left.priority - right.priority);
+  }
+
+  async create(input: CreatePolicyInput): Promise<CustomerGatewayPolicySummary> {
+    const policy = this.summary({
+      id: 'cgp_created',
+      gatewayId: input.gatewayId,
+      lineGroupId: input.lineGroupId,
+      name: input.name,
+      priority: input.priority ?? 3,
+      callerMode: input.callerMode,
+      callerValue: input.callerValue ?? null,
+      calleeMode: input.calleeMode,
+      calleeValue: input.calleeValue ?? null,
+      status: input.status
+    });
+    this.policies.push(policy);
+    this.outboxEvents += 1;
+    return policy;
+  }
+
+  async update(policyId: string, input: UpdatePolicyInput): Promise<CustomerGatewayPolicySummary> {
+    const index = this.policies.findIndex((policy) => policy.id === policyId);
+    const current = this.policies[index] ?? this.summary({ id: policyId, name: 'Missing', priority: 999 });
+    const updated = {
+      ...current,
+      lineGroupId: input.lineGroupId ?? current.lineGroupId,
+      name: input.name ?? current.name,
+      priority: input.priority ?? current.priority,
+      callerMode: input.callerMode ?? current.callerMode,
+      callerValue: input.callerValue === undefined ? current.callerValue : input.callerValue,
+      calleeMode: input.calleeMode ?? current.calleeMode,
+      calleeValue: input.calleeValue === undefined ? current.calleeValue : input.calleeValue,
+      status: input.status ?? current.status
+    };
+    this.policies[index] = updated;
+    this.outboxEvents += 1;
+    return updated;
+  }
+
+  async softDelete(policyId: string): Promise<CustomerGatewayPolicySummary> {
+    const policy = await this.update(policyId, { status: 'DISABLED' });
+    this.policies = this.policies.filter((item) => item.id !== policyId);
+    return policy;
+  }
+
+  async reorder(gatewayId: string, policyIds: string[]): Promise<CustomerGatewayPolicySummary[]> {
+    this.policies = this.policies.map((policy) => {
+      const index = policyIds.indexOf(policy.id);
+      return policy.gatewayId === gatewayId && index >= 0 ? { ...policy, priority: index + 1 } : policy;
+    });
+    this.outboxEvents += 1;
+    return this.list(gatewayId);
+  }
+
+  private summary(input: {
+    id: string;
+    gatewayId?: string;
+    lineGroupId?: string;
+    name: string;
+    priority: number;
+    callerMode?: 'ANY' | 'EQUALS' | 'PREFIX';
+    callerValue?: string | null;
+    calleeMode?: 'ANY' | 'EQUALS' | 'PREFIX';
+    calleeValue?: string | null;
+    status?: 'ENABLED' | 'DISABLED';
+  }): CustomerGatewayPolicySummary {
+    return {
+      id: input.id,
+      customerId: 'cus_seed',
+      gatewayId: input.gatewayId ?? 'cgw_seed',
+      lineGroupId: input.lineGroupId ?? 'lg_seed',
+      name: input.name,
+      priority: input.priority,
+      callerMode: input.callerMode ?? 'ANY',
+      callerValue: input.callerValue ?? null,
+      calleeMode: input.calleeMode ?? 'ANY',
+      calleeValue: input.calleeValue ?? null,
+      status: input.status ?? 'ENABLED',
+      createdAt: new Date('2026-06-21T04:00:00.000Z'),
+      updatedAt: new Date('2026-06-21T04:00:00.000Z')
+    };
+  }
+}
+
+describe('S14 customer gateway policies API', () => {
+  let app: NestFastifyApplication;
+  let audit: MemoryAuditRepository;
+  let repository: MemoryPoliciesRepository;
+
+  const tokenFor = (userId: string) =>
+    signAccessToken(
+      {
+        sub: userId,
+        username: userId,
+        roles: ['test'],
+        typ: 'access'
+      },
+      {
+        secret: 'test-only-access-token-secret-min-32-bytes',
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        ttlSeconds: 900
+      }
+    );
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+    process.env.AUTH_ACCESS_TOKEN_SECRET = 'test-only-access-token-secret-min-32-bytes';
+
+    const identities = new MemoryIdentityRepository();
+    audit = new MemoryAuditRepository();
+    repository = new MemoryPoliciesRepository();
+
+    identities.users.set('usr_ops', {
+      id: 'usr_ops',
+      username: 'ops',
+      roles: ['运营管理员'],
+      permissions: ['customer_gateways.view', 'customer_gateways.manage'] as PermissionKey[]
+    });
+    identities.users.set('usr_viewer', {
+      id: 'usr_viewer',
+      username: 'viewer',
+      roles: ['只读'],
+      permissions: ['customer_gateways.view'] as PermissionKey[]
+    });
+
+    const { AppModule } = await import('../app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({ imports: [AppModule] })
+      .overrideProvider(IDENTITY_REPOSITORY)
+      .useValue(identities)
+      .overrideProvider(AUDIT_REPOSITORY)
+      .useValue(audit)
+      .overrideProvider(CUSTOMER_GATEWAY_POLICIES_REPOSITORY)
+      .useValue(repository)
+      .compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('lists policies ordered by priority for viewers', async () => {
+    const response = await request(app.getHttpServer())
+      .get('/api/v2/customer-gateways/cgw_seed/policies')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .expect(200);
+
+    expect(response.body.map((policy: { id: string }) => policy.id)).toEqual(['cgp_1', 'cgp_2']);
+  });
+
+  it('rejects policy writes without manage permission', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/customer-gateways/cgw_seed/policies')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .send({ lineGroupId: 'lg_seed', name: 'Denied' })
+      .expect(403);
+  });
+
+  it('creates, updates, reorders, and deletes policies with audit and outbox intent', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/customer-gateways/cgw_seed/policies')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({
+        lineGroupId: 'lg_seed',
+        name: 'Callee exact',
+        priority: 3,
+        callerMode: 'ANY',
+        calleeMode: 'EQUALS',
+        calleeValue: '13800138000'
+      })
+      .expect(201)
+      .expect((response) => {
+        expect(response.body).toMatchObject({
+          id: 'cgp_created',
+          calleeMode: 'EQUALS',
+          calleeValue: '13800138000'
+        });
+      });
+
+    await request(app.getHttpServer())
+      .patch('/api/v2/customer-gateway-policies/cgp_created')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ callerMode: 'PREFIX', callerValue: '010' })
+      .expect(200);
+
+    const reordered = await request(app.getHttpServer())
+      .post('/api/v2/customer-gateways/cgw_seed/policies/reorder')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ policyIds: ['cgp_created', 'cgp_2', 'cgp_1'] })
+      .expect(201);
+    expect(reordered.body.map((policy: { id: string }) => policy.id)).toEqual(['cgp_created', 'cgp_2', 'cgp_1']);
+
+    await request(app.getHttpServer()).delete('/api/v2/customer-gateway-policies/cgp_2').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(200);
+
+    expect(repository.outboxEvents).toBeGreaterThanOrEqual(4);
+    expect(audit.entries.some((entry) => entry.module === 'customer_gateways' && entry.action === 'policy_create')).toBe(true);
+    expect(audit.entries.some((entry) => entry.module === 'customer_gateways' && entry.action === 'policy_reorder')).toBe(true);
+  });
+
+  it('validates match values for non-ANY modes', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/customer-gateways/cgw_seed/policies')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ lineGroupId: 'lg_seed', name: 'Invalid', callerMode: 'PREFIX' })
+      .expect(400);
+  });
+});
diff --git a/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.module.ts b/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.module.ts
new file mode 100644
index 0000000..1cc0377
--- /dev/null
+++ b/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { CustomerGatewayPoliciesController } from './customer-gateway-policies.controller.js';
+import { CUSTOMER_GATEWAY_POLICIES_REPOSITORY, PrismaCustomerGatewayPoliciesRepository } from './customer-gateway-policies.repository.js';
+import { CustomerGatewayPoliciesService } from './customer-gateway-policies.service.js';
+
+@Module({
+  controllers: [CustomerGatewayPoliciesController],
+  providers: [
+    CustomerGatewayPoliciesService,
+    {
+      provide: CUSTOMER_GATEWAY_POLICIES_REPOSITORY,
+      useClass: PrismaCustomerGatewayPoliciesRepository
+    }
+  ],
+  exports: [CustomerGatewayPoliciesService]
+})
+export class CustomerGatewayPoliciesModule {}
diff --git a/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.repository.ts b/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.repository.ts
new file mode 100644
index 0000000..242f032
--- /dev/null
+++ b/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.repository.ts
@@ -0,0 +1,290 @@
+import { BadRequestException, ConflictException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export type PolicyStatus = 'ENABLED' | 'DISABLED';
+export type PolicyMatchMode = 'ANY' | 'EQUALS' | 'PREFIX';
+
+export interface CustomerGatewayPolicySummary {
+  id: string;
+  customerId: string;
+  gatewayId: string;
+  lineGroupId: string;
+  name: string;
+  priority: number;
+  callerMode: PolicyMatchMode;
+  callerValue: string | null;
+  calleeMode: PolicyMatchMode;
+  calleeValue: string | null;
+  status: PolicyStatus;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface CreatePolicyInput {
+  gatewayId: string;
+  lineGroupId: string;
+  name: string;
+  priority?: number;
+  callerMode: PolicyMatchMode;
+  callerValue?: string | null;
+  calleeMode: PolicyMatchMode;
+  calleeValue?: string | null;
+  status: PolicyStatus;
+  actorId?: string;
+}
+
+export interface UpdatePolicyInput {
+  lineGroupId?: string;
+  name?: string;
+  priority?: number;
+  callerMode?: PolicyMatchMode;
+  callerValue?: string | null;
+  calleeMode?: PolicyMatchMode;
+  calleeValue?: string | null;
+  status?: PolicyStatus;
+  actorId?: string;
+}
+
+export interface CustomerGatewayPoliciesRepository {
+  list(gatewayId: string): Promise<CustomerGatewayPolicySummary[]>;
+  create(input: CreatePolicyInput): Promise<CustomerGatewayPolicySummary>;
+  update(policyId: string, input: UpdatePolicyInput): Promise<CustomerGatewayPolicySummary>;
+  softDelete(policyId: string, actorId?: string): Promise<CustomerGatewayPolicySummary>;
+  reorder(gatewayId: string, policyIds: string[], actorId?: string): Promise<CustomerGatewayPolicySummary[]>;
+}
+
+export const CUSTOMER_GATEWAY_POLICIES_REPOSITORY = Symbol('CUSTOMER_GATEWAY_POLICIES_REPOSITORY');
+
+function policyId(): string {
+  return `cgp_${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
+}
+
+function outboxId(): string {
+  return `out_${crypto.randomUUID().replaceAll('-', '').slice(0, 36)}`;
+}
+
+@Injectable()
+export class PrismaCustomerGatewayPoliciesRepository implements CustomerGatewayPoliciesRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async list(gatewayId: string): Promise<CustomerGatewayPolicySummary[]> {
+    await this.ensureGateway(gatewayId);
+    const policies = await this.prisma.customerGatewayPolicy.findMany({
+      where: { gatewayId, deletedAt: null },
+      orderBy: [{ priority: 'asc' }]
+    });
+    return policies.map((policy) => this.toSummary(policy));
+  }
+
+  async create(input: CreatePolicyInput): Promise<CustomerGatewayPolicySummary> {
+    const gateway = await this.ensureGateway(input.gatewayId);
+    await this.ensureLineGroup(input.lineGroupId);
+    const priority = input.priority ?? (await this.nextPriority(input.gatewayId));
+
+    try {
+      const created = await this.prisma.$transaction(async (tx) => {
+        const policy = await tx.customerGatewayPolicy.create({
+          data: {
+            id: policyId(),
+            customerId: gateway.customerId,
+            gatewayId: input.gatewayId,
+            lineGroupId: input.lineGroupId,
+            name: input.name,
+            priority,
+            callerMode: input.callerMode,
+            callerValue: input.callerValue,
+            calleeMode: input.calleeMode,
+            calleeValue: input.calleeValue,
+            status: input.status,
+            createdBy: input.actorId,
+            updatedBy: input.actorId
+          }
+        });
+        await this.enqueueConfigOutbox(tx, input.gatewayId, 'customer_gateway_policy.changed');
+        return policy;
+      });
+      return this.toSummary(created);
+    } catch (error) {
+      this.handleUniqueConflict(error);
+      throw error;
+    }
+  }
+
+  async update(policyIdValue: string, input: UpdatePolicyInput): Promise<CustomerGatewayPolicySummary> {
+    const existing = await this.findActiveOrThrow(policyIdValue);
+    if (input.lineGroupId) {
+      await this.ensureLineGroup(input.lineGroupId);
+    }
+
+    try {
+      const updated = await this.prisma.$transaction(async (tx) => {
+        const policy = await tx.customerGatewayPolicy.update({
+          where: { id: policyIdValue },
+          data: {
+            lineGroupId: input.lineGroupId,
+            name: input.name,
+            priority: input.priority,
+            callerMode: input.callerMode,
+            callerValue: input.callerValue,
+            calleeMode: input.calleeMode,
+            calleeValue: input.calleeValue,
+            status: input.status,
+            updatedBy: input.actorId,
+            version: { increment: 1 }
+          }
+        });
+        await this.enqueueConfigOutbox(tx, existing.gatewayId, 'customer_gateway_policy.changed');
+        return policy;
+      });
+      return this.toSummary(updated);
+    } catch (error) {
+      this.handleUniqueConflict(error);
+      throw error;
+    }
+  }
+
+  async softDelete(policyIdValue: string, actorId?: string): Promise<CustomerGatewayPolicySummary> {
+    const existing = await this.findActiveOrThrow(policyIdValue);
+    const deleted = await this.prisma.$transaction(async (tx) => {
+      const policy = await tx.customerGatewayPolicy.update({
+        where: { id: policyIdValue },
+        data: {
+          status: 'DISABLED',
+          deletedAt: new Date(),
+          updatedBy: actorId,
+          version: { increment: 1 }
+        }
+      });
+      await this.enqueueConfigOutbox(tx, existing.gatewayId, 'customer_gateway_policy.changed');
+      return policy;
+    });
+    return this.toSummary(deleted);
+  }
+
+  async reorder(gatewayId: string, policyIds: string[], actorId?: string): Promise<CustomerGatewayPolicySummary[]> {
+    await this.ensureGateway(gatewayId);
+    const current = await this.prisma.customerGatewayPolicy.findMany({
+      where: { gatewayId, deletedAt: null },
+      select: { id: true }
+    });
+    const currentIds = current.map((policy) => policy.id).sort();
+    const requestedIds = [...policyIds].sort();
+    if (currentIds.length !== requestedIds.length || currentIds.some((id, index) => id !== requestedIds[index])) {
+      throw new BadRequestException({ code: 'POLICY_REORDER_SET_MISMATCH', message: 'Reorder must include every active policy exactly once.' });
+    }
+    if (new Set(policyIds).size !== policyIds.length) {
+      throw new BadRequestException({ code: 'POLICY_REORDER_DUPLICATE', message: 'Policy ids must be unique.' });
+    }
+
+    await this.prisma.$transaction(async (tx) => {
+      for (let index = 0; index < policyIds.length; index += 1) {
+        await tx.customerGatewayPolicy.update({
+          where: { id: policyIds[index] },
+          data: {
+            priority: -(index + 1),
+            updatedBy: actorId,
+            version: { increment: 1 }
+          }
+        });
+      }
+      for (let index = 0; index < policyIds.length; index += 1) {
+        await tx.customerGatewayPolicy.update({
+          where: { id: policyIds[index] },
+          data: { priority: index + 1 }
+        });
+      }
+      await this.enqueueConfigOutbox(tx, gatewayId, 'customer_gateway_policy.reordered');
+    });
+
+    return this.list(gatewayId);
+  }
+
+  private async ensureGateway(gatewayId: string): Promise<{ id: string; customerId: string }> {
+    const gateway = await this.prisma.customerGateway.findUnique({
+      where: { id: gatewayId },
+      select: { id: true, customerId: true, deletedAt: true }
+    });
+    if (!gateway || gateway.deletedAt) {
+      throw new NotFoundException({ code: 'CUSTOMER_GATEWAY_NOT_FOUND', message: 'Customer gateway not found.' });
+    }
+    return gateway;
+  }
+
+  private async ensureLineGroup(lineGroupId: string): Promise<void> {
+    const lineGroup = await this.prisma.landingLineGroup.findUnique({
+      where: { id: lineGroupId },
+      select: { id: true, deletedAt: true }
+    });
+    if (!lineGroup || lineGroup.deletedAt) {
+      throw new NotFoundException({ code: 'LINE_GROUP_NOT_FOUND', message: 'Landing line group not found.' });
+    }
+  }
+
+  private async findActiveOrThrow(policyIdValue: string) {
+    const policy = await this.prisma.customerGatewayPolicy.findUnique({ where: { id: policyIdValue } });
+    if (!policy || policy.deletedAt) {
+      throw new NotFoundException({ code: 'CUSTOMER_GATEWAY_POLICY_NOT_FOUND', message: 'Customer gateway policy not found.' });
+    }
+    return policy;
+  }
+
+  private async nextPriority(gatewayId: string): Promise<number> {
+    const aggregate = await this.prisma.customerGatewayPolicy.aggregate({
+      where: { gatewayId, deletedAt: null },
+      _max: { priority: true }
+    });
+    return (aggregate._max.priority ?? 0) + 1;
+  }
+
+  private async enqueueConfigOutbox(tx: Prisma.TransactionClient, gatewayId: string, eventType: string): Promise<void> {
+    await tx.outboxEvent.create({
+      data: {
+        id: outboxId(),
+        aggregateType: 'customer_gateway_config',
+        aggregateId: gatewayId,
+        eventType,
+        payload: { gatewayId, eventType }
+      }
+    });
+  }
+
+  private toSummary(policy: {
+    id: string;
+    customerId: string;
+    gatewayId: string;
+    lineGroupId: string;
+    name: string;
+    priority: number;
+    callerMode: PolicyMatchMode;
+    callerValue: string | null;
+    calleeMode: PolicyMatchMode;
+    calleeValue: string | null;
+    status: PolicyStatus;
+    createdAt: Date;
+    updatedAt: Date;
+  }): CustomerGatewayPolicySummary {
+    return {
+      id: policy.id,
+      customerId: policy.customerId,
+      gatewayId: policy.gatewayId,
+      lineGroupId: policy.lineGroupId,
+      name: policy.name,
+      priority: policy.priority,
+      callerMode: policy.callerMode,
+      callerValue: policy.callerValue,
+      calleeMode: policy.calleeMode,
+      calleeValue: policy.calleeValue,
+      status: policy.status,
+      createdAt: policy.createdAt,
+      updatedAt: policy.updatedAt
+    };
+  }
+
+  private handleUniqueConflict(error: unknown): void {
+    if (error && typeof error === 'object' && 'code' in error && (error as { code?: unknown }).code === 'P2002') {
+      throw new ConflictException({ code: 'CUSTOMER_GATEWAY_POLICY_CONFLICT', message: 'Customer gateway policy priority already exists.' });
+    }
+  }
+}
diff --git a/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.service.ts b/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.service.ts
new file mode 100644
index 0000000..aa72567
--- /dev/null
+++ b/apps/api/src/modules/customer-gateway-policies/customer-gateway-policies.service.ts
@@ -0,0 +1,145 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import {
+  CUSTOMER_GATEWAY_POLICIES_REPOSITORY,
+  type CreatePolicyInput,
+  type CustomerGatewayPoliciesRepository,
+  type CustomerGatewayPolicySummary,
+  type PolicyMatchMode,
+  type PolicyStatus,
+  type UpdatePolicyInput
+} from './customer-gateway-policies.repository.js';
+
+interface CreatePolicyDto {
+  lineGroupId?: unknown;
+  name?: unknown;
+  priority?: unknown;
+  callerMode?: unknown;
+  callerValue?: unknown;
+  calleeMode?: unknown;
+  calleeValue?: unknown;
+  status?: unknown;
+}
+
+interface UpdatePolicyDto {
+  lineGroupId?: unknown;
+  name?: unknown;
+  priority?: unknown;
+  callerMode?: unknown;
+  callerValue?: unknown;
+  calleeMode?: unknown;
+  calleeValue?: unknown;
+  status?: unknown;
+}
+
+interface ReorderDto {
+  policyIds?: unknown;
+}
+
+@Injectable()
+export class CustomerGatewayPoliciesService {
+  constructor(@Inject(CUSTOMER_GATEWAY_POLICIES_REPOSITORY) private readonly policies: CustomerGatewayPoliciesRepository) {}
+
+  list(gatewayId: string): Promise<CustomerGatewayPolicySummary[]> {
+    return this.policies.list(gatewayId);
+  }
+
+  create(gatewayId: string, body: CreatePolicyDto, actorId?: string): Promise<CustomerGatewayPolicySummary> {
+    const callerMode = body.callerMode === undefined ? 'ANY' : this.matchMode(body.callerMode, 'callerMode');
+    const calleeMode = body.calleeMode === undefined ? 'ANY' : this.matchMode(body.calleeMode, 'calleeMode');
+    const input: CreatePolicyInput = {
+      gatewayId,
+      lineGroupId: this.limitedString(body.lineGroupId, 'lineGroupId', 32),
+      name: this.limitedString(body.name, 'name', 120),
+      priority: body.priority === undefined ? undefined : this.priority(body.priority),
+      callerMode,
+      callerValue: this.matchValue(callerMode, body.callerValue, 'callerValue'),
+      calleeMode,
+      calleeValue: this.matchValue(calleeMode, body.calleeValue, 'calleeValue'),
+      status: body.status === undefined ? 'ENABLED' : this.status(body.status),
+      actorId
+    };
+    return this.policies.create(input);
+  }
+
+  update(policyId: string, body: UpdatePolicyDto, actorId?: string): Promise<CustomerGatewayPolicySummary> {
+    const callerMode = body.callerMode === undefined ? undefined : this.matchMode(body.callerMode, 'callerMode');
+    const calleeMode = body.calleeMode === undefined ? undefined : this.matchMode(body.calleeMode, 'calleeMode');
+    const input: UpdatePolicyInput = {
+      lineGroupId: body.lineGroupId === undefined ? undefined : this.limitedString(body.lineGroupId, 'lineGroupId', 32),
+      name: body.name === undefined ? undefined : this.limitedString(body.name, 'name', 120),
+      priority: body.priority === undefined ? undefined : this.priority(body.priority),
+      callerMode,
+      callerValue: callerMode === undefined ? (body.callerValue === undefined ? undefined : this.nullableString(body.callerValue, 'callerValue', 64)) : this.matchValue(callerMode, body.callerValue, 'callerValue'),
+      calleeMode,
+      calleeValue: calleeMode === undefined ? (body.calleeValue === undefined ? undefined : this.nullableString(body.calleeValue, 'calleeValue', 64)) : this.matchValue(calleeMode, body.calleeValue, 'calleeValue'),
+      status: body.status === undefined ? undefined : this.status(body.status),
+      actorId
+    };
+    return this.policies.update(policyId, input);
+  }
+
+  remove(policyId: string, actorId?: string): Promise<CustomerGatewayPolicySummary> {
+    return this.policies.softDelete(policyId, actorId);
+  }
+
+  reorder(gatewayId: string, body: ReorderDto, actorId?: string): Promise<CustomerGatewayPolicySummary[]> {
+    if (!Array.isArray(body.policyIds) || body.policyIds.length === 0) {
+      throw new BadRequestException({ code: 'POLICY_IDS_INVALID', message: 'policyIds must be a non-empty array.' });
+    }
+    return this.policies.reorder(
+      gatewayId,
+      body.policyIds.map((id) => this.limitedString(id, 'policyIds', 32)),
+      actorId
+    );
+  }
+
+  private limitedString(value: unknown, field: string, maxLength: number): string {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is required.` });
+    }
+    const trimmed = value.trim();
+    if (trimmed.length > maxLength) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is too long.` });
+    }
+    return trimmed;
+  }
+
+  private nullableString(value: unknown, field: string, maxLength: number): string | null {
+    if (value === null) {
+      return null;
+    }
+    return this.limitedString(value, field, maxLength);
+  }
+
+  private matchMode(value: unknown, field: string): PolicyMatchMode {
+    if (value !== 'ANY' && value !== 'EQUALS' && value !== 'PREFIX') {
+      throw new BadRequestException({ code: 'MATCH_MODE_INVALID', message: `${field} is invalid.` });
+    }
+    return value;
+  }
+
+  private matchValue(mode: PolicyMatchMode, value: unknown, field: string): string | null {
+    if (mode === 'ANY') {
+      return null;
+    }
+    const text = this.limitedString(value, field, 64);
+    if (!/^[0-9A-Za-z+*#.-]+$/.test(text)) {
+      throw new BadRequestException({ code: 'MATCH_VALUE_INVALID', message: `${field} contains invalid characters.` });
+    }
+    return text;
+  }
+
+  private priority(value: unknown): number {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 1 || value > 10000) {
+      throw new BadRequestException({ code: 'PRIORITY_INVALID', message: 'priority must be an integer from 1 to 10000.' });
+    }
+    return value;
+  }
+
+  private status(value: unknown): PolicyStatus {
+    if (value !== 'ENABLED' && value !== 'DISABLED') {
+      throw new BadRequestException({ code: 'STATUS_INVALID', message: 'Status is invalid.' });
+    }
+    return value;
+  }
+}
diff --git a/apps/api/src/modules/customer-gateways/customer-gateways.controller.ts b/apps/api/src/modules/customer-gateways/customer-gateways.controller.ts
new file mode 100644
index 0000000..3254355
--- /dev/null
+++ b/apps/api/src/modules/customer-gateways/customer-gateways.controller.ts
@@ -0,0 +1,51 @@
+import { Body, Controller, Get, Inject, Param, Patch, Post, Query } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { CustomerGatewaysService } from './customer-gateways.service.js';
+
+@ApiTags('customer-gateways')
+@Controller('customer-gateways')
+export class CustomerGatewaysController {
+  constructor(@Inject(CustomerGatewaysService) private readonly customerGatewaysService: CustomerGatewaysService) {}
+
+  @Get()
+  @RequirePermissions('customer_gateways.view')
+  list(@Query() query: unknown) {
+    return this.customerGatewaysService.list(query as never);
+  }
+
+  @Get(':id')
+  @RequirePermissions('customer_gateways.view')
+  get(@Param('id') id: string) {
+    return this.customerGatewaysService.get(id);
+  }
+
+  @Post()
+  @RequirePermissions('customer_gateways.manage')
+  @AuditAction({ module: 'customer_gateways', action: 'create', objectType: 'customer_gateway' })
+  create(@Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.customerGatewaysService.create(body as never, currentUser?.id);
+  }
+
+  @Patch(':id')
+  @RequirePermissions('customer_gateways.manage')
+  @AuditAction({ module: 'customer_gateways', action: 'update', objectType: 'customer_gateway', objectIdParam: 'id' })
+  update(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.customerGatewaysService.update(id, body as never, currentUser?.id);
+  }
+
+  @Post(':id/enable')
+  @RequirePermissions('customer_gateways.manage')
+  @AuditAction({ module: 'customer_gateways', action: 'enable', objectType: 'customer_gateway', objectIdParam: 'id' })
+  enable(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.customerGatewaysService.enable(id, currentUser?.id);
+  }
+
+  @Post(':id/disable')
+  @RequirePermissions('customer_gateways.manage')
+  @AuditAction({ module: 'customer_gateways', action: 'disable', objectType: 'customer_gateway', objectIdParam: 'id' })
+  disable(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.customerGatewaysService.disable(id, currentUser?.id);
+  }
+}
diff --git a/apps/api/src/modules/customer-gateways/customer-gateways.e2e.spec.ts b/apps/api/src/modules/customer-gateways/customer-gateways.e2e.spec.ts
new file mode 100644
index 0000000..8b19134
--- /dev/null
+++ b/apps/api/src/modules/customer-gateways/customer-gateways.e2e.spec.ts
@@ -0,0 +1,273 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { signAccessToken, type PermissionKey } from '@lisglosips/auth';
+import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from '../audit/audit.repository.js';
+import { IDENTITY_REPOSITORY, type IdentityRepository } from '../security/identity.repository.js';
+import type { CurrentUser } from '../security/security.metadata.js';
+import {
+  CUSTOMER_GATEWAYS_REPOSITORY,
+  type CreateCustomerGatewayInput,
+  type CustomerGatewayStatus,
+  type CustomerGatewaySummary,
+  type CustomerGatewaysRepository,
+  type UpdateCustomerGatewayInput
+} from './customer-gateways.repository.js';
+
+class MemoryIdentityRepository implements IdentityRepository {
+  users = new Map<string, CurrentUser>();
+
+  async findCurrentUserById(userId: string): Promise<CurrentUser | null> {
+    return this.users.get(userId) ?? null;
+  }
+}
+
+class MemoryAuditRepository implements AuditRepository {
+  entries: AuditEntryInput[] = [];
+
+  async write(input: AuditEntryInput): Promise<void> {
+    this.entries.push(input);
+  }
+}
+
+class MemoryCustomerGatewaysRepository implements CustomerGatewaysRepository {
+  private readonly gateways = new Map<string, CustomerGatewaySummary>();
+
+  constructor() {
+    this.gateways.set(
+      'cgw_seed',
+      this.summary({
+        id: 'cgw_seed',
+        customerId: 'cus_seed',
+        name: 'Seed IP Gateway',
+        authMode: 'IP',
+        sourceIp: '100.93.185.30',
+        hasSipCredential: false,
+        policyCount: 1
+      })
+    );
+  }
+
+  async list(customerId?: string): Promise<CustomerGatewaySummary[]> {
+    return [...this.gateways.values()].filter((gateway) => !customerId || gateway.customerId === customerId);
+  }
+
+  async get(gatewayId: string): Promise<CustomerGatewaySummary> {
+    return this.gateways.get(gatewayId) ?? this.summary({ id: gatewayId, name: 'Missing Gateway' });
+  }
+
+  async create(input: CreateCustomerGatewayInput): Promise<CustomerGatewaySummary> {
+    const gateway = this.summary({
+      id: 'cgw_created',
+      customerId: input.customerId,
+      name: input.name,
+      authMode: input.authMode,
+      sourceIp: input.sourceIp ?? null,
+      sipUsername: input.sipUsername ?? null,
+      sipDomain: input.sipDomain ?? null,
+      hasSipCredential: Boolean(input.sipHa1)
+    });
+    this.gateways.set(gateway.id, gateway);
+    return gateway;
+  }
+
+  async update(gatewayId: string, input: UpdateCustomerGatewayInput): Promise<CustomerGatewaySummary> {
+    const current = await this.get(gatewayId);
+    const updated: CustomerGatewaySummary = {
+      ...current,
+      customerId: input.customerId ?? current.customerId,
+      name: input.name ?? current.name,
+      authMode: input.authMode ?? current.authMode,
+      sourceIp: input.sourceIp === undefined ? current.sourceIp : input.sourceIp,
+      sipUsername: input.sipUsername === undefined ? current.sipUsername : input.sipUsername,
+      sipDomain: input.sipDomain === undefined ? current.sipDomain : input.sipDomain,
+      hasSipCredential: input.sipHa1 === undefined ? current.hasSipCredential : Boolean(input.sipHa1),
+      updatedAt: new Date('2026-06-21T03:00:00.000Z')
+    };
+    this.gateways.set(gatewayId, updated);
+    return updated;
+  }
+
+  async setStatus(gatewayId: string, status: CustomerGatewayStatus): Promise<CustomerGatewaySummary> {
+    const current = await this.get(gatewayId);
+    const updated = { ...current, status };
+    this.gateways.set(gatewayId, updated);
+    return updated;
+  }
+
+  private summary(input: {
+    id: string;
+    customerId?: string;
+    name: string;
+    authMode?: 'IP' | 'SIP_DIGEST' | 'MIXED';
+    sourceIp?: string | null;
+    sipUsername?: string | null;
+    sipDomain?: string | null;
+    hasSipCredential?: boolean;
+    status?: CustomerGatewayStatus;
+    policyCount?: number;
+  }): CustomerGatewaySummary {
+    return {
+      id: input.id,
+      customerId: input.customerId ?? 'cus_seed',
+      customerName: 'Seed Customer',
+      name: input.name,
+      authMode: input.authMode ?? 'IP',
+      sourceIp: input.sourceIp ?? null,
+      sipUsername: input.sipUsername ?? null,
+      sipDomain: input.sipDomain ?? null,
+      hasSipCredential: input.hasSipCredential ?? false,
+      status: input.status ?? 'ENABLED',
+      policyCount: input.policyCount ?? 0,
+      createdAt: new Date('2026-06-21T02:30:00.000Z'),
+      updatedAt: new Date('2026-06-21T02:30:00.000Z')
+    };
+  }
+}
+
+describe('S13 customer gateways API', () => {
+  let app: NestFastifyApplication;
+  let audit: MemoryAuditRepository;
+
+  const tokenFor = (userId: string) =>
+    signAccessToken(
+      {
+        sub: userId,
+        username: userId,
+        roles: ['test'],
+        typ: 'access'
+      },
+      {
+        secret: 'test-only-access-token-secret-min-32-bytes',
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        ttlSeconds: 900
+      }
+    );
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+    process.env.AUTH_ACCESS_TOKEN_SECRET = 'test-only-access-token-secret-min-32-bytes';
+
+    const identities = new MemoryIdentityRepository();
+    audit = new MemoryAuditRepository();
+
+    identities.users.set('usr_ops', {
+      id: 'usr_ops',
+      username: 'ops',
+      roles: ['运营管理员'],
+      permissions: ['customer_gateways.view', 'customer_gateways.manage'] as PermissionKey[]
+    });
+    identities.users.set('usr_viewer', {
+      id: 'usr_viewer',
+      username: 'viewer',
+      roles: ['只读'],
+      permissions: ['customer_gateways.view'] as PermissionKey[]
+    });
+
+    const { AppModule } = await import('../app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule]
+    })
+      .overrideProvider(IDENTITY_REPOSITORY)
+      .useValue(identities)
+      .overrideProvider(AUDIT_REPOSITORY)
+      .useValue(audit)
+      .overrideProvider(CUSTOMER_GATEWAYS_REPOSITORY)
+      .useValue(new MemoryCustomerGatewaysRepository())
+      .compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('lists gateways without exposing SIP secrets', async () => {
+    const response = await request(app.getHttpServer())
+      .get('/api/v2/customer-gateways?customerId=cus_seed')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .expect(200);
+
+    expect(response.body[0]).toMatchObject({
+      id: 'cgw_seed',
+      authMode: 'IP',
+      sourceIp: '100.93.185.30',
+      policyCount: 1
+    });
+    expect(JSON.stringify(response.body)).not.toContain('sipPassword');
+    expect(JSON.stringify(response.body)).not.toContain('sipHa1');
+  });
+
+  it('rejects writes without customer_gateways.manage', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/customer-gateways')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .send({ customerId: 'cus_seed', name: 'Denied', authMode: 'IP', sourceIp: '100.93.185.31' })
+      .expect(403);
+  });
+
+  it('creates SIP digest gateway, hides the password, and writes audit', async () => {
+    const response = await request(app.getHttpServer())
+      .post('/api/v2/customer-gateways')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({
+        customerId: 'cus_seed',
+        name: 'SIP Digest Gateway',
+        authMode: 'SIP_DIGEST',
+        sipUsername: 'alice-gw',
+        sipDomain: 'SIP.EXAMPLE.LOCAL',
+        sipPassword: 'change-me-very-strong'
+      })
+      .expect(201);
+
+    expect(response.body).toMatchObject({
+      id: 'cgw_created',
+      authMode: 'SIP_DIGEST',
+      sipUsername: 'alice-gw',
+      sipDomain: 'sip.example.local',
+      sourceIp: null,
+      hasSipCredential: true
+    });
+    expect(response.body.sipPassword).toBeUndefined();
+    expect(response.body.sipHa1).toBeUndefined();
+    expect(audit.entries.some((entry) => entry.module === 'customer_gateways' && entry.action === 'create' && entry.result === 'SUCCESS')).toBe(true);
+    expect(JSON.stringify(audit.entries)).not.toContain('change-me-very-strong');
+  });
+
+  it('requires a new SIP password when SIP identity changes', async () => {
+    await request(app.getHttpServer())
+      .patch('/api/v2/customer-gateways/cgw_created')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ sipDomain: 'new.example.local' })
+      .expect(400);
+  });
+
+  it('switches to IP auth and supports enable/disable', async () => {
+    await request(app.getHttpServer())
+      .patch('/api/v2/customer-gateways/cgw_created')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ authMode: 'IP', sourceIp: '100.93.185.32' })
+      .expect(200)
+      .expect((response) => {
+        expect(response.body).toMatchObject({
+          authMode: 'IP',
+          sourceIp: '100.93.185.32',
+          sipUsername: null,
+          sipDomain: null,
+          hasSipCredential: false
+        });
+      });
+
+    await request(app.getHttpServer()).post('/api/v2/customer-gateways/cgw_created/disable').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(201);
+    await request(app.getHttpServer()).post('/api/v2/customer-gateways/cgw_created/enable').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(201);
+  });
+});
diff --git a/apps/api/src/modules/customer-gateways/customer-gateways.module.ts b/apps/api/src/modules/customer-gateways/customer-gateways.module.ts
new file mode 100644
index 0000000..05dd977
--- /dev/null
+++ b/apps/api/src/modules/customer-gateways/customer-gateways.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { CustomerGatewaysController } from './customer-gateways.controller.js';
+import { CUSTOMER_GATEWAYS_REPOSITORY, PrismaCustomerGatewaysRepository } from './customer-gateways.repository.js';
+import { CustomerGatewaysService } from './customer-gateways.service.js';
+
+@Module({
+  controllers: [CustomerGatewaysController],
+  providers: [
+    CustomerGatewaysService,
+    {
+      provide: CUSTOMER_GATEWAYS_REPOSITORY,
+      useClass: PrismaCustomerGatewaysRepository
+    }
+  ],
+  exports: [CustomerGatewaysService]
+})
+export class CustomerGatewaysModule {}
diff --git a/apps/api/src/modules/customer-gateways/customer-gateways.repository.ts b/apps/api/src/modules/customer-gateways/customer-gateways.repository.ts
new file mode 100644
index 0000000..28a329d
--- /dev/null
+++ b/apps/api/src/modules/customer-gateways/customer-gateways.repository.ts
@@ -0,0 +1,265 @@
+import { ConflictException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export type CustomerGatewayStatus = 'ENABLED' | 'DISABLED';
+export type CustomerGatewayAuthMode = 'IP' | 'SIP_DIGEST' | 'MIXED';
+
+export interface CustomerGatewaySummary {
+  id: string;
+  customerId: string;
+  customerName: string;
+  name: string;
+  authMode: CustomerGatewayAuthMode;
+  sourceIp: string | null;
+  sipUsername: string | null;
+  sipDomain: string | null;
+  hasSipCredential: boolean;
+  status: CustomerGatewayStatus;
+  policyCount: number;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface CreateCustomerGatewayInput {
+  customerId: string;
+  name: string;
+  authMode: CustomerGatewayAuthMode;
+  sourceIp?: string | null;
+  sipUsername?: string | null;
+  sipDomain?: string | null;
+  sipHa1?: string;
+  actorId?: string;
+}
+
+export interface UpdateCustomerGatewayInput {
+  customerId?: string;
+  name?: string;
+  authMode?: CustomerGatewayAuthMode;
+  sourceIp?: string | null;
+  sipUsername?: string | null;
+  sipDomain?: string | null;
+  sipHa1?: string | null;
+  actorId?: string;
+}
+
+export interface CustomerGatewaysRepository {
+  list(customerId?: string): Promise<CustomerGatewaySummary[]>;
+  get(gatewayId: string): Promise<CustomerGatewaySummary>;
+  create(input: CreateCustomerGatewayInput): Promise<CustomerGatewaySummary>;
+  update(gatewayId: string, input: UpdateCustomerGatewayInput): Promise<CustomerGatewaySummary>;
+  setStatus(gatewayId: string, status: CustomerGatewayStatus, actorId?: string): Promise<CustomerGatewaySummary>;
+}
+
+export const CUSTOMER_GATEWAYS_REPOSITORY = Symbol('CUSTOMER_GATEWAYS_REPOSITORY');
+
+function gatewayId(): string {
+  return `cgw_${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
+}
+
+function outboxId(): string {
+  return `out_${crypto.randomUUID().replaceAll('-', '').slice(0, 36)}`;
+}
+
+@Injectable()
+export class PrismaCustomerGatewaysRepository implements CustomerGatewaysRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async list(customerId?: string): Promise<CustomerGatewaySummary[]> {
+    const gateways = await this.prisma.customerGateway.findMany({
+      where: {
+        deletedAt: null,
+        customerId
+      },
+      orderBy: [{ createdAt: 'desc' }],
+      include: this.includeSummary()
+    });
+
+    return gateways.map((gateway) => this.toSummary(gateway));
+  }
+
+  async get(gatewayIdValue: string): Promise<CustomerGatewaySummary> {
+    return this.toSummary(await this.findActiveOrThrow(gatewayIdValue));
+  }
+
+  async create(input: CreateCustomerGatewayInput): Promise<CustomerGatewaySummary> {
+    await this.ensureCustomerExists(input.customerId);
+
+    try {
+      const gateway = await this.prisma.$transaction(async (tx) => {
+        const created = await tx.customerGateway.create({
+          data: {
+            id: gatewayId(),
+            customerId: input.customerId,
+            name: input.name,
+            authMode: input.authMode,
+            sourceIp: input.sourceIp,
+            sipUsername: input.sipUsername,
+            sipDomain: input.sipDomain,
+            sipHa1: input.sipHa1,
+            createdBy: input.actorId,
+            updatedBy: input.actorId
+          },
+          include: this.includeSummary()
+        });
+        await this.enqueueConfigOutbox(tx, created.id, 'customer_gateway.changed');
+        return created;
+      });
+
+      return this.toSummary(gateway);
+    } catch (error) {
+      this.handleUniqueConflict(error);
+      throw error;
+    }
+  }
+
+  async update(gatewayIdValue: string, input: UpdateCustomerGatewayInput): Promise<CustomerGatewaySummary> {
+    await this.findActiveOrThrow(gatewayIdValue);
+    if (input.customerId) {
+      await this.ensureCustomerExists(input.customerId);
+    }
+
+    try {
+      const gateway = await this.prisma.$transaction(async (tx) => {
+        const updated = await tx.customerGateway.update({
+          where: { id: gatewayIdValue },
+          data: {
+            customerId: input.customerId,
+            name: input.name,
+            authMode: input.authMode,
+            sourceIp: input.sourceIp,
+            sipUsername: input.sipUsername,
+            sipDomain: input.sipDomain,
+            sipHa1: input.sipHa1,
+            updatedBy: input.actorId,
+            version: { increment: 1 }
+          },
+          include: this.includeSummary()
+        });
+        await this.enqueueConfigOutbox(tx, updated.id, 'customer_gateway.changed');
+        return updated;
+      });
+
+      return this.toSummary(gateway);
+    } catch (error) {
+      this.handleUniqueConflict(error);
+      throw error;
+    }
+  }
+
+  async setStatus(gatewayIdValue: string, status: CustomerGatewayStatus, actorId?: string): Promise<CustomerGatewaySummary> {
+    await this.findActiveOrThrow(gatewayIdValue);
+
+    const gateway = await this.prisma.$transaction(async (tx) => {
+      const updated = await tx.customerGateway.update({
+        where: { id: gatewayIdValue },
+        data: {
+          status,
+          updatedBy: actorId,
+          version: { increment: 1 }
+        },
+        include: this.includeSummary()
+      });
+      await this.enqueueConfigOutbox(tx, updated.id, 'customer_gateway.changed');
+      return updated;
+    });
+
+    return this.toSummary(gateway);
+  }
+
+  private async enqueueConfigOutbox(tx: Prisma.TransactionClient, aggregateId: string, eventType: string): Promise<void> {
+    await tx.outboxEvent.create({
+      data: {
+        id: outboxId(),
+        aggregateType: 'customer_gateway_config',
+        aggregateId,
+        eventType,
+        payload: {
+          aggregateId,
+          eventType
+        }
+      }
+    });
+  }
+
+  private async ensureCustomerExists(customerId: string): Promise<void> {
+    const customer = await this.prisma.customer.findUnique({
+      where: { id: customerId },
+      select: { id: true, deletedAt: true }
+    });
+
+    if (!customer || customer.deletedAt) {
+      throw new NotFoundException({ code: 'CUSTOMER_NOT_FOUND', message: 'Customer not found.' });
+    }
+  }
+
+  private async findActiveOrThrow(gatewayIdValue: string) {
+    const gateway = await this.prisma.customerGateway.findUnique({
+      where: { id: gatewayIdValue },
+      include: this.includeSummary()
+    });
+
+    if (!gateway || gateway.deletedAt) {
+      throw new NotFoundException({ code: 'CUSTOMER_GATEWAY_NOT_FOUND', message: 'Customer gateway not found.' });
+    }
+
+    return gateway;
+  }
+
+  private includeSummary() {
+    return {
+      customer: {
+        select: {
+          id: true,
+          name: true
+        }
+      },
+      _count: {
+        select: {
+          policies: {
+            where: { deletedAt: null }
+          }
+        }
+      }
+    } satisfies Prisma.CustomerGatewayInclude;
+  }
+
+  private toSummary(gateway: {
+    id: string;
+    customerId: string;
+    name: string;
+    authMode: CustomerGatewayAuthMode;
+    sourceIp: string | null;
+    sipUsername: string | null;
+    sipDomain: string | null;
+    sipHa1: string | null;
+    status: CustomerGatewayStatus;
+    createdAt: Date;
+    updatedAt: Date;
+    customer: { name: string };
+    _count: { policies: number };
+  }): CustomerGatewaySummary {
+    return {
+      id: gateway.id,
+      customerId: gateway.customerId,
+      customerName: gateway.customer.name,
+      name: gateway.name,
+      authMode: gateway.authMode,
+      sourceIp: gateway.sourceIp,
+      sipUsername: gateway.sipUsername,
+      sipDomain: gateway.sipDomain,
+      hasSipCredential: Boolean(gateway.sipHa1),
+      status: gateway.status,
+      policyCount: gateway._count.policies,
+      createdAt: gateway.createdAt,
+      updatedAt: gateway.updatedAt
+    };
+  }
+
+  private handleUniqueConflict(error: unknown): void {
+    if (error && typeof error === 'object' && 'code' in error && (error as { code?: unknown }).code === 'P2002') {
+      throw new ConflictException({ code: 'CUSTOMER_GATEWAY_CONFLICT', message: 'Customer gateway name or SIP identity already exists.' });
+    }
+  }
+}
diff --git a/apps/api/src/modules/customer-gateways/customer-gateways.service.ts b/apps/api/src/modules/customer-gateways/customer-gateways.service.ts
new file mode 100644
index 0000000..87697de
--- /dev/null
+++ b/apps/api/src/modules/customer-gateways/customer-gateways.service.ts
@@ -0,0 +1,196 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import crypto from 'node:crypto';
+import net from 'node:net';
+import {
+  CUSTOMER_GATEWAYS_REPOSITORY,
+  type CreateCustomerGatewayInput,
+  type CustomerGatewayAuthMode,
+  type CustomerGatewaySummary,
+  type CustomerGatewaysRepository,
+  type UpdateCustomerGatewayInput
+} from './customer-gateways.repository.js';
+
+interface CreateCustomerGatewayDto {
+  customerId?: unknown;
+  name?: unknown;
+  authMode?: unknown;
+  sourceIp?: unknown;
+  sipUsername?: unknown;
+  sipDomain?: unknown;
+  sipPassword?: unknown;
+}
+
+interface UpdateCustomerGatewayDto {
+  customerId?: unknown;
+  name?: unknown;
+  authMode?: unknown;
+  sourceIp?: unknown;
+  sipUsername?: unknown;
+  sipDomain?: unknown;
+  sipPassword?: unknown;
+}
+
+@Injectable()
+export class CustomerGatewaysService {
+  constructor(@Inject(CUSTOMER_GATEWAYS_REPOSITORY) private readonly gateways: CustomerGatewaysRepository) {}
+
+  list(query: { customerId?: unknown } = {}): Promise<CustomerGatewaySummary[]> {
+    const customerId = query.customerId === undefined ? undefined : this.limitedString(query.customerId, 'customerId', 32);
+    return this.gateways.list(customerId);
+  }
+
+  get(gatewayId: string): Promise<CustomerGatewaySummary> {
+    return this.gateways.get(gatewayId);
+  }
+
+  create(body: CreateCustomerGatewayDto, actorId?: string): Promise<CustomerGatewaySummary> {
+    const authMode = this.authMode(body.authMode);
+    const sipIdentity = this.normalizeSipIdentity(authMode, body.sipUsername, body.sipDomain);
+    const sipPassword = this.requiredSipPassword(authMode, body.sipPassword);
+    const input: CreateCustomerGatewayInput = {
+      customerId: this.limitedString(body.customerId, 'customerId', 32),
+      name: this.limitedString(body.name, 'name', 120),
+      authMode,
+      sourceIp: this.normalizeSourceIp(authMode, body.sourceIp),
+      sipUsername: sipIdentity.sipUsername,
+      sipDomain: sipIdentity.sipDomain,
+      sipHa1: sipPassword ? this.sipHa1(sipIdentity.sipUsername, sipIdentity.sipDomain, sipPassword) : undefined,
+      actorId
+    };
+
+    return this.gateways.create(input);
+  }
+
+  async update(gatewayId: string, body: UpdateCustomerGatewayDto, actorId?: string): Promise<CustomerGatewaySummary> {
+    const current = await this.gateways.get(gatewayId);
+    const authMode = body.authMode === undefined ? current.authMode : this.authMode(body.authMode);
+    const requestedSipUsername = body.sipUsername === undefined ? current.sipUsername : this.nullableString(body.sipUsername, 'sipUsername', 120);
+    const requestedSipDomain = body.sipDomain === undefined ? current.sipDomain : this.nullableString(body.sipDomain, 'sipDomain', 160);
+    const sipIdentity = this.normalizeSipIdentity(authMode, requestedSipUsername, requestedSipDomain);
+    const sourceIp = body.sourceIp === undefined ? current.sourceIp : this.nullableString(body.sourceIp, 'sourceIp', 45);
+    const normalizedSourceIp = this.normalizeSourceIp(authMode, sourceIp);
+    const password = body.sipPassword === undefined ? undefined : this.requiredSipPassword(authMode, body.sipPassword);
+
+    if (this.requiresSip(authMode)) {
+      const identityChanged = sipIdentity.sipUsername !== current.sipUsername || sipIdentity.sipDomain !== current.sipDomain;
+      if (!password && (identityChanged || !current.hasSipCredential)) {
+        throw new BadRequestException({
+          code: 'SIP_PASSWORD_REQUIRED',
+          message: 'sipPassword is required when creating or changing SIP identity.'
+        });
+      }
+    }
+
+    const input: UpdateCustomerGatewayInput = {
+      customerId: body.customerId === undefined ? undefined : this.limitedString(body.customerId, 'customerId', 32),
+      name: body.name === undefined ? undefined : this.limitedString(body.name, 'name', 120),
+      authMode,
+      sourceIp: normalizedSourceIp,
+      sipUsername: sipIdentity.sipUsername,
+      sipDomain: sipIdentity.sipDomain,
+      sipHa1: password ? this.sipHa1(sipIdentity.sipUsername, sipIdentity.sipDomain, password) : authMode === 'IP' ? null : undefined,
+      actorId
+    };
+
+    return this.gateways.update(gatewayId, input);
+  }
+
+  enable(gatewayId: string, actorId?: string): Promise<CustomerGatewaySummary> {
+    return this.gateways.setStatus(gatewayId, 'ENABLED', actorId);
+  }
+
+  disable(gatewayId: string, actorId?: string): Promise<CustomerGatewaySummary> {
+    return this.gateways.setStatus(gatewayId, 'DISABLED', actorId);
+  }
+
+  private limitedString(value: unknown, field: string, maxLength: number): string {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is required.` });
+    }
+
+    const trimmed = value.trim();
+    if (trimmed.length > maxLength) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is too long.` });
+    }
+
+    return trimmed;
+  }
+
+  private nullableString(value: unknown, field: string, maxLength: number): string | null {
+    if (value === null) {
+      return null;
+    }
+
+    return this.limitedString(value, field, maxLength);
+  }
+
+  private authMode(value: unknown): CustomerGatewayAuthMode {
+    if (value !== 'IP' && value !== 'SIP_DIGEST' && value !== 'MIXED') {
+      throw new BadRequestException({ code: 'AUTH_MODE_INVALID', message: 'Auth mode is invalid.' });
+    }
+
+    return value;
+  }
+
+  private normalizeSourceIp(authMode: CustomerGatewayAuthMode, value: unknown): string | null {
+    if (!this.requiresIp(authMode)) {
+      return null;
+    }
+
+    const sourceIp = this.limitedString(value, 'sourceIp', 45);
+    if (net.isIP(sourceIp) === 0) {
+      throw new BadRequestException({ code: 'SOURCE_IP_INVALID', message: 'sourceIp must be an IPv4 or IPv6 address.' });
+    }
+
+    return sourceIp;
+  }
+
+  private normalizeSipIdentity(authMode: CustomerGatewayAuthMode, usernameValue: unknown, domainValue: unknown) {
+    if (!this.requiresSip(authMode)) {
+      return {
+        sipUsername: null,
+        sipDomain: null
+      };
+    }
+
+    const sipUsername = this.limitedString(usernameValue, 'sipUsername', 120);
+    const sipDomain = this.limitedString(domainValue, 'sipDomain', 160).toLowerCase();
+    if (!/^[A-Za-z0-9_.:+-]+$/.test(sipUsername)) {
+      throw new BadRequestException({ code: 'SIP_USERNAME_INVALID', message: 'sipUsername contains invalid characters.' });
+    }
+    if (!/^[A-Za-z0-9.-]+$/.test(sipDomain)) {
+      throw new BadRequestException({ code: 'SIP_DOMAIN_INVALID', message: 'sipDomain contains invalid characters.' });
+    }
+
+    return { sipUsername, sipDomain };
+  }
+
+  private requiredSipPassword(authMode: CustomerGatewayAuthMode, value: unknown): string | undefined {
+    if (!this.requiresSip(authMode)) {
+      return undefined;
+    }
+
+    const password = this.limitedString(value, 'sipPassword', 128);
+    if (password.length < 12) {
+      throw new BadRequestException({ code: 'SIP_PASSWORD_WEAK', message: 'sipPassword must be at least 12 characters.' });
+    }
+
+    return password;
+  }
+
+  private sipHa1(username: string | null, domain: string | null, password: string): string {
+    if (!username || !domain) {
+      throw new BadRequestException({ code: 'SIP_IDENTITY_REQUIRED', message: 'SIP identity is required.' });
+    }
+
+    return crypto.createHash('md5').update(`${username}:${domain}:${password}`, 'utf8').digest('hex');
+  }
+
+  private requiresIp(authMode: CustomerGatewayAuthMode): boolean {
+    return authMode === 'IP' || authMode === 'MIXED';
+  }
+
+  private requiresSip(authMode: CustomerGatewayAuthMode): boolean {
+    return authMode === 'SIP_DIGEST' || authMode === 'MIXED';
+  }
+}
diff --git a/apps/api/src/modules/customers/customers.controller.ts b/apps/api/src/modules/customers/customers.controller.ts
new file mode 100644
index 0000000..b74610a
--- /dev/null
+++ b/apps/api/src/modules/customers/customers.controller.ts
@@ -0,0 +1,58 @@
+import { Body, Controller, Delete, Get, Inject, Param, Patch, Post } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { CustomersService } from './customers.service.js';
+
+@ApiTags('customers')
+@Controller('customers')
+export class CustomersController {
+  constructor(@Inject(CustomersService) private readonly customersService: CustomersService) {}
+
+  @Get()
+  @RequirePermissions('customers.view')
+  list() {
+    return this.customersService.list();
+  }
+
+  @Get(':id')
+  @RequirePermissions('customers.view')
+  get(@Param('id') id: string) {
+    return this.customersService.get(id);
+  }
+
+  @Post()
+  @RequirePermissions('customers.manage')
+  @AuditAction({ module: 'customers', action: 'create', objectType: 'customer' })
+  create(@Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.customersService.create(body as never, currentUser?.id);
+  }
+
+  @Patch(':id')
+  @RequirePermissions('customers.manage')
+  @AuditAction({ module: 'customers', action: 'update', objectType: 'customer', objectIdParam: 'id' })
+  update(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.customersService.update(id, body as never, currentUser?.id);
+  }
+
+  @Post(':id/enable')
+  @RequirePermissions('customers.manage')
+  @AuditAction({ module: 'customers', action: 'enable', objectType: 'customer', objectIdParam: 'id' })
+  enable(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.customersService.enable(id, currentUser?.id);
+  }
+
+  @Post(':id/disable')
+  @RequirePermissions('customers.manage')
+  @AuditAction({ module: 'customers', action: 'disable', objectType: 'customer', objectIdParam: 'id' })
+  disable(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.customersService.disable(id, currentUser?.id);
+  }
+
+  @Delete(':id')
+  @RequirePermissions('customers.manage')
+  @AuditAction({ module: 'customers', action: 'delete', objectType: 'customer', objectIdParam: 'id' })
+  remove(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.customersService.remove(id, currentUser?.id);
+  }
+}
diff --git a/apps/api/src/modules/customers/customers.e2e.spec.ts b/apps/api/src/modules/customers/customers.e2e.spec.ts
new file mode 100644
index 0000000..ff907ae
--- /dev/null
+++ b/apps/api/src/modules/customers/customers.e2e.spec.ts
@@ -0,0 +1,256 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { signAccessToken, type PermissionKey } from '@lisglosips/auth';
+import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from '../audit/audit.repository.js';
+import { IDENTITY_REPOSITORY, type IdentityRepository } from '../security/identity.repository.js';
+import type { CurrentUser } from '../security/security.metadata.js';
+import {
+  CUSTOMERS_REPOSITORY,
+  type CreateCustomerInput,
+  type CustomerStatus,
+  type CustomerSummary,
+  type CustomersRepository,
+  type UpdateCustomerInput
+} from './customers.repository.js';
+
+class MemoryIdentityRepository implements IdentityRepository {
+  users = new Map<string, CurrentUser>();
+
+  async findCurrentUserById(userId: string): Promise<CurrentUser | null> {
+    return this.users.get(userId) ?? null;
+  }
+}
+
+class MemoryAuditRepository implements AuditRepository {
+  entries: AuditEntryInput[] = [];
+
+  async write(input: AuditEntryInput): Promise<void> {
+    this.entries.push(input);
+  }
+}
+
+class MemoryCustomersRepository implements CustomersRepository {
+  private readonly customers = new Map<string, CustomerSummary>();
+
+  constructor() {
+    this.customers.set(
+      'cus_seed',
+      this.summary({
+        id: 'cus_seed',
+        name: 'Seed Customer',
+        status: 'ENABLED',
+        creditLimit: '100.000000',
+        minBalance: '5.000000',
+        gatewayCount: 2
+      })
+    );
+  }
+
+  async list(): Promise<CustomerSummary[]> {
+    return [...this.customers.values()];
+  }
+
+  async get(customerId: string): Promise<CustomerSummary> {
+    return this.customers.get(customerId) ?? this.summary({ id: customerId, name: 'Missing' });
+  }
+
+  async create(input: CreateCustomerInput): Promise<CustomerSummary> {
+    const customer = this.summary({
+      id: 'cus_created',
+      name: input.name,
+      contactName: input.contactName ?? null,
+      phone: input.phone ?? null,
+      email: input.email ?? null,
+      domain: input.domain ?? null,
+      status: input.status ?? 'ENABLED',
+      billingMode: input.billingMode,
+      creditLimit: input.creditLimit,
+      minBalance: input.minBalance,
+      notes: input.notes ?? null
+    });
+    this.customers.set(customer.id, customer);
+    return customer;
+  }
+
+  async update(customerId: string, input: UpdateCustomerInput): Promise<CustomerSummary> {
+    const current = this.customers.get(customerId) ?? this.summary({ id: customerId, name: 'Updated Customer' });
+    const updated: CustomerSummary = {
+      ...current,
+      name: input.name ?? current.name,
+      contactName: input.contactName === undefined ? current.contactName : input.contactName,
+      phone: input.phone === undefined ? current.phone : input.phone,
+      email: input.email === undefined ? current.email : input.email,
+      domain: input.domain === undefined ? current.domain : input.domain,
+      status: input.status ?? current.status,
+      billingMode: input.billingMode ?? current.billingMode,
+      creditLimit: input.creditLimit ?? current.creditLimit,
+      minBalance: input.minBalance ?? current.minBalance,
+      notes: input.notes === undefined ? current.notes : input.notes,
+      updatedAt: new Date('2026-06-21T01:00:00.000Z')
+    };
+    this.customers.set(customerId, updated);
+    return updated;
+  }
+
+  async setStatus(customerId: string, status: CustomerStatus): Promise<CustomerSummary> {
+    return this.update(customerId, { status });
+  }
+
+  async softDelete(customerId: string): Promise<CustomerSummary> {
+    return this.update(customerId, { status: 'DISABLED' });
+  }
+
+  private summary(input: {
+    id: string;
+    name: string;
+    contactName?: string | null;
+    phone?: string | null;
+    email?: string | null;
+    domain?: string | null;
+    status?: CustomerStatus;
+    billingMode?: 'PREPAID' | 'POSTPAID';
+    creditLimit?: string;
+    minBalance?: string;
+    notes?: string | null;
+    gatewayCount?: number;
+  }): CustomerSummary {
+    return {
+      id: input.id,
+      name: input.name,
+      contactName: input.contactName ?? null,
+      phone: input.phone ?? null,
+      email: input.email ?? null,
+      domain: input.domain ?? null,
+      status: input.status ?? 'ENABLED',
+      billingMode: input.billingMode ?? 'PREPAID',
+      balance: '10.000000',
+      creditLimit: input.creditLimit ?? '0.000000',
+      minBalance: input.minBalance ?? '0.000000',
+      availableBalance: (10 + Number(input.creditLimit ?? '0')).toFixed(6),
+      notes: input.notes ?? null,
+      gatewayCount: input.gatewayCount ?? 0,
+      createdAt: new Date('2026-06-21T00:00:00.000Z'),
+      updatedAt: new Date('2026-06-21T00:00:00.000Z')
+    };
+  }
+}
+
+describe('S11 customers API', () => {
+  let app: NestFastifyApplication;
+  let audit: MemoryAuditRepository;
+
+  const tokenFor = (userId: string) =>
+    signAccessToken(
+      {
+        sub: userId,
+        username: userId,
+        roles: ['test'],
+        typ: 'access'
+      },
+      {
+        secret: 'test-only-access-token-secret-min-32-bytes',
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        ttlSeconds: 900
+      }
+    );
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+    process.env.AUTH_ACCESS_TOKEN_SECRET = 'test-only-access-token-secret-min-32-bytes';
+
+    const identities = new MemoryIdentityRepository();
+    audit = new MemoryAuditRepository();
+
+    identities.users.set('usr_admin', {
+      id: 'usr_admin',
+      username: 'admin',
+      roles: ['超级管理员'],
+      permissions: ['customers.view', 'customers.manage', 'audit.view'] as PermissionKey[]
+    });
+    identities.users.set('usr_readonly', {
+      id: 'usr_readonly',
+      username: 'readonly',
+      roles: ['只读'],
+      permissions: ['customers.view'] as PermissionKey[]
+    });
+
+    const { AppModule } = await import('../app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule]
+    })
+      .overrideProvider(IDENTITY_REPOSITORY)
+      .useValue(identities)
+      .overrideProvider(AUDIT_REPOSITORY)
+      .useValue(audit)
+      .overrideProvider(CUSTOMERS_REPOSITORY)
+      .useValue(new MemoryCustomersRepository())
+      .compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('returns customer balance, credit, and gateway count to viewers', async () => {
+    const response = await request(app.getHttpServer()).get('/api/v2/customers').set('Authorization', `Bearer ${tokenFor('usr_readonly')}`).expect(200);
+
+    expect(response.body[0]).toMatchObject({
+      id: 'cus_seed',
+      balance: '10.000000',
+      creditLimit: '100.000000',
+      minBalance: '5.000000',
+      availableBalance: '110.000000',
+      gatewayCount: 2
+    });
+  });
+
+  it('rejects write operations without customers.manage', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/customers')
+      .set('Authorization', `Bearer ${tokenFor('usr_readonly')}`)
+      .send({ name: 'Rejected Customer' })
+      .expect(403);
+  });
+
+  it('creates, disables, enables, and soft deletes customers with audit entries', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/customers')
+      .set('Authorization', `Bearer ${tokenFor('usr_admin')}`)
+      .send({
+        name: 'Acme Telecom',
+        contactName: 'Ops',
+        creditLimit: '88.5',
+        minBalance: '2.25',
+        billingMode: 'POSTPAID'
+      })
+      .expect(201)
+      .expect((response) => {
+        expect(response.body).toMatchObject({
+          id: 'cus_created',
+          name: 'Acme Telecom',
+          creditLimit: '88.500000',
+          minBalance: '2.250000',
+          billingMode: 'POSTPAID'
+        });
+      });
+
+    await request(app.getHttpServer()).post('/api/v2/customers/cus_created/disable').set('Authorization', `Bearer ${tokenFor('usr_admin')}`).expect(201);
+    await request(app.getHttpServer()).post('/api/v2/customers/cus_created/enable').set('Authorization', `Bearer ${tokenFor('usr_admin')}`).expect(201);
+    await request(app.getHttpServer()).delete('/api/v2/customers/cus_created').set('Authorization', `Bearer ${tokenFor('usr_admin')}`).expect(200);
+
+    expect(audit.entries.some((entry) => entry.module === 'customers' && entry.action === 'create' && entry.result === 'SUCCESS')).toBe(true);
+    expect(audit.entries.some((entry) => entry.module === 'customers' && entry.action === 'disable' && entry.objectId === 'cus_created')).toBe(true);
+    expect(audit.entries.some((entry) => entry.module === 'customers' && entry.action === 'delete' && entry.objectId === 'cus_created')).toBe(true);
+  });
+});
diff --git a/apps/api/src/modules/customers/customers.module.ts b/apps/api/src/modules/customers/customers.module.ts
new file mode 100644
index 0000000..3c5cd26
--- /dev/null
+++ b/apps/api/src/modules/customers/customers.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { CustomersController } from './customers.controller.js';
+import { CUSTOMERS_REPOSITORY, PrismaCustomersRepository } from './customers.repository.js';
+import { CustomersService } from './customers.service.js';
+
+@Module({
+  controllers: [CustomersController],
+  providers: [
+    CustomersService,
+    {
+      provide: CUSTOMERS_REPOSITORY,
+      useClass: PrismaCustomersRepository
+    }
+  ],
+  exports: [CustomersService]
+})
+export class CustomersModule {}
diff --git a/apps/api/src/modules/customers/customers.repository.ts b/apps/api/src/modules/customers/customers.repository.ts
new file mode 100644
index 0000000..50532a7
--- /dev/null
+++ b/apps/api/src/modules/customers/customers.repository.ts
@@ -0,0 +1,264 @@
+import { BadRequestException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export type CustomerStatus = 'ENABLED' | 'DISABLED';
+export type CustomerBillingMode = 'PREPAID' | 'POSTPAID';
+
+export interface CustomerSummary {
+  id: string;
+  name: string;
+  contactName: string | null;
+  phone: string | null;
+  email: string | null;
+  domain: string | null;
+  status: CustomerStatus;
+  billingMode: CustomerBillingMode;
+  balance: string;
+  creditLimit: string;
+  minBalance: string;
+  availableBalance: string;
+  notes: string | null;
+  gatewayCount: number;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface CreateCustomerInput {
+  name: string;
+  contactName?: string;
+  phone?: string;
+  email?: string;
+  domain?: string;
+  status?: CustomerStatus;
+  billingMode: CustomerBillingMode;
+  creditLimit: string;
+  minBalance: string;
+  notes?: string;
+  actorId?: string;
+}
+
+export interface UpdateCustomerInput {
+  name?: string;
+  contactName?: string | null;
+  phone?: string | null;
+  email?: string | null;
+  domain?: string | null;
+  status?: CustomerStatus;
+  billingMode?: CustomerBillingMode;
+  creditLimit?: string;
+  minBalance?: string;
+  notes?: string | null;
+  actorId?: string;
+}
+
+export interface CustomersRepository {
+  list(): Promise<CustomerSummary[]>;
+  get(customerId: string): Promise<CustomerSummary>;
+  create(input: CreateCustomerInput): Promise<CustomerSummary>;
+  update(customerId: string, input: UpdateCustomerInput): Promise<CustomerSummary>;
+  setStatus(customerId: string, status: CustomerStatus, actorId?: string): Promise<CustomerSummary>;
+  softDelete(customerId: string, actorId?: string): Promise<CustomerSummary>;
+}
+
+export const CUSTOMERS_REPOSITORY = Symbol('CUSTOMERS_REPOSITORY');
+
+function customerId(): string {
+  return `cus_${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
+}
+
+@Injectable()
+export class PrismaCustomersRepository implements CustomersRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async list(): Promise<CustomerSummary[]> {
+    const customers = await this.prisma.customer.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ createdAt: 'desc' }],
+      include: {
+        _count: {
+          select: {
+            gateways: {
+              where: { deletedAt: null }
+            }
+          }
+        }
+      }
+    });
+
+    return customers.map((customer) => this.toSummary(customer));
+  }
+
+  async get(customerIdValue: string): Promise<CustomerSummary> {
+    return this.toSummary(await this.findActiveOrThrow(customerIdValue));
+  }
+
+  async create(input: CreateCustomerInput): Promise<CustomerSummary> {
+    const customer = await this.prisma.customer.create({
+      data: {
+        id: customerId(),
+        name: input.name,
+        contactName: input.contactName,
+        phone: input.phone,
+        email: input.email,
+        domain: input.domain,
+        status: input.status ?? 'ENABLED',
+        billingMode: input.billingMode,
+        creditLimit: new Prisma.Decimal(input.creditLimit),
+        minBalance: new Prisma.Decimal(input.minBalance),
+        notes: input.notes,
+        createdBy: input.actorId,
+        updatedBy: input.actorId
+      },
+      include: {
+        _count: {
+          select: {
+            gateways: {
+              where: { deletedAt: null }
+            }
+          }
+        }
+      }
+    });
+
+    return this.toSummary(customer);
+  }
+
+  async update(customerIdValue: string, input: UpdateCustomerInput): Promise<CustomerSummary> {
+    await this.ensureExists(customerIdValue);
+
+    const customer = await this.prisma.customer.update({
+      where: { id: customerIdValue },
+      data: {
+        name: input.name,
+        contactName: input.contactName,
+        phone: input.phone,
+        email: input.email,
+        domain: input.domain,
+        status: input.status,
+        billingMode: input.billingMode,
+        creditLimit: input.creditLimit === undefined ? undefined : new Prisma.Decimal(input.creditLimit),
+        minBalance: input.minBalance === undefined ? undefined : new Prisma.Decimal(input.minBalance),
+        notes: input.notes,
+        updatedBy: input.actorId,
+        version: { increment: 1 }
+      },
+      include: {
+        _count: {
+          select: {
+            gateways: {
+              where: { deletedAt: null }
+            }
+          }
+        }
+      }
+    });
+
+    return this.toSummary(customer);
+  }
+
+  async setStatus(customerIdValue: string, status: CustomerStatus, actorId?: string): Promise<CustomerSummary> {
+    return this.update(customerIdValue, { status, actorId });
+  }
+
+  async softDelete(customerIdValue: string, actorId?: string): Promise<CustomerSummary> {
+    const existing = await this.findActiveOrThrow(customerIdValue);
+    const linkedGateways = await this.prisma.customerGateway.count({
+      where: {
+        customerId: customerIdValue,
+        deletedAt: null
+      }
+    });
+
+    if (linkedGateways > 0) {
+      throw new BadRequestException({
+        code: 'CUSTOMER_HAS_GATEWAYS',
+        message: 'Customer with active gateways cannot be deleted.'
+      });
+    }
+
+    const customer = await this.prisma.customer.update({
+      where: { id: existing.id },
+      data: {
+        status: 'DISABLED',
+        deletedAt: new Date(),
+        updatedBy: actorId,
+        version: { increment: 1 }
+      },
+      include: {
+        _count: {
+          select: {
+            gateways: {
+              where: { deletedAt: null }
+            }
+          }
+        }
+      }
+    });
+
+    return this.toSummary(customer);
+  }
+
+  private async ensureExists(customerIdValue: string): Promise<void> {
+    await this.findActiveOrThrow(customerIdValue);
+  }
+
+  private async findActiveOrThrow(customerIdValue: string) {
+    const customer = await this.prisma.customer.findUnique({
+      where: { id: customerIdValue },
+      include: {
+        _count: {
+          select: {
+            gateways: {
+              where: { deletedAt: null }
+            }
+          }
+        }
+      }
+    });
+
+    if (!customer || customer.deletedAt) {
+      throw new NotFoundException({ code: 'CUSTOMER_NOT_FOUND', message: 'Customer not found.' });
+    }
+
+    return customer;
+  }
+
+  private toSummary(customer: {
+    id: string;
+    name: string;
+    contactName: string | null;
+    phone: string | null;
+    email: string | null;
+    domain: string | null;
+    status: CustomerStatus;
+    billingMode: CustomerBillingMode;
+    balance: Prisma.Decimal;
+    creditLimit: Prisma.Decimal;
+    minBalance: Prisma.Decimal;
+    notes: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    _count: { gateways: number };
+  }): CustomerSummary {
+    return {
+      id: customer.id,
+      name: customer.name,
+      contactName: customer.contactName,
+      phone: customer.phone,
+      email: customer.email,
+      domain: customer.domain,
+      status: customer.status,
+      billingMode: customer.billingMode,
+      balance: customer.balance.toFixed(6),
+      creditLimit: customer.creditLimit.toFixed(6),
+      minBalance: customer.minBalance.toFixed(6),
+      availableBalance: customer.balance.plus(customer.creditLimit).toFixed(6),
+      notes: customer.notes,
+      gatewayCount: customer._count.gateways,
+      createdAt: customer.createdAt,
+      updatedAt: customer.updatedAt
+    };
+  }
+}
diff --git a/apps/api/src/modules/customers/customers.service.ts b/apps/api/src/modules/customers/customers.service.ts
new file mode 100644
index 0000000..41a22be
--- /dev/null
+++ b/apps/api/src/modules/customers/customers.service.ts
@@ -0,0 +1,152 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import {
+  CUSTOMERS_REPOSITORY,
+  type CreateCustomerInput,
+  type CustomerBillingMode,
+  type CustomerStatus,
+  type CustomerSummary,
+  type CustomersRepository,
+  type UpdateCustomerInput
+} from './customers.repository.js';
+
+interface CreateCustomerDto {
+  name?: unknown;
+  contactName?: unknown;
+  phone?: unknown;
+  email?: unknown;
+  domain?: unknown;
+  status?: unknown;
+  billingMode?: unknown;
+  creditLimit?: unknown;
+  minBalance?: unknown;
+  notes?: unknown;
+}
+
+interface UpdateCustomerDto {
+  name?: unknown;
+  contactName?: unknown;
+  phone?: unknown;
+  email?: unknown;
+  domain?: unknown;
+  status?: unknown;
+  billingMode?: unknown;
+  creditLimit?: unknown;
+  minBalance?: unknown;
+  notes?: unknown;
+}
+
+@Injectable()
+export class CustomersService {
+  constructor(@Inject(CUSTOMERS_REPOSITORY) private readonly customers: CustomersRepository) {}
+
+  list(): Promise<CustomerSummary[]> {
+    return this.customers.list();
+  }
+
+  get(customerId: string): Promise<CustomerSummary> {
+    return this.customers.get(customerId);
+  }
+
+  create(body: CreateCustomerDto, actorId?: string): Promise<CustomerSummary> {
+    const input: CreateCustomerInput = {
+      name: this.limitedString(body.name, 'name', 120),
+      contactName: this.optionalString(body.contactName, 'contactName', 80),
+      phone: this.optionalString(body.phone, 'phone', 32),
+      email: this.optionalString(body.email, 'email', 160),
+      domain: this.optionalString(body.domain, 'domain', 160),
+      status: body.status === undefined ? 'ENABLED' : this.status(body.status),
+      billingMode: body.billingMode === undefined ? 'PREPAID' : this.billingMode(body.billingMode),
+      creditLimit: body.creditLimit === undefined ? '0.000000' : this.money(body.creditLimit, 'creditLimit'),
+      minBalance: body.minBalance === undefined ? '0.000000' : this.money(body.minBalance, 'minBalance'),
+      notes: this.optionalString(body.notes, 'notes', 500),
+      actorId
+    };
+
+    return this.customers.create(input);
+  }
+
+  update(customerId: string, body: UpdateCustomerDto, actorId?: string): Promise<CustomerSummary> {
+    const input: UpdateCustomerInput = {
+      name: body.name === undefined ? undefined : this.limitedString(body.name, 'name', 120),
+      contactName: body.contactName === undefined ? undefined : this.nullableString(body.contactName, 'contactName', 80),
+      phone: body.phone === undefined ? undefined : this.nullableString(body.phone, 'phone', 32),
+      email: body.email === undefined ? undefined : this.nullableString(body.email, 'email', 160),
+      domain: body.domain === undefined ? undefined : this.nullableString(body.domain, 'domain', 160),
+      status: body.status === undefined ? undefined : this.status(body.status),
+      billingMode: body.billingMode === undefined ? undefined : this.billingMode(body.billingMode),
+      creditLimit: body.creditLimit === undefined ? undefined : this.money(body.creditLimit, 'creditLimit'),
+      minBalance: body.minBalance === undefined ? undefined : this.money(body.minBalance, 'minBalance'),
+      notes: body.notes === undefined ? undefined : this.nullableString(body.notes, 'notes', 500),
+      actorId
+    };
+
+    return this.customers.update(customerId, input);
+  }
+
+  enable(customerId: string, actorId?: string): Promise<CustomerSummary> {
+    return this.customers.setStatus(customerId, 'ENABLED', actorId);
+  }
+
+  disable(customerId: string, actorId?: string): Promise<CustomerSummary> {
+    return this.customers.setStatus(customerId, 'DISABLED', actorId);
+  }
+
+  remove(customerId: string, actorId?: string): Promise<CustomerSummary> {
+    return this.customers.softDelete(customerId, actorId);
+  }
+
+  private limitedString(value: unknown, field: string, maxLength: number): string {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is required.` });
+    }
+
+    const trimmed = value.trim();
+    if (trimmed.length > maxLength) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is too long.` });
+    }
+
+    return trimmed;
+  }
+
+  private optionalString(value: unknown, field: string, maxLength: number): string | undefined {
+    if (value === undefined) {
+      return undefined;
+    }
+
+    return this.limitedString(value, field, maxLength);
+  }
+
+  private nullableString(value: unknown, field: string, maxLength: number): string | null {
+    if (value === null) {
+      return null;
+    }
+
+    return this.limitedString(value, field, maxLength);
+  }
+
+  private status(value: unknown): CustomerStatus {
+    if (value !== 'ENABLED' && value !== 'DISABLED') {
+      throw new BadRequestException({ code: 'STATUS_INVALID', message: 'Status is invalid.' });
+    }
+
+    return value;
+  }
+
+  private billingMode(value: unknown): CustomerBillingMode {
+    if (value !== 'PREPAID' && value !== 'POSTPAID') {
+      throw new BadRequestException({ code: 'BILLING_MODE_INVALID', message: 'Billing mode is invalid.' });
+    }
+
+    return value;
+  }
+
+  private money(value: unknown, field: string): string {
+    const raw = typeof value === 'number' ? value.toString() : typeof value === 'string' ? value.trim() : '';
+    if (!/^\d{1,14}(?:\.\d{1,6})?$/.test(raw)) {
+      throw new BadRequestException({ code: 'MONEY_INVALID', message: `${field} must be a non-negative decimal with up to 6 places.` });
+    }
+
+    const [integerPart, fractionPart = ''] = raw.split('.');
+    return `${integerPart}.${fractionPart.padEnd(6, '0')}`;
+  }
+}
diff --git a/apps/api/src/modules/dashboard/dashboard.controller.ts b/apps/api/src/modules/dashboard/dashboard.controller.ts
new file mode 100644
index 0000000..f0ec895
--- /dev/null
+++ b/apps/api/src/modules/dashboard/dashboard.controller.ts
@@ -0,0 +1,22 @@
+import { Controller, Get, Inject, Query } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { RequirePermissions } from '../security/security.metadata.js';
+import { DashboardService } from './dashboard.service.js';
+
+@ApiTags('dashboard')
+@Controller('dashboard')
+export class DashboardController {
+  constructor(@Inject(DashboardService) private readonly dashboardService: DashboardService) {}
+
+  @Get('summary')
+  @RequirePermissions('dashboard.view')
+  summary() {
+    return this.dashboardService.summary();
+  }
+
+  @Get('trends')
+  @RequirePermissions('dashboard.view')
+  trends(@Query() query: { hours?: string; bucketMinutes?: string }) {
+    return this.dashboardService.trends(query);
+  }
+}
diff --git a/apps/api/src/modules/dashboard/dashboard.module.ts b/apps/api/src/modules/dashboard/dashboard.module.ts
new file mode 100644
index 0000000..da137a5
--- /dev/null
+++ b/apps/api/src/modules/dashboard/dashboard.module.ts
@@ -0,0 +1,16 @@
+import { Module } from '@nestjs/common';
+import { DashboardController } from './dashboard.controller.js';
+import { PrismaDashboardRepository, DASHBOARD_REPOSITORY } from './dashboard.repository.js';
+import { DashboardService } from './dashboard.service.js';
+
+@Module({
+  controllers: [DashboardController],
+  providers: [
+    DashboardService,
+    {
+      provide: DASHBOARD_REPOSITORY,
+      useClass: PrismaDashboardRepository
+    }
+  ]
+})
+export class DashboardModule {}
diff --git a/apps/api/src/modules/dashboard/dashboard.repository.ts b/apps/api/src/modules/dashboard/dashboard.repository.ts
new file mode 100644
index 0000000..888f8d2
--- /dev/null
+++ b/apps/api/src/modules/dashboard/dashboard.repository.ts
@@ -0,0 +1,194 @@
+import { Injectable } from '@nestjs/common';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export interface DashboardCdrRow {
+  startedAt: Date;
+  durationSec: number;
+  sipCode: number;
+}
+
+export interface DashboardRatedRow {
+  startedAt: Date;
+  customerFee: string;
+  vendorCost: string;
+  grossProfit: string;
+}
+
+export interface DashboardFailureCodeRow {
+  sipCode: number;
+  count: number;
+}
+
+export interface DashboardGatewayFailureRow {
+  vendorGatewayId: string;
+  vendorGatewayName: string;
+  vendorName: string | null;
+  host: string;
+  port: number;
+  status: string;
+  failedCalls: number;
+  totalCalls: number;
+}
+
+export interface DashboardSummarySnapshot {
+  cdrs: DashboardCdrRow[];
+  ratedCdrs: DashboardRatedRow[];
+  failureCodes: DashboardFailureCodeRow[];
+  abnormalGateways: DashboardGatewayFailureRow[];
+  activeCustomers: number;
+  activeCustomerGateways: number;
+  activeVendorGateways: number;
+  pendingQuality: number;
+}
+
+export const DASHBOARD_REPOSITORY = Symbol('DASHBOARD_REPOSITORY');
+
+export interface DashboardRepository {
+  summaryWindow(start: Date, end: Date): Promise<DashboardSummarySnapshot>;
+  trendWindow(start: Date, end: Date): Promise<{ cdrs: DashboardCdrRow[]; ratedCdrs: DashboardRatedRow[] }>;
+}
+
+@Injectable()
+export class PrismaDashboardRepository implements DashboardRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async summaryWindow(start: Date, end: Date): Promise<DashboardSummarySnapshot> {
+    const [cdrs, ratedCdrs, activeCustomers, activeCustomerGateways, activeVendorGateways, pendingQuality] = await Promise.all([
+      this.prisma.rawCdr.findMany({
+        where: { startedAt: { gte: start, lt: end } },
+        select: { startedAt: true, durationSec: true, sipCode: true }
+      }),
+      this.prisma.ratedCdr.findMany({
+        where: { rawCdr: { startedAt: { gte: start, lt: end } } },
+        select: {
+          customerFee: true,
+          vendorCost: true,
+          grossProfit: true,
+          rawCdr: { select: { startedAt: true } }
+        }
+      }),
+      this.prisma.customer.count({ where: { status: 'ENABLED', deletedAt: null } }),
+      this.prisma.customerGateway.count({ where: { status: 'ENABLED', deletedAt: null } }),
+      this.prisma.vendorGateway.count({ where: { status: 'ENABLED', deletedAt: null } }),
+      this.prisma.recording.count({ where: { status: 'READY', reviews: { none: {} } } })
+    ]);
+
+    const failureCodes = failureCodesFrom(cdrs);
+    const abnormalGateways = await this.gatewayFailures(start, end);
+
+    return {
+      cdrs,
+      ratedCdrs: ratedCdrs.map((row) => ({
+        startedAt: row.rawCdr.startedAt,
+        customerFee: decimalString(row.customerFee),
+        vendorCost: decimalString(row.vendorCost),
+        grossProfit: decimalString(row.grossProfit)
+      })),
+      failureCodes,
+      abnormalGateways,
+      activeCustomers,
+      activeCustomerGateways,
+      activeVendorGateways,
+      pendingQuality
+    };
+  }
+
+  async trendWindow(start: Date, end: Date): Promise<{ cdrs: DashboardCdrRow[]; ratedCdrs: DashboardRatedRow[] }> {
+    const [cdrs, ratedCdrs] = await Promise.all([
+      this.prisma.rawCdr.findMany({
+        where: { startedAt: { gte: start, lt: end } },
+        select: { startedAt: true, durationSec: true, sipCode: true }
+      }),
+      this.prisma.ratedCdr.findMany({
+        where: { rawCdr: { startedAt: { gte: start, lt: end } } },
+        select: {
+          customerFee: true,
+          vendorCost: true,
+          grossProfit: true,
+          rawCdr: { select: { startedAt: true } }
+        }
+      })
+    ]);
+
+    return {
+      cdrs,
+      ratedCdrs: ratedCdrs.map((row) => ({
+        startedAt: row.rawCdr.startedAt,
+        customerFee: decimalString(row.customerFee),
+        vendorCost: decimalString(row.vendorCost),
+        grossProfit: decimalString(row.grossProfit)
+      }))
+    };
+  }
+
+  private async gatewayFailures(start: Date, end: Date): Promise<DashboardGatewayFailureRow[]> {
+    const cdrs = await this.prisma.rawCdr.findMany({
+      where: { startedAt: { gte: start, lt: end }, vendorGatewayId: { not: null } },
+      select: {
+        vendorGatewayId: true,
+        sipCode: true,
+        vendorGateway: {
+          select: {
+            id: true,
+            name: true,
+            host: true,
+            port: true,
+            status: true,
+            vendor: { select: { name: true } }
+          }
+        }
+      }
+    });
+
+    const grouped = new Map<string, { failedCalls: number; totalCalls: number; gateway: NonNullable<(typeof cdrs)[number]['vendorGateway']> }>();
+    for (const cdr of cdrs) {
+      if (!cdr.vendorGatewayId || !cdr.vendorGateway) {
+        continue;
+      }
+      const current = grouped.get(cdr.vendorGatewayId) ?? { failedCalls: 0, totalCalls: 0, gateway: cdr.vendorGateway };
+      current.totalCalls += 1;
+      if (!isAnswered(cdr.sipCode)) {
+        current.failedCalls += 1;
+      }
+      grouped.set(cdr.vendorGatewayId, current);
+    }
+
+    return [...grouped.entries()]
+      .map(([vendorGatewayId, item]) => ({
+        vendorGatewayId,
+        vendorGatewayName: item.gateway.name,
+        vendorName: item.gateway.vendor?.name ?? null,
+        host: item.gateway.host,
+        port: item.gateway.port,
+        status: item.gateway.status,
+        failedCalls: item.failedCalls,
+        totalCalls: item.totalCalls
+      }))
+      .filter((item) => item.failedCalls > 0)
+      .sort((left, right) => right.failedCalls - left.failedCalls || right.totalCalls - left.totalCalls)
+      .slice(0, 10);
+  }
+}
+
+function failureCodesFrom(cdrs: DashboardCdrRow[]): DashboardFailureCodeRow[] {
+  const counts = new Map<number, number>();
+  for (const cdr of cdrs) {
+    if (isAnswered(cdr.sipCode)) {
+      continue;
+    }
+    counts.set(cdr.sipCode, (counts.get(cdr.sipCode) ?? 0) + 1);
+  }
+  return [...counts.entries()]
+    .map(([sipCode, count]) => ({ sipCode, count }))
+    .sort((left, right) => right.count - left.count || left.sipCode - right.sipCode)
+    .slice(0, 10);
+}
+
+function decimalString(value: Prisma.Decimal): string {
+  return value.toFixed(6);
+}
+
+function isAnswered(sipCode: number): boolean {
+  return sipCode >= 200 && sipCode < 300;
+}
diff --git a/apps/api/src/modules/dashboard/dashboard.service.spec.ts b/apps/api/src/modules/dashboard/dashboard.service.spec.ts
new file mode 100644
index 0000000..8600d23
--- /dev/null
+++ b/apps/api/src/modules/dashboard/dashboard.service.spec.ts
@@ -0,0 +1,78 @@
+import { BadRequestException } from '@nestjs/common';
+import { describe, expect, it } from 'vitest';
+import { buildTrendBuckets, callMetrics, DashboardService, startOfShanghaiDayUtc } from './dashboard.service.js';
+import type { DashboardRepository } from './dashboard.repository.js';
+
+describe('dashboard service', () => {
+  it('uses Asia/Shanghai day boundary for today summary', async () => {
+    const calls: Array<{ start: Date; end: Date }> = [];
+    const repository = {
+      summaryWindow: async (start: Date, end: Date) => {
+        calls.push({ start, end });
+        return {
+          cdrs: [],
+          ratedCdrs: [],
+          failureCodes: [],
+          abnormalGateways: [],
+          activeCustomers: 0,
+          activeCustomerGateways: 0,
+          activeVendorGateways: 0,
+          pendingQuality: 0
+        };
+      }
+    } as unknown as DashboardRepository;
+    const service = new DashboardService(repository);
+    const now = new Date('2026-06-21T15:30:00.000Z');
+
+    await service.summary(now);
+
+    expect(calls[0]?.start.toISOString()).toBe('2026-06-20T16:00:00.000Z');
+    expect(startOfShanghaiDayUtc(now).toISOString()).toBe('2026-06-20T16:00:00.000Z');
+  });
+
+  it('computes call metrics and answer rate without floating point money exposure', () => {
+    expect(
+      callMetrics([
+        { startedAt: new Date('2026-06-21T00:00:00.000Z'), durationSec: 10, sipCode: 200 },
+        { startedAt: new Date('2026-06-21T00:01:00.000Z'), durationSec: 0, sipCode: 486 },
+        { startedAt: new Date('2026-06-21T00:02:00.000Z'), durationSec: 0, sipCode: 503 }
+      ])
+    ).toEqual({
+      totalCalls: 3,
+      answeredCalls: 1,
+      failedCalls: 2,
+      answerRate: '0.3333',
+      totalDurationSec: 10
+    });
+  });
+
+  it('builds fixed trend buckets', () => {
+    const buckets = buildTrendBuckets(
+      new Date('2026-06-21T00:00:00.000Z'),
+      new Date('2026-06-21T01:00:00.000Z'),
+      30,
+      [
+        { startedAt: new Date('2026-06-21T00:10:00.000Z'), durationSec: 30, sipCode: 200 },
+        { startedAt: new Date('2026-06-21T00:45:00.000Z'), durationSec: 0, sipCode: 480 }
+      ],
+      [
+        { startedAt: new Date('2026-06-21T00:10:00.000Z'), customerFee: '0.100000', vendorCost: '0.030000', grossProfit: '0.070000' }
+      ]
+    );
+
+    expect(buckets).toHaveLength(2);
+    expect(buckets[0]).toMatchObject({
+      calls: { totalCalls: 1, answeredCalls: 1, failedCalls: 0 },
+      money: { customerFee: '0.100000', vendorCost: '0.030000', grossProfit: '0.070000' }
+    });
+    expect(buckets[1]).toMatchObject({
+      calls: { totalCalls: 1, answeredCalls: 0, failedCalls: 1 }
+    });
+  });
+
+  it('validates trend query bounds', async () => {
+    const service = new DashboardService({} as DashboardRepository);
+    await expect(service.trends({ hours: '0' })).rejects.toThrow(BadRequestException);
+    await expect(service.trends({ bucketMinutes: '10' })).rejects.toThrow(BadRequestException);
+  });
+});
diff --git a/apps/api/src/modules/dashboard/dashboard.service.ts b/apps/api/src/modules/dashboard/dashboard.service.ts
new file mode 100644
index 0000000..e3f682d
--- /dev/null
+++ b/apps/api/src/modules/dashboard/dashboard.service.ts
@@ -0,0 +1,177 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import {
+  DASHBOARD_REPOSITORY,
+  type DashboardCdrRow,
+  type DashboardRatedRow,
+  type DashboardRepository
+} from './dashboard.repository.js';
+
+const SHANGHAI_OFFSET_MS = 8 * 60 * 60 * 1000;
+const DEFAULT_TREND_HOURS = 24;
+const DEFAULT_BUCKET_MINUTES = 60;
+const ALLOWED_BUCKET_MINUTES = new Set([5, 15, 60]);
+
+export interface DashboardCallMetrics {
+  totalCalls: number;
+  answeredCalls: number;
+  failedCalls: number;
+  answerRate: string;
+  totalDurationSec: number;
+}
+
+export interface DashboardMoneyMetrics {
+  customerFee: string;
+  vendorCost: string;
+  grossProfit: string;
+}
+
+export interface DashboardTrendBucket {
+  start: string;
+  end: string;
+  calls: DashboardCallMetrics;
+  money: DashboardMoneyMetrics;
+}
+
+@Injectable()
+export class DashboardService {
+  constructor(@Inject(DASHBOARD_REPOSITORY) private readonly dashboard: DashboardRepository) {}
+
+  async summary(now = new Date()) {
+    const start = startOfShanghaiDayUtc(now);
+    const snapshot = await this.dashboard.summaryWindow(start, now);
+    return {
+      generatedAt: now.toISOString(),
+      window: { start: start.toISOString(), end: now.toISOString(), timezone: 'Asia/Shanghai' },
+      calls: callMetrics(snapshot.cdrs),
+      money: moneyMetrics(snapshot.ratedCdrs),
+      realtime: {
+        onlineCalls: 0,
+        registeredUsers: 0,
+        source: 'not_configured'
+      },
+      entities: {
+        activeCustomers: snapshot.activeCustomers,
+        activeCustomerGateways: snapshot.activeCustomerGateways,
+        activeVendorGateways: snapshot.activeVendorGateways
+      },
+      quality: {
+        pendingReviews: snapshot.pendingQuality
+      },
+      failureCodes: snapshot.failureCodes,
+      abnormalGateways: snapshot.abnormalGateways
+    };
+  }
+
+  async trends(query: { hours?: unknown; bucketMinutes?: unknown } = {}, now = new Date()) {
+    const hours = query.hours === undefined ? DEFAULT_TREND_HOURS : this.integer(query.hours, 'hours', 1, 168);
+    const bucketMinutes =
+      query.bucketMinutes === undefined ? DEFAULT_BUCKET_MINUTES : this.integer(query.bucketMinutes, 'bucketMinutes', 5, 60);
+    if (!ALLOWED_BUCKET_MINUTES.has(bucketMinutes)) {
+      throw new BadRequestException({ code: 'DASHBOARD_BUCKET_INVALID', message: 'bucketMinutes must be one of 5, 15 or 60.' });
+    }
+
+    const bucketMs = bucketMinutes * 60 * 1000;
+    const end = new Date(Math.ceil(now.getTime() / bucketMs) * bucketMs);
+    const start = new Date(end.getTime() - hours * 60 * 60 * 1000);
+    const rows = await this.dashboard.trendWindow(start, end);
+
+    return {
+      generatedAt: now.toISOString(),
+      window: { start: start.toISOString(), end: end.toISOString(), hours, bucketMinutes },
+      buckets: buildTrendBuckets(start, end, bucketMinutes, rows.cdrs, rows.ratedCdrs)
+    };
+  }
+
+  private integer(value: unknown, field: string, min: number, max: number): number {
+    const parsed = typeof value === 'number' ? value : typeof value === 'string' && /^\d+$/.test(value) ? Number.parseInt(value, 10) : NaN;
+    if (!Number.isInteger(parsed) || parsed < min || parsed > max) {
+      throw new BadRequestException({ code: 'INTEGER_INVALID', message: `${field} must be an integer from ${min} to ${max}.` });
+    }
+    return parsed;
+  }
+}
+
+export function startOfShanghaiDayUtc(now: Date): Date {
+  const shifted = new Date(now.getTime() + SHANGHAI_OFFSET_MS);
+  shifted.setUTCHours(0, 0, 0, 0);
+  return new Date(shifted.getTime() - SHANGHAI_OFFSET_MS);
+}
+
+export function buildTrendBuckets(
+  start: Date,
+  end: Date,
+  bucketMinutes: number,
+  cdrs: DashboardCdrRow[],
+  ratedCdrs: DashboardRatedRow[]
+): DashboardTrendBucket[] {
+  const bucketMs = bucketMinutes * 60 * 1000;
+  const bucketCount = Math.ceil((end.getTime() - start.getTime()) / bucketMs);
+  const buckets = Array.from({ length: bucketCount }, (_, index) => {
+    const bucketStart = new Date(start.getTime() + index * bucketMs);
+    return {
+      start: bucketStart,
+      end: new Date(bucketStart.getTime() + bucketMs),
+      cdrs: [] as DashboardCdrRow[],
+      ratedCdrs: [] as DashboardRatedRow[]
+    };
+  });
+
+  for (const cdr of cdrs) {
+    const index = Math.floor((cdr.startedAt.getTime() - start.getTime()) / bucketMs);
+    if (index >= 0 && index < buckets.length) {
+      buckets[index].cdrs.push(cdr);
+    }
+  }
+
+  for (const ratedCdr of ratedCdrs) {
+    const index = Math.floor((ratedCdr.startedAt.getTime() - start.getTime()) / bucketMs);
+    if (index >= 0 && index < buckets.length) {
+      buckets[index].ratedCdrs.push(ratedCdr);
+    }
+  }
+
+  return buckets.map((bucket) => ({
+    start: bucket.start.toISOString(),
+    end: bucket.end.toISOString(),
+    calls: callMetrics(bucket.cdrs),
+    money: moneyMetrics(bucket.ratedCdrs)
+  }));
+}
+
+export function callMetrics(cdrs: DashboardCdrRow[]): DashboardCallMetrics {
+  const answeredCalls = cdrs.filter((cdr) => isAnswered(cdr.sipCode)).length;
+  const totalCalls = cdrs.length;
+  return {
+    totalCalls,
+    answeredCalls,
+    failedCalls: totalCalls - answeredCalls,
+    answerRate: ratioString(answeredCalls, totalCalls),
+    totalDurationSec: cdrs.reduce((sum, cdr) => sum + cdr.durationSec, 0)
+  };
+}
+
+export function moneyMetrics(rows: DashboardRatedRow[]): DashboardMoneyMetrics {
+  const customerFee = rows.reduce((sum, row) => sum + Number.parseFloat(row.customerFee), 0);
+  const vendorCost = rows.reduce((sum, row) => sum + Number.parseFloat(row.vendorCost), 0);
+  const grossProfit = rows.reduce((sum, row) => sum + Number.parseFloat(row.grossProfit), 0);
+  return {
+    customerFee: moneyString(customerFee),
+    vendorCost: moneyString(vendorCost),
+    grossProfit: moneyString(grossProfit)
+  };
+}
+
+function ratioString(numerator: number, denominator: number): string {
+  if (denominator === 0) {
+    return '0.0000';
+  }
+  return (numerator / denominator).toFixed(4);
+}
+
+function moneyString(value: number): string {
+  return value.toFixed(6);
+}
+
+function isAnswered(sipCode: number): boolean {
+  return sipCode >= 200 && sipCode < 300;
+}
diff --git a/apps/api/src/modules/database/database.module.ts b/apps/api/src/modules/database/database.module.ts
new file mode 100644
index 0000000..b97a851
--- /dev/null
+++ b/apps/api/src/modules/database/database.module.ts
@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { PrismaService } from './prisma.service.js';
+
+@Global()
+@Module({
+  providers: [PrismaService],
+  exports: [PrismaService]
+})
+export class DatabaseModule {}
diff --git a/apps/api/src/modules/database/prisma.service.ts b/apps/api/src/modules/database/prisma.service.ts
new file mode 100644
index 0000000..b5197b7
--- /dev/null
+++ b/apps/api/src/modules/database/prisma.service.ts
@@ -0,0 +1,9 @@
+import { Injectable, OnModuleDestroy } from '@nestjs/common';
+import { PrismaClient } from '@lisglosips/database';
+
+@Injectable()
+export class PrismaService extends PrismaClient implements OnModuleDestroy {
+  async onModuleDestroy(): Promise<void> {
+    await this.$disconnect();
+  }
+}
diff --git a/apps/api/src/modules/health/health.controller.ts b/apps/api/src/modules/health/health.controller.ts
new file mode 100644
index 0000000..011c5b6
--- /dev/null
+++ b/apps/api/src/modules/health/health.controller.ts
@@ -0,0 +1,24 @@
+import { Controller, Get, Inject } from '@nestjs/common';
+import { ApiOkResponse, ApiTags } from '@nestjs/swagger';
+import type { HealthCheckResponse } from '@lisglosips/contracts';
+import { Public } from '../security/security.metadata.js';
+import { HealthService } from './health.service.js';
+
+@ApiTags('health')
+@Public()
+@Controller('health')
+export class HealthController {
+  constructor(@Inject(HealthService) private readonly healthService: HealthService) {}
+
+  @Get('live')
+  @ApiOkResponse({ description: 'Process liveness check.' })
+  live(): HealthCheckResponse {
+    return this.healthService.live();
+  }
+
+  @Get('ready')
+  @ApiOkResponse({ description: 'Configuration and dependency readiness check.' })
+  ready(): HealthCheckResponse {
+    return this.healthService.ready();
+  }
+}
diff --git a/apps/api/src/modules/health/health.module.ts b/apps/api/src/modules/health/health.module.ts
new file mode 100644
index 0000000..dd1dcc4
--- /dev/null
+++ b/apps/api/src/modules/health/health.module.ts
@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { HealthController } from './health.controller.js';
+import { HealthService } from './health.service.js';
+
+@Module({
+  controllers: [HealthController],
+  providers: [HealthService]
+})
+export class HealthModule {}
diff --git a/apps/api/src/modules/health/health.service.spec.ts b/apps/api/src/modules/health/health.service.spec.ts
new file mode 100644
index 0000000..a96d815
--- /dev/null
+++ b/apps/api/src/modules/health/health.service.spec.ts
@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest';
+import { ConfigService } from '@nestjs/config';
+import { HealthService } from './health.service.js';
+
+describe('HealthService', () => {
+  it('reports ready when required connection strings are configured', () => {
+    const config = new ConfigService({
+      service: { name: 'api-test' },
+      database: { url: 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips' },
+      redis: { url: 'redis://127.0.0.1:6379/0' }
+    });
+
+    const result = new HealthService(config).ready();
+
+    expect(result.status).toBe('ok');
+    expect(result.service).toBe('api-test');
+    expect(result.checks.database).toBe('ok');
+    expect(result.checks.redis).toBe('ok');
+  });
+});
diff --git a/apps/api/src/modules/health/health.service.ts b/apps/api/src/modules/health/health.service.ts
new file mode 100644
index 0000000..16e1cec
--- /dev/null
+++ b/apps/api/src/modules/health/health.service.ts
@@ -0,0 +1,34 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import type { HealthCheckResponse, HealthStatus } from '@lisglosips/contracts';
+
+@Injectable()
+export class HealthService {
+  constructor(@Inject(ConfigService) private readonly configService: ConfigService) {}
+
+  live(): HealthCheckResponse {
+    return this.response('ok', {
+      process: 'ok'
+    });
+  }
+
+  ready(): HealthCheckResponse {
+    const hasDatabaseUrl = Boolean(this.configService.get<string>('database.url'));
+    const hasRedisUrl = Boolean(this.configService.get<string>('redis.url'));
+
+    return this.response(hasDatabaseUrl && hasRedisUrl ? 'ok' : 'degraded', {
+      config: 'ok',
+      database: hasDatabaseUrl ? 'ok' : 'degraded',
+      redis: hasRedisUrl ? 'ok' : 'degraded'
+    });
+  }
+
+  private response(status: HealthStatus, checks: Record<string, HealthStatus>): HealthCheckResponse {
+    return {
+      status,
+      service: this.configService.get<string>('service.name') ?? 'api',
+      timestamp: new Date().toISOString(),
+      checks
+    };
+  }
+}
diff --git a/apps/api/src/modules/landing-line-groups/landing-line-groups.controller.ts b/apps/api/src/modules/landing-line-groups/landing-line-groups.controller.ts
new file mode 100644
index 0000000..1fcd6ec
--- /dev/null
+++ b/apps/api/src/modules/landing-line-groups/landing-line-groups.controller.ts
@@ -0,0 +1,86 @@
+import { Body, Controller, Delete, Get, Inject, Param, Patch, Post } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { LandingLineGroupsService } from './landing-line-groups.service.js';
+
+@ApiTags('landing-line-groups')
+@Controller('landing-line-groups')
+export class LandingLineGroupsController {
+  constructor(@Inject(LandingLineGroupsService) private readonly lineGroupsService: LandingLineGroupsService) {}
+
+  @Get()
+  @RequirePermissions('line_groups.view')
+  list() {
+    return this.lineGroupsService.list();
+  }
+
+  @Get(':id')
+  @RequirePermissions('line_groups.view')
+  get(@Param('id') id: string) {
+    return this.lineGroupsService.get(id);
+  }
+
+  @Post()
+  @RequirePermissions('line_groups.manage')
+  @AuditAction({ module: 'line_groups', action: 'create', objectType: 'landing_line_group' })
+  create(@Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.lineGroupsService.create(body as never, currentUser?.id);
+  }
+
+  @Patch(':id')
+  @RequirePermissions('line_groups.manage')
+  @AuditAction({ module: 'line_groups', action: 'update', objectType: 'landing_line_group', objectIdParam: 'id' })
+  update(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.lineGroupsService.update(id, body as never, currentUser?.id);
+  }
+
+  @Post(':id/enable')
+  @RequirePermissions('line_groups.manage')
+  @AuditAction({ module: 'line_groups', action: 'enable', objectType: 'landing_line_group', objectIdParam: 'id' })
+  enable(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.lineGroupsService.enable(id, currentUser?.id);
+  }
+
+  @Post(':id/disable')
+  @RequirePermissions('line_groups.manage')
+  @AuditAction({ module: 'line_groups', action: 'disable', objectType: 'landing_line_group', objectIdParam: 'id' })
+  disable(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.lineGroupsService.disable(id, currentUser?.id);
+  }
+
+  @Delete(':id')
+  @RequirePermissions('line_groups.manage')
+  @AuditAction({ module: 'line_groups', action: 'delete', objectType: 'landing_line_group', objectIdParam: 'id' })
+  remove(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.lineGroupsService.remove(id, currentUser?.id);
+  }
+
+  @Post(':id/items')
+  @RequirePermissions('line_groups.manage')
+  @AuditAction({ module: 'line_groups', action: 'item_create', objectType: 'landing_line_group', objectIdParam: 'id' })
+  addItem(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.lineGroupsService.addItem(id, body as never, currentUser?.id);
+  }
+
+  @Patch('items/:itemId')
+  @RequirePermissions('line_groups.manage')
+  @AuditAction({ module: 'line_groups', action: 'item_update', objectType: 'landing_line_group_item', objectIdParam: 'itemId' })
+  updateItem(@Param('itemId') itemId: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.lineGroupsService.updateItem(itemId, body as never, currentUser?.id);
+  }
+
+  @Delete(':id/items/:gatewayId')
+  @RequirePermissions('line_groups.manage')
+  @AuditAction({ module: 'line_groups', action: 'item_delete', objectType: 'landing_line_group', objectIdParam: 'id' })
+  removeItem(@Param('id') id: string, @Param('gatewayId') gatewayId: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.lineGroupsService.removeItem(id, gatewayId, currentUser?.id);
+  }
+
+  @Post(':id/items/reorder')
+  @RequirePermissions('line_groups.manage')
+  @AuditAction({ module: 'line_groups', action: 'item_reorder', objectType: 'landing_line_group', objectIdParam: 'id' })
+  reorderItems(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.lineGroupsService.reorderItems(id, body as never, currentUser?.id);
+  }
+}
diff --git a/apps/api/src/modules/landing-line-groups/landing-line-groups.e2e.spec.ts b/apps/api/src/modules/landing-line-groups/landing-line-groups.e2e.spec.ts
new file mode 100644
index 0000000..fe13f34
--- /dev/null
+++ b/apps/api/src/modules/landing-line-groups/landing-line-groups.e2e.spec.ts
@@ -0,0 +1,354 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { signAccessToken, type PermissionKey } from '@lisglosips/auth';
+import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from '../audit/audit.repository.js';
+import { IDENTITY_REPOSITORY, type IdentityRepository } from '../security/identity.repository.js';
+import type { CurrentUser } from '../security/security.metadata.js';
+import {
+  LANDING_LINE_GROUPS_REPOSITORY,
+  type AddLineGroupItemInput,
+  type LandingLineGroupsRepository,
+  type LineGroupItemSummary,
+  type LineGroupStatus,
+  type LineGroupSummary,
+  type UpdateLineGroupInput,
+  type UpdateLineGroupItemInput
+} from './landing-line-groups.repository.js';
+
+class MemoryIdentityRepository implements IdentityRepository {
+  users = new Map<string, CurrentUser>();
+
+  async findCurrentUserById(userId: string): Promise<CurrentUser | null> {
+    return this.users.get(userId) ?? null;
+  }
+}
+
+class MemoryAuditRepository implements AuditRepository {
+  entries: AuditEntryInput[] = [];
+
+  async write(input: AuditEntryInput): Promise<void> {
+    this.entries.push(input);
+  }
+}
+
+class MemoryLandingLineGroupsRepository implements LandingLineGroupsRepository {
+  private readonly groups = new Map<string, LineGroupSummary>();
+  outboxEvents = 0;
+
+  constructor() {
+    this.groups.set(
+      'llg_seed',
+      this.summary({
+        id: 'llg_seed',
+        name: 'Seed Group',
+        items: [
+          this.item({ id: 'item_a', lineGroupId: 'llg_seed', vendorGatewayId: 'vgw_a', priority: 1, concurrencyCap: 80 }),
+          this.item({ id: 'item_b', lineGroupId: 'llg_seed', vendorGatewayId: 'vgw_b', priority: 2, concurrencyCap: 20, status: 'DISABLED' })
+        ]
+      })
+    );
+  }
+
+  async list(): Promise<LineGroupSummary[]> {
+    return [...this.groups.values()];
+  }
+
+  async get(lineGroupId: string): Promise<LineGroupSummary> {
+    return this.groups.get(lineGroupId) ?? this.summary({ id: lineGroupId, name: 'Missing Group' });
+  }
+
+  async create(input: { name: string; status: LineGroupStatus; notes?: string | null }): Promise<LineGroupSummary> {
+    const group = this.summary({
+      id: 'llg_created',
+      name: input.name,
+      status: input.status,
+      notes: input.notes ?? null
+    });
+    this.groups.set(group.id, group);
+    this.outboxEvents += 1;
+    return group;
+  }
+
+  async update(lineGroupId: string, input: UpdateLineGroupInput): Promise<LineGroupSummary> {
+    const current = await this.get(lineGroupId);
+    const updated = this.summary({
+      ...current,
+      name: input.name ?? current.name,
+      status: input.status ?? current.status,
+      notes: input.notes === undefined ? current.notes : input.notes,
+      items: current.items
+    });
+    this.groups.set(lineGroupId, updated);
+    this.outboxEvents += 1;
+    return updated;
+  }
+
+  async setStatus(lineGroupId: string, status: LineGroupStatus): Promise<LineGroupSummary> {
+    return this.update(lineGroupId, { status });
+  }
+
+  async softDelete(lineGroupId: string): Promise<LineGroupSummary> {
+    return this.update(lineGroupId, { status: 'DISABLED' });
+  }
+
+  async addItem(input: AddLineGroupItemInput): Promise<LineGroupSummary> {
+    const current = await this.get(input.lineGroupId);
+    const item = this.item({
+      id: `item_${current.items.length + 1}`,
+      lineGroupId: input.lineGroupId,
+      vendorGatewayId: input.vendorGatewayId,
+      priority: input.priority ?? current.items.length + 1,
+      weight: input.weight,
+      concurrencyCap: input.concurrencyCap,
+      status: input.status
+    });
+    const updated = this.summary({ ...current, items: [...current.items, item] });
+    this.groups.set(input.lineGroupId, updated);
+    this.outboxEvents += 1;
+    return updated;
+  }
+
+  async updateItem(itemId: string, input: UpdateLineGroupItemInput): Promise<LineGroupItemSummary> {
+    for (const group of this.groups.values()) {
+      const item = group.items.find((candidate) => candidate.id === itemId);
+      if (!item) {
+        continue;
+      }
+      const updatedItem = this.item({
+        ...item,
+        priority: input.priority ?? item.priority,
+        weight: input.weight ?? item.weight,
+        concurrencyCap: input.concurrencyCap ?? item.concurrencyCap,
+        status: input.status ?? item.status
+      });
+      const updated = this.summary({
+        ...group,
+        items: group.items.map((candidate) => (candidate.id === itemId ? updatedItem : candidate))
+      });
+      this.groups.set(group.id, updated);
+      this.outboxEvents += 1;
+      return updatedItem;
+    }
+    return this.item({ id: itemId, lineGroupId: 'missing', vendorGatewayId: 'missing', priority: 1 });
+  }
+
+  async removeItem(lineGroupId: string, vendorGatewayId: string): Promise<LineGroupSummary> {
+    const current = await this.get(lineGroupId);
+    const updated = this.summary({
+      ...current,
+      items: current.items.filter((item) => item.vendorGatewayId !== vendorGatewayId)
+    });
+    this.groups.set(lineGroupId, updated);
+    this.outboxEvents += 1;
+    return updated;
+  }
+
+  async reorderItems(lineGroupId: string, itemIds: string[]): Promise<LineGroupSummary> {
+    const current = await this.get(lineGroupId);
+    const currentIds = current.items.map((item) => item.id).sort();
+    const requestedIds = [...itemIds].sort();
+    if (currentIds.length !== requestedIds.length || currentIds.some((id, index) => id !== requestedIds[index])) {
+      throw new Error('test repository reorder mismatch');
+    }
+    const itemsById = new Map(current.items.map((item) => [item.id, item]));
+    const updated = this.summary({
+      ...current,
+      items: itemIds.map((id, index) => this.item({ ...itemsById.get(id)!, priority: index + 1 }))
+    });
+    this.groups.set(lineGroupId, updated);
+    this.outboxEvents += 1;
+    return updated;
+  }
+
+  private summary(input: Partial<LineGroupSummary> & { id: string; name: string; items?: LineGroupItemSummary[] }): LineGroupSummary {
+    const items = input.items ?? [];
+    const enabledItems = items.filter((item) => item.status === 'ENABLED');
+    return {
+      id: input.id,
+      name: input.name,
+      status: input.status ?? 'ENABLED',
+      notes: input.notes ?? null,
+      itemCount: items.length,
+      enabledItemCount: enabledItems.length,
+      concurrencyCapSum: enabledItems.reduce((sum, item) => sum + item.concurrencyCap, 0),
+      gatewayConcurrencyLimitSum: enabledItems.reduce((sum, item) => sum + item.vendorGatewayConcurrencyLimit, 0),
+      policyCount: input.policyCount ?? 0,
+      items,
+      createdAt: new Date('2026-06-21T07:00:00.000Z'),
+      updatedAt: new Date('2026-06-21T07:00:00.000Z')
+    };
+  }
+
+  private item(input: Partial<LineGroupItemSummary> & { id: string; lineGroupId: string; vendorGatewayId: string; priority: number }): LineGroupItemSummary {
+    return {
+      id: input.id,
+      lineGroupId: input.lineGroupId,
+      vendorGatewayId: input.vendorGatewayId,
+      vendorGatewayName: input.vendorGatewayName ?? `Gateway ${input.vendorGatewayId}`,
+      vendorId: input.vendorId ?? 'ven_seed',
+      vendorName: input.vendorName ?? 'Seed Vendor',
+      vendorGatewayStatus: input.vendorGatewayStatus ?? 'ENABLED',
+      vendorGatewayConcurrencyLimit: input.vendorGatewayConcurrencyLimit ?? 100,
+      vendorGatewayCpsLimit: input.vendorGatewayCpsLimit ?? 10,
+      priority: input.priority,
+      weight: input.weight ?? 1,
+      concurrencyCap: input.concurrencyCap ?? 0,
+      status: input.status ?? 'ENABLED',
+      createdAt: new Date('2026-06-21T07:00:00.000Z'),
+      updatedAt: new Date('2026-06-21T07:00:00.000Z')
+    };
+  }
+}
+
+describe('S17 landing line groups API', () => {
+  let app: NestFastifyApplication;
+  let audit: MemoryAuditRepository;
+  let repository: MemoryLandingLineGroupsRepository;
+
+  const tokenFor = (userId: string) =>
+    signAccessToken(
+      {
+        sub: userId,
+        username: userId,
+        roles: ['test'],
+        typ: 'access'
+      },
+      {
+        secret: 'test-only-access-token-secret-min-32-bytes',
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        ttlSeconds: 900
+      }
+    );
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+    process.env.AUTH_ACCESS_TOKEN_SECRET = 'test-only-access-token-secret-min-32-bytes';
+
+    const identities = new MemoryIdentityRepository();
+    audit = new MemoryAuditRepository();
+    repository = new MemoryLandingLineGroupsRepository();
+
+    identities.users.set('usr_ops', {
+      id: 'usr_ops',
+      username: 'ops',
+      roles: ['运营管理员'],
+      permissions: ['line_groups.view', 'line_groups.manage'] as PermissionKey[]
+    });
+    identities.users.set('usr_viewer', {
+      id: 'usr_viewer',
+      username: 'viewer',
+      roles: ['只读'],
+      permissions: ['line_groups.view'] as PermissionKey[]
+    });
+
+    const { AppModule } = await import('../app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({ imports: [AppModule] })
+      .overrideProvider(IDENTITY_REPOSITORY)
+      .useValue(identities)
+      .overrideProvider(AUDIT_REPOSITORY)
+      .useValue(audit)
+      .overrideProvider(LANDING_LINE_GROUPS_REPOSITORY)
+      .useValue(repository)
+      .compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('lists line groups with member counts and concurrency summaries', async () => {
+    const response = await request(app.getHttpServer())
+      .get('/api/v2/landing-line-groups')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .expect(200);
+
+    expect(response.body[0]).toMatchObject({
+      id: 'llg_seed',
+      itemCount: 2,
+      enabledItemCount: 1,
+      concurrencyCapSum: 80,
+      gatewayConcurrencyLimitSum: 100
+    });
+  });
+
+  it('rejects writes without line_groups.manage', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/landing-line-groups')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .send({ name: 'Denied Group' })
+      .expect(403);
+  });
+
+  it('creates and maintains group members with audit entries', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/landing-line-groups')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ name: 'Primary Routing', notes: 'core vendors' })
+      .expect(201)
+      .expect((response) => {
+        expect(response.body).toMatchObject({ id: 'llg_created', name: 'Primary Routing', itemCount: 0 });
+      });
+
+    await request(app.getHttpServer())
+      .post('/api/v2/landing-line-groups/llg_created/items')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ vendorGatewayId: 'vgw_primary', priority: 1, weight: 2, concurrencyCap: 60 })
+      .expect(201)
+      .expect((response) => {
+        expect(response.body).toMatchObject({ itemCount: 1, concurrencyCapSum: 60 });
+      });
+
+    await request(app.getHttpServer())
+      .patch('/api/v2/landing-line-groups/items/item_1')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ concurrencyCap: 40, status: 'DISABLED' })
+      .expect(200)
+      .expect((response) => {
+        expect(response.body).toMatchObject({ id: 'item_1', concurrencyCap: 40, status: 'DISABLED' });
+      });
+
+    await request(app.getHttpServer())
+      .delete('/api/v2/landing-line-groups/llg_created/items/vgw_primary')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .expect(200)
+      .expect((response) => {
+        expect(response.body).toMatchObject({ itemCount: 0 });
+      });
+
+    expect(repository.outboxEvents).toBeGreaterThanOrEqual(4);
+    expect(audit.entries.some((entry) => entry.module === 'line_groups' && entry.action === 'create')).toBe(true);
+    expect(audit.entries.some((entry) => entry.module === 'line_groups' && entry.action === 'item_delete')).toBe(true);
+  });
+
+  it('validates members and supports reorder, enable, disable, and delete', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/landing-line-groups/llg_seed/items')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ vendorGatewayId: 'vgw_bad', weight: 0 })
+      .expect(400);
+
+    await request(app.getHttpServer())
+      .post('/api/v2/landing-line-groups/llg_seed/items/reorder')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ itemIds: ['item_b', 'item_a'] })
+      .expect(201)
+      .expect((response) => {
+        expect(response.body.items.map((item: { id: string }) => item.id)).toEqual(['item_b', 'item_a']);
+      });
+
+    await request(app.getHttpServer()).post('/api/v2/landing-line-groups/llg_seed/disable').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(201);
+    await request(app.getHttpServer()).post('/api/v2/landing-line-groups/llg_seed/enable').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(201);
+    await request(app.getHttpServer()).delete('/api/v2/landing-line-groups/llg_seed').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(200);
+  });
+});
diff --git a/apps/api/src/modules/landing-line-groups/landing-line-groups.module.ts b/apps/api/src/modules/landing-line-groups/landing-line-groups.module.ts
new file mode 100644
index 0000000..9f9021f
--- /dev/null
+++ b/apps/api/src/modules/landing-line-groups/landing-line-groups.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { LandingLineGroupsController } from './landing-line-groups.controller.js';
+import { LANDING_LINE_GROUPS_REPOSITORY, PrismaLandingLineGroupsRepository } from './landing-line-groups.repository.js';
+import { LandingLineGroupsService } from './landing-line-groups.service.js';
+
+@Module({
+  controllers: [LandingLineGroupsController],
+  providers: [
+    LandingLineGroupsService,
+    {
+      provide: LANDING_LINE_GROUPS_REPOSITORY,
+      useClass: PrismaLandingLineGroupsRepository
+    }
+  ],
+  exports: [LandingLineGroupsService]
+})
+export class LandingLineGroupsModule {}
diff --git a/apps/api/src/modules/landing-line-groups/landing-line-groups.repository.ts b/apps/api/src/modules/landing-line-groups/landing-line-groups.repository.ts
new file mode 100644
index 0000000..5766182
--- /dev/null
+++ b/apps/api/src/modules/landing-line-groups/landing-line-groups.repository.ts
@@ -0,0 +1,474 @@
+import { BadRequestException, ConflictException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export type LineGroupStatus = 'ENABLED' | 'DISABLED';
+
+export interface LineGroupItemSummary {
+  id: string;
+  lineGroupId: string;
+  vendorGatewayId: string;
+  vendorGatewayName: string;
+  vendorId: string;
+  vendorName: string;
+  vendorGatewayStatus: LineGroupStatus;
+  vendorGatewayConcurrencyLimit: number;
+  vendorGatewayCpsLimit: number;
+  priority: number;
+  weight: number;
+  concurrencyCap: number;
+  status: LineGroupStatus;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface LineGroupSummary {
+  id: string;
+  name: string;
+  status: LineGroupStatus;
+  notes: string | null;
+  itemCount: number;
+  enabledItemCount: number;
+  concurrencyCapSum: number;
+  gatewayConcurrencyLimitSum: number;
+  policyCount: number;
+  items: LineGroupItemSummary[];
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface CreateLineGroupInput {
+  name: string;
+  status: LineGroupStatus;
+  notes?: string | null;
+  actorId?: string;
+}
+
+export interface UpdateLineGroupInput {
+  name?: string;
+  status?: LineGroupStatus;
+  notes?: string | null;
+  actorId?: string;
+}
+
+export interface AddLineGroupItemInput {
+  lineGroupId: string;
+  vendorGatewayId: string;
+  priority?: number;
+  weight: number;
+  concurrencyCap: number;
+  status: LineGroupStatus;
+  actorId?: string;
+}
+
+export interface UpdateLineGroupItemInput {
+  priority?: number;
+  weight?: number;
+  concurrencyCap?: number;
+  status?: LineGroupStatus;
+  actorId?: string;
+}
+
+export interface LandingLineGroupsRepository {
+  list(): Promise<LineGroupSummary[]>;
+  get(lineGroupId: string): Promise<LineGroupSummary>;
+  create(input: CreateLineGroupInput): Promise<LineGroupSummary>;
+  update(lineGroupId: string, input: UpdateLineGroupInput): Promise<LineGroupSummary>;
+  setStatus(lineGroupId: string, status: LineGroupStatus, actorId?: string): Promise<LineGroupSummary>;
+  softDelete(lineGroupId: string, actorId?: string): Promise<LineGroupSummary>;
+  addItem(input: AddLineGroupItemInput): Promise<LineGroupSummary>;
+  updateItem(itemId: string, input: UpdateLineGroupItemInput): Promise<LineGroupItemSummary>;
+  removeItem(lineGroupId: string, vendorGatewayId: string, actorId?: string): Promise<LineGroupSummary>;
+  reorderItems(lineGroupId: string, itemIds: string[], actorId?: string): Promise<LineGroupSummary>;
+}
+
+export const LANDING_LINE_GROUPS_REPOSITORY = Symbol('LANDING_LINE_GROUPS_REPOSITORY');
+
+type LineGroupItemRecord = {
+  id: string;
+  lineGroupId: string;
+  vendorGatewayId: string;
+  priority: number;
+  weight: number;
+  concurrencyCap: number;
+  status: LineGroupStatus;
+  createdAt: Date;
+  updatedAt: Date;
+  vendorGateway: {
+    id: string;
+    vendorId: string;
+    name: string;
+    status: LineGroupStatus;
+    concurrencyLimit: number;
+    cpsLimit: number;
+    vendor: { name: string };
+  };
+};
+
+type LineGroupRecord = {
+  id: string;
+  name: string;
+  status: LineGroupStatus;
+  notes: string | null;
+  createdAt: Date;
+  updatedAt: Date;
+  items: LineGroupItemRecord[];
+  _count: { policies: number };
+};
+
+function lineGroupId(): string {
+  return `llg_${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
+}
+
+function lineGroupItemId(): string {
+  return `llgi_${crypto.randomUUID().replaceAll('-', '').slice(0, 27)}`;
+}
+
+function outboxId(): string {
+  return `out_${crypto.randomUUID().replaceAll('-', '').slice(0, 36)}`;
+}
+
+@Injectable()
+export class PrismaLandingLineGroupsRepository implements LandingLineGroupsRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async list(): Promise<LineGroupSummary[]> {
+    const groups = await this.prisma.landingLineGroup.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ createdAt: 'desc' }],
+      include: this.includeSummary()
+    });
+    return groups.map((group) => this.toSummary(group));
+  }
+
+  async get(lineGroupIdValue: string): Promise<LineGroupSummary> {
+    return this.toSummary(await this.findActiveOrThrow(lineGroupIdValue));
+  }
+
+  async create(input: CreateLineGroupInput): Promise<LineGroupSummary> {
+    try {
+      const group = await this.prisma.$transaction(async (tx) => {
+        const created = await tx.landingLineGroup.create({
+          data: {
+            id: lineGroupId(),
+            name: input.name,
+            status: input.status,
+            notes: input.notes,
+            createdBy: input.actorId,
+            updatedBy: input.actorId
+          },
+          include: this.includeSummary()
+        });
+        await this.enqueueConfigOutbox(tx, created.id, 'line_group.changed');
+        return created;
+      });
+      return this.toSummary(group);
+    } catch (error) {
+      this.handleUniqueConflict(error);
+      throw error;
+    }
+  }
+
+  async update(lineGroupIdValue: string, input: UpdateLineGroupInput): Promise<LineGroupSummary> {
+    await this.findActiveOrThrow(lineGroupIdValue);
+    try {
+      const group = await this.prisma.$transaction(async (tx) => {
+        const updated = await tx.landingLineGroup.update({
+          where: { id: lineGroupIdValue },
+          data: {
+            name: input.name,
+            status: input.status,
+            notes: input.notes,
+            updatedBy: input.actorId,
+            version: { increment: 1 }
+          },
+          include: this.includeSummary()
+        });
+        await this.enqueueConfigOutbox(tx, updated.id, 'line_group.changed');
+        return updated;
+      });
+      return this.toSummary(group);
+    } catch (error) {
+      this.handleUniqueConflict(error);
+      throw error;
+    }
+  }
+
+  async setStatus(lineGroupIdValue: string, status: LineGroupStatus, actorId?: string): Promise<LineGroupSummary> {
+    return this.update(lineGroupIdValue, { status, actorId });
+  }
+
+  async softDelete(lineGroupIdValue: string, actorId?: string): Promise<LineGroupSummary> {
+    await this.findActiveOrThrow(lineGroupIdValue);
+    const linkedPolicies = await this.prisma.customerGatewayPolicy.count({
+      where: { lineGroupId: lineGroupIdValue, deletedAt: null }
+    });
+    if (linkedPolicies > 0) {
+      throw new BadRequestException({ code: 'LINE_GROUP_IN_USE', message: 'Line group referenced by active policies cannot be deleted.' });
+    }
+
+    const group = await this.prisma.$transaction(async (tx) => {
+      const deleted = await tx.landingLineGroup.update({
+        where: { id: lineGroupIdValue },
+        data: {
+          status: 'DISABLED',
+          deletedAt: new Date(),
+          updatedBy: actorId,
+          version: { increment: 1 }
+        },
+        include: this.includeSummary()
+      });
+      await this.enqueueConfigOutbox(tx, deleted.id, 'line_group.deleted');
+      return deleted;
+    });
+    return this.toSummary(group);
+  }
+
+  async addItem(input: AddLineGroupItemInput): Promise<LineGroupSummary> {
+    await this.findActiveOrThrow(input.lineGroupId);
+    await this.ensureVendorGateway(input.vendorGatewayId);
+    const priority = input.priority ?? (await this.nextPriority(input.lineGroupId));
+
+    try {
+      await this.prisma.$transaction(async (tx) => {
+        await tx.landingLineGroupItem.create({
+          data: {
+            id: lineGroupItemId(),
+            lineGroupId: input.lineGroupId,
+            vendorGatewayId: input.vendorGatewayId,
+            priority,
+            weight: input.weight,
+            concurrencyCap: input.concurrencyCap,
+            status: input.status,
+            createdBy: input.actorId,
+            updatedBy: input.actorId
+          }
+        });
+        await this.enqueueConfigOutbox(tx, input.lineGroupId, 'line_group_item.changed');
+      });
+      return this.get(input.lineGroupId);
+    } catch (error) {
+      this.handleUniqueConflict(error);
+      throw error;
+    }
+  }
+
+  async updateItem(itemId: string, input: UpdateLineGroupItemInput): Promise<LineGroupItemSummary> {
+    const existing = await this.findItemOrThrow(itemId);
+    try {
+      const item = await this.prisma.$transaction(async (tx) => {
+        const updated = await tx.landingLineGroupItem.update({
+          where: { id: itemId },
+          data: {
+            priority: input.priority,
+            weight: input.weight,
+            concurrencyCap: input.concurrencyCap,
+            status: input.status,
+            updatedBy: input.actorId,
+            version: { increment: 1 }
+          },
+          include: this.includeItem()
+        });
+        await this.enqueueConfigOutbox(tx, existing.lineGroupId, 'line_group_item.changed');
+        return updated;
+      });
+      return this.toItemSummary(item);
+    } catch (error) {
+      this.handleUniqueConflict(error);
+      throw error;
+    }
+  }
+
+  async removeItem(lineGroupIdValue: string, vendorGatewayId: string, actorId?: string): Promise<LineGroupSummary> {
+    await this.findActiveOrThrow(lineGroupIdValue);
+    const item = await this.prisma.landingLineGroupItem.findUnique({
+      where: { lineGroupId_vendorGatewayId: { lineGroupId: lineGroupIdValue, vendorGatewayId } },
+      select: { id: true }
+    });
+    if (!item) {
+      throw new NotFoundException({ code: 'LINE_GROUP_ITEM_NOT_FOUND', message: 'Line group item not found.' });
+    }
+
+    await this.prisma.$transaction(async (tx) => {
+      await tx.landingLineGroupItem.delete({ where: { id: item.id } });
+      await tx.landingLineGroup.update({
+        where: { id: lineGroupIdValue },
+        data: { updatedBy: actorId, version: { increment: 1 } }
+      });
+      await this.enqueueConfigOutbox(tx, lineGroupIdValue, 'line_group_item.deleted');
+    });
+    return this.get(lineGroupIdValue);
+  }
+
+  async reorderItems(lineGroupIdValue: string, itemIds: string[], actorId?: string): Promise<LineGroupSummary> {
+    await this.findActiveOrThrow(lineGroupIdValue);
+    const current = await this.prisma.landingLineGroupItem.findMany({
+      where: { lineGroupId: lineGroupIdValue },
+      select: { id: true }
+    });
+    const currentIds = current.map((item) => item.id).sort();
+    const requestedIds = [...itemIds].sort();
+    if (currentIds.length !== requestedIds.length || currentIds.some((id, index) => id !== requestedIds[index])) {
+      throw new BadRequestException({ code: 'LINE_GROUP_ITEM_REORDER_SET_MISMATCH', message: 'Reorder must include every item exactly once.' });
+    }
+    if (new Set(itemIds).size !== itemIds.length) {
+      throw new BadRequestException({ code: 'LINE_GROUP_ITEM_REORDER_DUPLICATE', message: 'Item ids must be unique.' });
+    }
+
+    await this.prisma.$transaction(async (tx) => {
+      for (let index = 0; index < itemIds.length; index += 1) {
+        await tx.landingLineGroupItem.update({
+          where: { id: itemIds[index] },
+          data: {
+            priority: -(index + 1),
+            updatedBy: actorId,
+            version: { increment: 1 }
+          }
+        });
+      }
+      for (let index = 0; index < itemIds.length; index += 1) {
+        await tx.landingLineGroupItem.update({
+          where: { id: itemIds[index] },
+          data: { priority: index + 1 }
+        });
+      }
+      await tx.landingLineGroup.update({
+        where: { id: lineGroupIdValue },
+        data: { updatedBy: actorId, version: { increment: 1 } }
+      });
+      await this.enqueueConfigOutbox(tx, lineGroupIdValue, 'line_group_items.reordered');
+    });
+    return this.get(lineGroupIdValue);
+  }
+
+  private includeItem() {
+    return {
+      vendorGateway: {
+        include: {
+          vendor: { select: { name: true } }
+        }
+      }
+    } satisfies Prisma.LandingLineGroupItemInclude;
+  }
+
+  private includeSummary() {
+    return {
+      items: {
+        orderBy: [{ priority: 'asc' }],
+        include: this.includeItem()
+      },
+      _count: {
+        select: {
+          policies: {
+            where: { deletedAt: null }
+          }
+        }
+      }
+    } satisfies Prisma.LandingLineGroupInclude;
+  }
+
+  private async ensureVendorGateway(vendorGatewayId: string): Promise<void> {
+    const gateway = await this.prisma.vendorGateway.findUnique({
+      where: { id: vendorGatewayId },
+      select: { id: true, deletedAt: true }
+    });
+    if (!gateway || gateway.deletedAt) {
+      throw new NotFoundException({ code: 'VENDOR_GATEWAY_NOT_FOUND', message: 'Vendor gateway not found.' });
+    }
+  }
+
+  private async findActiveOrThrow(lineGroupIdValue: string) {
+    const group = await this.prisma.landingLineGroup.findUnique({
+      where: { id: lineGroupIdValue },
+      include: this.includeSummary()
+    });
+    if (!group || group.deletedAt) {
+      throw new NotFoundException({ code: 'LINE_GROUP_NOT_FOUND', message: 'Landing line group not found.' });
+    }
+    return group;
+  }
+
+  private async findItemOrThrow(itemId: string) {
+    const item = await this.prisma.landingLineGroupItem.findUnique({
+      where: { id: itemId },
+      include: this.includeItem()
+    });
+    if (!item) {
+      throw new NotFoundException({ code: 'LINE_GROUP_ITEM_NOT_FOUND', message: 'Line group item not found.' });
+    }
+    const group = await this.prisma.landingLineGroup.findUnique({
+      where: { id: item.lineGroupId },
+      select: { deletedAt: true }
+    });
+    if (!group || group.deletedAt) {
+      throw new NotFoundException({ code: 'LINE_GROUP_NOT_FOUND', message: 'Landing line group not found.' });
+    }
+    return item;
+  }
+
+  private async nextPriority(lineGroupIdValue: string): Promise<number> {
+    const aggregate = await this.prisma.landingLineGroupItem.aggregate({
+      where: { lineGroupId: lineGroupIdValue },
+      _max: { priority: true }
+    });
+    return (aggregate._max.priority ?? 0) + 1;
+  }
+
+  private async enqueueConfigOutbox(tx: Prisma.TransactionClient, lineGroupIdValue: string, eventType: string): Promise<void> {
+    await tx.outboxEvent.create({
+      data: {
+        id: outboxId(),
+        aggregateType: 'line_group_config',
+        aggregateId: lineGroupIdValue,
+        eventType,
+        payload: { lineGroupId: lineGroupIdValue, eventType }
+      }
+    });
+  }
+
+  private toSummary(group: LineGroupRecord): LineGroupSummary {
+    const items = group.items.map((item) => this.toItemSummary(item));
+    const enabledItems = items.filter((item) => item.status === 'ENABLED');
+    return {
+      id: group.id,
+      name: group.name,
+      status: group.status,
+      notes: group.notes,
+      itemCount: items.length,
+      enabledItemCount: enabledItems.length,
+      concurrencyCapSum: enabledItems.reduce((sum, item) => sum + item.concurrencyCap, 0),
+      gatewayConcurrencyLimitSum: enabledItems.reduce((sum, item) => sum + item.vendorGatewayConcurrencyLimit, 0),
+      policyCount: group._count.policies,
+      items,
+      createdAt: group.createdAt,
+      updatedAt: group.updatedAt
+    };
+  }
+
+  private toItemSummary(item: LineGroupItemRecord): LineGroupItemSummary {
+    return {
+      id: item.id,
+      lineGroupId: item.lineGroupId,
+      vendorGatewayId: item.vendorGatewayId,
+      vendorGatewayName: item.vendorGateway.name,
+      vendorId: item.vendorGateway.vendorId,
+      vendorName: item.vendorGateway.vendor.name,
+      vendorGatewayStatus: item.vendorGateway.status,
+      vendorGatewayConcurrencyLimit: item.vendorGateway.concurrencyLimit,
+      vendorGatewayCpsLimit: item.vendorGateway.cpsLimit,
+      priority: item.priority,
+      weight: item.weight,
+      concurrencyCap: item.concurrencyCap,
+      status: item.status,
+      createdAt: item.createdAt,
+      updatedAt: item.updatedAt
+    };
+  }
+
+  private handleUniqueConflict(error: unknown): void {
+    if (error && typeof error === 'object' && 'code' in error && (error as { code?: unknown }).code === 'P2002') {
+      throw new ConflictException({ code: 'LINE_GROUP_CONFLICT', message: 'Line group name, member gateway, or priority already exists.' });
+    }
+  }
+}
diff --git a/apps/api/src/modules/landing-line-groups/landing-line-groups.service.ts b/apps/api/src/modules/landing-line-groups/landing-line-groups.service.ts
new file mode 100644
index 0000000..d2969ce
--- /dev/null
+++ b/apps/api/src/modules/landing-line-groups/landing-line-groups.service.ts
@@ -0,0 +1,166 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import {
+  LANDING_LINE_GROUPS_REPOSITORY,
+  type AddLineGroupItemInput,
+  type CreateLineGroupInput,
+  type LandingLineGroupsRepository,
+  type LineGroupItemSummary,
+  type LineGroupStatus,
+  type LineGroupSummary,
+  type UpdateLineGroupInput,
+  type UpdateLineGroupItemInput
+} from './landing-line-groups.repository.js';
+
+interface CreateLineGroupDto {
+  name?: unknown;
+  status?: unknown;
+  notes?: unknown;
+}
+
+interface UpdateLineGroupDto {
+  name?: unknown;
+  status?: unknown;
+  notes?: unknown;
+}
+
+interface AddItemDto {
+  vendorGatewayId?: unknown;
+  priority?: unknown;
+  weight?: unknown;
+  concurrencyCap?: unknown;
+  status?: unknown;
+}
+
+interface UpdateItemDto {
+  priority?: unknown;
+  weight?: unknown;
+  concurrencyCap?: unknown;
+  status?: unknown;
+}
+
+interface ReorderItemsDto {
+  itemIds?: unknown;
+}
+
+@Injectable()
+export class LandingLineGroupsService {
+  constructor(@Inject(LANDING_LINE_GROUPS_REPOSITORY) private readonly lineGroups: LandingLineGroupsRepository) {}
+
+  list(): Promise<LineGroupSummary[]> {
+    return this.lineGroups.list();
+  }
+
+  get(lineGroupId: string): Promise<LineGroupSummary> {
+    return this.lineGroups.get(lineGroupId);
+  }
+
+  create(body: CreateLineGroupDto, actorId?: string): Promise<LineGroupSummary> {
+    const input: CreateLineGroupInput = {
+      name: this.limitedString(body.name, 'name', 120),
+      status: body.status === undefined ? 'ENABLED' : this.status(body.status),
+      notes: this.optionalString(body.notes, 'notes', 500),
+      actorId
+    };
+    return this.lineGroups.create(input);
+  }
+
+  update(lineGroupId: string, body: UpdateLineGroupDto, actorId?: string): Promise<LineGroupSummary> {
+    const input: UpdateLineGroupInput = {
+      name: body.name === undefined ? undefined : this.limitedString(body.name, 'name', 120),
+      status: body.status === undefined ? undefined : this.status(body.status),
+      notes: body.notes === undefined ? undefined : this.nullableString(body.notes, 'notes', 500),
+      actorId
+    };
+    return this.lineGroups.update(lineGroupId, input);
+  }
+
+  enable(lineGroupId: string, actorId?: string): Promise<LineGroupSummary> {
+    return this.lineGroups.setStatus(lineGroupId, 'ENABLED', actorId);
+  }
+
+  disable(lineGroupId: string, actorId?: string): Promise<LineGroupSummary> {
+    return this.lineGroups.setStatus(lineGroupId, 'DISABLED', actorId);
+  }
+
+  remove(lineGroupId: string, actorId?: string): Promise<LineGroupSummary> {
+    return this.lineGroups.softDelete(lineGroupId, actorId);
+  }
+
+  addItem(lineGroupId: string, body: AddItemDto, actorId?: string): Promise<LineGroupSummary> {
+    const input: AddLineGroupItemInput = {
+      lineGroupId,
+      vendorGatewayId: this.limitedString(body.vendorGatewayId, 'vendorGatewayId', 32),
+      priority: body.priority === undefined ? undefined : this.positiveInteger(body.priority, 'priority', 1, 10000),
+      weight: body.weight === undefined ? 1 : this.positiveInteger(body.weight, 'weight', 1, 1000),
+      concurrencyCap: body.concurrencyCap === undefined ? 0 : this.positiveInteger(body.concurrencyCap, 'concurrencyCap', 0, 100000),
+      status: body.status === undefined ? 'ENABLED' : this.status(body.status),
+      actorId
+    };
+    return this.lineGroups.addItem(input);
+  }
+
+  updateItem(itemId: string, body: UpdateItemDto, actorId?: string): Promise<LineGroupItemSummary> {
+    const input: UpdateLineGroupItemInput = {
+      priority: body.priority === undefined ? undefined : this.positiveInteger(body.priority, 'priority', 1, 10000),
+      weight: body.weight === undefined ? undefined : this.positiveInteger(body.weight, 'weight', 1, 1000),
+      concurrencyCap: body.concurrencyCap === undefined ? undefined : this.positiveInteger(body.concurrencyCap, 'concurrencyCap', 0, 100000),
+      status: body.status === undefined ? undefined : this.status(body.status),
+      actorId
+    };
+    return this.lineGroups.updateItem(itemId, input);
+  }
+
+  removeItem(lineGroupId: string, vendorGatewayId: string, actorId?: string): Promise<LineGroupSummary> {
+    return this.lineGroups.removeItem(lineGroupId, vendorGatewayId, actorId);
+  }
+
+  reorderItems(lineGroupId: string, body: ReorderItemsDto, actorId?: string): Promise<LineGroupSummary> {
+    if (!Array.isArray(body.itemIds) || body.itemIds.length === 0) {
+      throw new BadRequestException({ code: 'LINE_GROUP_ITEM_IDS_INVALID', message: 'itemIds must be a non-empty array.' });
+    }
+    return this.lineGroups.reorderItems(
+      lineGroupId,
+      body.itemIds.map((id) => this.limitedString(id, 'itemIds', 32)),
+      actorId
+    );
+  }
+
+  private limitedString(value: unknown, field: string, maxLength: number): string {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is required.` });
+    }
+    const trimmed = value.trim();
+    if (trimmed.length > maxLength) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is too long.` });
+    }
+    return trimmed;
+  }
+
+  private optionalString(value: unknown, field: string, maxLength: number): string | undefined {
+    if (value === undefined) {
+      return undefined;
+    }
+    return this.limitedString(value, field, maxLength);
+  }
+
+  private nullableString(value: unknown, field: string, maxLength: number): string | null {
+    if (value === null) {
+      return null;
+    }
+    return this.limitedString(value, field, maxLength);
+  }
+
+  private positiveInteger(value: unknown, field: string, min: number, max: number): number {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < min || value > max) {
+      throw new BadRequestException({ code: 'INTEGER_INVALID', message: `${field} must be an integer from ${min} to ${max}.` });
+    }
+    return value;
+  }
+
+  private status(value: unknown): LineGroupStatus {
+    if (value !== 'ENABLED' && value !== 'DISABLED') {
+      throw new BadRequestException({ code: 'STATUS_INVALID', message: 'Status is invalid.' });
+    }
+    return value;
+  }
+}
diff --git a/apps/api/src/modules/quality/quality.controller.ts b/apps/api/src/modules/quality/quality.controller.ts
new file mode 100644
index 0000000..45cac89
--- /dev/null
+++ b/apps/api/src/modules/quality/quality.controller.ts
@@ -0,0 +1,58 @@
+import { Body, Controller, Delete, Get, Inject, Param, Patch, Post } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { QualityService } from './quality.service.js';
+
+@ApiTags('quality')
+@Controller('quality')
+export class QualityController {
+  constructor(@Inject(QualityService) private readonly qualityService: QualityService) {}
+
+  @Get('rules')
+  @RequirePermissions('quality.view')
+  listRules() {
+    return this.qualityService.listRules();
+  }
+
+  @Get('rules/:id')
+  @RequirePermissions('quality.view')
+  getRule(@Param('id') id: string) {
+    return this.qualityService.getRule(id);
+  }
+
+  @Post('rules')
+  @RequirePermissions('quality.manage')
+  @AuditAction({ module: 'quality', action: 'rule_create', objectType: 'quality_sampling_rule' })
+  createRule(@Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.qualityService.createRule(body as never, currentUser?.id);
+  }
+
+  @Patch('rules/:id')
+  @RequirePermissions('quality.manage')
+  @AuditAction({ module: 'quality', action: 'rule_update', objectType: 'quality_sampling_rule', objectIdParam: 'id' })
+  updateRule(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.qualityService.updateRule(id, body as never, currentUser?.id);
+  }
+
+  @Post('rules/:id/enable')
+  @RequirePermissions('quality.manage')
+  @AuditAction({ module: 'quality', action: 'rule_enable', objectType: 'quality_sampling_rule', objectIdParam: 'id' })
+  enableRule(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.qualityService.enableRule(id, currentUser?.id);
+  }
+
+  @Post('rules/:id/disable')
+  @RequirePermissions('quality.manage')
+  @AuditAction({ module: 'quality', action: 'rule_disable', objectType: 'quality_sampling_rule', objectIdParam: 'id' })
+  disableRule(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.qualityService.disableRule(id, currentUser?.id);
+  }
+
+  @Delete('rules/:id')
+  @RequirePermissions('quality.manage')
+  @AuditAction({ module: 'quality', action: 'rule_delete', objectType: 'quality_sampling_rule', objectIdParam: 'id' })
+  deleteRule(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.qualityService.deleteRule(id, currentUser?.id);
+  }
+}
diff --git a/apps/api/src/modules/quality/quality.module.ts b/apps/api/src/modules/quality/quality.module.ts
new file mode 100644
index 0000000..710e942
--- /dev/null
+++ b/apps/api/src/modules/quality/quality.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { QualityController } from './quality.controller.js';
+import { PrismaQualityRepository, QUALITY_REPOSITORY } from './quality.repository.js';
+import { QualityService } from './quality.service.js';
+
+@Module({
+  controllers: [QualityController],
+  providers: [
+    QualityService,
+    {
+      provide: QUALITY_REPOSITORY,
+      useClass: PrismaQualityRepository
+    }
+  ],
+  exports: [QualityService]
+})
+export class QualityModule {}
diff --git a/apps/api/src/modules/quality/quality.repository.ts b/apps/api/src/modules/quality/quality.repository.ts
new file mode 100644
index 0000000..d3a73a8
--- /dev/null
+++ b/apps/api/src/modules/quality/quality.repository.ts
@@ -0,0 +1,231 @@
+import { ConflictException, Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export type QualityRuleStatus = 'ENABLED' | 'DISABLED';
+
+export interface QualityRuleSummary {
+  id: string;
+  name: string;
+  customerId: string | null;
+  customerName: string | null;
+  lineGroupId: string | null;
+  lineGroupName: string | null;
+  ratio: string;
+  status: QualityRuleStatus;
+  effectiveAt: Date;
+  expiresAt: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface CreateQualityRuleInput {
+  name: string;
+  customerId?: string | null;
+  lineGroupId?: string | null;
+  ratio: string;
+  status: QualityRuleStatus;
+  effectiveAt?: Date;
+  expiresAt?: Date | null;
+  actorId?: string;
+}
+
+export interface UpdateQualityRuleInput {
+  name?: string;
+  customerId?: string | null;
+  lineGroupId?: string | null;
+  ratio?: string;
+  status?: QualityRuleStatus;
+  effectiveAt?: Date;
+  expiresAt?: Date | null;
+  actorId?: string;
+}
+
+export interface ActiveQualityRule {
+  id: string;
+  name: string;
+  customerId: string | null;
+  lineGroupId: string | null;
+  ratio: string;
+}
+
+export const QUALITY_REPOSITORY = Symbol('QUALITY_REPOSITORY');
+
+export interface QualityRepository {
+  listRules(): Promise<QualityRuleSummary[]>;
+  getRule(ruleId: string): Promise<QualityRuleSummary>;
+  createRule(input: CreateQualityRuleInput): Promise<QualityRuleSummary>;
+  updateRule(ruleId: string, input: UpdateQualityRuleInput): Promise<QualityRuleSummary>;
+  setRuleStatus(ruleId: string, status: QualityRuleStatus, actorId?: string): Promise<QualityRuleSummary>;
+  softDeleteRule(ruleId: string, actorId?: string): Promise<QualityRuleSummary>;
+  listActiveRules(now: Date): Promise<ActiveQualityRule[]>;
+}
+
+type QualityRuleRecord = {
+  id: string;
+  name: string;
+  customerId: string | null;
+  lineGroupId: string | null;
+  ratio: Prisma.Decimal;
+  status: QualityRuleStatus;
+  effectiveAt: Date;
+  expiresAt: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+  customer: { name: string } | null;
+  lineGroup: { name: string } | null;
+};
+
+@Injectable()
+export class PrismaQualityRepository implements QualityRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async listRules(): Promise<QualityRuleSummary[]> {
+    const rules = await this.prisma.qualitySamplingRule.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ createdAt: 'desc' }],
+      include: this.includeRule()
+    });
+    return rules.map((rule) => this.toRuleSummary(rule));
+  }
+
+  async getRule(ruleId: string): Promise<QualityRuleSummary> {
+    return this.toRuleSummary(await this.findRuleOrThrow(ruleId));
+  }
+
+  async createRule(input: CreateQualityRuleInput): Promise<QualityRuleSummary> {
+    try {
+      const created = await this.prisma.qualitySamplingRule.create({
+        data: {
+          id: qualityRuleId(),
+          name: input.name,
+          customerId: input.customerId,
+          lineGroupId: input.lineGroupId,
+          ratio: input.ratio,
+          status: input.status,
+          effectiveAt: input.effectiveAt,
+          expiresAt: input.expiresAt,
+          createdBy: input.actorId,
+          updatedBy: input.actorId
+        },
+        include: this.includeRule()
+      });
+      return this.toRuleSummary(created);
+    } catch (error) {
+      this.handleForeignKey(error);
+      throw error;
+    }
+  }
+
+  async updateRule(ruleId: string, input: UpdateQualityRuleInput): Promise<QualityRuleSummary> {
+    await this.findRuleOrThrow(ruleId);
+    try {
+      const updated = await this.prisma.qualitySamplingRule.update({
+        where: { id: ruleId },
+        data: {
+          name: input.name,
+          customerId: input.customerId,
+          lineGroupId: input.lineGroupId,
+          ratio: input.ratio,
+          status: input.status,
+          effectiveAt: input.effectiveAt,
+          expiresAt: input.expiresAt,
+          updatedBy: input.actorId,
+          version: { increment: 1 }
+        },
+        include: this.includeRule()
+      });
+      return this.toRuleSummary(updated);
+    } catch (error) {
+      this.handleForeignKey(error);
+      throw error;
+    }
+  }
+
+  setRuleStatus(ruleId: string, status: QualityRuleStatus, actorId?: string): Promise<QualityRuleSummary> {
+    return this.updateRule(ruleId, { status, actorId });
+  }
+
+  async softDeleteRule(ruleId: string, actorId?: string): Promise<QualityRuleSummary> {
+    await this.findRuleOrThrow(ruleId);
+    const deleted = await this.prisma.qualitySamplingRule.update({
+      where: { id: ruleId },
+      data: {
+        status: 'DISABLED',
+        deletedAt: new Date(),
+        updatedBy: actorId,
+        version: { increment: 1 }
+      },
+      include: this.includeRule()
+    });
+    return this.toRuleSummary(deleted);
+  }
+
+  async listActiveRules(now: Date): Promise<ActiveQualityRule[]> {
+    const rules = await this.prisma.qualitySamplingRule.findMany({
+      where: {
+        deletedAt: null,
+        status: 'ENABLED',
+        effectiveAt: { lte: now },
+        OR: [{ expiresAt: null }, { expiresAt: { gt: now } }]
+      },
+      select: {
+        id: true,
+        name: true,
+        customerId: true,
+        lineGroupId: true,
+        ratio: true
+      }
+    });
+    return rules.map((rule) => ({
+      ...rule,
+      ratio: rule.ratio.toFixed(2)
+    }));
+  }
+
+  private includeRule() {
+    return {
+      customer: { select: { name: true } },
+      lineGroup: { select: { name: true } }
+    } satisfies Prisma.QualitySamplingRuleInclude;
+  }
+
+  private async findRuleOrThrow(ruleId: string): Promise<QualityRuleRecord> {
+    const rule = await this.prisma.qualitySamplingRule.findUnique({
+      where: { id: ruleId },
+      include: this.includeRule()
+    });
+    if (!rule || rule.deletedAt) {
+      throw new NotFoundException({ code: 'QUALITY_RULE_NOT_FOUND', message: 'Quality sampling rule not found.' });
+    }
+    return rule;
+  }
+
+  private toRuleSummary(rule: QualityRuleRecord): QualityRuleSummary {
+    return {
+      id: rule.id,
+      name: rule.name,
+      customerId: rule.customerId,
+      customerName: rule.customer?.name ?? null,
+      lineGroupId: rule.lineGroupId,
+      lineGroupName: rule.lineGroup?.name ?? null,
+      ratio: rule.ratio.toFixed(2),
+      status: rule.status,
+      effectiveAt: rule.effectiveAt,
+      expiresAt: rule.expiresAt,
+      createdAt: rule.createdAt,
+      updatedAt: rule.updatedAt
+    };
+  }
+
+  private handleForeignKey(error: unknown): void {
+    if (error && typeof error === 'object' && 'code' in error && (error as { code?: unknown }).code === 'P2003') {
+      throw new ConflictException({ code: 'QUALITY_RULE_REFERENCE_INVALID', message: 'Referenced customer or line group does not exist.' });
+    }
+  }
+}
+
+function qualityRuleId(): string {
+  return `qsr_${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
+}
diff --git a/apps/api/src/modules/quality/quality.service.ts b/apps/api/src/modules/quality/quality.service.ts
new file mode 100644
index 0000000..8887ecf
--- /dev/null
+++ b/apps/api/src/modules/quality/quality.service.ts
@@ -0,0 +1,182 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import {
+  QUALITY_REPOSITORY,
+  type ActiveQualityRule,
+  type CreateQualityRuleInput,
+  type QualityRepository,
+  type QualityRuleStatus,
+  type QualityRuleSummary,
+  type UpdateQualityRuleInput
+} from './quality.repository.js';
+import { stableSamplingDecision } from './sampling.js';
+
+interface QualityRuleBody {
+  name?: unknown;
+  customerId?: unknown;
+  lineGroupId?: unknown;
+  ratio?: unknown;
+  status?: unknown;
+  effectiveAt?: unknown;
+  expiresAt?: unknown;
+}
+
+export interface RecordingSamplingContext {
+  recordingId: string;
+  customerId: string | null;
+  lineGroupId: string | null;
+}
+
+export interface RecordingSamplingMatch {
+  ruleId: string;
+  ruleName: string;
+  ratio: string;
+  score: number;
+  selected: boolean;
+}
+
+@Injectable()
+export class QualityService {
+  constructor(@Inject(QUALITY_REPOSITORY) private readonly quality: QualityRepository) {}
+
+  listRules(): Promise<QualityRuleSummary[]> {
+    return this.quality.listRules();
+  }
+
+  getRule(ruleId: string): Promise<QualityRuleSummary> {
+    return this.quality.getRule(ruleId);
+  }
+
+  createRule(body: QualityRuleBody, actorId?: string): Promise<QualityRuleSummary> {
+    const effectiveAt = body.effectiveAt === undefined ? undefined : this.date(body.effectiveAt, 'effectiveAt');
+    const expiresAt = body.expiresAt === undefined ? undefined : this.nullableDate(body.expiresAt, 'expiresAt');
+    this.ensureDateRange(effectiveAt, expiresAt);
+    const input: CreateQualityRuleInput = {
+      name: this.limitedString(body.name, 'name', 120),
+      customerId: this.nullableId(body.customerId, 'customerId', 32),
+      lineGroupId: this.nullableId(body.lineGroupId, 'lineGroupId', 32),
+      ratio: this.ratio(body.ratio),
+      status: body.status === undefined ? 'ENABLED' : this.status(body.status),
+      effectiveAt,
+      expiresAt,
+      actorId
+    };
+    return this.quality.createRule(input);
+  }
+
+  updateRule(ruleId: string, body: QualityRuleBody, actorId?: string): Promise<QualityRuleSummary> {
+    const effectiveAt = body.effectiveAt === undefined ? undefined : this.date(body.effectiveAt, 'effectiveAt');
+    const expiresAt = body.expiresAt === undefined ? undefined : this.nullableDate(body.expiresAt, 'expiresAt');
+    this.ensureDateRange(effectiveAt, expiresAt);
+    const input: UpdateQualityRuleInput = {
+      name: body.name === undefined ? undefined : this.limitedString(body.name, 'name', 120),
+      customerId: body.customerId === undefined ? undefined : this.nullableId(body.customerId, 'customerId', 32),
+      lineGroupId: body.lineGroupId === undefined ? undefined : this.nullableId(body.lineGroupId, 'lineGroupId', 32),
+      ratio: body.ratio === undefined ? undefined : this.ratio(body.ratio),
+      status: body.status === undefined ? undefined : this.status(body.status),
+      effectiveAt,
+      expiresAt,
+      actorId
+    };
+    return this.quality.updateRule(ruleId, input);
+  }
+
+  enableRule(ruleId: string, actorId?: string): Promise<QualityRuleSummary> {
+    return this.quality.setRuleStatus(ruleId, 'ENABLED', actorId);
+  }
+
+  disableRule(ruleId: string, actorId?: string): Promise<QualityRuleSummary> {
+    return this.quality.setRuleStatus(ruleId, 'DISABLED', actorId);
+  }
+
+  deleteRule(ruleId: string, actorId?: string): Promise<QualityRuleSummary> {
+    return this.quality.softDeleteRule(ruleId, actorId);
+  }
+
+  async samplingFor(context: RecordingSamplingContext, now = new Date()): Promise<{ selected: boolean; matches: RecordingSamplingMatch[] }> {
+    const rules = await this.quality.listActiveRules(now);
+    const matches = this.matchRules(rules, context).map((rule) => {
+      const decision = stableSamplingDecision(rule.id, context.recordingId, rule.ratio);
+      return {
+        ruleId: rule.id,
+        ruleName: rule.name,
+        ratio: rule.ratio,
+        score: decision.score,
+        selected: decision.selected
+      };
+    });
+    return {
+      selected: matches.some((match) => match.selected),
+      matches
+    };
+  }
+
+  private matchRules(rules: ActiveQualityRule[], context: RecordingSamplingContext): ActiveQualityRule[] {
+    return rules.filter((rule) => {
+      const customerMatches = !rule.customerId || rule.customerId === context.customerId;
+      const lineGroupMatches = !rule.lineGroupId || rule.lineGroupId === context.lineGroupId;
+      return customerMatches && lineGroupMatches;
+    });
+  }
+
+  private limitedString(value: unknown, field: string, maxLength: number): string {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is required.` });
+    }
+    const trimmed = value.trim();
+    if (trimmed.length > maxLength) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is too long.` });
+    }
+    return trimmed;
+  }
+
+  private nullableId(value: unknown, field: string, maxLength: number): string | null {
+    if (value === undefined || value === null || value === '') {
+      return null;
+    }
+    return this.limitedString(value, field, maxLength);
+  }
+
+  private ratio(value: unknown): string {
+    const raw = typeof value === 'number' ? value.toString() : typeof value === 'string' ? value.trim() : '';
+    if (!/^(?:100(?:\.0{1,2})?|\d{1,2}(?:\.\d{1,2})?)$/.test(raw)) {
+      throw new BadRequestException({ code: 'QUALITY_RATIO_INVALID', message: 'ratio must be from 0 to 100 with up to 2 decimals.' });
+    }
+    const numeric = Number.parseFloat(raw);
+    if (!Number.isFinite(numeric) || numeric < 0 || numeric > 100) {
+      throw new BadRequestException({ code: 'QUALITY_RATIO_INVALID', message: 'ratio must be from 0 to 100 with up to 2 decimals.' });
+    }
+    const [integerPart, fractionPart = ''] = raw.split('.');
+    return `${integerPart}.${fractionPart.padEnd(2, '0')}`;
+  }
+
+  private status(value: unknown): QualityRuleStatus {
+    if (value !== 'ENABLED' && value !== 'DISABLED') {
+      throw new BadRequestException({ code: 'STATUS_INVALID', message: 'status is invalid.' });
+    }
+    return value;
+  }
+
+  private date(value: unknown, field: string): Date {
+    if (typeof value !== 'string') {
+      throw new BadRequestException({ code: 'DATE_INVALID', message: `${field} must be an ISO date string.` });
+    }
+    const parsed = new Date(value);
+    if (Number.isNaN(parsed.getTime())) {
+      throw new BadRequestException({ code: 'DATE_INVALID', message: `${field} must be an ISO date string.` });
+    }
+    return parsed;
+  }
+
+  private nullableDate(value: unknown, field: string): Date | null {
+    if (value === null || value === '') {
+      return null;
+    }
+    return this.date(value, field);
+  }
+
+  private ensureDateRange(effectiveAt?: Date, expiresAt?: Date | null): void {
+    if (effectiveAt && expiresAt && expiresAt <= effectiveAt) {
+      throw new BadRequestException({ code: 'QUALITY_RULE_DATE_RANGE_INVALID', message: 'expiresAt must be after effectiveAt.' });
+    }
+  }
+}
diff --git a/apps/api/src/modules/quality/sampling.spec.ts b/apps/api/src/modules/quality/sampling.spec.ts
new file mode 100644
index 0000000..0b77eb4
--- /dev/null
+++ b/apps/api/src/modules/quality/sampling.spec.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest';
+import { stableSamplingDecision, stableSamplingScore } from './sampling.js';
+
+describe('stable quality sampling', () => {
+  it('returns a stable score for the same rule and recording', () => {
+    const first = stableSamplingScore('rule-a', 'rec-a');
+    const second = stableSamplingScore('rule-a', 'rec-a');
+    expect(first).toBe(second);
+    expect(first).toBeGreaterThanOrEqual(0);
+    expect(first).toBeLessThan(100);
+  });
+
+  it('honors ratio boundaries', () => {
+    expect(stableSamplingDecision('rule-a', 'rec-a', '0.00').selected).toBe(false);
+    expect(stableSamplingDecision('rule-a', 'rec-a', '100.00').selected).toBe(true);
+  });
+});
diff --git a/apps/api/src/modules/quality/sampling.ts b/apps/api/src/modules/quality/sampling.ts
new file mode 100644
index 0000000..372b5f6
--- /dev/null
+++ b/apps/api/src/modules/quality/sampling.ts
@@ -0,0 +1,24 @@
+import crypto from 'node:crypto';
+
+export interface SamplingDecision {
+  score: number;
+  selected: boolean;
+}
+
+export function stableSamplingDecision(ruleId: string, recordingId: string, ratio: string | number): SamplingDecision {
+  const normalizedRatio = typeof ratio === 'number' ? ratio : Number.parseFloat(ratio);
+  if (!Number.isFinite(normalizedRatio) || normalizedRatio <= 0) {
+    return { score: stableSamplingScore(ruleId, recordingId), selected: false };
+  }
+  if (normalizedRatio >= 100) {
+    return { score: stableSamplingScore(ruleId, recordingId), selected: true };
+  }
+  const score = stableSamplingScore(ruleId, recordingId);
+  return { score, selected: score < normalizedRatio };
+}
+
+export function stableSamplingScore(ruleId: string, recordingId: string): number {
+  const digest = crypto.createHash('sha256').update(`${ruleId}:${recordingId}`, 'utf8').digest();
+  const value = digest.readUInt32BE(0);
+  return Number(((value / 0x1_0000_0000) * 100).toFixed(4));
+}
diff --git a/apps/api/src/modules/recharges/recharges.controller.ts b/apps/api/src/modules/recharges/recharges.controller.ts
new file mode 100644
index 0000000..5dbdf22
--- /dev/null
+++ b/apps/api/src/modules/recharges/recharges.controller.ts
@@ -0,0 +1,31 @@
+import { Body, Controller, Get, Inject, Param, Post, Query } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { RechargesService } from './recharges.service.js';
+
+@ApiTags('recharges')
+@Controller()
+export class RechargesController {
+  constructor(@Inject(RechargesService) private readonly rechargesService: RechargesService) {}
+
+  @Get('recharges')
+  @RequirePermissions('recharges.view')
+  list(@Query() query: unknown) {
+    return this.rechargesService.list(query as never);
+  }
+
+  @Post('customers/:id/recharges')
+  @RequirePermissions('recharges.manage')
+  @AuditAction({ module: 'recharges', action: 'customer_recharge', objectType: 'customer', objectIdParam: 'id' })
+  rechargeCustomer(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.rechargesService.rechargeCustomer(id, body as never, currentUser?.id);
+  }
+
+  @Post('vendors/:id/recharges')
+  @RequirePermissions('recharges.manage')
+  @AuditAction({ module: 'recharges', action: 'vendor_recharge', objectType: 'vendor', objectIdParam: 'id' })
+  rechargeVendor(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.rechargesService.rechargeVendor(id, body as never, currentUser?.id);
+  }
+}
diff --git a/apps/api/src/modules/recharges/recharges.e2e.spec.ts b/apps/api/src/modules/recharges/recharges.e2e.spec.ts
new file mode 100644
index 0000000..8f805c4
--- /dev/null
+++ b/apps/api/src/modules/recharges/recharges.e2e.spec.ts
@@ -0,0 +1,228 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { ConflictException } from '@nestjs/common';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { signAccessToken, type PermissionKey } from '@lisglosips/auth';
+import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from '../audit/audit.repository.js';
+import { IDENTITY_REPOSITORY, type IdentityRepository } from '../security/identity.repository.js';
+import type { CurrentUser } from '../security/security.metadata.js';
+import {
+  RECHARGES_REPOSITORY,
+  type RechargeInput,
+  type RechargeListQuery,
+  type RechargeListResult,
+  type RechargeSummary,
+  type RechargesRepository
+} from './recharges.repository.js';
+
+class MemoryIdentityRepository implements IdentityRepository {
+  users = new Map<string, CurrentUser>();
+
+  async findCurrentUserById(userId: string): Promise<CurrentUser | null> {
+    return this.users.get(userId) ?? null;
+  }
+}
+
+class MemoryAuditRepository implements AuditRepository {
+  entries: AuditEntryInput[] = [];
+
+  async write(input: AuditEntryInput): Promise<void> {
+    this.entries.push(input);
+  }
+}
+
+class MemoryRechargesRepository implements RechargesRepository {
+  private readonly items: RechargeSummary[] = [];
+  private readonly balances = new Map<string, number>([
+    ['CUSTOMER:cus_seed', 10],
+    ['VENDOR:ven_seed', 20]
+  ]);
+  private readonly idempotency = new Map<string, { scope: string; hash: string; response: RechargeSummary }>();
+
+  async list(query: RechargeListQuery): Promise<RechargeListResult> {
+    const items = this.items.filter((item) => {
+      if (query.accountType && item.accountType !== query.accountType) {
+        return false;
+      }
+
+      return !query.accountId || item.accountId === query.accountId;
+    });
+
+    return {
+      items: items.slice(query.skip, query.skip + query.take),
+      total: items.length
+    };
+  }
+
+  async rechargeCustomer(input: RechargeInput): Promise<RechargeSummary> {
+    return this.recharge('CUSTOMER', 'customer_recharge', input, 'Seed Customer');
+  }
+
+  async rechargeVendor(input: RechargeInput): Promise<RechargeSummary> {
+    return this.recharge('VENDOR', 'vendor_recharge', input, 'Seed Vendor');
+  }
+
+  private async recharge(accountType: 'CUSTOMER' | 'VENDOR', scope: string, input: RechargeInput, accountName: string): Promise<RechargeSummary> {
+    const existing = this.idempotency.get(input.idempotencyKey);
+    if (existing) {
+      if (existing.scope !== scope || existing.hash !== input.requestHash) {
+        throw new ConflictException({ code: 'IDEMPOTENCY_KEY_CONFLICT', message: 'Idempotency key was used by another request.' });
+      }
+
+      return existing.response;
+    }
+
+    const key = `${accountType}:${input.accountId}`;
+    const before = this.balances.get(key) ?? 0;
+    const amount = Number(input.amount);
+    const after = before + amount;
+    this.balances.set(key, after);
+
+    const response: RechargeSummary = {
+      id: `rch_${this.items.length + 1}`,
+      accountType,
+      accountId: input.accountId,
+      accountName,
+      amount: amount.toFixed(6),
+      beforeBalance: before.toFixed(6),
+      afterBalance: after.toFixed(6),
+      idempotencyKey: input.idempotencyKey,
+      remark: input.remark ?? null,
+      status: 'SUCCEEDED',
+      occurredAt: new Date('2026-06-21T02:00:00.000Z'),
+      createdAt: new Date('2026-06-21T02:00:00.000Z'),
+      createdBy: input.actorId ?? null
+    };
+    this.items.unshift(response);
+    this.idempotency.set(input.idempotencyKey, { scope, hash: input.requestHash, response });
+    return response;
+  }
+}
+
+describe('S12 recharges API', () => {
+  let app: NestFastifyApplication;
+  let audit: MemoryAuditRepository;
+
+  const tokenFor = (userId: string) =>
+    signAccessToken(
+      {
+        sub: userId,
+        username: userId,
+        roles: ['test'],
+        typ: 'access'
+      },
+      {
+        secret: 'test-only-access-token-secret-min-32-bytes',
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        ttlSeconds: 900
+      }
+    );
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+    process.env.AUTH_ACCESS_TOKEN_SECRET = 'test-only-access-token-secret-min-32-bytes';
+
+    const identities = new MemoryIdentityRepository();
+    audit = new MemoryAuditRepository();
+
+    identities.users.set('usr_finance', {
+      id: 'usr_finance',
+      username: 'finance',
+      roles: ['财务'],
+      permissions: ['recharges.view', 'recharges.manage', 'customers.view', 'vendors.view'] as PermissionKey[]
+    });
+    identities.users.set('usr_viewer', {
+      id: 'usr_viewer',
+      username: 'viewer',
+      roles: ['只读'],
+      permissions: ['recharges.view'] as PermissionKey[]
+    });
+
+    const { AppModule } = await import('../app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule]
+    })
+      .overrideProvider(IDENTITY_REPOSITORY)
+      .useValue(identities)
+      .overrideProvider(AUDIT_REPOSITORY)
+      .useValue(audit)
+      .overrideProvider(RECHARGES_REPOSITORY)
+      .useValue(new MemoryRechargesRepository())
+      .compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('rejects recharge without recharges.manage', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/customers/cus_seed/recharges')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .send({ amount: '10', idempotencyKey: 'viewer-denied-001' })
+      .expect(403);
+  });
+
+  it('creates customer recharge once and replays idempotent duplicate', async () => {
+    const body = { amount: '15.25', idempotencyKey: 'customer-rch-001', remark: 'manual top up' };
+    const first = await request(app.getHttpServer())
+      .post('/api/v2/customers/cus_seed/recharges')
+      .set('Authorization', `Bearer ${tokenFor('usr_finance')}`)
+      .send(body)
+      .expect(201);
+
+    const duplicate = await request(app.getHttpServer())
+      .post('/api/v2/customers/cus_seed/recharges')
+      .set('Authorization', `Bearer ${tokenFor('usr_finance')}`)
+      .send(body)
+      .expect(201);
+
+    expect(first.body).toMatchObject({
+      accountType: 'CUSTOMER',
+      accountId: 'cus_seed',
+      amount: '15.250000',
+      beforeBalance: '10.000000',
+      afterBalance: '25.250000'
+    });
+    expect(duplicate.body.id).toBe(first.body.id);
+    expect(audit.entries.some((entry) => entry.module === 'recharges' && entry.action === 'customer_recharge' && entry.result === 'SUCCESS')).toBe(true);
+  });
+
+  it('creates vendor recharge, lists ledgers, and rejects idempotency conflicts', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/vendors/ven_seed/recharges')
+      .set('Authorization', `Bearer ${tokenFor('usr_finance')}`)
+      .send({ amount: '3.5', idempotencyKey: 'vendor-rch-001' })
+      .expect(201)
+      .expect((response) => {
+        expect(response.body).toMatchObject({
+          accountType: 'VENDOR',
+          accountId: 'ven_seed',
+          beforeBalance: '20.000000',
+          afterBalance: '23.500000'
+        });
+      });
+
+    await request(app.getHttpServer())
+      .post('/api/v2/vendors/ven_seed/recharges')
+      .set('Authorization', `Bearer ${tokenFor('usr_finance')}`)
+      .send({ amount: '4.5', idempotencyKey: 'vendor-rch-001' })
+      .expect(409);
+
+    const list = await request(app.getHttpServer()).get('/api/v2/recharges?take=10').set('Authorization', `Bearer ${tokenFor('usr_viewer')}`).expect(200);
+
+    expect(list.body.total).toBe(2);
+    expect(list.body.items.some((item: { accountType: string }) => item.accountType === 'CUSTOMER')).toBe(true);
+    expect(list.body.items.some((item: { accountType: string }) => item.accountType === 'VENDOR')).toBe(true);
+  });
+});
diff --git a/apps/api/src/modules/recharges/recharges.module.ts b/apps/api/src/modules/recharges/recharges.module.ts
new file mode 100644
index 0000000..9c0f7ec
--- /dev/null
+++ b/apps/api/src/modules/recharges/recharges.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { RechargesController } from './recharges.controller.js';
+import { RECHARGES_REPOSITORY, PrismaRechargesRepository } from './recharges.repository.js';
+import { RechargesService } from './recharges.service.js';
+
+@Module({
+  controllers: [RechargesController],
+  providers: [
+    RechargesService,
+    {
+      provide: RECHARGES_REPOSITORY,
+      useClass: PrismaRechargesRepository
+    }
+  ],
+  exports: [RechargesService]
+})
+export class RechargesModule {}
diff --git a/apps/api/src/modules/recharges/recharges.repository.ts b/apps/api/src/modules/recharges/recharges.repository.ts
new file mode 100644
index 0000000..a084ad1
--- /dev/null
+++ b/apps/api/src/modules/recharges/recharges.repository.ts
@@ -0,0 +1,355 @@
+import { ConflictException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export type RechargeAccountType = 'CUSTOMER' | 'VENDOR';
+
+export interface RechargeInput {
+  accountId: string;
+  amount: string;
+  idempotencyKey: string;
+  requestHash: string;
+  remark?: string;
+  actorId?: string;
+}
+
+export interface RechargeSummary {
+  id: string;
+  accountType: RechargeAccountType;
+  accountId: string;
+  accountName: string;
+  amount: string;
+  beforeBalance: string;
+  afterBalance: string;
+  idempotencyKey: string;
+  remark: string | null;
+  status: 'SUCCEEDED' | 'FAILED' | 'REVERSED';
+  occurredAt: Date | string;
+  createdAt: Date | string;
+  createdBy: string | null;
+}
+
+export interface RechargeListQuery {
+  accountType?: RechargeAccountType;
+  accountId?: string;
+  take: number;
+  skip: number;
+}
+
+export interface RechargeListResult {
+  items: RechargeSummary[];
+  total: number;
+}
+
+export interface RechargesRepository {
+  list(query: RechargeListQuery): Promise<RechargeListResult>;
+  rechargeCustomer(input: RechargeInput): Promise<RechargeSummary>;
+  rechargeVendor(input: RechargeInput): Promise<RechargeSummary>;
+}
+
+export const RECHARGES_REPOSITORY = Symbol('RECHARGES_REPOSITORY');
+
+function rechargeId(): string {
+  return `rch_${crypto.randomUUID().replaceAll('-', '').slice(0, 36)}`;
+}
+
+function idempotencyId(): string {
+  return `idem_${crypto.randomUUID().replaceAll('-', '').slice(0, 35)}`;
+}
+
+@Injectable()
+export class PrismaRechargesRepository implements RechargesRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async list(query: RechargeListQuery): Promise<RechargeListResult> {
+    const [customerItems, customerTotal] =
+      query.accountType === 'VENDOR' ? [[], 0] : await this.listCustomerRecharges(query.accountId, query.take, query.skip);
+    const [vendorItems, vendorTotal] =
+      query.accountType === 'CUSTOMER' ? [[], 0] : await this.listVendorRecharges(query.accountId, query.take, query.skip);
+
+    const items = [...customerItems, ...vendorItems]
+      .sort((left, right) => this.timeOf(right.occurredAt) - this.timeOf(left.occurredAt))
+      .slice(0, query.take);
+
+    return {
+      items,
+      total: customerTotal + vendorTotal
+    };
+  }
+
+  async rechargeCustomer(input: RechargeInput): Promise<RechargeSummary> {
+    return this.runIdempotent('customer_recharge', input, async (tx) => {
+      const [locked] = await tx.$queryRaw<
+        {
+          id: string;
+          name: string;
+          balance: Prisma.Decimal;
+          deleted_at: Date | null;
+        }[]
+      >`SELECT id, name, balance, deleted_at FROM customers WHERE id = ${input.accountId} FOR UPDATE`;
+
+      if (!locked || locked.deleted_at) {
+        throw new NotFoundException({ code: 'CUSTOMER_NOT_FOUND', message: 'Customer not found.' });
+      }
+
+      const amount = new Prisma.Decimal(input.amount);
+      const afterBalance = locked.balance.plus(amount);
+      const created = await tx.customerRecharge.create({
+        data: {
+          id: rechargeId(),
+          customerId: locked.id,
+          amount,
+          beforeBalance: locked.balance,
+          afterBalance,
+          idempotencyKey: input.idempotencyKey,
+          remark: input.remark,
+          createdBy: input.actorId
+        }
+      });
+
+      await tx.customer.update({
+        where: { id: locked.id },
+        data: {
+          balance: afterBalance,
+          updatedBy: input.actorId,
+          version: { increment: 1 }
+        }
+      });
+
+      return this.customerSummary(created, locked.name);
+    });
+  }
+
+  async rechargeVendor(input: RechargeInput): Promise<RechargeSummary> {
+    return this.runIdempotent('vendor_recharge', input, async (tx) => {
+      const [locked] = await tx.$queryRaw<
+        {
+          id: string;
+          name: string;
+          balance: Prisma.Decimal;
+          deleted_at: Date | null;
+        }[]
+      >`SELECT id, name, balance, deleted_at FROM vendors WHERE id = ${input.accountId} FOR UPDATE`;
+
+      if (!locked || locked.deleted_at) {
+        throw new NotFoundException({ code: 'VENDOR_NOT_FOUND', message: 'Vendor not found.' });
+      }
+
+      const amount = new Prisma.Decimal(input.amount);
+      const afterBalance = locked.balance.plus(amount);
+      const created = await tx.vendorRecharge.create({
+        data: {
+          id: rechargeId(),
+          vendorId: locked.id,
+          amount,
+          beforeBalance: locked.balance,
+          afterBalance,
+          idempotencyKey: input.idempotencyKey,
+          remark: input.remark,
+          createdBy: input.actorId
+        }
+      });
+
+      await tx.vendor.update({
+        where: { id: locked.id },
+        data: {
+          balance: afterBalance,
+          updatedBy: input.actorId,
+          version: { increment: 1 }
+        }
+      });
+
+      return this.vendorSummary(created, locked.name);
+    });
+  }
+
+  private async runIdempotent(
+    scope: string,
+    input: RechargeInput,
+    operation: (tx: Prisma.TransactionClient) => Promise<RechargeSummary>
+  ): Promise<RechargeSummary> {
+    for (let attempt = 1; attempt <= 8; attempt += 1) {
+      try {
+        return await this.prisma.$transaction(
+          async (tx) => {
+            const existing = await tx.idempotencyKey.findUnique({
+              where: { key: input.idempotencyKey }
+            });
+
+            if (existing) {
+              if (existing.scope !== scope || existing.requestHash !== input.requestHash) {
+                throw new ConflictException({ code: 'IDEMPOTENCY_KEY_CONFLICT', message: 'Idempotency key was used by another request.' });
+              }
+
+              if (existing.status === 'SUCCEEDED' && existing.responseBody) {
+                return existing.responseBody as unknown as RechargeSummary;
+              }
+
+              throw new ConflictException({ code: 'IDEMPOTENCY_IN_PROGRESS', message: 'Idempotent request is still in progress.' });
+            }
+
+            await tx.idempotencyKey.create({
+              data: {
+                id: idempotencyId(),
+                key: input.idempotencyKey,
+                scope,
+                requestHash: input.requestHash,
+                status: 'IN_PROGRESS',
+                lockedUntil: new Date(Date.now() + 60_000),
+                expiresAt: new Date(Date.now() + 86_400_000)
+              }
+            });
+
+            const response = await operation(tx);
+
+            await tx.idempotencyKey.update({
+              where: { key: input.idempotencyKey },
+              data: {
+                status: 'SUCCEEDED',
+                responseStatus: 201,
+                responseBody: this.toJson(response),
+                lockedUntil: null
+              }
+            });
+
+            return response;
+          },
+          {
+            isolationLevel: Prisma.TransactionIsolationLevel.ReadCommitted,
+            timeout: 30000
+          }
+        );
+      } catch (error) {
+        if (attempt < 8 && this.isRetryableTransactionError(error)) {
+          await this.delay(50 * attempt);
+          continue;
+        }
+
+        throw error;
+      }
+    }
+
+    throw new ConflictException({ code: 'RECHARGE_RETRY_EXHAUSTED', message: 'Recharge transaction retry exhausted.' });
+  }
+
+  private async listCustomerRecharges(accountId: string | undefined, take: number, skip: number): Promise<[RechargeSummary[], number]> {
+    const where = accountId ? { customerId: accountId } : {};
+    const [items, total] = await this.prisma.$transaction([
+      this.prisma.customerRecharge.findMany({
+        where,
+        take,
+        skip,
+        orderBy: [{ occurredAt: 'desc' }],
+        include: { customer: true }
+      }),
+      this.prisma.customerRecharge.count({ where })
+    ]);
+
+    return [items.map((item) => this.customerSummary(item, item.customer.name)), total];
+  }
+
+  private async listVendorRecharges(accountId: string | undefined, take: number, skip: number): Promise<[RechargeSummary[], number]> {
+    const where = accountId ? { vendorId: accountId } : {};
+    const [items, total] = await this.prisma.$transaction([
+      this.prisma.vendorRecharge.findMany({
+        where,
+        take,
+        skip,
+        orderBy: [{ occurredAt: 'desc' }],
+        include: { vendor: true }
+      }),
+      this.prisma.vendorRecharge.count({ where })
+    ]);
+
+    return [items.map((item) => this.vendorSummary(item, item.vendor.name)), total];
+  }
+
+  private customerSummary(
+    recharge: {
+      id: string;
+      customerId: string;
+      amount: Prisma.Decimal;
+      beforeBalance: Prisma.Decimal;
+      afterBalance: Prisma.Decimal;
+      idempotencyKey: string;
+      remark: string | null;
+      status: 'SUCCEEDED' | 'FAILED' | 'REVERSED';
+      occurredAt: Date;
+      createdAt: Date;
+      createdBy: string | null;
+    },
+    accountName: string
+  ): RechargeSummary {
+    return {
+      id: recharge.id,
+      accountType: 'CUSTOMER',
+      accountId: recharge.customerId,
+      accountName,
+      amount: recharge.amount.toFixed(6),
+      beforeBalance: recharge.beforeBalance.toFixed(6),
+      afterBalance: recharge.afterBalance.toFixed(6),
+      idempotencyKey: recharge.idempotencyKey,
+      remark: recharge.remark,
+      status: recharge.status,
+      occurredAt: recharge.occurredAt,
+      createdAt: recharge.createdAt,
+      createdBy: recharge.createdBy
+    };
+  }
+
+  private vendorSummary(
+    recharge: {
+      id: string;
+      vendorId: string;
+      amount: Prisma.Decimal;
+      beforeBalance: Prisma.Decimal;
+      afterBalance: Prisma.Decimal;
+      idempotencyKey: string;
+      remark: string | null;
+      status: 'SUCCEEDED' | 'FAILED' | 'REVERSED';
+      occurredAt: Date;
+      createdAt: Date;
+      createdBy: string | null;
+    },
+    accountName: string
+  ): RechargeSummary {
+    return {
+      id: recharge.id,
+      accountType: 'VENDOR',
+      accountId: recharge.vendorId,
+      accountName,
+      amount: recharge.amount.toFixed(6),
+      beforeBalance: recharge.beforeBalance.toFixed(6),
+      afterBalance: recharge.afterBalance.toFixed(6),
+      idempotencyKey: recharge.idempotencyKey,
+      remark: recharge.remark,
+      status: recharge.status,
+      occurredAt: recharge.occurredAt,
+      createdAt: recharge.createdAt,
+      createdBy: recharge.createdBy
+    };
+  }
+
+  private toJson(response: RechargeSummary): Prisma.InputJsonValue {
+    return {
+      ...response,
+      occurredAt: response.occurredAt instanceof Date ? response.occurredAt.toISOString() : response.occurredAt,
+      createdAt: response.createdAt instanceof Date ? response.createdAt.toISOString() : response.createdAt
+    };
+  }
+
+  private timeOf(value: Date | string): number {
+    return value instanceof Date ? value.getTime() : Date.parse(value);
+  }
+
+  private isRetryableTransactionError(error: unknown): boolean {
+    return Boolean(error && typeof error === 'object' && 'code' in error && ((error as { code?: unknown }).code === 'P2034' || (error as { code?: unknown }).code === 'P2002'));
+  }
+
+  private delay(milliseconds: number): Promise<void> {
+    return new Promise((resolve) => {
+      setTimeout(resolve, milliseconds);
+    });
+  }
+}
diff --git a/apps/api/src/modules/recharges/recharges.service.ts b/apps/api/src/modules/recharges/recharges.service.ts
new file mode 100644
index 0000000..af69d14
--- /dev/null
+++ b/apps/api/src/modules/recharges/recharges.service.ts
@@ -0,0 +1,139 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import crypto from 'node:crypto';
+import {
+  RECHARGES_REPOSITORY,
+  type RechargeAccountType,
+  type RechargeListResult,
+  type RechargeSummary,
+  type RechargesRepository
+} from './recharges.repository.js';
+
+interface RechargeDto {
+  amount?: unknown;
+  idempotencyKey?: unknown;
+  remark?: unknown;
+}
+
+interface ListRechargesQueryDto {
+  accountType?: unknown;
+  accountId?: unknown;
+  take?: unknown;
+  skip?: unknown;
+}
+
+@Injectable()
+export class RechargesService {
+  constructor(@Inject(RECHARGES_REPOSITORY) private readonly recharges: RechargesRepository) {}
+
+  list(query: ListRechargesQueryDto): Promise<RechargeListResult> {
+    return this.recharges.list({
+      accountType: query.accountType === undefined ? undefined : this.accountType(query.accountType),
+      accountId: query.accountId === undefined ? undefined : this.limitedString(query.accountId, 'accountId', 40),
+      take: this.pageNumber(query.take, 50, 100),
+      skip: this.pageNumber(query.skip, 0, 10000)
+    });
+  }
+
+  rechargeCustomer(customerId: string, body: RechargeDto, actorId?: string): Promise<RechargeSummary> {
+    const amount = this.money(body.amount, 'amount');
+    const idempotencyKey = this.idempotencyKey(body.idempotencyKey);
+    const remark = this.optionalString(body.remark, 'remark', 500);
+
+    return this.recharges.rechargeCustomer({
+      accountId: customerId,
+      amount,
+      idempotencyKey,
+      requestHash: this.requestHash({ accountType: 'CUSTOMER', accountId: customerId, amount, remark }),
+      remark,
+      actorId
+    });
+  }
+
+  rechargeVendor(vendorId: string, body: RechargeDto, actorId?: string): Promise<RechargeSummary> {
+    const amount = this.money(body.amount, 'amount');
+    const idempotencyKey = this.idempotencyKey(body.idempotencyKey);
+    const remark = this.optionalString(body.remark, 'remark', 500);
+
+    return this.recharges.rechargeVendor({
+      accountId: vendorId,
+      amount,
+      idempotencyKey,
+      requestHash: this.requestHash({ accountType: 'VENDOR', accountId: vendorId, amount, remark }),
+      remark,
+      actorId
+    });
+  }
+
+  private accountType(value: unknown): RechargeAccountType {
+    if (value !== 'CUSTOMER' && value !== 'VENDOR') {
+      throw new BadRequestException({ code: 'ACCOUNT_TYPE_INVALID', message: 'Account type is invalid.' });
+    }
+
+    return value;
+  }
+
+  private idempotencyKey(value: unknown): string {
+    const key = this.limitedString(value, 'idempotencyKey', 128);
+    if (key.length < 8 || !/^[A-Za-z0-9._:-]+$/.test(key)) {
+      throw new BadRequestException({
+        code: 'IDEMPOTENCY_KEY_INVALID',
+        message: 'Idempotency key must be 8-128 safe characters.'
+      });
+    }
+
+    return key;
+  }
+
+  private optionalString(value: unknown, field: string, maxLength: number): string | undefined {
+    if (value === undefined) {
+      return undefined;
+    }
+
+    return this.limitedString(value, field, maxLength);
+  }
+
+  private limitedString(value: unknown, field: string, maxLength: number): string {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is required.` });
+    }
+
+    const trimmed = value.trim();
+    if (trimmed.length > maxLength) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is too long.` });
+    }
+
+    return trimmed;
+  }
+
+  private money(value: unknown, field: string): string {
+    const raw = typeof value === 'number' ? value.toString() : typeof value === 'string' ? value.trim() : '';
+    if (!/^(?:0|[1-9]\d{0,13})(?:\.\d{1,6})?$/.test(raw)) {
+      throw new BadRequestException({ code: 'MONEY_INVALID', message: `${field} must be a positive decimal with up to 6 places.` });
+    }
+
+    const [integerPart, fractionPart = ''] = raw.split('.');
+    const normalized = `${integerPart}.${fractionPart.padEnd(6, '0')}`;
+    if (normalized === '0.000000') {
+      throw new BadRequestException({ code: 'MONEY_INVALID', message: `${field} must be greater than zero.` });
+    }
+
+    return normalized;
+  }
+
+  private pageNumber(value: unknown, defaultValue: number, max: number): number {
+    if (value === undefined) {
+      return defaultValue;
+    }
+
+    const parsed = typeof value === 'string' ? Number(value) : typeof value === 'number' ? value : Number.NaN;
+    if (!Number.isInteger(parsed) || parsed < 0 || parsed > max) {
+      throw new BadRequestException({ code: 'PAGINATION_INVALID', message: 'Pagination is invalid.' });
+    }
+
+    return parsed;
+  }
+
+  private requestHash(value: Record<string, unknown>): string {
+    return crypto.createHash('sha256').update(JSON.stringify(value)).digest('hex');
+  }
+}
diff --git a/apps/api/src/modules/recordings/recordings.controller.ts b/apps/api/src/modules/recordings/recordings.controller.ts
new file mode 100644
index 0000000..e0e6f79
--- /dev/null
+++ b/apps/api/src/modules/recordings/recordings.controller.ts
@@ -0,0 +1,50 @@
+import { Body, Controller, Get, Header, Inject, Param, Put, Query, Res } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import type { FastifyReply } from 'fastify';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { RecordingsService } from './recordings.service.js';
+
+@ApiTags('recordings')
+@Controller('recordings')
+export class RecordingsController {
+  constructor(@Inject(RecordingsService) private readonly recordingsService: RecordingsService) {}
+
+  @Get()
+  @RequirePermissions('quality.view')
+  list(@Query() query: Record<string, unknown>) {
+    return this.recordingsService.list(query);
+  }
+
+  @Get(':id')
+  @RequirePermissions('quality.view')
+  get(@Param('id') id: string) {
+    return this.recordingsService.get(id);
+  }
+
+  @Get(':id/play')
+  @RequirePermissions('recordings.play')
+  @AuditAction({ module: 'recordings', action: 'play', objectType: 'recording', objectIdParam: 'id' })
+  @Header('Cache-Control', 'private, no-store')
+  async play(@Param('id') id: string, @Res() reply: FastifyReply): Promise<void> {
+    const playback = await this.recordingsService.playback(id);
+    reply
+      .header('X-Accel-Redirect', playback.internalPath)
+      .header('Content-Type', playback.contentType)
+      .header('Content-Length', playback.recording.bytes.toString())
+      .header('X-Recording-Sha256', playback.recording.sha256 ?? '')
+      .header('Content-Disposition', `inline; filename="${sanitizeFileName(playback.fileName)}"`)
+      .send();
+  }
+
+  @Put(':id/review')
+  @RequirePermissions('quality.manage')
+  @AuditAction({ module: 'quality', action: 'review_save', objectType: 'recording', objectIdParam: 'id' })
+  saveReview(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.recordingsService.saveReview(id, body, currentUser?.id);
+  }
+}
+
+function sanitizeFileName(fileName: string): string {
+  return fileName.replaceAll(/[^A-Za-z0-9._-]/g, '_');
+}
diff --git a/apps/api/src/modules/recordings/recordings.module.ts b/apps/api/src/modules/recordings/recordings.module.ts
new file mode 100644
index 0000000..44f3a32
--- /dev/null
+++ b/apps/api/src/modules/recordings/recordings.module.ts
@@ -0,0 +1,18 @@
+import { Module } from '@nestjs/common';
+import { QualityModule } from '../quality/quality.module.js';
+import { RecordingsController } from './recordings.controller.js';
+import { PrismaRecordingsRepository, RECORDINGS_REPOSITORY } from './recordings.repository.js';
+import { RecordingsService } from './recordings.service.js';
+
+@Module({
+  imports: [QualityModule],
+  controllers: [RecordingsController],
+  providers: [
+    RecordingsService,
+    {
+      provide: RECORDINGS_REPOSITORY,
+      useClass: PrismaRecordingsRepository
+    }
+  ]
+})
+export class RecordingsModule {}
diff --git a/apps/api/src/modules/recordings/recordings.repository.ts b/apps/api/src/modules/recordings/recordings.repository.ts
new file mode 100644
index 0000000..c896c5a
--- /dev/null
+++ b/apps/api/src/modules/recordings/recordings.repository.ts
@@ -0,0 +1,260 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export interface RecordingPlayback {
+  id: string;
+  storageKey: string;
+  storagePath: string;
+  sha256: string | null;
+  bytes: bigint;
+  durationSec: number;
+  status: 'PENDING' | 'READY' | 'FAILED' | 'DELETED';
+}
+
+export type ReviewResult = 'PASS' | 'ISSUE' | 'ESCALATED';
+
+export interface RecordingReviewSummary {
+  id: string;
+  reviewerId: string;
+  reviewerName: string;
+  score: number | null;
+  result: ReviewResult;
+  issueTags: Prisma.JsonValue | null;
+  notes: string | null;
+  reviewedAt: Date;
+}
+
+export interface RecordingListItem {
+  id: string;
+  rawCdrId: string | null;
+  callId: string | null;
+  customerId: string | null;
+  customerName: string | null;
+  lineGroupId: string | null;
+  lineGroupName: string | null;
+  caller: string | null;
+  callee: string | null;
+  startedAt: Date | null;
+  durationSec: number;
+  storageKey: string;
+  sha256: string | null;
+  bytes: string;
+  status: string;
+  movedAt: Date | null;
+  createdAt: Date;
+  latestReview: RecordingReviewSummary | null;
+}
+
+export interface RecordingDetail extends RecordingListItem {
+  storagePath: string;
+  reviews: RecordingReviewSummary[];
+  previousId: string | null;
+  nextId: string | null;
+}
+
+export interface SaveReviewInput {
+  recordingId: string;
+  reviewerId: string;
+  score?: number | null;
+  result: ReviewResult;
+  issueTags?: Prisma.InputJsonValue | null;
+  notes?: string | null;
+}
+
+export const RECORDINGS_REPOSITORY = Symbol('RECORDINGS_REPOSITORY');
+
+export interface RecordingsRepository {
+  list(query?: { status?: string; reviewStatus?: 'PENDING' | 'REVIEWED'; limit?: number }): Promise<RecordingListItem[]>;
+  getDetail(id: string): Promise<RecordingDetail>;
+  getReadyForPlayback(id: string): Promise<RecordingPlayback>;
+  saveReview(input: SaveReviewInput): Promise<RecordingReviewSummary>;
+}
+
+type RecordingRecord = Prisma.RecordingGetPayload<{
+  include: {
+    rawCdr: {
+      include: {
+        customer: { select: { name: true } };
+        lineGroup: { select: { name: true } };
+      };
+    };
+    reviews: {
+      orderBy: [{ reviewedAt: 'desc' }];
+      include: {
+        reviewer: { select: { displayName: true; username: true } };
+      };
+    };
+  };
+}>;
+
+type ReviewRecord = Prisma.QualityReviewGetPayload<{
+  include: {
+    reviewer: { select: { displayName: true; username: true } };
+  };
+}>;
+
+@Injectable()
+export class PrismaRecordingsRepository implements RecordingsRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async list(query: { status?: string; reviewStatus?: 'PENDING' | 'REVIEWED'; limit?: number } = {}): Promise<RecordingListItem[]> {
+    const take = Math.min(query.limit ?? 100, 500);
+    const recordings = await this.prisma.recording.findMany({
+      where: {
+        status: query.status ? (query.status as never) : 'READY',
+        reviews: query.reviewStatus === 'PENDING' ? { none: {} } : query.reviewStatus === 'REVIEWED' ? { some: {} } : undefined
+      },
+      orderBy: [{ createdAt: 'desc' }],
+      take,
+      include: this.includeRecording()
+    });
+    return recordings.map((recording) => this.toListItem(recording));
+  }
+
+  async getDetail(id: string): Promise<RecordingDetail> {
+    const recording = await this.findRecordingOrThrow(id);
+    const [previous, next] = await Promise.all([
+      this.prisma.recording.findFirst({
+        where: { status: 'READY', createdAt: { gt: recording.createdAt } },
+        orderBy: [{ createdAt: 'asc' }],
+        select: { id: true }
+      }),
+      this.prisma.recording.findFirst({
+        where: { status: 'READY', createdAt: { lt: recording.createdAt } },
+        orderBy: [{ createdAt: 'desc' }],
+        select: { id: true }
+      })
+    ]);
+    const item = this.toListItem(recording);
+    return {
+      ...item,
+      storagePath: recording.storagePath,
+      reviews: recording.reviews.map((review) => this.toReviewSummary(review)),
+      previousId: previous?.id ?? null,
+      nextId: next?.id ?? null
+    };
+  }
+
+  async getReadyForPlayback(id: string): Promise<RecordingPlayback> {
+    const recording = await this.prisma.recording.findUnique({
+      where: { id },
+      select: {
+        id: true,
+        storageKey: true,
+        storagePath: true,
+        sha256: true,
+        bytes: true,
+        durationSec: true,
+        status: true
+      }
+    });
+
+    if (!recording || recording.status !== 'READY') {
+      throw new NotFoundException({
+        code: 'RECORDING_NOT_READY',
+        message: 'Recording is not available for playback.'
+      });
+    }
+
+    return recording;
+  }
+
+  async saveReview(input: SaveReviewInput): Promise<RecordingReviewSummary> {
+    const recording = await this.prisma.recording.findUnique({
+      where: { id: input.recordingId },
+      select: { id: true, status: true }
+    });
+    if (!recording || recording.status !== 'READY') {
+      throw new NotFoundException({
+        code: 'RECORDING_NOT_READY',
+        message: 'Recording is not available for review.'
+      });
+    }
+
+    const review = await this.prisma.qualityReview.create({
+      data: {
+        id: qualityReviewId(),
+        recordingId: input.recordingId,
+        reviewerId: input.reviewerId,
+        score: input.score,
+        result: input.result,
+        issueTags: input.issueTags === null ? Prisma.JsonNull : input.issueTags,
+        notes: input.notes
+      },
+      include: {
+        reviewer: { select: { displayName: true, username: true } }
+      }
+    });
+    return this.toReviewSummary(review as ReviewRecord);
+  }
+
+  private includeRecording() {
+    return {
+      rawCdr: {
+        include: {
+          customer: { select: { name: true } },
+          lineGroup: { select: { name: true } }
+        }
+      },
+      reviews: {
+        orderBy: [{ reviewedAt: 'desc' }],
+        include: {
+          reviewer: { select: { displayName: true, username: true } }
+        }
+      }
+    } satisfies Prisma.RecordingInclude;
+  }
+
+  private async findRecordingOrThrow(id: string): Promise<RecordingRecord> {
+    const recording = await this.prisma.recording.findUnique({
+      where: { id },
+      include: this.includeRecording()
+    });
+    if (!recording) {
+      throw new NotFoundException({ code: 'RECORDING_NOT_FOUND', message: 'Recording not found.' });
+    }
+    return recording;
+  }
+
+  private toListItem(recording: RecordingRecord): RecordingListItem {
+    return {
+      id: recording.id,
+      rawCdrId: recording.rawCdrId,
+      callId: recording.rawCdr?.callId ?? null,
+      customerId: recording.rawCdr?.customerId ?? null,
+      customerName: recording.rawCdr?.customer?.name ?? null,
+      lineGroupId: recording.rawCdr?.lineGroupId ?? null,
+      lineGroupName: recording.rawCdr?.lineGroup?.name ?? null,
+      caller: recording.rawCdr?.caller ?? null,
+      callee: recording.rawCdr?.callee ?? null,
+      startedAt: recording.rawCdr?.startedAt ?? null,
+      durationSec: recording.durationSec,
+      storageKey: recording.storageKey,
+      sha256: recording.sha256,
+      bytes: recording.bytes.toString(),
+      status: recording.status,
+      movedAt: recording.movedAt,
+      createdAt: recording.createdAt,
+      latestReview: recording.reviews[0] ? this.toReviewSummary(recording.reviews[0]) : null
+    };
+  }
+
+  private toReviewSummary(review: ReviewRecord): RecordingReviewSummary {
+    return {
+      id: review.id,
+      reviewerId: review.reviewerId,
+      reviewerName: review.reviewer.displayName || review.reviewer.username,
+      score: review.score,
+      result: review.result,
+      issueTags: review.issueTags,
+      notes: review.notes,
+      reviewedAt: review.reviewedAt
+    };
+  }
+}
+
+function qualityReviewId(): string {
+  return `qrev_${crypto.randomUUID().replaceAll('-', '').slice(0, 32)}`;
+}
diff --git a/apps/api/src/modules/recordings/recordings.service.spec.ts b/apps/api/src/modules/recordings/recordings.service.spec.ts
new file mode 100644
index 0000000..4fabaf4
--- /dev/null
+++ b/apps/api/src/modules/recordings/recordings.service.spec.ts
@@ -0,0 +1,64 @@
+import { BadRequestException } from '@nestjs/common';
+import { describe, expect, it } from 'vitest';
+import { internalRecordingPath, RecordingsService } from './recordings.service.js';
+import type { RecordingsRepository } from './recordings.repository.js';
+import type { QualityService } from '../quality/quality.service.js';
+
+describe('recordings service', () => {
+  it('builds nginx internal recording paths', () => {
+    expect(internalRecordingPath('2026/06/21/call one.wav')).toBe('/_recordings/2026/06/21/call%20one.wav');
+  });
+
+  it('rejects unsafe storage keys', () => {
+    expect(() => internalRecordingPath('../secret.wav')).toThrow(BadRequestException);
+    expect(() => internalRecordingPath('/../../secret.wav')).toThrow(BadRequestException);
+  });
+
+  it('adds stable sampling and review status to recording list rows', async () => {
+    const recordings = {
+      list: async () => [
+        {
+          id: 'rec_1',
+          rawCdrId: 'raw_1',
+          callId: 'call-1',
+          customerId: 'cust_1',
+          customerName: 'Customer',
+          lineGroupId: 'lg_1',
+          lineGroupName: 'Line group',
+          caller: '1001',
+          callee: '1002',
+          startedAt: new Date('2026-06-21T00:00:00.000Z'),
+          durationSec: 12,
+          storageKey: '2026/06/21/call.wav',
+          sha256: null,
+          bytes: '12',
+          status: 'READY',
+          movedAt: null,
+          createdAt: new Date('2026-06-21T00:00:00.000Z'),
+          latestReview: null
+        }
+      ]
+    } as RecordingsRepository;
+    const quality = {
+      samplingFor: async () => ({
+        selected: true,
+        matches: [{ ruleId: 'rule_1', ruleName: 'All', ratio: '100.00', score: 1, selected: true }]
+      })
+    } as unknown as QualityService;
+    const service = new RecordingsService(recordings, quality);
+
+    await expect(service.list()).resolves.toMatchObject([
+      {
+        id: 'rec_1',
+        reviewStatus: 'PENDING',
+        sampling: { selected: true }
+      }
+    ]);
+  });
+
+  it('validates quality review payloads', async () => {
+    const service = new RecordingsService({} as RecordingsRepository, {} as QualityService);
+    await expect(service.saveReview('rec_1', { result: 'BAD' }, 'user_1')).rejects.toThrow(BadRequestException);
+    await expect(service.saveReview('rec_1', { result: 'PASS', score: 101 }, 'user_1')).rejects.toThrow(BadRequestException);
+  });
+});
diff --git a/apps/api/src/modules/recordings/recordings.service.ts b/apps/api/src/modules/recordings/recordings.service.ts
new file mode 100644
index 0000000..fa646b8
--- /dev/null
+++ b/apps/api/src/modules/recordings/recordings.service.ts
@@ -0,0 +1,149 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import { Prisma } from '@lisglosips/database';
+import path from 'node:path';
+import { QualityService } from '../quality/quality.service.js';
+import {
+  RECORDINGS_REPOSITORY,
+  type RecordingDetail,
+  type RecordingListItem,
+  type RecordingPlayback,
+  type RecordingReviewSummary,
+  type RecordingsRepository,
+  type ReviewResult
+} from './recordings.repository.js';
+
+export interface RecordingPlaybackResponse {
+  recording: RecordingPlayback;
+  internalPath: string;
+  contentType: string;
+  fileName: string;
+}
+
+@Injectable()
+export class RecordingsService {
+  constructor(
+    @Inject(RECORDINGS_REPOSITORY) private readonly recordings: RecordingsRepository,
+    @Inject(QualityService) private readonly qualityService: QualityService
+  ) {}
+
+  async list(query: { status?: unknown; reviewStatus?: unknown; limit?: unknown } = {}) {
+    const recordings = await this.recordings.list({
+      status: query.status === undefined ? undefined : this.recordingStatus(query.status),
+      reviewStatus: query.reviewStatus === undefined ? undefined : this.reviewStatus(query.reviewStatus),
+      limit: query.limit === undefined ? undefined : this.integer(query.limit, 'limit', 1, 500)
+    });
+    return Promise.all(recordings.map((recording) => this.withSampling(recording)));
+  }
+
+  async get(id: string) {
+    return this.withSampling(await this.recordings.getDetail(id));
+  }
+
+  async playback(id: string): Promise<RecordingPlaybackResponse> {
+    const recording = await this.recordings.getReadyForPlayback(id);
+    return {
+      recording,
+      internalPath: internalRecordingPath(recording.storageKey),
+      contentType: contentTypeFor(recording.storageKey),
+      fileName: path.posix.basename(recording.storageKey)
+    };
+  }
+
+  async saveReview(id: string, body: unknown, reviewerId?: string): Promise<RecordingReviewSummary> {
+    if (!reviewerId) {
+      throw new BadRequestException({ code: 'REVIEWER_REQUIRED', message: 'Current user is required to save review.' });
+    }
+    const data = body as Record<string, unknown>;
+    return this.recordings.saveReview({
+      recordingId: id,
+      reviewerId,
+      score: data.score === undefined || data.score === null ? null : this.integer(data.score, 'score', 0, 100),
+      result: this.reviewResult(data.result),
+      issueTags: data.issueTags === undefined ? null : this.issueTags(data.issueTags),
+      notes: data.notes === undefined || data.notes === null ? null : this.optionalString(data.notes, 'notes', 1000)
+    });
+  }
+
+  private async withSampling<T extends RecordingListItem | RecordingDetail>(recording: T) {
+    const sampling = await this.qualityService.samplingFor({
+      recordingId: recording.id,
+      customerId: recording.customerId,
+      lineGroupId: recording.lineGroupId
+    });
+    return {
+      ...recording,
+      reviewStatus: recording.latestReview ? 'REVIEWED' : 'PENDING',
+      sampling
+    };
+  }
+
+  private recordingStatus(value: unknown): string {
+    if (value !== 'PENDING' && value !== 'READY' && value !== 'FAILED' && value !== 'DELETED') {
+      throw new BadRequestException({ code: 'RECORDING_STATUS_INVALID', message: 'status is invalid.' });
+    }
+    return value;
+  }
+
+  private reviewStatus(value: unknown): 'PENDING' | 'REVIEWED' {
+    if (value !== 'PENDING' && value !== 'REVIEWED') {
+      throw new BadRequestException({ code: 'REVIEW_STATUS_INVALID', message: 'reviewStatus is invalid.' });
+    }
+    return value;
+  }
+
+  private reviewResult(value: unknown): ReviewResult {
+    if (value !== 'PASS' && value !== 'ISSUE' && value !== 'ESCALATED') {
+      throw new BadRequestException({ code: 'QUALITY_REVIEW_RESULT_INVALID', message: 'result is invalid.' });
+    }
+    return value;
+  }
+
+  private issueTags(value: unknown): Prisma.InputJsonValue {
+    if (!Array.isArray(value) || value.some((tag) => typeof tag !== 'string' || tag.trim().length === 0 || tag.length > 60)) {
+      throw new BadRequestException({ code: 'QUALITY_ISSUE_TAGS_INVALID', message: 'issueTags must be an array of short strings.' });
+    }
+    return value.map((tag) => tag.trim());
+  }
+
+  private optionalString(value: unknown, field: string, maxLength: number): string {
+    if (typeof value !== 'string') {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} must be a string.` });
+    }
+    const trimmed = value.trim();
+    if (trimmed.length > maxLength) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is too long.` });
+    }
+    return trimmed;
+  }
+
+  private integer(value: unknown, field: string, min: number, max: number): number {
+    const parsed = typeof value === 'number' ? value : typeof value === 'string' && /^\d+$/.test(value) ? Number.parseInt(value, 10) : NaN;
+    if (!Number.isInteger(parsed) || parsed < min || parsed > max) {
+      throw new BadRequestException({ code: 'INTEGER_INVALID', message: `${field} must be an integer from ${min} to ${max}.` });
+    }
+    return parsed;
+  }
+}
+
+export function internalRecordingPath(storageKey: string): string {
+  const normalized = storageKey.replaceAll('\\', '/').replace(/^\/+/, '');
+  const parts = normalized.split('/').filter(Boolean);
+  if (parts.length === 0 || parts.some((part) => part === '.' || part === '..' || part.includes('\0'))) {
+    throw new BadRequestException({
+      code: 'RECORDING_STORAGE_KEY_INVALID',
+      message: 'Recording storage key is invalid.'
+    });
+  }
+  return `/_recordings/${parts.map(encodeURIComponent).join('/')}`;
+}
+
+function contentTypeFor(storageKey: string): string {
+  const extension = path.posix.extname(storageKey).toLowerCase();
+  if (extension === '.wav') {
+    return 'audio/wav';
+  }
+  if (extension === '.mp3') {
+    return 'audio/mpeg';
+  }
+  return 'application/octet-stream';
+}
diff --git a/apps/api/src/modules/roles/roles.controller.ts b/apps/api/src/modules/roles/roles.controller.ts
new file mode 100644
index 0000000..f42daf0
--- /dev/null
+++ b/apps/api/src/modules/roles/roles.controller.ts
@@ -0,0 +1,37 @@
+import { Body, Controller, Get, Inject, Param, Patch, Post } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { RolesService } from './roles.service.js';
+
+@ApiTags('roles')
+@Controller()
+export class RolesController {
+  constructor(@Inject(RolesService) private readonly rolesService: RolesService) {}
+
+  @Get('roles')
+  @RequirePermissions('roles.view')
+  listRoles() {
+    return this.rolesService.listRoles();
+  }
+
+  @Post('roles')
+  @RequirePermissions('roles.manage')
+  @AuditAction({ module: 'roles', action: 'create', objectType: 'role' })
+  createRole(@Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.rolesService.createRole(body as never, currentUser?.id);
+  }
+
+  @Patch('roles/:id')
+  @RequirePermissions('roles.manage')
+  @AuditAction({ module: 'roles', action: 'update', objectType: 'role', objectIdParam: 'id' })
+  updateRole(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.rolesService.updateRole(id, body as never, currentUser?.id);
+  }
+
+  @Get('permissions')
+  @RequirePermissions('roles.view')
+  listPermissions() {
+    return this.rolesService.listPermissions();
+  }
+}
diff --git a/apps/api/src/modules/roles/roles.module.ts b/apps/api/src/modules/roles/roles.module.ts
new file mode 100644
index 0000000..152a9f1
--- /dev/null
+++ b/apps/api/src/modules/roles/roles.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { RolesController } from './roles.controller.js';
+import { PrismaRolesRepository, ROLES_REPOSITORY } from './roles.repository.js';
+import { RolesService } from './roles.service.js';
+
+@Module({
+  controllers: [RolesController],
+  providers: [
+    RolesService,
+    PrismaRolesRepository,
+    {
+      provide: ROLES_REPOSITORY,
+      useExisting: PrismaRolesRepository
+    }
+  ]
+})
+export class RolesModule {}
diff --git a/apps/api/src/modules/roles/roles.repository.ts b/apps/api/src/modules/roles/roles.repository.ts
new file mode 100644
index 0000000..ea04419
--- /dev/null
+++ b/apps/api/src/modules/roles/roles.repository.ts
@@ -0,0 +1,211 @@
+import { BadRequestException, ForbiddenException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { PrismaService } from '../database/prisma.service.js';
+
+export interface PermissionSummary {
+  id: string;
+  module: string;
+  action: string;
+  description: string | null;
+}
+
+export interface RoleSummary {
+  id: string;
+  name: string;
+  description: string | null;
+  builtIn: boolean;
+  status: 'ENABLED' | 'DISABLED';
+  permissionIds: string[];
+  userCount: number;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface CreateRoleInput {
+  name: string;
+  description?: string;
+  permissionIds: string[];
+  actorId?: string;
+}
+
+export interface UpdateRoleInput {
+  name?: string;
+  description?: string | null;
+  status?: 'ENABLED' | 'DISABLED';
+  permissionIds?: string[];
+  actorId?: string;
+}
+
+export interface RolesRepository {
+  listRoles(): Promise<RoleSummary[]>;
+  listPermissions(): Promise<PermissionSummary[]>;
+  createRole(input: CreateRoleInput): Promise<RoleSummary>;
+  updateRole(roleId: string, input: UpdateRoleInput): Promise<RoleSummary>;
+}
+
+export const ROLES_REPOSITORY = Symbol('ROLES_REPOSITORY');
+
+function roleId(): string {
+  return `rol_${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
+}
+
+@Injectable()
+export class PrismaRolesRepository implements RolesRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async listRoles(): Promise<RoleSummary[]> {
+    const roles = await this.prisma.role.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ builtIn: 'desc' }, { name: 'asc' }],
+      include: {
+        permissions: true,
+        _count: {
+          select: { userRoles: true }
+        }
+      }
+    });
+
+    return roles.map((role) => this.toSummary(role));
+  }
+
+  async listPermissions(): Promise<PermissionSummary[]> {
+    return this.prisma.permission.findMany({
+      orderBy: [{ module: 'asc' }, { action: 'asc' }]
+    });
+  }
+
+  async createRole(input: CreateRoleInput): Promise<RoleSummary> {
+    await this.ensurePermissions(input.permissionIds);
+
+    const role = await this.prisma.$transaction(async (tx) => {
+      const created = await tx.role.create({
+        data: {
+          id: roleId(),
+          name: input.name,
+          description: input.description,
+          builtIn: false,
+          createdBy: input.actorId,
+          updatedBy: input.actorId
+        }
+      });
+
+      for (const permissionId of input.permissionIds) {
+        await tx.rolePermission.create({
+          data: {
+            roleId: created.id,
+            permissionId,
+            createdBy: input.actorId
+          }
+        });
+      }
+
+      return tx.role.findUniqueOrThrow({
+        where: { id: created.id },
+        include: {
+          permissions: true,
+          _count: {
+            select: { userRoles: true }
+          }
+        }
+      });
+    });
+
+    return this.toSummary(role);
+  }
+
+  async updateRole(roleIdValue: string, input: UpdateRoleInput): Promise<RoleSummary> {
+    if (input.permissionIds) {
+      await this.ensurePermissions(input.permissionIds);
+    }
+
+    const role = await this.prisma.$transaction(async (tx) => {
+      const existing = await tx.role.findUnique({ where: { id: roleIdValue } });
+      if (!existing || existing.deletedAt) {
+        throw new NotFoundException({ code: 'ROLE_NOT_FOUND', message: 'Role not found.' });
+      }
+
+      if (existing.builtIn && (input.name !== undefined || input.status !== undefined || input.permissionIds !== undefined)) {
+        throw new ForbiddenException({
+          code: 'BUILT_IN_ROLE_PROTECTED',
+          message: 'Built-in role name, status, and permissions are protected.'
+        });
+      }
+
+      await tx.role.update({
+        where: { id: roleIdValue },
+        data: {
+          name: input.name,
+          description: input.description,
+          status: input.status,
+          updatedBy: input.actorId,
+          version: { increment: 1 }
+        }
+      });
+
+      if (input.permissionIds) {
+        await tx.rolePermission.deleteMany({ where: { roleId: roleIdValue } });
+        for (const permissionId of input.permissionIds) {
+          await tx.rolePermission.create({
+            data: {
+              roleId: roleIdValue,
+              permissionId,
+              createdBy: input.actorId
+            }
+          });
+        }
+      }
+
+      return tx.role.findUniqueOrThrow({
+        where: { id: roleIdValue },
+        include: {
+          permissions: true,
+          _count: {
+            select: { userRoles: true }
+          }
+        }
+      });
+    });
+
+    return this.toSummary(role);
+  }
+
+  private async ensurePermissions(permissionIds: string[]): Promise<void> {
+    const uniquePermissionIds = [...new Set(permissionIds)];
+    const count = await this.prisma.permission.count({
+      where: {
+        id: { in: uniquePermissionIds }
+      }
+    });
+
+    if (count !== uniquePermissionIds.length) {
+      throw new BadRequestException({
+        code: 'PERMISSION_INVALID',
+        message: 'One or more permissions are invalid.'
+      });
+    }
+  }
+
+  private toSummary(role: {
+    id: string;
+    name: string;
+    description: string | null;
+    builtIn: boolean;
+    status: 'ENABLED' | 'DISABLED';
+    createdAt: Date;
+    updatedAt: Date;
+    permissions: { permissionId: string }[];
+    _count: { userRoles: number };
+  }): RoleSummary {
+    return {
+      id: role.id,
+      name: role.name,
+      description: role.description,
+      builtIn: role.builtIn,
+      status: role.status,
+      permissionIds: role.permissions.map((permission) => permission.permissionId).sort(),
+      userCount: role._count.userRoles,
+      createdAt: role.createdAt,
+      updatedAt: role.updatedAt
+    };
+  }
+}
diff --git a/apps/api/src/modules/roles/roles.service.ts b/apps/api/src/modules/roles/roles.service.ts
new file mode 100644
index 0000000..aa70b21
--- /dev/null
+++ b/apps/api/src/modules/roles/roles.service.ts
@@ -0,0 +1,91 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import { ROLES_REPOSITORY, type CreateRoleInput, type RolesRepository, type UpdateRoleInput } from './roles.repository.js';
+
+interface CreateRoleDto {
+  name?: unknown;
+  description?: unknown;
+  permissionIds?: unknown;
+}
+
+interface UpdateRoleDto {
+  name?: unknown;
+  description?: unknown;
+  status?: unknown;
+  permissionIds?: unknown;
+}
+
+@Injectable()
+export class RolesService {
+  constructor(@Inject(ROLES_REPOSITORY) private readonly roles: RolesRepository) {}
+
+  listRoles() {
+    return this.roles.listRoles();
+  }
+
+  listPermissions() {
+    return this.roles.listPermissions();
+  }
+
+  createRole(body: CreateRoleDto, actorId?: string) {
+    const input: CreateRoleInput = {
+      name: this.requiredString(body.name, 'name').trim(),
+      description: this.optionalString(body.description),
+      permissionIds: this.permissionIds(body.permissionIds),
+      actorId
+    };
+
+    return this.roles.createRole(input);
+  }
+
+  updateRole(roleId: string, body: UpdateRoleDto, actorId?: string) {
+    const input: UpdateRoleInput = {
+      name: body.name === undefined ? undefined : this.requiredString(body.name, 'name').trim(),
+      description: body.description === undefined ? undefined : this.nullableString(body.description),
+      status: body.status === undefined ? undefined : this.status(body.status),
+      permissionIds: body.permissionIds === undefined ? undefined : this.permissionIds(body.permissionIds),
+      actorId
+    };
+
+    return this.roles.updateRole(roleId, input);
+  }
+
+  private requiredString(value: unknown, field: string): string {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is required.` });
+    }
+
+    return value;
+  }
+
+  private optionalString(value: unknown): string | undefined {
+    if (value === undefined) {
+      return undefined;
+    }
+
+    return this.requiredString(value, 'description').trim();
+  }
+
+  private nullableString(value: unknown): string | null {
+    if (value === null) {
+      return null;
+    }
+
+    return this.requiredString(value, 'description').trim();
+  }
+
+  private permissionIds(value: unknown): string[] {
+    if (!Array.isArray(value) || !value.every((permissionId) => typeof permissionId === 'string' && permissionId.length > 0)) {
+      throw new BadRequestException({ code: 'PERMISSION_IDS_INVALID', message: 'Permission ids are invalid.' });
+    }
+
+    return [...new Set(value as string[])];
+  }
+
+  private status(value: unknown): 'ENABLED' | 'DISABLED' {
+    if (value !== 'ENABLED' && value !== 'DISABLED') {
+      throw new BadRequestException({ code: 'STATUS_INVALID', message: 'Status is invalid.' });
+    }
+
+    return value;
+  }
+}
diff --git a/apps/api/src/modules/security/auth.guard.ts b/apps/api/src/modules/security/auth.guard.ts
new file mode 100644
index 0000000..10c9341
--- /dev/null
+++ b/apps/api/src/modules/security/auth.guard.ts
@@ -0,0 +1,64 @@
+import { CanActivate, ExecutionContext, Inject, Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Reflector } from '@nestjs/core';
+import { verifyAccessToken } from '@lisglosips/auth';
+import type { RuntimeConfig } from '../../shared/config.js';
+import { IDENTITY_REPOSITORY, type IdentityRepository } from './identity.repository.js';
+import { IS_PUBLIC_KEY, type AuthenticatedRequest } from './security.metadata.js';
+
+@Injectable()
+export class AccessTokenGuard implements CanActivate {
+  constructor(
+    @Inject(Reflector) private readonly reflector: Reflector,
+    @Inject(ConfigService) private readonly config: ConfigService<RuntimeConfig, true>,
+    @Inject(IDENTITY_REPOSITORY) private readonly identities: IdentityRepository
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [context.getHandler(), context.getClass()]);
+    if (isPublic) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
+    const token = this.extractBearerToken(request.headers.authorization);
+
+    if (!token) {
+      throw this.unauthorized();
+    }
+
+    const payload = verifyAccessToken(token, {
+      secret: this.config.get('auth.accessTokenSecret', { infer: true }),
+      issuer: this.config.get('auth.tokenIssuer', { infer: true }),
+      audience: this.config.get('auth.tokenAudience', { infer: true })
+    });
+
+    if (!payload) {
+      throw this.unauthorized();
+    }
+
+    const user = await this.identities.findCurrentUserById(payload.sub);
+    if (!user) {
+      throw this.unauthorized();
+    }
+
+    request.currentUser = user;
+    return true;
+  }
+
+  private extractBearerToken(header: string | undefined): string | null {
+    if (!header) {
+      return null;
+    }
+
+    const [type, token] = header.split(' ');
+    return type === 'Bearer' && token ? token : null;
+  }
+
+  private unauthorized(): UnauthorizedException {
+    return new UnauthorizedException({
+      code: 'AUTH_REQUIRED',
+      message: 'Authentication is required.'
+    });
+  }
+}
diff --git a/apps/api/src/modules/security/identity.repository.ts b/apps/api/src/modules/security/identity.repository.ts
new file mode 100644
index 0000000..9474667
--- /dev/null
+++ b/apps/api/src/modules/security/identity.repository.ts
@@ -0,0 +1,52 @@
+import { Inject, Injectable } from '@nestjs/common';
+import type { PermissionKey } from '@lisglosips/auth';
+import { PrismaService } from '../database/prisma.service.js';
+import type { CurrentUser } from './security.metadata.js';
+
+export interface IdentityRepository {
+  findCurrentUserById(userId: string): Promise<CurrentUser | null>;
+}
+
+export const IDENTITY_REPOSITORY = Symbol('IDENTITY_REPOSITORY');
+
+@Injectable()
+export class PrismaIdentityRepository implements IdentityRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async findCurrentUserById(userId: string): Promise<CurrentUser | null> {
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      include: {
+        userRoles: {
+          include: {
+            role: {
+              include: {
+                permissions: true
+              }
+            }
+          }
+        }
+      }
+    });
+
+    if (!user || user.deletedAt || user.status !== 'ENABLED') {
+      return null;
+    }
+
+    const enabledRoles = user.userRoles.map((userRole) => userRole.role).filter((role) => role.status === 'ENABLED' && !role.deletedAt);
+    const permissions = new Set<PermissionKey>();
+
+    for (const role of enabledRoles) {
+      for (const rolePermission of role.permissions) {
+        permissions.add(rolePermission.permissionId as PermissionKey);
+      }
+    }
+
+    return {
+      id: user.id,
+      username: user.username,
+      roles: enabledRoles.map((role) => role.name),
+      permissions: [...permissions].sort()
+    };
+  }
+}
diff --git a/apps/api/src/modules/security/rbac.guard.ts b/apps/api/src/modules/security/rbac.guard.ts
new file mode 100644
index 0000000..120457f
--- /dev/null
+++ b/apps/api/src/modules/security/rbac.guard.ts
@@ -0,0 +1,34 @@
+import { CanActivate, ExecutionContext, ForbiddenException, Inject, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { PermissionKey } from '@lisglosips/auth';
+import { IS_PUBLIC_KEY, REQUIRED_PERMISSIONS_KEY, type AuthenticatedRequest } from './security.metadata.js';
+
+@Injectable()
+export class RbacGuard implements CanActivate {
+  constructor(@Inject(Reflector) private readonly reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [context.getHandler(), context.getClass()]);
+    if (isPublic) {
+      return true;
+    }
+
+    const required = this.reflector.getAllAndOverride<PermissionKey[]>(REQUIRED_PERMISSIONS_KEY, [context.getHandler(), context.getClass()]) ?? [];
+    if (required.length === 0) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
+    const granted = new Set(request.currentUser?.permissions ?? []);
+    const allowed = required.every((permission) => granted.has(permission));
+
+    if (!allowed) {
+      throw new ForbiddenException({
+        code: 'RBAC_FORBIDDEN',
+        message: 'Permission denied.'
+      });
+    }
+
+    return true;
+  }
+}
diff --git a/apps/api/src/modules/security/security-rbac-audit.e2e.spec.ts b/apps/api/src/modules/security/security-rbac-audit.e2e.spec.ts
new file mode 100644
index 0000000..6848711
--- /dev/null
+++ b/apps/api/src/modules/security/security-rbac-audit.e2e.spec.ts
@@ -0,0 +1,249 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import crypto from 'node:crypto';
+import { ForbiddenException } from '@nestjs/common';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { signAccessToken, type PermissionKey } from '@lisglosips/auth';
+import { AUDIT_LOGS_REPOSITORY, type AuditLogDetail, type AuditLogsRepository } from '../audit-logs/audit-logs.repository.js';
+import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from '../audit/audit.repository.js';
+import { IDENTITY_REPOSITORY, type IdentityRepository } from './identity.repository.js';
+import type { CurrentUser } from './security.metadata.js';
+import { ROLES_REPOSITORY, type CreateRoleInput, type RoleSummary, type RolesRepository, type UpdateRoleInput } from '../roles/roles.repository.js';
+import { USERS_REPOSITORY, type CreateUserInput, type UpdateUserInput, type UserSummary, type UsersRepository } from '../users/users.repository.js';
+
+class MemoryIdentityRepository implements IdentityRepository {
+  users = new Map<string, CurrentUser>();
+
+  async findCurrentUserById(userId: string): Promise<CurrentUser | null> {
+    return this.users.get(userId) ?? null;
+  }
+}
+
+class MemoryAuditRepository implements AuditRepository {
+  entries: AuditEntryInput[] = [];
+
+  async write(input: AuditEntryInput): Promise<void> {
+    this.entries.push(input);
+  }
+}
+
+class MemoryAuditLogsRepository implements AuditLogsRepository {
+  constructor(private readonly audit: MemoryAuditRepository) {}
+
+  async list() {
+    return {
+      items: this.audit.entries.map((entry, index) => this.toDetail(entry, index)),
+      total: this.audit.entries.length
+    };
+  }
+
+  async get(id: string): Promise<AuditLogDetail> {
+    const index = Number(id.replace('aud_test_', ''));
+    return this.toDetail(this.audit.entries[index], index);
+  }
+
+  private toDetail(entry: AuditEntryInput, index: number): AuditLogDetail {
+    return {
+      id: `aud_test_${index}`,
+      requestId: entry.requestId,
+      userId: entry.userId ?? null,
+      username: entry.username ?? null,
+      roleNames: entry.roleNames ?? null,
+      ip: entry.ip ?? null,
+      userAgent: entry.userAgent ?? null,
+      module: entry.module,
+      action: entry.action,
+      objectType: entry.objectType,
+      objectId: entry.objectId ?? null,
+      beforeSummary: entry.beforeSummary,
+      afterSummary: entry.afterSummary,
+      result: entry.result,
+      errorCode: entry.errorCode ?? null,
+      createdAt: new Date('2026-06-21T00:00:00.000Z')
+    };
+  }
+}
+
+class MemoryUsersRepository implements UsersRepository {
+  async list(): Promise<UserSummary[]> {
+    return [];
+  }
+
+  async create(input: CreateUserInput): Promise<UserSummary> {
+    return this.summary('usr_created', input.username, input.roleIds);
+  }
+
+  async update(userId: string, input: UpdateUserInput): Promise<UserSummary> {
+    return this.summary(userId, 'operator', input.roleIds ?? ['ROLE_SUPER_ADMIN']);
+  }
+
+  async resetPassword(userId: string): Promise<UserSummary> {
+    return this.summary(userId, 'operator', ['ROLE_SUPER_ADMIN'], true);
+  }
+
+  private summary(id: string, username: string, roleIds: string[], requirePasswordChange = false): UserSummary {
+    return {
+      id,
+      username,
+      displayName: 'Operator',
+      phone: null,
+      email: null,
+      status: 'ENABLED',
+      requirePasswordChange,
+      lastLoginAt: null,
+      roles: roleIds,
+      roleIds,
+      createdAt: new Date('2026-06-21T00:00:00.000Z'),
+      updatedAt: new Date('2026-06-21T00:00:00.000Z')
+    };
+  }
+}
+
+class MemoryRolesRepository implements RolesRepository {
+  async listRoles(): Promise<RoleSummary[]> {
+    return [this.role('ROLE_SUPER_ADMIN', true, ['users.manage', 'roles.manage'])];
+  }
+
+  async listPermissions() {
+    return [{ id: 'users.manage', module: 'users', action: 'manage', description: 'Manage users' }];
+  }
+
+  async createRole(input: CreateRoleInput): Promise<RoleSummary> {
+    return this.role('rol_created', false, input.permissionIds, input.name);
+  }
+
+  async updateRole(roleId: string, input: UpdateRoleInput): Promise<RoleSummary> {
+    if (roleId === 'ROLE_SUPER_ADMIN' && (input.name !== undefined || input.status !== undefined || input.permissionIds !== undefined)) {
+      throw new ForbiddenException({
+        code: 'BUILT_IN_ROLE_PROTECTED',
+        message: 'Built-in role name, status, and permissions are protected.'
+      });
+    }
+
+    return this.role(roleId, roleId === 'ROLE_SUPER_ADMIN', input.permissionIds ?? ['users.manage']);
+  }
+
+  private role(id: string, builtIn: boolean, permissionIds: string[], name = 'role'): RoleSummary {
+    return {
+      id,
+      name,
+      description: null,
+      builtIn,
+      status: 'ENABLED',
+      permissionIds,
+      userCount: 0,
+      createdAt: new Date('2026-06-21T00:00:00.000Z'),
+      updatedAt: new Date('2026-06-21T00:00:00.000Z')
+    };
+  }
+}
+
+describe('S10 security, RBAC, and audit API', () => {
+  let app: NestFastifyApplication;
+  let identities: MemoryIdentityRepository;
+  let audit: MemoryAuditRepository;
+
+  const tokenFor = (userId: string) =>
+    signAccessToken(
+      {
+        sub: userId,
+        username: userId,
+        roles: ['test'],
+        typ: 'access'
+      },
+      {
+        secret: 'test-only-access-token-secret-min-32-bytes',
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        ttlSeconds: 900
+      }
+    );
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+    process.env.AUTH_ACCESS_TOKEN_SECRET = 'test-only-access-token-secret-min-32-bytes';
+
+    identities = new MemoryIdentityRepository();
+    audit = new MemoryAuditRepository();
+    const auditLogs = new MemoryAuditLogsRepository(audit);
+
+    identities.users.set('usr_admin', {
+      id: 'usr_admin',
+      username: 'admin',
+      roles: ['超级管理员'],
+      permissions: ['users.view', 'users.manage', 'roles.view', 'roles.manage', 'audit.view'] as PermissionKey[]
+    });
+    identities.users.set('usr_readonly', {
+      id: 'usr_readonly',
+      username: 'readonly',
+      roles: ['只读'],
+      permissions: ['users.view'] as PermissionKey[]
+    });
+
+    const { AppModule } = await import('../app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule]
+    })
+      .overrideProvider(IDENTITY_REPOSITORY)
+      .useValue(identities)
+      .overrideProvider(AUDIT_REPOSITORY)
+      .useValue(audit)
+      .overrideProvider(AUDIT_LOGS_REPOSITORY)
+      .useValue(auditLogs)
+      .overrideProvider(USERS_REPOSITORY)
+      .useValue(new MemoryUsersRepository())
+      .overrideProvider(ROLES_REPOSITORY)
+      .useValue(new MemoryRolesRepository())
+      .compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('rejects missing and insufficient permissions', async () => {
+    await request(app.getHttpServer()).get('/api/v2/users').expect(401);
+    await request(app.getHttpServer()).post('/api/v2/users/usr_target/reset-password').set('Authorization', `Bearer ${tokenFor('usr_readonly')}`).send({
+      password: crypto.randomUUID() + crypto.randomUUID()
+    }).expect(403);
+  });
+
+  it('audits reset password with sensitive body redacted', async () => {
+    const generatedPassword = crypto.randomUUID() + crypto.randomUUID();
+
+    await request(app.getHttpServer())
+      .post('/api/v2/users/usr_target/reset-password')
+      .set('Authorization', `Bearer ${tokenFor('usr_admin')}`)
+      .send({ password: generatedPassword })
+      .expect(201);
+
+    const entry = audit.entries.find((item) => item.action === 'reset_password');
+
+    expect(entry?.userId).toBe('usr_admin');
+    expect(entry?.result).toBe('SUCCESS');
+    expect(JSON.stringify(entry?.beforeSummary)).not.toContain(generatedPassword);
+    expect(JSON.stringify(entry?.beforeSummary)).toContain('[REDACTED]');
+  });
+
+  it('protects built-in role permissions and exposes audit details', async () => {
+    await request(app.getHttpServer())
+      .patch('/api/v2/roles/ROLE_SUPER_ADMIN')
+      .set('Authorization', `Bearer ${tokenFor('usr_admin')}`)
+      .send({ permissionIds: ['users.view'] })
+      .expect(403);
+
+    const logs = await request(app.getHttpServer()).get('/api/v2/audit-logs').set('Authorization', `Bearer ${tokenFor('usr_admin')}`).expect(200);
+
+    expect(logs.body.total).toBeGreaterThanOrEqual(1);
+    expect(logs.body.items.some((item: { action: string }) => item.action === 'reset_password')).toBe(true);
+  });
+});
diff --git a/apps/api/src/modules/security/security.metadata.ts b/apps/api/src/modules/security/security.metadata.ts
new file mode 100644
index 0000000..3e28629
--- /dev/null
+++ b/apps/api/src/modules/security/security.metadata.ts
@@ -0,0 +1,26 @@
+import { SetMetadata, createParamDecorator, type ExecutionContext } from '@nestjs/common';
+import type { PermissionKey } from '@lisglosips/auth';
+import type { FastifyRequest } from 'fastify';
+
+export const IS_PUBLIC_KEY = 'lisglosips:is_public';
+export const REQUIRED_PERMISSIONS_KEY = 'lisglosips:required_permissions';
+
+export interface CurrentUser {
+  id: string;
+  username: string;
+  roles: string[];
+  permissions: PermissionKey[];
+}
+
+export type AuthenticatedRequest = FastifyRequest & {
+  currentUser?: CurrentUser;
+};
+
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);
+
+export const RequirePermissions = (...permissions: PermissionKey[]) => SetMetadata(REQUIRED_PERMISSIONS_KEY, permissions);
+
+export const CurrentUserParam = createParamDecorator((_data: unknown, context: ExecutionContext): CurrentUser | undefined => {
+  const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
+  return request.currentUser;
+});
diff --git a/apps/api/src/modules/security/security.module.ts b/apps/api/src/modules/security/security.module.ts
new file mode 100644
index 0000000..3d128e1
--- /dev/null
+++ b/apps/api/src/modules/security/security.module.ts
@@ -0,0 +1,25 @@
+import { Module } from '@nestjs/common';
+import { APP_GUARD } from '@nestjs/core';
+import { AccessTokenGuard } from './auth.guard.js';
+import { PrismaIdentityRepository, IDENTITY_REPOSITORY } from './identity.repository.js';
+import { RbacGuard } from './rbac.guard.js';
+
+@Module({
+  providers: [
+    PrismaIdentityRepository,
+    {
+      provide: IDENTITY_REPOSITORY,
+      useExisting: PrismaIdentityRepository
+    },
+    {
+      provide: APP_GUARD,
+      useClass: AccessTokenGuard
+    },
+    {
+      provide: APP_GUARD,
+      useClass: RbacGuard
+    }
+  ],
+  exports: [IDENTITY_REPOSITORY]
+})
+export class SecurityModule {}
diff --git a/apps/api/src/modules/users/users.controller.ts b/apps/api/src/modules/users/users.controller.ts
new file mode 100644
index 0000000..c8cf776
--- /dev/null
+++ b/apps/api/src/modules/users/users.controller.ts
@@ -0,0 +1,38 @@
+import { Body, Controller, Get, Inject, Param, Patch, Post } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { UsersService } from './users.service.js';
+
+@ApiTags('users')
+@Controller('users')
+export class UsersController {
+  constructor(@Inject(UsersService) private readonly usersService: UsersService) {}
+
+  @Get()
+  @RequirePermissions('users.view')
+  list() {
+    return this.usersService.list();
+  }
+
+  @Post()
+  @RequirePermissions('users.manage')
+  @AuditAction({ module: 'users', action: 'create', objectType: 'user' })
+  create(@Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.usersService.create(body as never, currentUser?.id);
+  }
+
+  @Patch(':id')
+  @RequirePermissions('users.manage')
+  @AuditAction({ module: 'users', action: 'update', objectType: 'user', objectIdParam: 'id' })
+  update(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.usersService.update(id, body as never, currentUser?.id);
+  }
+
+  @Post(':id/reset-password')
+  @RequirePermissions('users.manage')
+  @AuditAction({ module: 'users', action: 'reset_password', objectType: 'user', objectIdParam: 'id' })
+  resetPassword(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.usersService.resetPassword(id, body as never, currentUser?.id);
+  }
+}
diff --git a/apps/api/src/modules/users/users.module.ts b/apps/api/src/modules/users/users.module.ts
new file mode 100644
index 0000000..6333045
--- /dev/null
+++ b/apps/api/src/modules/users/users.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { PrismaUsersRepository, USERS_REPOSITORY } from './users.repository.js';
+import { UsersController } from './users.controller.js';
+import { UsersService } from './users.service.js';
+
+@Module({
+  controllers: [UsersController],
+  providers: [
+    UsersService,
+    PrismaUsersRepository,
+    {
+      provide: USERS_REPOSITORY,
+      useExisting: PrismaUsersRepository
+    }
+  ]
+})
+export class UsersModule {}
diff --git a/apps/api/src/modules/users/users.repository.ts b/apps/api/src/modules/users/users.repository.ts
new file mode 100644
index 0000000..f1fc076
--- /dev/null
+++ b/apps/api/src/modules/users/users.repository.ts
@@ -0,0 +1,239 @@
+import { BadRequestException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { PrismaService } from '../database/prisma.service.js';
+
+export interface UserSummary {
+  id: string;
+  username: string;
+  displayName: string;
+  phone: string | null;
+  email: string | null;
+  status: 'ENABLED' | 'DISABLED';
+  requirePasswordChange: boolean;
+  lastLoginAt: Date | null;
+  roles: string[];
+  roleIds: string[];
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface CreateUserInput {
+  username: string;
+  displayName: string;
+  phone?: string;
+  email?: string;
+  passwordHash: string;
+  passwordAlgo: string;
+  requirePasswordChange: boolean;
+  roleIds: string[];
+  actorId?: string;
+}
+
+export interface UpdateUserInput {
+  displayName?: string;
+  phone?: string | null;
+  email?: string | null;
+  status?: 'ENABLED' | 'DISABLED';
+  roleIds?: string[];
+  actorId?: string;
+}
+
+export interface UsersRepository {
+  list(): Promise<UserSummary[]>;
+  create(input: CreateUserInput): Promise<UserSummary>;
+  update(userId: string, input: UpdateUserInput): Promise<UserSummary>;
+  resetPassword(userId: string, passwordHash: string, passwordAlgo: string, actorId?: string): Promise<UserSummary>;
+}
+
+export const USERS_REPOSITORY = Symbol('USERS_REPOSITORY');
+
+function userId(): string {
+  return `usr_${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
+}
+
+@Injectable()
+export class PrismaUsersRepository implements UsersRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async list(): Promise<UserSummary[]> {
+    const users = await this.prisma.user.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ createdAt: 'desc' }],
+      include: {
+        userRoles: {
+          include: {
+            role: true
+          }
+        }
+      }
+    });
+
+    return users.map((user) => this.toSummary(user));
+  }
+
+  async create(input: CreateUserInput): Promise<UserSummary> {
+    await this.ensureRoles(input.roleIds);
+
+    const user = await this.prisma.$transaction(async (tx) => {
+      const created = await tx.user.create({
+        data: {
+          id: userId(),
+          username: input.username,
+          displayName: input.displayName,
+          phone: input.phone,
+          email: input.email,
+          passwordHash: input.passwordHash,
+          passwordAlgo: input.passwordAlgo,
+          requirePasswordChange: input.requirePasswordChange,
+          createdBy: input.actorId,
+          updatedBy: input.actorId
+        }
+      });
+
+      for (const roleId of input.roleIds) {
+        await tx.userRole.create({
+          data: {
+            userId: created.id,
+            roleId,
+            createdBy: input.actorId
+          }
+        });
+      }
+
+      return tx.user.findUniqueOrThrow({
+        where: { id: created.id },
+        include: {
+          userRoles: {
+            include: {
+              role: true
+            }
+          }
+        }
+      });
+    });
+
+    return this.toSummary(user);
+  }
+
+  async update(userIdValue: string, input: UpdateUserInput): Promise<UserSummary> {
+    if (input.roleIds) {
+      await this.ensureRoles(input.roleIds);
+    }
+
+    const user = await this.prisma.$transaction(async (tx) => {
+      const exists = await tx.user.findUnique({ where: { id: userIdValue } });
+      if (!exists || exists.deletedAt) {
+        throw new NotFoundException({ code: 'USER_NOT_FOUND', message: 'User not found.' });
+      }
+
+      await tx.user.update({
+        where: { id: userIdValue },
+        data: {
+          displayName: input.displayName,
+          phone: input.phone,
+          email: input.email,
+          status: input.status,
+          updatedBy: input.actorId,
+          version: { increment: 1 }
+        }
+      });
+
+      if (input.roleIds) {
+        await tx.userRole.deleteMany({ where: { userId: userIdValue } });
+        for (const roleId of input.roleIds) {
+          await tx.userRole.create({
+            data: {
+              userId: userIdValue,
+              roleId,
+              createdBy: input.actorId
+            }
+          });
+        }
+      }
+
+      return tx.user.findUniqueOrThrow({
+        where: { id: userIdValue },
+        include: {
+          userRoles: {
+            include: {
+              role: true
+            }
+          }
+        }
+      });
+    });
+
+    return this.toSummary(user);
+  }
+
+  async resetPassword(userIdValue: string, passwordHash: string, passwordAlgo: string, actorId?: string): Promise<UserSummary> {
+    const user = await this.prisma.user.update({
+      where: { id: userIdValue },
+      data: {
+        passwordHash,
+        passwordAlgo,
+        requirePasswordChange: true,
+        failedLoginCount: 0,
+        lockedUntil: null,
+        updatedBy: actorId,
+        version: { increment: 1 }
+      },
+      include: {
+        userRoles: {
+          include: {
+            role: true
+          }
+        }
+      }
+    });
+
+    return this.toSummary(user);
+  }
+
+  private async ensureRoles(roleIds: string[]): Promise<void> {
+    const uniqueRoleIds = [...new Set(roleIds)];
+    const count = await this.prisma.role.count({
+      where: {
+        id: { in: uniqueRoleIds },
+        status: 'ENABLED',
+        deletedAt: null
+      }
+    });
+
+    if (count !== uniqueRoleIds.length) {
+      throw new BadRequestException({
+        code: 'ROLE_INVALID',
+        message: 'One or more roles are invalid.'
+      });
+    }
+  }
+
+  private toSummary(user: {
+    id: string;
+    username: string;
+    displayName: string;
+    phone: string | null;
+    email: string | null;
+    status: 'ENABLED' | 'DISABLED';
+    requirePasswordChange: boolean;
+    lastLoginAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+    userRoles: { roleId: string; role: { name: string } }[];
+  }): UserSummary {
+    return {
+      id: user.id,
+      username: user.username,
+      displayName: user.displayName,
+      phone: user.phone,
+      email: user.email,
+      status: user.status,
+      requirePasswordChange: user.requirePasswordChange,
+      lastLoginAt: user.lastLoginAt,
+      roleIds: user.userRoles.map((userRole) => userRole.roleId),
+      roles: user.userRoles.map((userRole) => userRole.role.name),
+      createdAt: user.createdAt,
+      updatedAt: user.updatedAt
+    };
+  }
+}
diff --git a/apps/api/src/modules/users/users.service.ts b/apps/api/src/modules/users/users.service.ts
new file mode 100644
index 0000000..8b724fb
--- /dev/null
+++ b/apps/api/src/modules/users/users.service.ts
@@ -0,0 +1,119 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import { PASSWORD_ALGO_ARGON2ID, hashPasswordArgon2id } from '@lisglosips/auth';
+import { USERS_REPOSITORY, type UpdateUserInput, type UserSummary, type UsersRepository } from './users.repository.js';
+
+interface CreateUserDto {
+  username?: unknown;
+  displayName?: unknown;
+  phone?: unknown;
+  email?: unknown;
+  password?: unknown;
+  requirePasswordChange?: unknown;
+  roleIds?: unknown;
+}
+
+interface UpdateUserDto {
+  displayName?: unknown;
+  phone?: unknown;
+  email?: unknown;
+  status?: unknown;
+  roleIds?: unknown;
+}
+
+interface ResetPasswordDto {
+  password?: unknown;
+}
+
+@Injectable()
+export class UsersService {
+  constructor(@Inject(USERS_REPOSITORY) private readonly users: UsersRepository) {}
+
+  list(): Promise<UserSummary[]> {
+    return this.users.list();
+  }
+
+  async create(body: CreateUserDto, actorId?: string): Promise<UserSummary> {
+    const username = this.requiredString(body.username, 'username').trim().toLowerCase();
+    const displayName = this.requiredString(body.displayName, 'displayName').trim();
+    const password = this.password(body.password);
+    const roleIds = this.roleIds(body.roleIds);
+
+    return this.users.create({
+      username,
+      displayName,
+      phone: this.optionalString(body.phone),
+      email: this.optionalString(body.email),
+      passwordHash: await hashPasswordArgon2id(password),
+      passwordAlgo: PASSWORD_ALGO_ARGON2ID,
+      requirePasswordChange: body.requirePasswordChange === undefined ? true : body.requirePasswordChange === true,
+      roleIds,
+      actorId
+    });
+  }
+
+  update(userId: string, body: UpdateUserDto, actorId?: string): Promise<UserSummary> {
+    const input: UpdateUserInput = {
+      displayName: body.displayName === undefined ? undefined : this.requiredString(body.displayName, 'displayName').trim(),
+      phone: body.phone === undefined ? undefined : this.nullableString(body.phone),
+      email: body.email === undefined ? undefined : this.nullableString(body.email),
+      status: body.status === undefined ? undefined : this.status(body.status),
+      roleIds: body.roleIds === undefined ? undefined : this.roleIds(body.roleIds),
+      actorId
+    };
+
+    return this.users.update(userId, input);
+  }
+
+  async resetPassword(userId: string, body: ResetPasswordDto, actorId?: string): Promise<UserSummary> {
+    return this.users.resetPassword(userId, await hashPasswordArgon2id(this.password(body.password)), PASSWORD_ALGO_ARGON2ID, actorId);
+  }
+
+  private requiredString(value: unknown, field: string): string {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is required.` });
+    }
+
+    return value;
+  }
+
+  private optionalString(value: unknown): string | undefined {
+    if (value === undefined) {
+      return undefined;
+    }
+
+    return this.requiredString(value, 'value').trim();
+  }
+
+  private nullableString(value: unknown): string | null {
+    if (value === null) {
+      return null;
+    }
+
+    return this.requiredString(value, 'value').trim();
+  }
+
+  private password(value: unknown): string {
+    const password = this.requiredString(value, 'password');
+    if (password.length < 12) {
+      throw new BadRequestException({ code: 'PASSWORD_TOO_SHORT', message: 'Password must be at least 12 characters.' });
+    }
+
+    return password;
+  }
+
+  private roleIds(value: unknown): string[] {
+    if (!Array.isArray(value) || value.length === 0 || !value.every((roleId) => typeof roleId === 'string' && roleId.length > 0)) {
+      throw new BadRequestException({ code: 'ROLE_IDS_REQUIRED', message: 'At least one role is required.' });
+    }
+
+    return [...new Set(value as string[])];
+  }
+
+  private status(value: unknown): 'ENABLED' | 'DISABLED' {
+    if (value !== 'ENABLED' && value !== 'DISABLED') {
+      throw new BadRequestException({ code: 'STATUS_INVALID', message: 'Status is invalid.' });
+    }
+
+    return value;
+  }
+}
diff --git a/apps/api/src/modules/vendor-gateways/vendor-gateways.controller.ts b/apps/api/src/modules/vendor-gateways/vendor-gateways.controller.ts
new file mode 100644
index 0000000..56e75f3
--- /dev/null
+++ b/apps/api/src/modules/vendor-gateways/vendor-gateways.controller.ts
@@ -0,0 +1,51 @@
+import { Body, Controller, Get, Inject, Param, Patch, Post, Query } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { VendorGatewaysService } from './vendor-gateways.service.js';
+
+@ApiTags('vendor-gateways')
+@Controller('vendor-gateways')
+export class VendorGatewaysController {
+  constructor(@Inject(VendorGatewaysService) private readonly vendorGatewaysService: VendorGatewaysService) {}
+
+  @Get()
+  @RequirePermissions('vendor_gateways.view')
+  list(@Query() query: unknown) {
+    return this.vendorGatewaysService.list(query as never);
+  }
+
+  @Get(':id')
+  @RequirePermissions('vendor_gateways.view')
+  get(@Param('id') id: string) {
+    return this.vendorGatewaysService.get(id);
+  }
+
+  @Post()
+  @RequirePermissions('vendor_gateways.manage')
+  @AuditAction({ module: 'vendor_gateways', action: 'create', objectType: 'vendor_gateway' })
+  create(@Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.vendorGatewaysService.create(body as never, currentUser?.id);
+  }
+
+  @Patch(':id')
+  @RequirePermissions('vendor_gateways.manage')
+  @AuditAction({ module: 'vendor_gateways', action: 'update', objectType: 'vendor_gateway', objectIdParam: 'id' })
+  update(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.vendorGatewaysService.update(id, body as never, currentUser?.id);
+  }
+
+  @Post(':id/enable')
+  @RequirePermissions('vendor_gateways.manage')
+  @AuditAction({ module: 'vendor_gateways', action: 'enable', objectType: 'vendor_gateway', objectIdParam: 'id' })
+  enable(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.vendorGatewaysService.enable(id, currentUser?.id);
+  }
+
+  @Post(':id/disable')
+  @RequirePermissions('vendor_gateways.manage')
+  @AuditAction({ module: 'vendor_gateways', action: 'disable', objectType: 'vendor_gateway', objectIdParam: 'id' })
+  disable(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.vendorGatewaysService.disable(id, currentUser?.id);
+  }
+}
diff --git a/apps/api/src/modules/vendor-gateways/vendor-gateways.e2e.spec.ts b/apps/api/src/modules/vendor-gateways/vendor-gateways.e2e.spec.ts
new file mode 100644
index 0000000..8d06ddc
--- /dev/null
+++ b/apps/api/src/modules/vendor-gateways/vendor-gateways.e2e.spec.ts
@@ -0,0 +1,317 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { signAccessToken, type PermissionKey } from '@lisglosips/auth';
+import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from '../audit/audit.repository.js';
+import { IDENTITY_REPOSITORY, type IdentityRepository } from '../security/identity.repository.js';
+import type { CurrentUser } from '../security/security.metadata.js';
+import {
+  VENDOR_GATEWAYS_REPOSITORY,
+  type CreateVendorGatewayInput,
+  type UpdateVendorGatewayInput,
+  type VendorGatewayStatus,
+  type VendorGatewaySummary,
+  type VendorGatewaysRepository
+} from './vendor-gateways.repository.js';
+
+class MemoryIdentityRepository implements IdentityRepository {
+  users = new Map<string, CurrentUser>();
+
+  async findCurrentUserById(userId: string): Promise<CurrentUser | null> {
+    return this.users.get(userId) ?? null;
+  }
+}
+
+class MemoryAuditRepository implements AuditRepository {
+  entries: AuditEntryInput[] = [];
+
+  async write(input: AuditEntryInput): Promise<void> {
+    this.entries.push(input);
+  }
+}
+
+class MemoryVendorGatewaysRepository implements VendorGatewaysRepository {
+  private readonly gateways = new Map<string, VendorGatewaySummary>();
+  outboxEvents = 0;
+
+  constructor() {
+    this.gateways.set(
+      'vgw_seed',
+      this.summary({
+        id: 'vgw_seed',
+        vendorId: 'ven_seed',
+        name: 'Seed Gateway',
+        host: 'carrier.example.local',
+        cpsLimit: 20,
+        concurrencyLimit: 200,
+        cycleRate: '0.120000',
+        billingCycleSec: 60
+      })
+    );
+  }
+
+  async list(vendorId?: string): Promise<VendorGatewaySummary[]> {
+    return [...this.gateways.values()].filter((gateway) => !vendorId || gateway.vendorId === vendorId);
+  }
+
+  async get(gatewayId: string): Promise<VendorGatewaySummary> {
+    return this.gateways.get(gatewayId) ?? this.summary({ id: gatewayId, name: 'Missing Gateway' });
+  }
+
+  async create(input: CreateVendorGatewayInput): Promise<VendorGatewaySummary> {
+    const gateway = this.summary({
+      id: 'vgw_created',
+      vendorId: input.vendorId,
+      name: input.name,
+      authMode: input.authMode,
+      host: input.host,
+      port: input.port,
+      transport: input.transport,
+      sipUsername: input.sipUsername ?? null,
+      hasSipCredential: Boolean(input.sipHa1),
+      cpsLimit: input.cpsLimit,
+      concurrencyLimit: input.concurrencyLimit,
+      billingCycleSec: input.billingCycleSec,
+      cycleRate: input.cycleRate,
+      forbiddenPeriods: input.forbiddenPeriods.map((period, index) => ({ id: `period_${index}`, ...period })),
+      codecs: input.codecs.map((codec, index) => ({ id: `codec_${index}`, ...codec })),
+      prefixRules: input.prefixRules.map((rule, index) => ({ id: `rule_${index}`, ...rule }))
+    });
+    this.gateways.set(gateway.id, gateway);
+    this.outboxEvents += 1;
+    return gateway;
+  }
+
+  async update(gatewayId: string, input: UpdateVendorGatewayInput): Promise<VendorGatewaySummary> {
+    const current = await this.get(gatewayId);
+    const updated = this.summary({
+      ...current,
+      vendorId: input.vendorId ?? current.vendorId,
+      name: input.name ?? current.name,
+      authMode: input.authMode ?? current.authMode,
+      host: input.host ?? current.host,
+      port: input.port ?? current.port,
+      transport: input.transport ?? current.transport,
+      sipUsername: input.sipUsername === undefined ? current.sipUsername : input.sipUsername,
+      hasSipCredential: input.sipHa1 === undefined ? current.hasSipCredential : Boolean(input.sipHa1),
+      cpsLimit: input.cpsLimit ?? current.cpsLimit,
+      concurrencyLimit: input.concurrencyLimit ?? current.concurrencyLimit,
+      billingCycleSec: input.billingCycleSec ?? current.billingCycleSec,
+      cycleRate: input.cycleRate ?? current.cycleRate,
+      status: input.status ?? current.status,
+      forbiddenPeriods: input.forbiddenPeriods === undefined ? current.forbiddenPeriods : input.forbiddenPeriods.map((period, index) => ({ id: `period_updated_${index}`, ...period })),
+      codecs: input.codecs === undefined ? current.codecs : input.codecs.map((codec, index) => ({ id: `codec_updated_${index}`, ...codec })),
+      prefixRules: input.prefixRules === undefined ? current.prefixRules : input.prefixRules.map((rule, index) => ({ id: `rule_updated_${index}`, ...rule }))
+    });
+    this.gateways.set(gatewayId, updated);
+    this.outboxEvents += 1;
+    return updated;
+  }
+
+  async setStatus(gatewayId: string, status: VendorGatewayStatus): Promise<VendorGatewaySummary> {
+    return this.update(gatewayId, { status });
+  }
+
+  private summary(input: Partial<VendorGatewaySummary> & { id: string; name: string }): VendorGatewaySummary {
+    const cycleRate = input.cycleRate ?? '0.000000';
+    const billingCycleSec = input.billingCycleSec ?? 60;
+    return {
+      id: input.id,
+      vendorId: input.vendorId ?? 'ven_seed',
+      vendorName: input.vendorName ?? 'Seed Vendor',
+      name: input.name,
+      authMode: input.authMode ?? 'IP',
+      host: input.host ?? 'carrier.example.local',
+      port: input.port ?? 5060,
+      transport: input.transport ?? 'udp',
+      sipUsername: input.sipUsername ?? null,
+      hasSipCredential: input.hasSipCredential ?? false,
+      cpsLimit: input.cpsLimit ?? 0,
+      concurrencyLimit: input.concurrencyLimit ?? 0,
+      billingCycleSec,
+      cycleRate,
+      minuteRate: (Number(cycleRate) * 60 / billingCycleSec).toFixed(6),
+      status: input.status ?? 'ENABLED',
+      forbiddenPeriods: input.forbiddenPeriods ?? [],
+      codecs: input.codecs ?? [],
+      prefixRules: input.prefixRules ?? [],
+      createdAt: new Date('2026-06-21T06:00:00.000Z'),
+      updatedAt: new Date('2026-06-21T06:00:00.000Z')
+    };
+  }
+}
+
+describe('S16 vendor gateways API', () => {
+  let app: NestFastifyApplication;
+  let audit: MemoryAuditRepository;
+  let repository: MemoryVendorGatewaysRepository;
+
+  const tokenFor = (userId: string) =>
+    signAccessToken(
+      {
+        sub: userId,
+        username: userId,
+        roles: ['test'],
+        typ: 'access'
+      },
+      {
+        secret: 'test-only-access-token-secret-min-32-bytes',
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        ttlSeconds: 900
+      }
+    );
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+    process.env.AUTH_ACCESS_TOKEN_SECRET = 'test-only-access-token-secret-min-32-bytes';
+
+    const identities = new MemoryIdentityRepository();
+    audit = new MemoryAuditRepository();
+    repository = new MemoryVendorGatewaysRepository();
+
+    identities.users.set('usr_ops', {
+      id: 'usr_ops',
+      username: 'ops',
+      roles: ['运营管理员'],
+      permissions: ['vendor_gateways.view', 'vendor_gateways.manage'] as PermissionKey[]
+    });
+    identities.users.set('usr_viewer', {
+      id: 'usr_viewer',
+      username: 'viewer',
+      roles: ['只读'],
+      permissions: ['vendor_gateways.view'] as PermissionKey[]
+    });
+
+    const { AppModule } = await import('../app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({ imports: [AppModule] })
+      .overrideProvider(IDENTITY_REPOSITORY)
+      .useValue(identities)
+      .overrideProvider(AUDIT_REPOSITORY)
+      .useValue(audit)
+      .overrideProvider(VENDOR_GATEWAYS_REPOSITORY)
+      .useValue(repository)
+      .compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('lists vendor gateways with limits and derived minute rate', async () => {
+    const response = await request(app.getHttpServer())
+      .get('/api/v2/vendor-gateways?vendorId=ven_seed')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .expect(200);
+
+    expect(response.body[0]).toMatchObject({
+      id: 'vgw_seed',
+      cpsLimit: 20,
+      concurrencyLimit: 200,
+      cycleRate: '0.120000',
+      minuteRate: '0.120000'
+    });
+    expect(JSON.stringify(response.body)).not.toContain('sipHa1');
+  });
+
+  it('rejects writes without vendor_gateways.manage', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/vendor-gateways')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .send({ vendorId: 'ven_seed', name: 'Denied', authMode: 'IP', host: '1.2.3.4' })
+      .expect(403);
+  });
+
+  it('creates and updates a full vendor gateway configuration', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/vendor-gateways')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({
+        vendorId: 'ven_seed',
+        name: 'Carrier SIP',
+        authMode: 'SIP_DIGEST',
+        host: 'SIP.CARRIER.LOCAL',
+        port: 5060,
+        transport: 'udp',
+        sipUsername: 'carrier-user',
+        sipPassword: 'change-me-very-strong',
+        cpsLimit: 30,
+        concurrencyLimit: 300,
+        billingCycleSec: 6,
+        cycleRate: '0.012',
+        forbiddenPeriods: [{ weekdayMask: 62, startTime: '23:00:00', endTime: '23:59:59' }],
+        codecs: [
+          { codec: 'PCMA', priority: 1 },
+          { codec: 'PCMU', priority: 2 }
+        ],
+        prefixRules: [{ direction: 'CALLEE', matchPrefix: '00', replacePrefix: '+', priority: 1 }]
+      })
+      .expect(201)
+      .expect((response) => {
+        expect(response.body).toMatchObject({
+          id: 'vgw_created',
+          authMode: 'SIP_DIGEST',
+          host: 'sip.carrier.local',
+          hasSipCredential: true,
+          billingCycleSec: 6,
+          cycleRate: '0.012000',
+          minuteRate: '0.120000'
+        });
+        expect(response.body.sipHa1).toBeUndefined();
+      });
+
+    await request(app.getHttpServer())
+      .patch('/api/v2/vendor-gateways/vgw_created')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({
+        authMode: 'IP',
+        host: '203.0.113.10',
+        codecs: [{ codec: 'G729', priority: 1 }],
+        prefixRules: [{ direction: 'CALLER', matchPrefix: '+86', replacePrefix: '0', priority: 1 }]
+      })
+      .expect(200)
+      .expect((response) => {
+        expect(response.body).toMatchObject({
+          authMode: 'IP',
+          host: '203.0.113.10',
+          sipUsername: null,
+          hasSipCredential: false
+        });
+        expect(response.body.codecs).toHaveLength(1);
+        expect(response.body.prefixRules[0]).toMatchObject({ direction: 'CALLER', matchPrefix: '+86' });
+      });
+
+    expect(repository.outboxEvents).toBeGreaterThanOrEqual(2);
+    expect(audit.entries.some((entry) => entry.module === 'vendor_gateways' && entry.action === 'create')).toBe(true);
+    expect(JSON.stringify(audit.entries)).not.toContain('change-me-very-strong');
+  });
+
+  it('validates child configuration and supports enable/disable', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/vendor-gateways')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({
+        vendorId: 'ven_seed',
+        name: 'Invalid Codec',
+        authMode: 'IP',
+        host: '203.0.113.20',
+        codecs: [
+          { codec: 'PCMA', priority: 1 },
+          { codec: 'PCMU', priority: 1 }
+        ]
+      })
+      .expect(400);
+
+    await request(app.getHttpServer()).post('/api/v2/vendor-gateways/vgw_created/disable').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(201);
+    await request(app.getHttpServer()).post('/api/v2/vendor-gateways/vgw_created/enable').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(201);
+  });
+});
diff --git a/apps/api/src/modules/vendor-gateways/vendor-gateways.module.ts b/apps/api/src/modules/vendor-gateways/vendor-gateways.module.ts
new file mode 100644
index 0000000..bc6fa03
--- /dev/null
+++ b/apps/api/src/modules/vendor-gateways/vendor-gateways.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { VENDOR_GATEWAYS_REPOSITORY, PrismaVendorGatewaysRepository } from './vendor-gateways.repository.js';
+import { VendorGatewaysController } from './vendor-gateways.controller.js';
+import { VendorGatewaysService } from './vendor-gateways.service.js';
+
+@Module({
+  controllers: [VendorGatewaysController],
+  providers: [
+    VendorGatewaysService,
+    {
+      provide: VENDOR_GATEWAYS_REPOSITORY,
+      useClass: PrismaVendorGatewaysRepository
+    }
+  ],
+  exports: [VendorGatewaysService]
+})
+export class VendorGatewaysModule {}
diff --git a/apps/api/src/modules/vendor-gateways/vendor-gateways.repository.ts b/apps/api/src/modules/vendor-gateways/vendor-gateways.repository.ts
new file mode 100644
index 0000000..78cdf4d
--- /dev/null
+++ b/apps/api/src/modules/vendor-gateways/vendor-gateways.repository.ts
@@ -0,0 +1,375 @@
+import { ConflictException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export type VendorGatewayStatus = 'ENABLED' | 'DISABLED';
+export type VendorGatewayAuthMode = 'IP' | 'SIP_DIGEST' | 'MIXED';
+export type PrefixDirection = 'CALLER' | 'CALLEE';
+
+export interface ForbiddenPeriodSummary {
+  id: string;
+  weekdayMask: number;
+  startTime: string;
+  endTime: string;
+}
+
+export interface CodecSummary {
+  id: string;
+  codec: string;
+  priority: number;
+}
+
+export interface PrefixRuleSummary {
+  id: string;
+  direction: PrefixDirection;
+  matchPrefix: string;
+  replacePrefix: string;
+  priority: number;
+}
+
+export interface VendorGatewaySummary {
+  id: string;
+  vendorId: string;
+  vendorName: string;
+  name: string;
+  authMode: VendorGatewayAuthMode;
+  host: string;
+  port: number;
+  transport: string;
+  sipUsername: string | null;
+  hasSipCredential: boolean;
+  cpsLimit: number;
+  concurrencyLimit: number;
+  billingCycleSec: number;
+  cycleRate: string;
+  minuteRate: string;
+  status: VendorGatewayStatus;
+  forbiddenPeriods: ForbiddenPeriodSummary[];
+  codecs: CodecSummary[];
+  prefixRules: PrefixRuleSummary[];
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface ForbiddenPeriodInput {
+  weekdayMask: number;
+  startTime: string;
+  endTime: string;
+}
+
+export interface CodecInput {
+  codec: string;
+  priority: number;
+}
+
+export interface PrefixRuleInput {
+  direction: PrefixDirection;
+  matchPrefix: string;
+  replacePrefix: string;
+  priority: number;
+}
+
+export interface CreateVendorGatewayInput {
+  vendorId: string;
+  name: string;
+  authMode: VendorGatewayAuthMode;
+  host: string;
+  port: number;
+  transport: string;
+  sipUsername?: string | null;
+  sipHa1?: string | null;
+  cpsLimit: number;
+  concurrencyLimit: number;
+  billingCycleSec: number;
+  cycleRate: string;
+  status: VendorGatewayStatus;
+  forbiddenPeriods: ForbiddenPeriodInput[];
+  codecs: CodecInput[];
+  prefixRules: PrefixRuleInput[];
+  actorId?: string;
+}
+
+export type UpdateVendorGatewayInput = Partial<Omit<CreateVendorGatewayInput, 'actorId'>> & {
+  actorId?: string;
+};
+
+export interface VendorGatewaysRepository {
+  list(vendorId?: string): Promise<VendorGatewaySummary[]>;
+  get(gatewayId: string): Promise<VendorGatewaySummary>;
+  create(input: CreateVendorGatewayInput): Promise<VendorGatewaySummary>;
+  update(gatewayId: string, input: UpdateVendorGatewayInput): Promise<VendorGatewaySummary>;
+  setStatus(gatewayId: string, status: VendorGatewayStatus, actorId?: string): Promise<VendorGatewaySummary>;
+}
+
+export const VENDOR_GATEWAYS_REPOSITORY = Symbol('VENDOR_GATEWAYS_REPOSITORY');
+
+function gatewayId(): string {
+  return `vgw_${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
+}
+
+function childId(prefix: string): string {
+  return `${prefix}_${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
+}
+
+function outboxId(): string {
+  return `out_${crypto.randomUUID().replaceAll('-', '').slice(0, 36)}`;
+}
+
+@Injectable()
+export class PrismaVendorGatewaysRepository implements VendorGatewaysRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async list(vendorId?: string): Promise<VendorGatewaySummary[]> {
+    const gateways = await this.prisma.vendorGateway.findMany({
+      where: {
+        deletedAt: null,
+        vendorId
+      },
+      orderBy: [{ createdAt: 'desc' }],
+      include: this.includeSummary()
+    });
+    return gateways.map((gateway) => this.toSummary(gateway));
+  }
+
+  async get(gatewayIdValue: string): Promise<VendorGatewaySummary> {
+    return this.toSummary(await this.findActiveOrThrow(gatewayIdValue));
+  }
+
+  async create(input: CreateVendorGatewayInput): Promise<VendorGatewaySummary> {
+    await this.ensureVendor(input.vendorId);
+    try {
+      const gateway = await this.prisma.$transaction(async (tx) => {
+        const created = await tx.vendorGateway.create({
+          data: {
+            id: gatewayId(),
+            vendorId: input.vendorId,
+            name: input.name,
+            authMode: input.authMode,
+            host: input.host,
+            port: input.port,
+            transport: input.transport,
+            sipUsername: input.sipUsername,
+            sipHa1: input.sipHa1,
+            cpsLimit: input.cpsLimit,
+            concurrencyLimit: input.concurrencyLimit,
+            billingCycleSec: input.billingCycleSec,
+            cycleRate: new Prisma.Decimal(input.cycleRate),
+            status: input.status,
+            createdBy: input.actorId,
+            updatedBy: input.actorId,
+            forbiddenPeriods: { create: input.forbiddenPeriods.map((period) => this.forbiddenCreate(period, input.actorId)) },
+            codecs: { create: input.codecs.map((codec) => this.codecCreate(codec, input.actorId)) },
+            prefixRules: { create: input.prefixRules.map((rule) => this.prefixRuleCreate(rule, input.actorId)) }
+          },
+          include: this.includeSummary()
+        });
+        await this.enqueueConfigOutbox(tx, created.id, 'vendor_gateway.changed');
+        return created;
+      });
+      return this.toSummary(gateway);
+    } catch (error) {
+      this.handleUniqueConflict(error);
+      throw error;
+    }
+  }
+
+  async update(gatewayIdValue: string, input: UpdateVendorGatewayInput): Promise<VendorGatewaySummary> {
+    const existing = await this.findActiveOrThrow(gatewayIdValue);
+    if (input.vendorId) {
+      await this.ensureVendor(input.vendorId);
+    }
+
+    try {
+      const gateway = await this.prisma.$transaction(async (tx) => {
+        if (input.forbiddenPeriods) {
+          await tx.vendorGatewayForbiddenPeriod.deleteMany({ where: { vendorGatewayId: gatewayIdValue } });
+        }
+        if (input.codecs) {
+          await tx.vendorGatewayCodec.deleteMany({ where: { vendorGatewayId: gatewayIdValue } });
+        }
+        if (input.prefixRules) {
+          await tx.vendorGatewayPrefixRule.deleteMany({ where: { vendorGatewayId: gatewayIdValue } });
+        }
+
+        const updated = await tx.vendorGateway.update({
+          where: { id: gatewayIdValue },
+          data: {
+            vendorId: input.vendorId,
+            name: input.name,
+            authMode: input.authMode,
+            host: input.host,
+            port: input.port,
+            transport: input.transport,
+            sipUsername: input.sipUsername,
+            sipHa1: input.sipHa1,
+            cpsLimit: input.cpsLimit,
+            concurrencyLimit: input.concurrencyLimit,
+            billingCycleSec: input.billingCycleSec,
+            cycleRate: input.cycleRate === undefined ? undefined : new Prisma.Decimal(input.cycleRate),
+            status: input.status,
+            updatedBy: input.actorId,
+            version: { increment: 1 },
+            forbiddenPeriods: input.forbiddenPeriods ? { create: input.forbiddenPeriods.map((period) => this.forbiddenCreate(period, input.actorId)) } : undefined,
+            codecs: input.codecs ? { create: input.codecs.map((codec) => this.codecCreate(codec, input.actorId)) } : undefined,
+            prefixRules: input.prefixRules ? { create: input.prefixRules.map((rule) => this.prefixRuleCreate(rule, input.actorId)) } : undefined
+          },
+          include: this.includeSummary()
+        });
+        await this.enqueueConfigOutbox(tx, existing.id, 'vendor_gateway.changed');
+        return updated;
+      });
+      return this.toSummary(gateway);
+    } catch (error) {
+      this.handleUniqueConflict(error);
+      throw error;
+    }
+  }
+
+  async setStatus(gatewayIdValue: string, status: VendorGatewayStatus, actorId?: string): Promise<VendorGatewaySummary> {
+    await this.findActiveOrThrow(gatewayIdValue);
+    const gateway = await this.prisma.$transaction(async (tx) => {
+      const updated = await tx.vendorGateway.update({
+        where: { id: gatewayIdValue },
+        data: {
+          status,
+          updatedBy: actorId,
+          version: { increment: 1 }
+        },
+        include: this.includeSummary()
+      });
+      await this.enqueueConfigOutbox(tx, updated.id, 'vendor_gateway.changed');
+      return updated;
+    });
+    return this.toSummary(gateway);
+  }
+
+  private async ensureVendor(vendorId: string): Promise<void> {
+    const vendor = await this.prisma.vendor.findUnique({
+      where: { id: vendorId },
+      select: { id: true, deletedAt: true }
+    });
+    if (!vendor || vendor.deletedAt) {
+      throw new NotFoundException({ code: 'VENDOR_NOT_FOUND', message: 'Vendor not found.' });
+    }
+  }
+
+  private async findActiveOrThrow(gatewayIdValue: string) {
+    const gateway = await this.prisma.vendorGateway.findUnique({
+      where: { id: gatewayIdValue },
+      include: this.includeSummary()
+    });
+    if (!gateway || gateway.deletedAt) {
+      throw new NotFoundException({ code: 'VENDOR_GATEWAY_NOT_FOUND', message: 'Vendor gateway not found.' });
+    }
+    return gateway;
+  }
+
+  private forbiddenCreate(period: ForbiddenPeriodInput, actorId?: string) {
+    return {
+      id: childId('vgfp'),
+      weekdayMask: period.weekdayMask,
+      startTime: period.startTime,
+      endTime: period.endTime,
+      createdBy: actorId,
+      updatedBy: actorId
+    };
+  }
+
+  private codecCreate(codec: CodecInput, actorId?: string) {
+    return {
+      id: childId('vgc'),
+      codec: codec.codec,
+      priority: codec.priority,
+      createdBy: actorId,
+      updatedBy: actorId
+    };
+  }
+
+  private prefixRuleCreate(rule: PrefixRuleInput, actorId?: string) {
+    return {
+      id: childId('vgpr'),
+      direction: rule.direction,
+      matchPrefix: rule.matchPrefix,
+      replacePrefix: rule.replacePrefix,
+      priority: rule.priority,
+      createdBy: actorId,
+      updatedBy: actorId
+    };
+  }
+
+  private includeSummary() {
+    return {
+      vendor: { select: { name: true } },
+      forbiddenPeriods: { orderBy: [{ weekdayMask: 'asc' }, { startTime: 'asc' }] },
+      codecs: { orderBy: [{ priority: 'asc' }] },
+      prefixRules: { orderBy: [{ direction: 'asc' }, { priority: 'asc' }] }
+    } satisfies Prisma.VendorGatewayInclude;
+  }
+
+  private async enqueueConfigOutbox(tx: Prisma.TransactionClient, gatewayIdValue: string, eventType: string): Promise<void> {
+    await tx.outboxEvent.create({
+      data: {
+        id: outboxId(),
+        aggregateType: 'vendor_gateway_config',
+        aggregateId: gatewayIdValue,
+        eventType,
+        payload: { gatewayId: gatewayIdValue, eventType }
+      }
+    });
+  }
+
+  private toSummary(gateway: {
+    id: string;
+    vendorId: string;
+    name: string;
+    authMode: VendorGatewayAuthMode;
+    host: string;
+    port: number;
+    transport: string;
+    sipUsername: string | null;
+    sipHa1: string | null;
+    cpsLimit: number;
+    concurrencyLimit: number;
+    billingCycleSec: number;
+    cycleRate: Prisma.Decimal;
+    status: VendorGatewayStatus;
+    createdAt: Date;
+    updatedAt: Date;
+    vendor: { name: string };
+    forbiddenPeriods: Array<{ id: string; weekdayMask: number; startTime: string; endTime: string }>;
+    codecs: Array<{ id: string; codec: string; priority: number }>;
+    prefixRules: Array<{ id: string; direction: PrefixDirection; matchPrefix: string; replacePrefix: string; priority: number }>;
+  }): VendorGatewaySummary {
+    const minuteRate = gateway.cycleRate.mul(new Prisma.Decimal(60)).div(gateway.billingCycleSec);
+    return {
+      id: gateway.id,
+      vendorId: gateway.vendorId,
+      vendorName: gateway.vendor.name,
+      name: gateway.name,
+      authMode: gateway.authMode,
+      host: gateway.host,
+      port: gateway.port,
+      transport: gateway.transport,
+      sipUsername: gateway.sipUsername,
+      hasSipCredential: Boolean(gateway.sipHa1),
+      cpsLimit: gateway.cpsLimit,
+      concurrencyLimit: gateway.concurrencyLimit,
+      billingCycleSec: gateway.billingCycleSec,
+      cycleRate: gateway.cycleRate.toFixed(6),
+      minuteRate: minuteRate.toFixed(6),
+      status: gateway.status,
+      forbiddenPeriods: gateway.forbiddenPeriods,
+      codecs: gateway.codecs,
+      prefixRules: gateway.prefixRules,
+      createdAt: gateway.createdAt,
+      updatedAt: gateway.updatedAt
+    };
+  }
+
+  private handleUniqueConflict(error: unknown): void {
+    if (error && typeof error === 'object' && 'code' in error && (error as { code?: unknown }).code === 'P2002') {
+      throw new ConflictException({ code: 'VENDOR_GATEWAY_CONFLICT', message: 'Vendor gateway name or child priority already exists.' });
+    }
+  }
+}
diff --git a/apps/api/src/modules/vendor-gateways/vendor-gateways.service.ts b/apps/api/src/modules/vendor-gateways/vendor-gateways.service.ts
new file mode 100644
index 0000000..ba0f74d
--- /dev/null
+++ b/apps/api/src/modules/vendor-gateways/vendor-gateways.service.ts
@@ -0,0 +1,324 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import crypto from 'node:crypto';
+import net from 'node:net';
+import {
+  VENDOR_GATEWAYS_REPOSITORY,
+  type CodecInput,
+  type CreateVendorGatewayInput,
+  type ForbiddenPeriodInput,
+  type PrefixDirection,
+  type PrefixRuleInput,
+  type UpdateVendorGatewayInput,
+  type VendorGatewayAuthMode,
+  type VendorGatewayStatus,
+  type VendorGatewaySummary,
+  type VendorGatewaysRepository
+} from './vendor-gateways.repository.js';
+
+interface VendorGatewayDto {
+  vendorId?: unknown;
+  name?: unknown;
+  authMode?: unknown;
+  host?: unknown;
+  port?: unknown;
+  transport?: unknown;
+  sipUsername?: unknown;
+  sipPassword?: unknown;
+  cpsLimit?: unknown;
+  concurrencyLimit?: unknown;
+  billingCycleSec?: unknown;
+  cycleRate?: unknown;
+  status?: unknown;
+  forbiddenPeriods?: unknown;
+  codecs?: unknown;
+  prefixRules?: unknown;
+}
+
+@Injectable()
+export class VendorGatewaysService {
+  constructor(@Inject(VENDOR_GATEWAYS_REPOSITORY) private readonly gateways: VendorGatewaysRepository) {}
+
+  list(query: { vendorId?: unknown } = {}): Promise<VendorGatewaySummary[]> {
+    const vendorId = query.vendorId === undefined ? undefined : this.limitedString(query.vendorId, 'vendorId', 32);
+    return this.gateways.list(vendorId);
+  }
+
+  get(gatewayId: string): Promise<VendorGatewaySummary> {
+    return this.gateways.get(gatewayId);
+  }
+
+  create(body: VendorGatewayDto, actorId?: string): Promise<VendorGatewaySummary> {
+    const authMode = this.authMode(body.authMode);
+    const host = this.host(body.host);
+    const sipUsername = this.normalizeSipUsername(authMode, body.sipUsername);
+    const sipPassword = this.requiredSipPassword(authMode, body.sipPassword);
+    const input: CreateVendorGatewayInput = {
+      vendorId: this.limitedString(body.vendorId, 'vendorId', 32),
+      name: this.limitedString(body.name, 'name', 120),
+      authMode,
+      host,
+      port: body.port === undefined ? 5060 : this.integer(body.port, 'port', 1, 65535),
+      transport: body.transport === undefined ? 'udp' : this.transport(body.transport),
+      sipUsername,
+      sipHa1: sipPassword ? this.sipHa1(sipUsername, host, sipPassword) : undefined,
+      cpsLimit: body.cpsLimit === undefined ? 0 : this.integer(body.cpsLimit, 'cpsLimit', 0, 10000),
+      concurrencyLimit: body.concurrencyLimit === undefined ? 0 : this.integer(body.concurrencyLimit, 'concurrencyLimit', 0, 100000),
+      billingCycleSec: body.billingCycleSec === undefined ? 60 : this.integer(body.billingCycleSec, 'billingCycleSec', 1, 60),
+      cycleRate: body.cycleRate === undefined ? '0.000000' : this.money(body.cycleRate, 'cycleRate'),
+      status: body.status === undefined ? 'ENABLED' : this.status(body.status),
+      forbiddenPeriods: this.forbiddenPeriods(body.forbiddenPeriods),
+      codecs: this.codecs(body.codecs),
+      prefixRules: this.prefixRules(body.prefixRules),
+      actorId
+    };
+    return this.gateways.create(input);
+  }
+
+  async update(gatewayId: string, body: VendorGatewayDto, actorId?: string): Promise<VendorGatewaySummary> {
+    const current = await this.gateways.get(gatewayId);
+    const authMode = body.authMode === undefined ? current.authMode : this.authMode(body.authMode);
+    const host = body.host === undefined ? current.host : this.host(body.host);
+    const sipUsername = body.sipUsername === undefined ? current.sipUsername : this.nullableSipUsername(authMode, body.sipUsername);
+    const password = body.sipPassword === undefined ? undefined : this.requiredSipPassword(authMode, body.sipPassword);
+
+    if (this.requiresSip(authMode)) {
+      const identityChanged = sipUsername !== current.sipUsername || host !== current.host;
+      if (!password && (identityChanged || !current.hasSipCredential)) {
+        throw new BadRequestException({
+          code: 'SIP_PASSWORD_REQUIRED',
+          message: 'sipPassword is required when creating or changing SIP identity.'
+        });
+      }
+    }
+
+    const input: UpdateVendorGatewayInput = {
+      vendorId: body.vendorId === undefined ? undefined : this.limitedString(body.vendorId, 'vendorId', 32),
+      name: body.name === undefined ? undefined : this.limitedString(body.name, 'name', 120),
+      authMode,
+      host,
+      port: body.port === undefined ? undefined : this.integer(body.port, 'port', 1, 65535),
+      transport: body.transport === undefined ? undefined : this.transport(body.transport),
+      sipUsername: this.requiresSip(authMode) ? sipUsername : null,
+      sipHa1: password ? this.sipHa1(sipUsername, host, password) : this.requiresSip(authMode) ? undefined : null,
+      cpsLimit: body.cpsLimit === undefined ? undefined : this.integer(body.cpsLimit, 'cpsLimit', 0, 10000),
+      concurrencyLimit: body.concurrencyLimit === undefined ? undefined : this.integer(body.concurrencyLimit, 'concurrencyLimit', 0, 100000),
+      billingCycleSec: body.billingCycleSec === undefined ? undefined : this.integer(body.billingCycleSec, 'billingCycleSec', 1, 60),
+      cycleRate: body.cycleRate === undefined ? undefined : this.money(body.cycleRate, 'cycleRate'),
+      status: body.status === undefined ? undefined : this.status(body.status),
+      forbiddenPeriods: body.forbiddenPeriods === undefined ? undefined : this.forbiddenPeriods(body.forbiddenPeriods),
+      codecs: body.codecs === undefined ? undefined : this.codecs(body.codecs),
+      prefixRules: body.prefixRules === undefined ? undefined : this.prefixRules(body.prefixRules),
+      actorId
+    };
+    return this.gateways.update(gatewayId, input);
+  }
+
+  enable(gatewayId: string, actorId?: string): Promise<VendorGatewaySummary> {
+    return this.gateways.setStatus(gatewayId, 'ENABLED', actorId);
+  }
+
+  disable(gatewayId: string, actorId?: string): Promise<VendorGatewaySummary> {
+    return this.gateways.setStatus(gatewayId, 'DISABLED', actorId);
+  }
+
+  private limitedString(value: unknown, field: string, maxLength: number): string {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is required.` });
+    }
+    const trimmed = value.trim();
+    if (trimmed.length > maxLength) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is too long.` });
+    }
+    return trimmed;
+  }
+
+  private authMode(value: unknown): VendorGatewayAuthMode {
+    if (value !== 'IP' && value !== 'SIP_DIGEST' && value !== 'MIXED') {
+      throw new BadRequestException({ code: 'AUTH_MODE_INVALID', message: 'Auth mode is invalid.' });
+    }
+    return value;
+  }
+
+  private status(value: unknown): VendorGatewayStatus {
+    if (value !== 'ENABLED' && value !== 'DISABLED') {
+      throw new BadRequestException({ code: 'STATUS_INVALID', message: 'Status is invalid.' });
+    }
+    return value;
+  }
+
+  private host(value: unknown): string {
+    const host = this.limitedString(value, 'host', 160).toLowerCase();
+    if (net.isIP(host) === 0 && !/^[a-z0-9.-]+$/.test(host)) {
+      throw new BadRequestException({ code: 'HOST_INVALID', message: 'host must be an IP address or hostname.' });
+    }
+    return host;
+  }
+
+  private transport(value: unknown): string {
+    const transport = this.limitedString(value, 'transport', 16).toLowerCase();
+    if (transport !== 'udp' && transport !== 'tcp' && transport !== 'tls') {
+      throw new BadRequestException({ code: 'TRANSPORT_INVALID', message: 'transport must be udp, tcp, or tls.' });
+    }
+    return transport;
+  }
+
+  private integer(value: unknown, field: string, min: number, max: number): number {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < min || value > max) {
+      throw new BadRequestException({ code: 'INTEGER_INVALID', message: `${field} must be an integer from ${min} to ${max}.` });
+    }
+    return value;
+  }
+
+  private money(value: unknown, field: string): string {
+    const raw = typeof value === 'number' ? value.toString() : typeof value === 'string' ? value.trim() : '';
+    if (!/^\d{1,14}(?:\.\d{1,6})?$/.test(raw)) {
+      throw new BadRequestException({ code: 'MONEY_INVALID', message: `${field} must be a non-negative decimal with up to 6 places.` });
+    }
+    const [integerPart, fractionPart = ''] = raw.split('.');
+    return `${integerPart}.${fractionPart.padEnd(6, '0')}`;
+  }
+
+  private normalizeSipUsername(authMode: VendorGatewayAuthMode, value: unknown): string | null {
+    if (!this.requiresSip(authMode)) {
+      return null;
+    }
+    return this.sipUsername(value);
+  }
+
+  private nullableSipUsername(authMode: VendorGatewayAuthMode, value: unknown): string | null {
+    if (!this.requiresSip(authMode)) {
+      return null;
+    }
+    return this.sipUsername(value);
+  }
+
+  private sipUsername(value: unknown): string {
+    const username = this.limitedString(value, 'sipUsername', 120);
+    if (!/^[A-Za-z0-9_.:+-]+$/.test(username)) {
+      throw new BadRequestException({ code: 'SIP_USERNAME_INVALID', message: 'sipUsername contains invalid characters.' });
+    }
+    return username;
+  }
+
+  private requiredSipPassword(authMode: VendorGatewayAuthMode, value: unknown): string | undefined {
+    if (!this.requiresSip(authMode)) {
+      return undefined;
+    }
+    const password = this.limitedString(value, 'sipPassword', 128);
+    if (password.length < 12) {
+      throw new BadRequestException({ code: 'SIP_PASSWORD_WEAK', message: 'sipPassword must be at least 12 characters.' });
+    }
+    return password;
+  }
+
+  private sipHa1(username: string | null, host: string, password: string): string {
+    if (!username) {
+      throw new BadRequestException({ code: 'SIP_IDENTITY_REQUIRED', message: 'SIP identity is required.' });
+    }
+    return crypto.createHash('md5').update(`${username}:${host}:${password}`, 'utf8').digest('hex');
+  }
+
+  private forbiddenPeriods(value: unknown): ForbiddenPeriodInput[] {
+    if (value === undefined) {
+      return [];
+    }
+    if (!Array.isArray(value)) {
+      throw new BadRequestException({ code: 'FORBIDDEN_PERIODS_INVALID', message: 'forbiddenPeriods must be an array.' });
+    }
+    return value.map((item, index) => {
+      const period = item as Record<string, unknown>;
+      return {
+        weekdayMask: this.integer(period.weekdayMask, `forbiddenPeriods[${index}].weekdayMask`, 1, 127),
+        startTime: this.time(period.startTime, `forbiddenPeriods[${index}].startTime`),
+        endTime: this.time(period.endTime, `forbiddenPeriods[${index}].endTime`)
+      };
+    });
+  }
+
+  private codecs(value: unknown): CodecInput[] {
+    if (value === undefined) {
+      return [];
+    }
+    if (!Array.isArray(value)) {
+      throw new BadRequestException({ code: 'CODECS_INVALID', message: 'codecs must be an array.' });
+    }
+    const codecs = value.map((item, index) => {
+      const codec = item as Record<string, unknown>;
+      return {
+        codec: this.codec(codec.codec, `codecs[${index}].codec`),
+        priority: this.integer(codec.priority, `codecs[${index}].priority`, 1, 1000)
+      };
+    });
+    this.ensureUnique(codecs.map((codec) => codec.codec), 'CODEC_DUPLICATE', 'Codec values must be unique.');
+    this.ensureUnique(codecs.map((codec) => String(codec.priority)), 'CODEC_PRIORITY_DUPLICATE', 'Codec priorities must be unique.');
+    return codecs;
+  }
+
+  private prefixRules(value: unknown): PrefixRuleInput[] {
+    if (value === undefined) {
+      return [];
+    }
+    if (!Array.isArray(value)) {
+      throw new BadRequestException({ code: 'PREFIX_RULES_INVALID', message: 'prefixRules must be an array.' });
+    }
+    const rules = value.map((item, index) => {
+      const rule = item as Record<string, unknown>;
+      return {
+        direction: this.direction(rule.direction, `prefixRules[${index}].direction`),
+        matchPrefix: this.prefix(rule.matchPrefix, `prefixRules[${index}].matchPrefix`),
+        replacePrefix: this.prefix(rule.replacePrefix, `prefixRules[${index}].replacePrefix`, true),
+        priority: this.integer(rule.priority, `prefixRules[${index}].priority`, 1, 1000)
+      };
+    });
+    this.ensureUnique(
+      rules.map((rule) => `${rule.direction}:${rule.priority}`),
+      'PREFIX_RULE_PRIORITY_DUPLICATE',
+      'Prefix rule priorities must be unique per direction.'
+    );
+    return rules;
+  }
+
+  private time(value: unknown, field: string): string {
+    const text = this.limitedString(value, field, 8);
+    if (!/^(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d$/.test(text)) {
+      throw new BadRequestException({ code: 'TIME_INVALID', message: `${field} must be HH:mm:ss.` });
+    }
+    return text;
+  }
+
+  private codec(value: unknown, field: string): string {
+    const text = this.limitedString(value, field, 32).toUpperCase();
+    if (!/^[A-Z0-9_-]+$/.test(text)) {
+      throw new BadRequestException({ code: 'CODEC_INVALID', message: `${field} contains invalid characters.` });
+    }
+    return text;
+  }
+
+  private direction(value: unknown, field: string): PrefixDirection {
+    if (value !== 'CALLER' && value !== 'CALLEE') {
+      throw new BadRequestException({ code: 'PREFIX_DIRECTION_INVALID', message: `${field} is invalid.` });
+    }
+    return value;
+  }
+
+  private prefix(value: unknown, field: string, allowEmpty = false): string {
+    if (allowEmpty && value === '') {
+      return '';
+    }
+    const text = this.limitedString(value, field, 32);
+    if (!/^[0-9+*#.-]*$/.test(text)) {
+      throw new BadRequestException({ code: 'PREFIX_INVALID', message: `${field} contains invalid characters.` });
+    }
+    return text;
+  }
+
+  private ensureUnique(values: string[], code: string, message: string): void {
+    if (new Set(values).size !== values.length) {
+      throw new BadRequestException({ code, message });
+    }
+  }
+
+  private requiresSip(authMode: VendorGatewayAuthMode): boolean {
+    return authMode === 'SIP_DIGEST' || authMode === 'MIXED';
+  }
+}
diff --git a/apps/api/src/modules/vendors/vendors.controller.ts b/apps/api/src/modules/vendors/vendors.controller.ts
new file mode 100644
index 0000000..5c8216f
--- /dev/null
+++ b/apps/api/src/modules/vendors/vendors.controller.ts
@@ -0,0 +1,58 @@
+import { Body, Controller, Delete, Get, Inject, Param, Patch, Post } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { AuditAction } from '../audit/audit.metadata.js';
+import { CurrentUserParam, RequirePermissions, type CurrentUser } from '../security/security.metadata.js';
+import { VendorsService } from './vendors.service.js';
+
+@ApiTags('vendors')
+@Controller('vendors')
+export class VendorsController {
+  constructor(@Inject(VendorsService) private readonly vendorsService: VendorsService) {}
+
+  @Get()
+  @RequirePermissions('vendors.view')
+  list() {
+    return this.vendorsService.list();
+  }
+
+  @Get(':id')
+  @RequirePermissions('vendors.view')
+  get(@Param('id') id: string) {
+    return this.vendorsService.get(id);
+  }
+
+  @Post()
+  @RequirePermissions('vendors.manage')
+  @AuditAction({ module: 'vendors', action: 'create', objectType: 'vendor' })
+  create(@Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.vendorsService.create(body as never, currentUser?.id);
+  }
+
+  @Patch(':id')
+  @RequirePermissions('vendors.manage')
+  @AuditAction({ module: 'vendors', action: 'update', objectType: 'vendor', objectIdParam: 'id' })
+  update(@Param('id') id: string, @Body() body: unknown, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.vendorsService.update(id, body as never, currentUser?.id);
+  }
+
+  @Post(':id/enable')
+  @RequirePermissions('vendors.manage')
+  @AuditAction({ module: 'vendors', action: 'enable', objectType: 'vendor', objectIdParam: 'id' })
+  enable(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.vendorsService.enable(id, currentUser?.id);
+  }
+
+  @Post(':id/disable')
+  @RequirePermissions('vendors.manage')
+  @AuditAction({ module: 'vendors', action: 'disable', objectType: 'vendor', objectIdParam: 'id' })
+  disable(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.vendorsService.disable(id, currentUser?.id);
+  }
+
+  @Delete(':id')
+  @RequirePermissions('vendors.manage')
+  @AuditAction({ module: 'vendors', action: 'delete', objectType: 'vendor', objectIdParam: 'id' })
+  remove(@Param('id') id: string, @CurrentUserParam() currentUser?: CurrentUser) {
+    return this.vendorsService.remove(id, currentUser?.id);
+  }
+}
diff --git a/apps/api/src/modules/vendors/vendors.e2e.spec.ts b/apps/api/src/modules/vendors/vendors.e2e.spec.ts
new file mode 100644
index 0000000..ac0ac06
--- /dev/null
+++ b/apps/api/src/modules/vendors/vendors.e2e.spec.ts
@@ -0,0 +1,259 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { signAccessToken, type PermissionKey } from '@lisglosips/auth';
+import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from '../audit/audit.repository.js';
+import { IDENTITY_REPOSITORY, type IdentityRepository } from '../security/identity.repository.js';
+import type { CurrentUser } from '../security/security.metadata.js';
+import {
+  VENDORS_REPOSITORY,
+  type CreateVendorInput,
+  type UpdateVendorInput,
+  type VendorStatus,
+  type VendorSummary,
+  type VendorsRepository
+} from './vendors.repository.js';
+
+class MemoryIdentityRepository implements IdentityRepository {
+  users = new Map<string, CurrentUser>();
+
+  async findCurrentUserById(userId: string): Promise<CurrentUser | null> {
+    return this.users.get(userId) ?? null;
+  }
+}
+
+class MemoryAuditRepository implements AuditRepository {
+  entries: AuditEntryInput[] = [];
+
+  async write(input: AuditEntryInput): Promise<void> {
+    this.entries.push(input);
+  }
+}
+
+class MemoryVendorsRepository implements VendorsRepository {
+  private readonly vendors = new Map<string, VendorSummary>();
+
+  constructor() {
+    this.vendors.set(
+      'ven_seed',
+      this.summary({
+        id: 'ven_seed',
+        name: 'Seed Vendor',
+        creditLimit: '200.000000',
+        gatewayCount: 2
+      })
+    );
+  }
+
+  async list(): Promise<VendorSummary[]> {
+    return [...this.vendors.values()];
+  }
+
+  async get(vendorId: string): Promise<VendorSummary> {
+    return this.vendors.get(vendorId) ?? this.summary({ id: vendorId, name: 'Missing Vendor' });
+  }
+
+  async create(input: CreateVendorInput): Promise<VendorSummary> {
+    const vendor = this.summary({
+      id: 'ven_created',
+      name: input.name,
+      contactName: input.contactName ?? null,
+      phone: input.phone ?? null,
+      email: input.email ?? null,
+      status: input.status ?? 'ENABLED',
+      creditLimit: input.creditLimit,
+      settlement: input.settlement ?? null,
+      notes: input.notes ?? null
+    });
+    this.vendors.set(vendor.id, vendor);
+    return vendor;
+  }
+
+  async update(vendorId: string, input: UpdateVendorInput): Promise<VendorSummary> {
+    const current = this.vendors.get(vendorId) ?? this.summary({ id: vendorId, name: 'Updated Vendor' });
+    const updated: VendorSummary = {
+      ...current,
+      name: input.name ?? current.name,
+      contactName: input.contactName === undefined ? current.contactName : input.contactName,
+      phone: input.phone === undefined ? current.phone : input.phone,
+      email: input.email === undefined ? current.email : input.email,
+      status: input.status ?? current.status,
+      creditLimit: input.creditLimit ?? current.creditLimit,
+      availableBalance: (Number(current.balance) + Number(input.creditLimit ?? current.creditLimit)).toFixed(6),
+      settlement: input.settlement === undefined ? current.settlement : input.settlement,
+      notes: input.notes === undefined ? current.notes : input.notes,
+      updatedAt: new Date('2026-06-21T05:00:00.000Z')
+    };
+    this.vendors.set(vendorId, updated);
+    return updated;
+  }
+
+  async setStatus(vendorId: string, status: VendorStatus): Promise<VendorSummary> {
+    return this.update(vendorId, { status });
+  }
+
+  async softDelete(vendorId: string): Promise<VendorSummary> {
+    return this.update(vendorId, { status: 'DISABLED' });
+  }
+
+  private summary(input: {
+    id: string;
+    name: string;
+    contactName?: string | null;
+    phone?: string | null;
+    email?: string | null;
+    status?: VendorStatus;
+    creditLimit?: string;
+    settlement?: string | null;
+    notes?: string | null;
+    gatewayCount?: number;
+  }): VendorSummary {
+    const balance = '20.000000';
+    const creditLimit = input.creditLimit ?? '0.000000';
+    return {
+      id: input.id,
+      name: input.name,
+      contactName: input.contactName ?? null,
+      phone: input.phone ?? null,
+      email: input.email ?? null,
+      status: input.status ?? 'ENABLED',
+      balance,
+      creditLimit,
+      availableBalance: (Number(balance) + Number(creditLimit)).toFixed(6),
+      settlement: input.settlement ?? null,
+      notes: input.notes ?? null,
+      gatewayCount: input.gatewayCount ?? 0,
+      createdAt: new Date('2026-06-21T05:00:00.000Z'),
+      updatedAt: new Date('2026-06-21T05:00:00.000Z')
+    };
+  }
+}
+
+describe('S15 vendors API', () => {
+  let app: NestFastifyApplication;
+  let audit: MemoryAuditRepository;
+
+  const tokenFor = (userId: string) =>
+    signAccessToken(
+      {
+        sub: userId,
+        username: userId,
+        roles: ['test'],
+        typ: 'access'
+      },
+      {
+        secret: 'test-only-access-token-secret-min-32-bytes',
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        ttlSeconds: 900
+      }
+    );
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+    process.env.AUTH_ACCESS_TOKEN_SECRET = 'test-only-access-token-secret-min-32-bytes';
+
+    const identities = new MemoryIdentityRepository();
+    audit = new MemoryAuditRepository();
+
+    identities.users.set('usr_ops', {
+      id: 'usr_ops',
+      username: 'ops',
+      roles: ['运营管理员'],
+      permissions: ['vendors.view', 'vendors.manage', 'recharges.view'] as PermissionKey[]
+    });
+    identities.users.set('usr_viewer', {
+      id: 'usr_viewer',
+      username: 'viewer',
+      roles: ['只读'],
+      permissions: ['vendors.view'] as PermissionKey[]
+    });
+
+    const { AppModule } = await import('../app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule]
+    })
+      .overrideProvider(IDENTITY_REPOSITORY)
+      .useValue(identities)
+      .overrideProvider(AUDIT_REPOSITORY)
+      .useValue(audit)
+      .overrideProvider(VENDORS_REPOSITORY)
+      .useValue(new MemoryVendorsRepository())
+      .compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('returns vendor balance, credit, and gateway count to viewers', async () => {
+    const response = await request(app.getHttpServer()).get('/api/v2/vendors').set('Authorization', `Bearer ${tokenFor('usr_viewer')}`).expect(200);
+
+    expect(response.body[0]).toMatchObject({
+      id: 'ven_seed',
+      balance: '20.000000',
+      creditLimit: '200.000000',
+      availableBalance: '220.000000',
+      gatewayCount: 2
+    });
+  });
+
+  it('rejects write operations without vendors.manage', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/vendors')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .send({ name: 'Denied Vendor' })
+      .expect(403);
+  });
+
+  it('creates, updates, disables, enables, and soft deletes vendors with audit entries', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/vendors')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({
+        name: 'Carrier One',
+        contactName: 'NOC',
+        creditLimit: '188.5',
+        settlement: 'monthly'
+      })
+      .expect(201)
+      .expect((response) => {
+        expect(response.body).toMatchObject({
+          id: 'ven_created',
+          name: 'Carrier One',
+          creditLimit: '188.500000',
+          availableBalance: '208.500000',
+          settlement: 'monthly'
+        });
+      });
+
+    await request(app.getHttpServer())
+      .patch('/api/v2/vendors/ven_created')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ notes: 'primary carrier', creditLimit: '200' })
+      .expect(200)
+      .expect((response) => {
+        expect(response.body).toMatchObject({
+          notes: 'primary carrier',
+          creditLimit: '200.000000'
+        });
+      });
+
+    await request(app.getHttpServer()).post('/api/v2/vendors/ven_created/disable').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(201);
+    await request(app.getHttpServer()).post('/api/v2/vendors/ven_created/enable').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(201);
+    await request(app.getHttpServer()).delete('/api/v2/vendors/ven_created').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(200);
+
+    expect(audit.entries.some((entry) => entry.module === 'vendors' && entry.action === 'create' && entry.result === 'SUCCESS')).toBe(true);
+    expect(audit.entries.some((entry) => entry.module === 'vendors' && entry.action === 'disable' && entry.objectId === 'ven_created')).toBe(true);
+    expect(audit.entries.some((entry) => entry.module === 'vendors' && entry.action === 'delete' && entry.objectId === 'ven_created')).toBe(true);
+  });
+});
diff --git a/apps/api/src/modules/vendors/vendors.module.ts b/apps/api/src/modules/vendors/vendors.module.ts
new file mode 100644
index 0000000..8fe8069
--- /dev/null
+++ b/apps/api/src/modules/vendors/vendors.module.ts
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { VENDORS_REPOSITORY, PrismaVendorsRepository } from './vendors.repository.js';
+import { VendorsController } from './vendors.controller.js';
+import { VendorsService } from './vendors.service.js';
+
+@Module({
+  controllers: [VendorsController],
+  providers: [
+    VendorsService,
+    {
+      provide: VENDORS_REPOSITORY,
+      useClass: PrismaVendorsRepository
+    }
+  ],
+  exports: [VendorsService]
+})
+export class VendorsModule {}
diff --git a/apps/api/src/modules/vendors/vendors.repository.ts b/apps/api/src/modules/vendors/vendors.repository.ts
new file mode 100644
index 0000000..c5b9024
--- /dev/null
+++ b/apps/api/src/modules/vendors/vendors.repository.ts
@@ -0,0 +1,217 @@
+import { BadRequestException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import crypto from 'node:crypto';
+import { Prisma } from '@lisglosips/database';
+import { PrismaService } from '../database/prisma.service.js';
+
+export type VendorStatus = 'ENABLED' | 'DISABLED';
+
+export interface VendorSummary {
+  id: string;
+  name: string;
+  contactName: string | null;
+  phone: string | null;
+  email: string | null;
+  status: VendorStatus;
+  balance: string;
+  creditLimit: string;
+  availableBalance: string;
+  settlement: string | null;
+  notes: string | null;
+  gatewayCount: number;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface CreateVendorInput {
+  name: string;
+  contactName?: string;
+  phone?: string;
+  email?: string;
+  status?: VendorStatus;
+  creditLimit: string;
+  settlement?: string;
+  notes?: string;
+  actorId?: string;
+}
+
+export interface UpdateVendorInput {
+  name?: string;
+  contactName?: string | null;
+  phone?: string | null;
+  email?: string | null;
+  status?: VendorStatus;
+  creditLimit?: string;
+  settlement?: string | null;
+  notes?: string | null;
+  actorId?: string;
+}
+
+export interface VendorsRepository {
+  list(): Promise<VendorSummary[]>;
+  get(vendorId: string): Promise<VendorSummary>;
+  create(input: CreateVendorInput): Promise<VendorSummary>;
+  update(vendorId: string, input: UpdateVendorInput): Promise<VendorSummary>;
+  setStatus(vendorId: string, status: VendorStatus, actorId?: string): Promise<VendorSummary>;
+  softDelete(vendorId: string, actorId?: string): Promise<VendorSummary>;
+}
+
+export const VENDORS_REPOSITORY = Symbol('VENDORS_REPOSITORY');
+
+function vendorId(): string {
+  return `ven_${crypto.randomUUID().replaceAll('-', '').slice(0, 28)}`;
+}
+
+@Injectable()
+export class PrismaVendorsRepository implements VendorsRepository {
+  constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {}
+
+  async list(): Promise<VendorSummary[]> {
+    const vendors = await this.prisma.vendor.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ createdAt: 'desc' }],
+      include: this.includeSummary()
+    });
+
+    return vendors.map((vendor) => this.toSummary(vendor));
+  }
+
+  async get(vendorIdValue: string): Promise<VendorSummary> {
+    return this.toSummary(await this.findActiveOrThrow(vendorIdValue));
+  }
+
+  async create(input: CreateVendorInput): Promise<VendorSummary> {
+    const vendor = await this.prisma.vendor.create({
+      data: {
+        id: vendorId(),
+        name: input.name,
+        contactName: input.contactName,
+        phone: input.phone,
+        email: input.email,
+        status: input.status ?? 'ENABLED',
+        creditLimit: new Prisma.Decimal(input.creditLimit),
+        settlement: input.settlement,
+        notes: input.notes,
+        createdBy: input.actorId,
+        updatedBy: input.actorId
+      },
+      include: this.includeSummary()
+    });
+
+    return this.toSummary(vendor);
+  }
+
+  async update(vendorIdValue: string, input: UpdateVendorInput): Promise<VendorSummary> {
+    await this.findActiveOrThrow(vendorIdValue);
+
+    const vendor = await this.prisma.vendor.update({
+      where: { id: vendorIdValue },
+      data: {
+        name: input.name,
+        contactName: input.contactName,
+        phone: input.phone,
+        email: input.email,
+        status: input.status,
+        creditLimit: input.creditLimit === undefined ? undefined : new Prisma.Decimal(input.creditLimit),
+        settlement: input.settlement,
+        notes: input.notes,
+        updatedBy: input.actorId,
+        version: { increment: 1 }
+      },
+      include: this.includeSummary()
+    });
+
+    return this.toSummary(vendor);
+  }
+
+  async setStatus(vendorIdValue: string, status: VendorStatus, actorId?: string): Promise<VendorSummary> {
+    return this.update(vendorIdValue, { status, actorId });
+  }
+
+  async softDelete(vendorIdValue: string, actorId?: string): Promise<VendorSummary> {
+    const existing = await this.findActiveOrThrow(vendorIdValue);
+    const linkedGateways = await this.prisma.vendorGateway.count({
+      where: {
+        vendorId: vendorIdValue,
+        deletedAt: null
+      }
+    });
+
+    if (linkedGateways > 0) {
+      throw new BadRequestException({
+        code: 'VENDOR_HAS_GATEWAYS',
+        message: 'Vendor with active gateways cannot be deleted.'
+      });
+    }
+
+    const vendor = await this.prisma.vendor.update({
+      where: { id: existing.id },
+      data: {
+        status: 'DISABLED',
+        deletedAt: new Date(),
+        updatedBy: actorId,
+        version: { increment: 1 }
+      },
+      include: this.includeSummary()
+    });
+
+    return this.toSummary(vendor);
+  }
+
+  private includeSummary() {
+    return {
+      _count: {
+        select: {
+          gateways: {
+            where: { deletedAt: null }
+          }
+        }
+      }
+    } satisfies Prisma.VendorInclude;
+  }
+
+  private async findActiveOrThrow(vendorIdValue: string) {
+    const vendor = await this.prisma.vendor.findUnique({
+      where: { id: vendorIdValue },
+      include: this.includeSummary()
+    });
+
+    if (!vendor || vendor.deletedAt) {
+      throw new NotFoundException({ code: 'VENDOR_NOT_FOUND', message: 'Vendor not found.' });
+    }
+
+    return vendor;
+  }
+
+  private toSummary(vendor: {
+    id: string;
+    name: string;
+    contactName: string | null;
+    phone: string | null;
+    email: string | null;
+    status: VendorStatus;
+    balance: Prisma.Decimal;
+    creditLimit: Prisma.Decimal;
+    settlement: string | null;
+    notes: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    _count: { gateways: number };
+  }): VendorSummary {
+    return {
+      id: vendor.id,
+      name: vendor.name,
+      contactName: vendor.contactName,
+      phone: vendor.phone,
+      email: vendor.email,
+      status: vendor.status,
+      balance: vendor.balance.toFixed(6),
+      creditLimit: vendor.creditLimit.toFixed(6),
+      availableBalance: vendor.balance.plus(vendor.creditLimit).toFixed(6),
+      settlement: vendor.settlement,
+      notes: vendor.notes,
+      gatewayCount: vendor._count.gateways,
+      createdAt: vendor.createdAt,
+      updatedAt: vendor.updatedAt
+    };
+  }
+}
diff --git a/apps/api/src/modules/vendors/vendors.service.ts b/apps/api/src/modules/vendors/vendors.service.ts
new file mode 100644
index 0000000..93dd167
--- /dev/null
+++ b/apps/api/src/modules/vendors/vendors.service.ts
@@ -0,0 +1,135 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import {
+  VENDORS_REPOSITORY,
+  type CreateVendorInput,
+  type UpdateVendorInput,
+  type VendorStatus,
+  type VendorSummary,
+  type VendorsRepository
+} from './vendors.repository.js';
+
+interface CreateVendorDto {
+  name?: unknown;
+  contactName?: unknown;
+  phone?: unknown;
+  email?: unknown;
+  status?: unknown;
+  creditLimit?: unknown;
+  settlement?: unknown;
+  notes?: unknown;
+}
+
+interface UpdateVendorDto {
+  name?: unknown;
+  contactName?: unknown;
+  phone?: unknown;
+  email?: unknown;
+  status?: unknown;
+  creditLimit?: unknown;
+  settlement?: unknown;
+  notes?: unknown;
+}
+
+@Injectable()
+export class VendorsService {
+  constructor(@Inject(VENDORS_REPOSITORY) private readonly vendors: VendorsRepository) {}
+
+  list(): Promise<VendorSummary[]> {
+    return this.vendors.list();
+  }
+
+  get(vendorId: string): Promise<VendorSummary> {
+    return this.vendors.get(vendorId);
+  }
+
+  create(body: CreateVendorDto, actorId?: string): Promise<VendorSummary> {
+    const input: CreateVendorInput = {
+      name: this.limitedString(body.name, 'name', 120),
+      contactName: this.optionalString(body.contactName, 'contactName', 80),
+      phone: this.optionalString(body.phone, 'phone', 32),
+      email: this.optionalString(body.email, 'email', 160),
+      status: body.status === undefined ? 'ENABLED' : this.status(body.status),
+      creditLimit: body.creditLimit === undefined ? '0.000000' : this.money(body.creditLimit, 'creditLimit'),
+      settlement: this.optionalString(body.settlement, 'settlement', 80),
+      notes: this.optionalString(body.notes, 'notes', 500),
+      actorId
+    };
+
+    return this.vendors.create(input);
+  }
+
+  update(vendorId: string, body: UpdateVendorDto, actorId?: string): Promise<VendorSummary> {
+    const input: UpdateVendorInput = {
+      name: body.name === undefined ? undefined : this.limitedString(body.name, 'name', 120),
+      contactName: body.contactName === undefined ? undefined : this.nullableString(body.contactName, 'contactName', 80),
+      phone: body.phone === undefined ? undefined : this.nullableString(body.phone, 'phone', 32),
+      email: body.email === undefined ? undefined : this.nullableString(body.email, 'email', 160),
+      status: body.status === undefined ? undefined : this.status(body.status),
+      creditLimit: body.creditLimit === undefined ? undefined : this.money(body.creditLimit, 'creditLimit'),
+      settlement: body.settlement === undefined ? undefined : this.nullableString(body.settlement, 'settlement', 80),
+      notes: body.notes === undefined ? undefined : this.nullableString(body.notes, 'notes', 500),
+      actorId
+    };
+
+    return this.vendors.update(vendorId, input);
+  }
+
+  enable(vendorId: string, actorId?: string): Promise<VendorSummary> {
+    return this.vendors.setStatus(vendorId, 'ENABLED', actorId);
+  }
+
+  disable(vendorId: string, actorId?: string): Promise<VendorSummary> {
+    return this.vendors.setStatus(vendorId, 'DISABLED', actorId);
+  }
+
+  remove(vendorId: string, actorId?: string): Promise<VendorSummary> {
+    return this.vendors.softDelete(vendorId, actorId);
+  }
+
+  private limitedString(value: unknown, field: string, maxLength: number): string {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is required.` });
+    }
+
+    const trimmed = value.trim();
+    if (trimmed.length > maxLength) {
+      throw new BadRequestException({ code: 'VALIDATION_ERROR', message: `${field} is too long.` });
+    }
+
+    return trimmed;
+  }
+
+  private optionalString(value: unknown, field: string, maxLength: number): string | undefined {
+    if (value === undefined) {
+      return undefined;
+    }
+
+    return this.limitedString(value, field, maxLength);
+  }
+
+  private nullableString(value: unknown, field: string, maxLength: number): string | null {
+    if (value === null) {
+      return null;
+    }
+
+    return this.limitedString(value, field, maxLength);
+  }
+
+  private status(value: unknown): VendorStatus {
+    if (value !== 'ENABLED' && value !== 'DISABLED') {
+      throw new BadRequestException({ code: 'STATUS_INVALID', message: 'Status is invalid.' });
+    }
+
+    return value;
+  }
+
+  private money(value: unknown, field: string): string {
+    const raw = typeof value === 'number' ? value.toString() : typeof value === 'string' ? value.trim() : '';
+    if (!/^\d{1,14}(?:\.\d{1,6})?$/.test(raw)) {
+      throw new BadRequestException({ code: 'MONEY_INVALID', message: `${field} must be a non-negative decimal with up to 6 places.` });
+    }
+
+    const [integerPart, fractionPart = ''] = raw.split('.');
+    return `${integerPart}.${fractionPart.padEnd(6, '0')}`;
+  }
+}
diff --git a/apps/api/src/openapi.ts b/apps/api/src/openapi.ts
new file mode 100644
index 0000000..cd9fcc2
--- /dev/null
+++ b/apps/api/src/openapi.ts
@@ -0,0 +1,16 @@
+import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
+import type { NestFastifyApplication } from '@nestjs/platform-fastify';
+
+export function buildOpenApiDocument(app: NestFastifyApplication): void {
+  const config = new DocumentBuilder()
+    .setTitle('LisgloSIPS API')
+    .setDescription('LisgloSIPS V2 management platform API contract.')
+    .setVersion('0.2.0')
+    .addBearerAuth()
+    .build();
+
+  const document = SwaggerModule.createDocument(app, config);
+  SwaggerModule.setup('api/v2/docs', app, document, {
+    jsonDocumentUrl: 'api/v2/openapi.json'
+  });
+}
diff --git a/apps/api/src/shared/config.ts b/apps/api/src/shared/config.ts
new file mode 100644
index 0000000..e141a94
--- /dev/null
+++ b/apps/api/src/shared/config.ts
@@ -0,0 +1,86 @@
+import Joi from 'joi';
+
+export interface RuntimeConfig {
+  service: {
+    name: string;
+  };
+  http: {
+    host: string;
+    port: number;
+  };
+  logging: {
+    level: string;
+    requestIdHeader: string;
+  };
+  database: {
+    url: string;
+  };
+  redis: {
+    url: string;
+  };
+  auth: {
+    accessTokenSecret: string;
+    accessTokenTtlSeconds: number;
+    refreshTokenTtlDays: number;
+    lockMaxFailures: number;
+    lockWindowSeconds: number;
+    cookieSecure: boolean;
+    tokenIssuer: string;
+    tokenAudience: string;
+  };
+}
+
+export const validationSchema = Joi.object({
+  NODE_ENV: Joi.string().valid('development', 'test', 'production').default('development'),
+  LISGLOSIPS_SERVICE_NAME: Joi.string().default('api'),
+  LISGLOSIPS_HOST: Joi.string().hostname().default('127.0.0.1'),
+  LISGLOSIPS_PORT: Joi.number().port().default(3000),
+  LISGLOSIPS_LOG_LEVEL: Joi.string().valid('trace', 'debug', 'info', 'warn', 'error', 'fatal', 'silent').default('info'),
+  LISGLOSIPS_REQUEST_ID_HEADER: Joi.string().default('x-request-id'),
+  DATABASE_URL: Joi.string().uri({ scheme: ['mysql'] }).required(),
+  REDIS_URL: Joi.string().uri({ scheme: ['redis', 'rediss'] }).required(),
+  AUTH_ACCESS_TOKEN_SECRET: Joi.string().min(32).when('NODE_ENV', {
+    is: 'production',
+    then: Joi.required(),
+    otherwise: Joi.string().default('dev-only-change-this-auth-secret-32-bytes-min')
+  }),
+  AUTH_ACCESS_TOKEN_TTL_SECONDS: Joi.number().integer().min(60).max(86_400).default(900),
+  AUTH_REFRESH_TOKEN_TTL_DAYS: Joi.number().integer().min(1).max(30).default(7),
+  AUTH_LOCK_MAX_FAILURES: Joi.number().integer().min(3).max(20).default(5),
+  AUTH_LOCK_WINDOW_SECONDS: Joi.number().integer().min(60).max(86_400).default(900),
+  AUTH_COOKIE_SECURE: Joi.boolean().truthy('true').falsy('false').default(true),
+  AUTH_TOKEN_ISSUER: Joi.string().default('lisglosips-api'),
+  AUTH_TOKEN_AUDIENCE: Joi.string().default('lisglosips-web')
+});
+
+export function appConfig(): RuntimeConfig {
+  return {
+    service: {
+      name: process.env.LISGLOSIPS_SERVICE_NAME ?? 'api'
+    },
+    http: {
+      host: process.env.LISGLOSIPS_HOST ?? '127.0.0.1',
+      port: Number(process.env.LISGLOSIPS_PORT ?? 3000)
+    },
+    logging: {
+      level: process.env.LISGLOSIPS_LOG_LEVEL ?? 'info',
+      requestIdHeader: process.env.LISGLOSIPS_REQUEST_ID_HEADER ?? 'x-request-id'
+    },
+    database: {
+      url: process.env.DATABASE_URL ?? ''
+    },
+    redis: {
+      url: process.env.REDIS_URL ?? ''
+    },
+    auth: {
+      accessTokenSecret: process.env.AUTH_ACCESS_TOKEN_SECRET ?? 'dev-only-change-this-auth-secret-32-bytes-min',
+      accessTokenTtlSeconds: Number(process.env.AUTH_ACCESS_TOKEN_TTL_SECONDS ?? 900),
+      refreshTokenTtlDays: Number(process.env.AUTH_REFRESH_TOKEN_TTL_DAYS ?? 7),
+      lockMaxFailures: Number(process.env.AUTH_LOCK_MAX_FAILURES ?? 5),
+      lockWindowSeconds: Number(process.env.AUTH_LOCK_WINDOW_SECONDS ?? 900),
+      cookieSecure: (process.env.AUTH_COOKIE_SECURE ?? 'true') !== 'false',
+      tokenIssuer: process.env.AUTH_TOKEN_ISSUER ?? 'lisglosips-api',
+      tokenAudience: process.env.AUTH_TOKEN_AUDIENCE ?? 'lisglosips-web'
+    }
+  };
+}
diff --git a/apps/api/tsconfig.json b/apps/api/tsconfig.json
new file mode 100644
index 0000000..04ac9c2
--- /dev/null
+++ b/apps/api/tsconfig.json
@@ -0,0 +1,18 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "tsBuildInfoFile": "dist/tsconfig.tsbuildinfo",
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true
+  },
+  "references": [
+    { "path": "../../packages/auth" },
+    { "path": "../../packages/contracts" },
+    { "path": "../../packages/database" },
+    { "path": "../../packages/observability" }
+  ],
+  "include": ["src/**/*.ts"]
+}
diff --git a/apps/web/index.html b/apps/web/index.html
new file mode 100644
index 0000000..13f0639
--- /dev/null
+++ b/apps/web/index.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>LisgloSIPS - 聆界SIP管理平台</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.jsx"></script>
+  </body>
+</html>
diff --git a/apps/web/package.json b/apps/web/package.json
new file mode 100644
index 0000000..1b79b79
--- /dev/null
+++ b/apps/web/package.json
@@ -0,0 +1,19 @@
+{
+  "name": "@lisglosips/web",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite --host 127.0.0.1",
+    "build": "vite build",
+    "preview": "vite preview --host 127.0.0.1"
+  },
+  "dependencies": {
+    "react": "18.2.0",
+    "react-dom": "18.2.0"
+  },
+  "devDependencies": {
+    "@vitejs/plugin-react": "4.7.0",
+    "vite": "5.4.21"
+  }
+}
diff --git a/apps/web/src/App.jsx b/apps/web/src/App.jsx
new file mode 100644
index 0000000..fdfe109
--- /dev/null
+++ b/apps/web/src/App.jsx
@@ -0,0 +1,2694 @@
+import React, { useEffect, useMemo, useState } from 'react';
+import {
+  Alert,
+  Badge,
+  Button,
+  Checkbox,
+  Field,
+  Input,
+  Progress,
+  Select,
+  Switch,
+  Tabs,
+  Textarea,
+} from './components/ui.jsx';
+import { api, explainApiError } from './api.js';
+
+const selectedBlue = '#2563EB';
+
+function formatCurrency(value, digits = 2) {
+  const numeric = Number(value || 0);
+  return `¥${numeric.toLocaleString('zh-CN', { minimumFractionDigits: digits, maximumFractionDigits: digits })}`;
+}
+
+function formatDate(value) {
+  if (!value) return '-';
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return '-';
+  return date.toLocaleDateString('zh-CN');
+}
+
+function formatDateTime(value) {
+  if (!value) return '-';
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return '-';
+  return date.toLocaleString('zh-CN', { hour12: false });
+}
+
+function zhStatus(status) {
+  return status === 'ENABLED' ? '启用' : status === 'DISABLED' ? '停用' : status === 'SUCCEEDED' ? '成功' : status || '-';
+}
+
+function enStatus(status) {
+  return status === '启用' ? 'ENABLED' : status === '停用' || status === '禁用' ? 'DISABLED' : status;
+}
+
+function billingModeLabel(value) {
+  return value === 'POSTPAID' ? '后付费' : value === 'PREPAID' ? '预付费' : '-';
+}
+
+function normalizeCustomer(item) {
+  return {
+    id: item.id,
+    name: item.name,
+    contact: item.contactName || '-',
+    phone: item.phone || '-',
+    email: item.email || '-',
+    domain: item.domain || '-',
+    auth: '真实 API',
+    status: zhStatus(item.status),
+    balance: formatCurrency(item.balance),
+    credit: formatCurrency(item.creditLimit),
+    billing: billingModeLabel(item.billingMode),
+    routeGroup: '-',
+    gateways: item.gatewayCount ?? 0,
+    createdAt: formatDate(item.createdAt),
+  };
+}
+
+function normalizeVendor(item) {
+  return {
+    id: item.id,
+    name: item.name,
+    balance: formatCurrency(item.balance),
+    credit: formatCurrency(item.creditLimit),
+    gateways: item.gatewayCount ?? 0,
+    status: zhStatus(item.status),
+    cycle: item.settlement || '-',
+    ratePlan: '-',
+    contact: item.contactName || '-',
+    createdAt: formatDate(item.createdAt),
+  };
+}
+
+function normalizeRecharge(item) {
+  return {
+    id: item.id,
+    type: item.accountType === 'VENDOR' ? 'vendor' : 'customer',
+    owner: item.accountName,
+    amount: formatCurrency(item.amount),
+    beforeBalance: formatCurrency(item.beforeBalance),
+    afterBalance: formatCurrency(item.afterBalance),
+    remark: item.remark || '-',
+    operator: item.createdBy || '系统',
+    time: formatDateTime(item.occurredAt),
+    status: zhStatus(item.status),
+  };
+}
+
+function normalizeUser(item) {
+  return {
+    id: item.id,
+    username: item.username,
+    name: item.displayName,
+    phone: item.phone || '-',
+    email: item.email || '-',
+    roleId: item.roleIds?.[0] || '',
+    status: zhStatus(item.status),
+    lastLogin: formatDateTime(item.lastLoginAt),
+    lastIp: '-',
+  };
+}
+
+function normalizeRole(item) {
+  return {
+    id: item.id,
+    name: item.name,
+    description: item.description || '-',
+    status: zhStatus(item.status),
+    builtIn: Boolean(item.builtIn),
+    permissions: item.permissionIds || [],
+  };
+}
+
+function normalizeAuditLog(item) {
+  return {
+    id: item.id,
+    time: formatDateTime(item.createdAt),
+    user: item.username || '系统',
+    username: item.username || '-',
+    module: item.module,
+    action: item.action,
+    object: item.objectId ? `${item.objectType}:${item.objectId}` : item.objectType,
+    result: item.result === 'SUCCESS' ? '成功' : '失败',
+    ip: item.ip || '-',
+    summary: item.errorCode || `${item.module}.${item.action}`,
+    userAgent: item.userAgent || '-',
+  };
+}
+
+const navGroups = [
+  {
+    title: '运营',
+    items: [
+      { key: 'dashboard', label: '概览 Dashboard' },
+      { key: 'customers', label: '客户管理' },
+      { key: 'customerGateways', label: '客户网关管理' },
+      { key: 'rechargeRecords', label: '充值记录' },
+      { key: 'vendors', label: '供应商管理' },
+      { key: 'vendorGateways', label: '落地网关管理' },
+      { key: 'vendorLineGroups', label: '落地线路组' },
+      { key: 'billing', label: '费率与计费', pending: true },
+    ],
+  },
+  {
+    title: '业务',
+    items: [
+      { key: 'cdr', label: '话单中心' },
+      { key: 'quality', label: '质检中心' },
+      { key: 'sipops', label: 'SIP 运维', pending: true },
+      { key: 'monitoring', label: '监控告警', pending: true },
+    ],
+  },
+  {
+    title: '系统',
+    items: [
+      { key: 'settings', label: '系统设置', pending: true },
+      { key: 'users', label: '用户管理' },
+      { key: 'roles', label: '角色与权限' },
+      { key: 'operationLogs', label: '操作日志' },
+    ],
+  },
+];
+
+const metrics = [
+  { label: '今日通话数', value: '128,640', delta: '+12.4%', tone: 'up' },
+  { label: '当前在线通话', value: '1,284', delta: '+86', tone: 'up' },
+  { label: '今日接通率', value: '92.8%', delta: '-1.1%', tone: 'down' },
+  { label: '客户消费', value: '¥86,420', delta: '+9.7%', tone: 'up' },
+  { label: '供应商成本', value: '¥52,180', delta: '+7.8%', tone: 'up' },
+  { label: '今日毛利', value: '¥34,240', delta: '39.6%', tone: 'neutral' },
+  { label: '在线注册用户', value: '18,920', delta: '+312', tone: 'up' },
+  { label: 'RTPEngine 节点', value: '1/1', delta: '正常', tone: 'up' },
+  { label: 'OpenSIPS 节点', value: '1/1', delta: '单节点 V1', tone: 'neutral' },
+  { label: '异常网关', value: '2', delta: '需关注', tone: 'warn' },
+  { label: '质检待处理', value: '248', delta: 'P1', tone: 'warn' },
+];
+
+const callTrend = [82, 96, 74, 118, 136, 162, 148, 176, 158, 190, 214, 188];
+const answerTrend = [90, 91, 88, 92, 94, 93, 91, 95, 94, 92, 93, 92];
+
+const customers = [
+  { id: 'C1001', name: '上海示例通信', contact: '张经理', phone: '13800010001', email: 'ops-sh@example.net', domain: 'sh-voice.example.net', auth: 'IP 白名单', status: '启用', balance: '¥56,820.40', credit: '¥200,000', billing: '预付费', routeGroup: '华东优先线路', gateways: 3, createdAt: '2026-05-18' },
+  { id: 'C1002', name: '杭州云呼叫中心', contact: '李主管', phone: '13900020002', email: 'contact-hz@example.net', domain: 'hz-call.example.net', auth: 'SIP 账号', status: '启用', balance: '¥18,445.80', credit: '¥80,000', billing: '后付费', routeGroup: '成本最低线路', gateways: 2, createdAt: '2026-05-22' },
+  { id: 'C1003', name: '深圳跨境业务部', contact: '王经理', phone: '13700030003', email: 'global-sz@example.net', domain: 'sz-global.example.net', auth: '混合认证', status: '观察', balance: '¥6,921.00', credit: '¥50,000', billing: '预付费', routeGroup: '国际备线池', gateways: 4, createdAt: '2026-06-01' },
+  { id: 'C1004', name: '北京金融外呼', contact: '赵经理', phone: '13600040004', email: 'bj-fin@example.net', domain: 'bj-fin.example.net', auth: 'IP 白名单', status: '停用', balance: '¥0.00', credit: '¥100,000', billing: '后付费', routeGroup: '合规外呼线路', gateways: 1, createdAt: '2026-06-08' },
+];
+
+const sipAccounts = [
+  { user: '10010001', domain: 'sh-voice.example.net', register: '在线', contact: '10.12.8.21:5060', expires: '274s' },
+  { user: '10010002', domain: 'sh-voice.example.net', register: '在线', contact: '10.12.8.22:5060', expires: '280s' },
+  { user: '10010003', domain: 'sh-voice.example.net', register: '离线', contact: '-', expires: '-' },
+];
+
+const vendors = [
+  { id: 'V2001', name: '供应商 A', balance: '¥42,860.00', credit: '¥300,000', gateways: 8, status: '启用', cycle: '月结', ratePlan: 'CN-Mobile-2026', contact: '陈经理', createdAt: '2026-04-02' },
+  { id: 'V2002', name: '供应商 B', balance: '¥18,200.00', credit: '¥120,000', gateways: 5, status: '启用', cycle: '周结', ratePlan: 'CN-LowCost-2026', contact: '王经理', createdAt: '2026-04-16' },
+  { id: 'V2003', name: '国际供应商 C', balance: '¥8,450.00', credit: '¥80,000', gateways: 3, status: '观察', cycle: '月结', ratePlan: 'Global-Std', contact: 'Lina', createdAt: '2026-05-03' },
+];
+
+const gateways = [
+  { id: 'GW-A-01', vendor: '供应商 A', name: '华东移动主用', authMode: 'IP', ipAddress: '203.0.113.18', sipAccount: '', sipPassword: '', concurrencyLimit: 800, billingCycle: 60, cycleRate: 0.031, requestRate: '120 CPS', blockedProvinces: '新疆、西藏', callTimeLimit: '08:00-22:00', codecs: 'PCMA, PCMU', calleePrefixTransform: '13/15/18 保持原样', callerPrefixTransform: '0216001* -> 0216001*', status: '启用' },
+  { id: 'GW-A-02', vendor: '供应商 A', name: '华东联通备用', authMode: 'IP', ipAddress: '203.0.113.19', sipAccount: '', sipPassword: '', concurrencyLimit: 500, billingCycle: 30, cycleRate: 0.017, requestRate: '80 CPS', blockedProvinces: '无', callTimeLimit: '00:00-23:59', codecs: 'PCMA', calleePrefixTransform: '021 保持原样', callerPrefixTransform: '0217002* -> 0217002*', status: '启用' },
+  { id: 'GW-B-01', vendor: '供应商 B', name: '成本最低路由', authMode: 'SIP注册', ipAddress: '', sipAccount: 'vendor-b-main', sipPassword: '******', concurrencyLimit: 360, billingCycle: 6, cycleRate: 0.0028, requestRate: '60 CPS', blockedProvinces: '北京', callTimeLimit: '09:00-21:00', codecs: 'PCMA, G729', calleePrefixTransform: '0571 -> 0571', callerPrefixTransform: '0571888* -> 0571888*', status: '禁用' },
+];
+
+const vendorLineGroups = [
+  { id: 'VLG-01', name: '华东主备线路组', gatewayIds: ['GW-A-01', 'GW-A-02'] },
+  { id: 'VLG-02', name: '低成本线路组', gatewayIds: ['GW-B-01', 'GW-A-02'] },
+  { id: 'VLG-03', name: '移动优先线路组', gatewayIds: ['GW-A-01'] },
+];
+
+const customerGatewayPolicies = [
+  { id: 'CGP-001', gateway: 'C-GW-SH-01', name: '上海移动外呼', callerMode: 'prefix', callerValue: '0216001', calleeMode: 'prefix', calleeValue: '13/15/18', routeGroup: '华东优先线路', priority: 10, status: '启用' },
+  { id: 'CGP-002', gateway: 'C-GW-SH-01', name: '上海本地回访', callerMode: 'prefix', callerValue: '0217002', calleeMode: 'prefix', calleeValue: '021', routeGroup: '华东优先线路', priority: 20, status: '启用' },
+  { id: 'CGP-003', gateway: 'C-GW-SH-01', name: '重点号码专线', callerMode: 'equals', callerValue: '02160010001', calleeMode: 'equals', calleeValue: '13800138000', routeGroup: '成本最低线路', priority: 30, status: '启用' },
+  { id: 'CGP-004', gateway: 'C-GW-SH-02', name: '固话回访', callerMode: 'any', callerValue: '', calleeMode: 'prefix', calleeValue: '021', routeGroup: '华东优先线路', priority: 10, status: '启用' },
+  { id: 'CGP-005', gateway: 'C-GW-HZ-01', name: '浙江固话业务', callerMode: 'prefix', callerValue: '0571', calleeMode: 'prefix', calleeValue: '0571/0574', routeGroup: '成本最低线路', priority: 10, status: '启用' },
+  { id: 'CGP-006', gateway: 'C-GW-HZ-01', name: '杭州移动外呼', callerMode: 'any', callerValue: '', calleeMode: 'prefix', calleeValue: '13/15/18', routeGroup: '华东优先线路', priority: 20, status: '启用' },
+  { id: 'CGP-007', gateway: 'C-GW-SZ-03', name: '国际直拨', callerMode: 'prefix', callerValue: '0755', calleeMode: 'prefix', calleeValue: '00', routeGroup: '国际备线池', priority: 10, status: '启用' },
+  { id: 'CGP-008', gateway: 'C-GW-SZ-03', name: '美国方向', callerMode: 'any', callerValue: '', calleeMode: 'prefix', calleeValue: '001', routeGroup: '国际备线池', priority: 20, status: '启用' },
+  { id: 'CGP-009', gateway: 'C-GW-SZ-03', name: '英国方向', callerMode: 'any', callerValue: '', calleeMode: 'prefix', calleeValue: '0044', routeGroup: '国际备线池', priority: 30, status: '启用' },
+  { id: 'CGP-010', gateway: 'C-GW-SZ-03', name: '指定客户号码', callerMode: 'equals', callerValue: '075588801111', calleeMode: 'any', calleeValue: '', routeGroup: '成本最低线路', priority: 40, status: '停用' },
+];
+
+const customerGateways = [
+  { id: 'C-GW-SH-01', name: '上海主接入网关', authMode: 'IP', ipAddress: '10.10.1.11', sipAccount: '', sipPassword: '', routePolicyCount: 3, status: '启用' },
+  { id: 'C-GW-SH-02', name: '上海固话回访入口', authMode: 'IP', ipAddress: '10.10.1.12', sipAccount: '', sipPassword: '', routePolicyCount: 1, status: '启用' },
+  { id: 'C-GW-HZ-01', name: '杭州坐席接入', authMode: 'SIP注册', ipAddress: '', sipAccount: 'hz-seat-1001', sipPassword: '******', routePolicyCount: 2, status: '启用' },
+  { id: 'C-GW-SZ-03', name: '深圳国际业务入口', authMode: 'SIP注册', ipAddress: '', sipAccount: 'sz-global-3003', sipPassword: '******', routePolicyCount: 4, status: '停用' },
+];
+
+const initialRechargeRecords = [
+  { id: 'RCG-20260618-003', type: 'customer', owner: '上海示例通信', amount: '¥10,000.00', beforeBalance: '¥46,820.40', afterBalance: '¥56,820.40', remark: '月初预存', operator: '财务', time: '2026-06-18 09:42:16', status: '成功' },
+  { id: 'RCG-20260617-012', type: 'customer', owner: '杭州云呼叫中心', amount: '¥5,000.00', beforeBalance: '¥13,445.80', afterBalance: '¥18,445.80', remark: '补充测试额度', operator: '运营管理员', time: '2026-06-17 16:18:33', status: '成功' },
+  { id: 'RCG-20260616-006', type: 'customer', owner: '深圳跨境业务部', amount: '¥2,000.00', beforeBalance: '¥4,921.00', afterBalance: '¥6,921.00', remark: '-', operator: '财务', time: '2026-06-16 11:07:25', status: '成功' },
+  { id: 'RCG-20260618-V02', type: 'vendor', owner: '供应商 A', amount: '¥20,000.00', beforeBalance: '¥22,860.00', afterBalance: '¥42,860.00', remark: '线路预存款', operator: '财务', time: '2026-06-18 10:22:43', status: '成功' },
+  { id: 'RCG-20260617-V01', type: 'vendor', owner: '国际供应商 C', amount: '¥5,000.00', beforeBalance: '¥3,450.00', afterBalance: '¥8,450.00', remark: '国际线路补款', operator: '运营管理员', time: '2026-06-17 15:39:08', status: '成功' },
+];
+
+const vendorGatewayPolicies = [
+  { vendor: '供应商 A', gateway: 'GW-A-01', caller: '0216001*', calleePrefix: '13/15/18', business: '国内移动成本线', vendorRate: 'A-Mobile-60/6', priority: 10, status: '启用' },
+  { vendor: '供应商 A', gateway: 'GW-A-02', caller: '0217002*', calleePrefix: '021', business: '上海固话成本线', vendorRate: 'A-SH-Local-6/6', priority: 20, status: '启用' },
+  { vendor: '供应商 B', gateway: 'GW-B-01', caller: '0571888*', calleePrefix: '0571', business: '杭州本地固话', vendorRate: 'B-HZ-Local-6/6', priority: 30, status: '观察' },
+  { vendor: '国际供应商 C', gateway: 'GW-C-01', caller: '0755888*', calleePrefix: '001/0044', business: '国际长途', vendorRate: 'C-Global-60/60', priority: 10, status: '启用' },
+];
+
+const routeGroups = [
+  { id: 'RG-01', name: '华东优先线路', customers: '上海示例通信', gateways: 'GW-A-01, GW-A-02', strategy: '按优先级', retry: '503/408 自动重试', status: '启用' },
+  { id: 'RG-02', name: '成本最低线路', customers: '杭州云呼叫中心', gateways: 'GW-B-01, GW-A-02', strategy: '按成本最低', retry: '失败换供应商', status: '启用' },
+  { id: 'RG-03', name: '国际备线池', customers: '深圳跨境业务部', gateways: 'GW-C-01', strategy: '按号码前缀', retry: '不重试', status: '观察' },
+];
+
+const routeRules = [
+  { id: 'DR-001', customer: '上海示例通信', prefix: '13,15,18', routeGroup: '华东优先线路', priority: 10, window: '00:00-23:59', status: '生效', remark: '国内移动优先' },
+  { id: 'DR-002', customer: '杭州云呼叫中心', prefix: '0571', routeGroup: '成本最低线路', priority: 20, window: '08:00-21:00', status: '生效', remark: '本地固话' },
+  { id: 'DR-003', customer: '深圳跨境业务部', prefix: '00', routeGroup: '国际备线池', priority: 30, window: '00:00-23:59', status: '暂停', remark: '国际前缀' },
+];
+
+const rates = [
+  { type: '客户费率', owner: '上海示例通信', business: '国内移动外呼', gateway: 'C-GW-SH-01', caller: '-', region: '中国大陆-移动', prefix: '13/15/18', price: '¥0.052/分钟', cycle: '60/6', first: '60s', start: '2026-06-01', end: '-' },
+  { type: '客户费率', owner: '杭州云呼叫中心', business: '浙江固话业务', gateway: 'C-GW-HZ-01', caller: '-', region: '中国大陆-固话', prefix: '0571', price: '¥0.038/分钟', cycle: '6/6', first: '6s', start: '2026-06-01', end: '-' },
+  { type: '供应商费率', owner: '供应商 A', business: '国内移动成本线', gateway: 'GW-A-01', caller: '0216001*', region: '中国大陆-移动', prefix: '13/15/18', price: '¥0.031/分钟', cycle: '60/6', first: '60s', start: '2026-05-15', end: '-' },
+  { type: '供应商费率', owner: '国际供应商 C', business: '国际长途', gateway: 'GW-C-01', caller: '0755888*', region: '美国', prefix: '001', price: '¥0.120/分钟', cycle: '60/60', first: '60s', start: '2026-05-21', end: '-' },
+];
+
+const cdrs = [
+  { callId: '8b4d-1001-202606151014', customer: '上海示例通信', customerGateway: 'C-GW-SH-01', sourceIp: '10.10.1.11', caller: '02160010001', callee: '13800138000', business: '国内移动外呼', started: '10:14:22', answered: '10:14:27', ended: '10:17:30', duration: 183, billSec: 186, code: 200, hangupReason: '正常挂断', vendor: '供应商 A', gateway: 'GW-A-01', route: 'DR-001', customerRate: 'CN-Mobile-60/6', vendorRate: 'A-Mobile-60/6', record: '已录音' },
+  { callId: '8b4d-1002-202606151018', customer: '杭州云呼叫中心', customerGateway: 'C-GW-HZ-01', sourceIp: '10.20.8.21', caller: '057188812345', callee: '02160018888', business: '浙江固话业务', started: '10:18:03', answered: '-', ended: '10:18:08', duration: 0, billSec: 0, code: 486, hangupReason: '用户忙', vendor: '供应商 B', gateway: 'GW-B-01', route: 'DR-002', customerRate: '-', vendorRate: '-', record: '无' },
+  { callId: '8b4d-1003-202606151021', customer: '深圳跨境业务部', customerGateway: 'C-GW-SZ-03', sourceIp: '10.30.5.31', caller: '075588801111', callee: '0014155550198', business: '国际直拨', started: '10:21:39', answered: '10:21:45', ended: '10:28:46', duration: 421, billSec: 480, code: 200, hangupReason: '正常挂断', vendor: '国际供应商 C', gateway: 'GW-C-01', route: 'DR-003', customerRate: 'Global-60/60', vendorRate: 'C-Global-60/60', record: '已录音' },
+];
+
+const samplingRules = [
+  { id: 'QR-001', name: '上海移动业务日常抽检', customer: '上海示例通信', ratio: 8, route: '华东优先线路', start: '2026-06-01', status: '启用' },
+  { id: 'QR-002', name: '杭州坐席服务抽检', customer: '杭州云呼叫中心', ratio: 5, route: '成本最低线路', start: '2026-06-01', status: '启用' },
+  { id: 'QR-003', name: '深圳国际业务专项抽检', customer: '深圳跨境业务部', ratio: 12, route: '国际备线池', start: '2026-06-10', status: '禁用' },
+];
+
+const ratedCdrs = [
+  { id: 'RCDR-88120', raw: '8b4d-1001', customerRate: 'CN-Mobile-60/6', vendorRate: 'A-Mobile-60/6', fee: '¥0.1612', cost: '¥0.0961', profit: '¥0.0651', status: '已计费', ratedAt: '10:17:41' },
+  { id: 'RCDR-88121', raw: '8b4d-1002', customerRate: '-', vendorRate: '-', fee: '¥0.0000', cost: '¥0.0000', profit: '¥0.0000', status: '失败不计费', ratedAt: '10:18:08' },
+  { id: 'RCDR-88122', raw: '8b4d-1003', customerRate: 'US-60/60', vendorRate: 'Global-60/60', fee: '¥0.9600', cost: '¥0.7200', profit: '¥0.2400', status: '已计费', ratedAt: '10:29:52' },
+];
+
+const recordings = [
+  { callId: '8b4d-1001-202606151014', customer: '上海示例通信', caller: '02160010001', callee: '13800138000', business: '国内移动外呼', time: '10:14:22', duration: '03:03', file: 'rec/2026/06/15/1001.wav', play: '可试听', review: '待质检', score: '-' },
+  { callId: '8b4d-1003-202606151021', customer: '深圳跨境业务部', caller: '075588801111', callee: '0014155550198', business: '国际直拨', time: '10:21:39', duration: '07:01', file: 'rec/2026/06/15/1003.wav', play: '可试听', review: '未开始', score: '-' },
+  { callId: '8b4d-0977-202606150938', customer: '上海示例通信', caller: '02160010009', callee: '13900139000', business: '国内移动外呼', time: '09:38:10', duration: '05:44', file: 'rec/2026/06/15/0977.wav', play: '可试听', review: '已完成', score: '92' },
+];
+
+const opsItems = [
+  { name: 'OpenSIPS 主节点', target: '10.0.2.11:8080/mi', status: '正常', value: 'ps/get_statistics 可用' },
+  { name: 'RTPEngine 节点 A', target: '10.0.2.21:2223', status: '正常', value: '会话 824' },
+  { name: 'SIP 5060 监听', target: 'udp:0.0.0.0:5060', status: '正常', value: '监听中' },
+  { name: 'Billing Worker 堆积', target: 'billing.queue', status: '观察', value: '1,284 条' },
+  { name: '录音文件入库队列', target: 'recording.queue', status: '告警', value: '428 条' },
+];
+
+const auditLogs = [
+  { time: '2026-06-15 10:31:44', user: '运营管理员', action: '新增客户', object: '杭州云呼叫中心', ip: '10.1.8.32' },
+  { time: '2026-06-15 10:24:09', user: '财务', action: '修改费率', object: 'CN-Mobile-60/6', ip: '10.1.8.45' },
+  { time: '2026-06-15 09:58:51', user: '技术运维', action: 'dr_reload', object: 'OpenSIPS 主节点', ip: '10.1.8.88' },
+  { time: '2026-06-15 09:42:18', user: '质检', action: '下载录音', object: '8b4d-0977', ip: '10.1.8.62' },
+];
+
+const initialAdminUsers = [
+  { id: 'U1001', username: 'admin', name: '系统管理员', phone: '13800000001', email: 'admin@lisglosips.local', roleId: 'R001', status: '启用', lastLogin: '2026-06-15 10:36:12', lastIp: '10.1.8.10' },
+  { id: 'U1002', username: 'operator.li', name: '李运营', phone: '13800000012', email: 'operator@lisglosips.local', roleId: 'R002', status: '启用', lastLogin: '2026-06-15 10:31:44', lastIp: '10.1.8.32' },
+  { id: 'U1003', username: 'finance.zhou', name: '周财务', phone: '13800000023', email: 'finance@lisglosips.local', roleId: 'R003', status: '启用', lastLogin: '2026-06-15 10:24:09', lastIp: '10.1.8.45' },
+  { id: 'U1004', username: 'quality.wang', name: '王质检', phone: '13800000034', email: 'quality@lisglosips.local', roleId: 'R004', status: '启用', lastLogin: '2026-06-15 09:42:18', lastIp: '10.1.8.62' },
+  { id: 'U1005', username: 'ops.chen', name: '陈运维', phone: '13800000045', email: 'ops@lisglosips.local', roleId: 'R005', status: '禁用', lastLogin: '2026-06-14 22:18:09', lastIp: '10.1.8.88' },
+];
+
+const permissionGroups = [
+  { name: '客户与供应商', permissions: [{ key: 'customers.view', label: '查看客户' }, { key: 'customers.manage', label: '管理客户' }, { key: 'vendors.view', label: '查看供应商' }, { key: 'vendors.manage', label: '管理供应商' }] },
+  { name: '网关与路由', permissions: [{ key: 'gateways.view', label: '查看网关' }, { key: 'gateways.manage', label: '管理网关' }, { key: 'routes.view', label: '查看线路与路由' }, { key: 'routes.manage', label: '配置线路与路由' }] },
+  { name: '计费与财务', permissions: [{ key: 'billing.view', label: '查看费率与账单' }, { key: 'billing.manage', label: '管理费率' }, { key: 'recharge.manage', label: '客户/供应商充值' }, { key: 'billing.export', label: '导出财务数据' }] },
+  { name: '话单与质检', permissions: [{ key: 'cdr.view', label: '查看话单' }, { key: 'cdr.export', label: '导出话单' }, { key: 'recording.play', label: '播放录音' }, { key: 'quality.manage', label: '质检与评分' }] },
+  { name: '运维监控', permissions: [{ key: 'sipops.view', label: '查看 SIP 运维' }, { key: 'sipops.manage', label: '执行运维操作' }, { key: 'monitoring.view', label: '查看监控告警' }, { key: 'monitoring.manage', label: '管理告警规则' }] },
+  { name: '系统管理', permissions: [{ key: 'settings.manage', label: '管理系统设置' }, { key: 'users.manage', label: '管理用户' }, { key: 'roles.manage', label: '管理角色权限' }, { key: 'logs.view', label: '查看操作日志' }] },
+];
+
+const allPermissionKeys = permissionGroups.flatMap((group) => group.permissions.map((permission) => permission.key));
+
+const initialRoles = [
+  { id: 'R001', name: '超级管理员', description: '拥有平台全部功能与数据权限', status: '启用', builtIn: true, permissions: allPermissionKeys },
+  { id: 'R002', name: '运营管理员', description: '负责客户、网关、线路与日常运营', status: '启用', builtIn: true, permissions: ['customers.view', 'customers.manage', 'vendors.view', 'gateways.view', 'gateways.manage', 'routes.view', 'routes.manage', 'cdr.view', 'cdr.export', 'monitoring.view'] },
+  { id: 'R003', name: '财务', description: '负责费率、充值、账单、成本与导出', status: '启用', builtIn: true, permissions: ['customers.view', 'vendors.view', 'billing.view', 'billing.manage', 'recharge.manage', 'billing.export', 'cdr.view'] },
+  { id: 'R004', name: '质检', description: '负责录音抽检、质检评分与报告', status: '启用', builtIn: true, permissions: ['customers.view', 'cdr.view', 'recording.play', 'quality.manage'] },
+  { id: 'R005', name: '技术运维', description: '负责 SIP 运维、监控和底层排障', status: '启用', builtIn: true, permissions: ['gateways.view', 'routes.view', 'cdr.view', 'sipops.view', 'sipops.manage', 'monitoring.view', 'monitoring.manage', 'logs.view'] },
+];
+
+const operationLogRows = [
+  { id: 'LOG-20260615-001', time: '2026-06-15 10:31:44', user: '李运营', username: 'operator.li', module: '客户管理', action: '新增客户', object: '杭州云呼叫中心（C1002）', result: '成功', ip: '10.1.8.32', summary: '创建客户并初始化默认账户配置', userAgent: 'Chrome 137 / Windows 11' },
+  { id: 'LOG-20260615-002', time: '2026-06-15 10:24:09', user: '周财务', username: 'finance.zhou', module: '费率与计费', action: '修改费率', object: 'CN-Mobile-60/6', result: '成功', ip: '10.1.8.45', summary: '周期费率由 ¥0.036 调整为 ¥0.038', userAgent: 'Edge 137 / Windows 11' },
+  { id: 'LOG-20260615-003', time: '2026-06-15 09:58:51', user: '陈运维', username: 'ops.chen', module: 'SIP 运维', action: '重载路由', object: 'OpenSIPS 主节点', result: '成功', ip: '10.1.8.88', summary: '执行 dr_reload，动态路由表重载完成', userAgent: 'Chrome 136 / Windows 10' },
+  { id: 'LOG-20260615-004', time: '2026-06-15 09:42:18', user: '王质检', username: 'quality.wang', module: '质检中心', action: '播放录音', object: '8b4d-0977-202606150940', result: '成功', ip: '10.1.8.62', summary: '试听话单录音用于质检评分', userAgent: 'Chrome 137 / macOS 15' },
+  { id: 'LOG-20260615-005', time: '2026-06-15 09:17:03', user: '李运营', username: 'operator.li', module: '线路与路由', action: '删除策略', object: '夜间国际备用线路', result: '失败', ip: '10.1.8.32', summary: '策略仍被客户网关引用，系统拒绝删除', userAgent: 'Chrome 137 / Windows 11' },
+  { id: 'LOG-20260615-006', time: '2026-06-15 08:55:26', user: '系统管理员', username: 'admin', module: '用户管理', action: '禁用用户', object: 'ops.chen（U1005）', result: '成功', ip: '10.1.8.10', summary: '因账号交接临时禁用技术运维账号', userAgent: 'Chrome 137 / Windows 11' },
+  { id: 'LOG-20260614-007', time: '2026-06-14 22:18:09', user: '陈运维', username: 'ops.chen', module: '认证', action: '用户登录', object: 'LisgloSIPS 运营端', result: '成功', ip: '10.1.8.88', summary: '密码认证成功', userAgent: 'Chrome 136 / Windows 10' },
+];
+
+function toneForStatus(status) {
+  if (['启用', '在线', '正常', '生效', '已计费', '完成', '已完成', '开启', '可试听', '成功'].includes(status)) return 'success';
+  if (['观察', '抖动', '待质检', '处理中', '失败不计费'].includes(status)) return 'warning';
+  if (['停用', '禁用', '暂停', '告警', '关闭', '失败'].includes(status)) return 'danger';
+  return 'neutral';
+}
+
+function Icon({ type }) {
+  const common = { width: 16, height: 16, viewBox: '0 0 24 24', fill: 'none', stroke: 'currentColor', strokeWidth: 2, strokeLinecap: 'round', strokeLinejoin: 'round' };
+  const paths = {
+    plus: <path d="M12 5v14M5 12h14" />,
+    search: <><circle cx="11" cy="11" r="7" /><path d="m20 20-3.4-3.4" /></>,
+    export: <><path d="M12 3v12" /><path d="m7 10 5 5 5-5" /><path d="M5 21h14" /></>,
+    reload: <><path d="M21 12a9 9 0 0 1-15 6.7" /><path d="M3 12a9 9 0 0 1 15-6.7" /><path d="M18 3v5h-5" /><path d="M6 21v-5h5" /></>,
+    collapse: <><path d="M15 18l-6-6 6-6" /><path d="M20 4v16" /></>,
+    expand: <><path d="M9 18l6-6-6-6" /><path d="M4 4v16" /></>,
+  };
+  return <svg {...common}>{paths[type]}</svg>;
+}
+
+function PageTitle({ title, desc, actions }) {
+  return (
+    <div className="page-title">
+      <div>
+        <h1>{title}</h1>
+        <p>{desc}</p>
+      </div>
+      <div className="page-actions">{actions}</div>
+    </div>
+  );
+}
+
+function Toolbar({ children }) {
+  return <div className="toolbar">{children}</div>;
+}
+
+function Panel({ title, aside, children, className = '' }) {
+  return (
+    <section className={`prototype-panel ${className}`}>
+      <div className="panel-head">
+        <h2>{title}</h2>
+        {aside}
+      </div>
+      {children}
+    </section>
+  );
+}
+
+function ApiNotice({ loading, error, onRetry }) {
+  if (loading) {
+    return <Alert title="正在读取真实 API">正在从 LisgloSIPS API 拉取页面数据。</Alert>;
+  }
+  if (error) {
+    return (
+      <Alert title="API 数据不可用" tone="warning">
+        {error}
+        {onRetry ? <Button size="sm" variant="outline" onClick={onRetry}>重试</Button> : null}
+      </Alert>
+    );
+  }
+  return null;
+}
+
+function EmptyState({ title = '暂无数据', children = '当前筛选条件下没有可展示的数据。' }) {
+  return (
+    <div className="empty-state">
+      <strong>{title}</strong>
+      <span>{children}</span>
+    </div>
+  );
+}
+
+function Modal({ title, aside, children, onClose, size = 'lg' }) {
+  return (
+    <div className="modal-backdrop" role="presentation" onMouseDown={onClose}>
+      <section className={`modal-dialog modal-${size}`} role="dialog" aria-modal="true" aria-label={title} onMouseDown={(event) => event.stopPropagation()}>
+        <div className="modal-head">
+          <div>
+            <h2>{title}</h2>
+            {aside}
+          </div>
+          <Button variant="ghost" size="sm" onClick={onClose}>关闭</Button>
+        </div>
+        <div className="modal-body">{children}</div>
+      </section>
+    </div>
+  );
+}
+
+function Drawer({ title, aside, children, onClose }) {
+  return (
+    <div className="drawer-backdrop" role="presentation" onMouseDown={onClose}>
+      <aside className="drawer-panel" role="dialog" aria-modal="true" aria-label={title} onMouseDown={(event) => event.stopPropagation()}>
+        <div className="drawer-head">
+          <div>
+            <h2>{title}</h2>
+            {aside}
+          </div>
+          <Button variant="ghost" size="sm" onClick={onClose}>关闭</Button>
+        </div>
+        <div className="drawer-body">{children}</div>
+      </aside>
+    </div>
+  );
+}
+
+function StatusBadge({ children }) {
+  return <Badge tone={toneForStatus(children)}>{children}</Badge>;
+}
+
+function SimpleTable({ columns, rows, onRowClick, selectedKey }) {
+  return (
+    <div className="table-shell">
+      <table className="proto-table">
+        <thead>
+          <tr>
+            {columns.map((column) => <th key={column.key}>{column.label}</th>)}
+          </tr>
+        </thead>
+        <tbody>
+          {rows.length === 0 ? (
+            <tr>
+              <td colSpan={columns.length}>
+                <EmptyState />
+              </td>
+            </tr>
+          ) : rows.map((row, index) => (
+            <tr
+              key={row.id || row.callId || row.name || index}
+              className={selectedKey && selectedKey === (row.id || row.callId) ? 'is-selected' : ''}
+              onClick={onRowClick ? () => onRowClick(row) : undefined}
+            >
+              {columns.map((column) => (
+                <td key={column.key}>
+                  {column.status ? <StatusBadge>{row[column.key]}</StatusBadge> : column.render ? column.render(row) : row[column.key]}
+                </td>
+              ))}
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
+function MiniBarChart({ data, color = selectedBlue }) {
+  const max = Math.max(1, ...data);
+  return (
+    <div className="mini-chart" aria-label="趋势图">
+      {data.map((value, index) => (
+        <span key={index} style={{ height: `${Math.max(14, (value / max) * 100)}%`, background: color }} />
+      ))}
+    </div>
+  );
+}
+
+function LineChart({ data }) {
+  const points = data.map((value, index) => `${(index / Math.max(1, data.length - 1)) * 100},${100 - value}`).join(' ');
+  return (
+    <svg className="line-chart" viewBox="0 0 100 100" preserveAspectRatio="none" aria-label="接通率趋势">
+      <polyline points={points} fill="none" stroke={selectedBlue} strokeWidth="3" vectorEffect="non-scaling-stroke" />
+    </svg>
+  );
+}
+
+function KeyValue({ label, value }) {
+  return (
+    <div className="kv">
+      <span>{label}</span>
+      <strong>{value}</strong>
+    </div>
+  );
+}
+
+function dashboardMetrics(summary) {
+  if (!summary) {
+    return metrics;
+  }
+  return [
+    { label: '今日通话数', value: String(summary.calls.totalCalls), delta: '真实 API', tone: 'neutral' },
+    { label: '当前在线通话', value: String(summary.realtime.onlineCalls), delta: summary.realtime.source, tone: 'neutral' },
+    { label: '今日接通率', value: `${(Number(summary.calls.answerRate) * 100).toFixed(2)}%`, delta: `${summary.calls.answeredCalls}/${summary.calls.totalCalls}`, tone: 'neutral' },
+    { label: '客户消费', value: formatCurrency(summary.money.customerFee), delta: '今日', tone: 'neutral' },
+    { label: '供应商成本', value: formatCurrency(summary.money.vendorCost), delta: '今日', tone: 'neutral' },
+    { label: '今日毛利', value: formatCurrency(summary.money.grossProfit), delta: '今日', tone: 'neutral' },
+    { label: '在线注册用户', value: String(summary.realtime.registeredUsers), delta: summary.realtime.source, tone: 'neutral' },
+    { label: '活跃客户', value: String(summary.entities.activeCustomers), delta: '启用', tone: 'neutral' },
+    { label: '活跃落地网关', value: String(summary.entities.activeVendorGateways), delta: '启用', tone: 'neutral' },
+    { label: '异常网关', value: String(summary.abnormalGateways.length), delta: '失败 Top', tone: summary.abnormalGateways.length ? 'warn' : 'neutral' },
+    { label: '质检待处理', value: String(summary.quality.pendingReviews), delta: '录音', tone: summary.quality.pendingReviews ? 'warn' : 'neutral' },
+  ];
+}
+
+function DashboardPage({ dashboardSummary, dashboardTrends, apiLoading, apiError, refreshApi, customerRows }) {
+  const trendBuckets = dashboardTrends?.buckets || [];
+  const callTrendData = trendBuckets.length ? trendBuckets.map((bucket) => bucket.calls.totalCalls) : callTrend;
+  const answerTrendData = trendBuckets.length ? trendBuckets.map((bucket) => Math.round(Number(bucket.calls.answerRate) * 100)) : answerTrend;
+  const failureCodes = dashboardSummary?.failureCodes?.length ? dashboardSummary.failureCodes : [];
+  return (
+    <>
+      <PageTitle
+        title="概览 Dashboard"
+        desc="展示平台整体运行状态，覆盖通话、收入、成本、注册、节点和质检待办。"
+        actions={<Button icon={<Icon type="reload" />} onClick={refreshApi}>刷新指标</Button>}
+      />
+      <ApiNotice loading={apiLoading} error={apiError} onRetry={refreshApi} />
+      <section className="metric-grid">
+        {dashboardMetrics(dashboardSummary).map((metric) => (
+          <div className="metric-card" key={metric.label}>
+            <span>{metric.label}</span>
+            <strong>{metric.value}</strong>
+            <em className={`metric-${metric.tone}`}>{metric.delta}</em>
+          </div>
+        ))}
+      </section>
+      <section className="content-grid">
+        <Panel title="最近 24 小时通话量趋势" aside={<Badge tone="info">OpenSIPS acc/CDR</Badge>}>
+          <MiniBarChart data={callTrendData.length ? callTrendData : [0]} />
+        </Panel>
+        <Panel title="最近 24 小时接通率趋势" aside={<Badge tone="info">dialog statistics</Badge>}>
+          <LineChart data={answerTrendData.length ? answerTrendData : [0, 0]} />
+        </Panel>
+        <Panel title="客户消费 TOP 10">
+          <div className="rank-list">
+            {customerRows.length ? customerRows.slice(0, 3).map((item, index) => (
+              <div key={item.id}><span>{index + 1}</span><strong>{item.name}</strong><em>{item.balance}</em></div>
+            )) : <EmptyState title="暂无客户数据">客户 API 返回空列表。</EmptyState>}
+          </div>
+        </Panel>
+        <Panel title="失败响应码分布">
+          <div className="code-grid">
+            {failureCodes.length ? failureCodes.map((code) => (
+              <div key={code.sipCode}><strong>{code.count}</strong><span>{code.sipCode}</span></div>
+            )) : <EmptyState title="暂无失败码">今日没有失败 CDR 或 API 尚未返回数据。</EmptyState>}
+          </div>
+        </Panel>
+      </section>
+    </>
+  );
+}
+
+function CustomersPage({ customerRows, setCustomerRows, addRechargeRecord, apiLoading, apiError, refreshApi, onCreateCustomer, onUpdateCustomer, onRechargeCustomer }) {
+  const [showCreateCustomer, setShowCreateCustomer] = useState(false);
+  const [editingCustomer, setEditingCustomer] = useState(null);
+  const [rechargeCustomer, setRechargeCustomer] = useState(null);
+  const [newCustomer, setNewCustomer] = useState({ name: '', contact: '', phone: '', email: '' });
+  const [editCustomerForm, setEditCustomerForm] = useState({ name: '', contact: '', phone: '', email: '' });
+  const [rechargeForm, setRechargeForm] = useState({ amount: '', remark: '' });
+  const [actionError, setActionError] = useState('');
+  const openEditCustomer = (customer) => {
+    setEditingCustomer(customer);
+    setEditCustomerForm({
+      name: customer.name || '',
+      contact: customer.contact === '-' ? '' : customer.contact || '',
+      phone: customer.phone === '-' ? '' : customer.phone || '',
+      email: customer.email === '-' ? '' : customer.email || '',
+    });
+  };
+  const closeEditCustomer = () => {
+    setEditingCustomer(null);
+    setEditCustomerForm({ name: '', contact: '', phone: '', email: '' });
+  };
+  const openRechargeCustomer = (customer) => {
+    setRechargeCustomer(customer);
+    setRechargeForm({ amount: '', remark: '' });
+  };
+  const closeRechargeCustomer = () => {
+    setRechargeCustomer(null);
+    setRechargeForm({ amount: '', remark: '' });
+  };
+  const parseMoney = (value) => Number(String(value).replace(/[^\d.-]/g, '')) || 0;
+  const formatMoney = (value) => `¥${value.toLocaleString('zh-CN', { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;
+  const submitCustomer = async (event) => {
+    event.preventDefault();
+    if (!newCustomer.name.trim()) return;
+    setActionError('');
+    try {
+      if (onCreateCustomer) {
+        await onCreateCustomer({
+          name: newCustomer.name.trim(),
+          contactName: newCustomer.contact.trim() || undefined,
+          phone: newCustomer.phone.trim() || undefined,
+          email: newCustomer.email.trim() || undefined,
+          billingMode: 'PREPAID',
+          creditLimit: '0.000000',
+          minBalance: '0.000000',
+        });
+      } else {
+        const nextIndex = customerRows.length + 1;
+        setCustomerRows([...customerRows, { id: `C${String(1000 + nextIndex)}`, name: newCustomer.name.trim(), contact: newCustomer.contact.trim() || '-', phone: newCustomer.phone.trim() || '-', email: newCustomer.email.trim() || '-', domain: '-', auth: '待配置', status: '启用', balance: '¥0.00', credit: '¥0', billing: '待配置', routeGroup: '待配置', gateways: 0, createdAt: '2026-06-18' }]);
+      }
+      setNewCustomer({ name: '', contact: '', phone: '', email: '' });
+      setShowCreateCustomer(false);
+    } catch (error) {
+      setActionError(explainApiError(error));
+    }
+  };
+  const submitEditCustomer = async (event) => {
+    event.preventDefault();
+    if (!editCustomerForm.name.trim() || !editingCustomer) return;
+    setActionError('');
+    try {
+      if (onUpdateCustomer) {
+        await onUpdateCustomer(editingCustomer.id, {
+          name: editCustomerForm.name.trim(),
+          contactName: editCustomerForm.contact.trim() || null,
+          phone: editCustomerForm.phone.trim() || null,
+          email: editCustomerForm.email.trim() || null,
+        });
+      } else {
+        setCustomerRows(customerRows.map((customer) => (
+          customer.id === editingCustomer.id ? { ...customer, name: editCustomerForm.name.trim(), contact: editCustomerForm.contact.trim() || '-', phone: editCustomerForm.phone.trim() || '-', email: editCustomerForm.email.trim() || '-' } : customer
+        )));
+      }
+      closeEditCustomer();
+    } catch (error) {
+      setActionError(explainApiError(error));
+    }
+  };
+  const submitRecharge = async (event) => {
+    event.preventDefault();
+    const amount = Number(rechargeForm.amount);
+    if (!rechargeCustomer || !Number.isFinite(amount) || amount <= 0) return;
+    setActionError('');
+    try {
+      if (onRechargeCustomer) {
+        await onRechargeCustomer(rechargeCustomer.id, {
+          amount: amount.toFixed(2),
+          remark: rechargeForm.remark.trim() || undefined,
+        });
+      } else {
+        const beforeBalance = parseMoney(rechargeCustomer.balance);
+        const afterBalance = beforeBalance + amount;
+        setCustomerRows(customerRows.map((customer) => (
+          customer.id === rechargeCustomer.id ? { ...customer, balance: formatMoney(afterBalance) } : customer
+        )));
+        addRechargeRecord({ id: `RCG-${Date.now()}`, type: 'customer', owner: rechargeCustomer.name, amount: formatMoney(amount), beforeBalance: formatMoney(beforeBalance), afterBalance: formatMoney(afterBalance), remark: rechargeForm.remark.trim() || '-', operator: '运营管理员', time: new Date().toLocaleString('zh-CN', { hour12: false }), status: '成功' });
+      }
+      closeRechargeCustomer();
+    } catch (error) {
+      setActionError(explainApiError(error));
+    }
+  };
+
+  return (
+    <>
+      <PageTitle
+        title="客户管理"
+        desc="客户开通、SIP 账号/IP 白名单、费率方案、线路组、余额授信和操作日志。"
+        actions={<Button icon={<Icon type="plus" />} onClick={() => setShowCreateCustomer(true)}>新增客户</Button>}
+      />
+      <ApiNotice loading={apiLoading} error={apiError || actionError} onRetry={refreshApi} />
+      <Toolbar>
+        <Field label="客户名称"><Input placeholder="搜索客户名称 / 域名" /></Field>
+        <Field label="状态"><Select defaultValue="all"><option value="all">全部状态</option><option>启用</option><option>观察</option><option>停用</option></Select></Field>
+        <Button icon={<Icon type="search" />}>查询</Button>
+      </Toolbar>
+      <section className="master-detail">
+        <Panel title="客户列表" className="main-list wide-panel">
+          <SimpleTable
+            rows={customerRows}
+            columns={[
+              { key: 'id', label: '客户 ID' },
+              { key: 'name', label: '名称' },
+              { key: 'balance', label: '余额' },
+              { key: 'credit', label: '授信额度' },
+              { key: 'status', label: '状态', status: true },
+              { key: 'gateways', label: '客户网关数' },
+              {
+                key: 'actions',
+                label: '操作',
+                render: (row) => (
+                  <div className="table-actions">
+                    <Button size="sm" variant="outline" onClick={() => openEditCustomer(row)}>编辑</Button>
+                    <Button size="sm" variant="secondary" onClick={() => openRechargeCustomer(row)}>充值</Button>
+                  </div>
+                ),
+              },
+            ]}
+          />
+        </Panel>
+      </section>
+      {showCreateCustomer ? (
+        <Modal title="新增客户" onClose={() => setShowCreateCustomer(false)} size="sm">
+          <form className="modal-form" onSubmit={submitCustomer}>
+            <Field label={<span>客户名称 <span className="required-star">*</span></span>}>
+              <Input value={newCustomer.name} onChange={(event) => setNewCustomer({ ...newCustomer, name: event.target.value })} placeholder="请输入企业名称" required />
+            </Field>
+            <Field label="联系人">
+              <Input value={newCustomer.contact} onChange={(event) => setNewCustomer({ ...newCustomer, contact: event.target.value })} placeholder="请输入联系人" />
+            </Field>
+            <Field label="联系电话">
+              <Input value={newCustomer.phone} onChange={(event) => setNewCustomer({ ...newCustomer, phone: event.target.value })} placeholder="请输入联系电话" />
+            </Field>
+            <Field label="邮箱">
+              <Input type="email" value={newCustomer.email} onChange={(event) => setNewCustomer({ ...newCustomer, email: event.target.value })} placeholder="请输入邮箱" />
+            </Field>
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={() => setShowCreateCustomer(false)}>取消</Button>
+              <Button type="submit">保存客户</Button>
+            </div>
+          </form>
+        </Modal>
+      ) : null}
+      {rechargeCustomer ? (
+        <Modal title={`${rechargeCustomer.name} 充值`} onClose={closeRechargeCustomer} size="sm">
+          <form className="modal-form" onSubmit={submitRecharge}>
+            <KeyValue label="当前余额" value={rechargeCustomer.balance} />
+            <Field label={<span>充值金额 <span className="required-star">*</span></span>}>
+              <Input type="number" min="0.01" step="0.01" value={rechargeForm.amount} onChange={(event) => setRechargeForm({ ...rechargeForm, amount: event.target.value })} placeholder="请输入充值金额" required />
+            </Field>
+            <Field label="备注">
+              <Textarea rows="4" value={rechargeForm.remark} onChange={(event) => setRechargeForm({ ...rechargeForm, remark: event.target.value })} placeholder="请输入备注" />
+            </Field>
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={closeRechargeCustomer}>取消</Button>
+              <Button type="submit">确认充值</Button>
+            </div>
+          </form>
+        </Modal>
+      ) : null}
+      {editingCustomer ? (
+        <Modal title="编辑客户" onClose={closeEditCustomer} size="sm">
+          <form className="modal-form" onSubmit={submitEditCustomer}>
+            <Field label={<span>客户名称 <span className="required-star">*</span></span>}>
+              <Input value={editCustomerForm.name} onChange={(event) => setEditCustomerForm({ ...editCustomerForm, name: event.target.value })} placeholder="请输入客户名称" required />
+            </Field>
+            <Field label="联系人">
+              <Input value={editCustomerForm.contact} onChange={(event) => setEditCustomerForm({ ...editCustomerForm, contact: event.target.value })} placeholder="请输入联系人" />
+            </Field>
+            <Field label="联系电话">
+              <Input value={editCustomerForm.phone} onChange={(event) => setEditCustomerForm({ ...editCustomerForm, phone: event.target.value })} placeholder="请输入联系电话" />
+            </Field>
+            <Field label="邮箱">
+              <Input type="email" value={editCustomerForm.email} onChange={(event) => setEditCustomerForm({ ...editCustomerForm, email: event.target.value })} placeholder="请输入邮箱" />
+            </Field>
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={closeEditCustomer}>取消</Button>
+              <Button type="submit">保存修改</Button>
+            </div>
+          </form>
+        </Modal>
+      ) : null}
+    </>
+  );
+}
+
+function RechargeRecordsPage({ rechargeRows, apiLoading, apiError, refreshApi }) {
+  const [activeTab, setActiveTab] = useState('customer');
+  const visibleRows = rechargeRows.filter((row) => row.type === activeTab);
+  const ownerLabel = activeTab === 'customer' ? '客户' : '供应商';
+  const recordTable = (
+    <section className="content-grid">
+      <Panel title={`${ownerLabel}充值记录列表`} className="wide-panel">
+        <SimpleTable rows={visibleRows} columns={[
+          { key: 'id', label: '记录 ID' },
+          { key: 'owner', label: ownerLabel },
+          { key: 'amount', label: '充值金额' },
+          { key: 'beforeBalance', label: '充值前余额' },
+          { key: 'afterBalance', label: '充值后余额' },
+          { key: 'remark', label: '备注' },
+          { key: 'operator', label: '操作人' },
+          { key: 'time', label: '充值时间' },
+          { key: 'status', label: '状态', status: true },
+        ]} />
+      </Panel>
+    </section>
+  );
+  return (
+    <>
+      <PageTitle
+        title="充值记录"
+        desc="记录客户和供应商充值金额、充值前后余额、备注、操作人和充值时间。"
+        actions={<Button icon={<Icon type="export" />} variant="outline">导出记录</Button>}
+      />
+      <ApiNotice loading={apiLoading} error={apiError} onRetry={refreshApi} />
+      <Toolbar>
+        <Field label={`${ownerLabel}名称`}><Input placeholder={`搜索${ownerLabel}名称`} /></Field>
+        <Field label="状态">
+          <Select defaultValue="all">
+            <option value="all">全部状态</option>
+            <option>成功</option>
+            <option>失败</option>
+          </Select>
+        </Field>
+        <Button icon={<Icon type="search" />}>查询</Button>
+      </Toolbar>
+      <Tabs
+        value={activeTab}
+        onChange={setActiveTab}
+        tabs={[
+          { value: 'customer', label: '客户充值', content: recordTable },
+          { value: 'vendor', label: '供应商充值', content: recordTable },
+        ]}
+      />
+    </>
+  );
+}
+
+function CustomerGatewaysPage() {
+  const [gatewayRows, setGatewayRows] = useState(customerGateways);
+  const [policyRows, setPolicyRows] = useState(customerGatewayPolicies);
+  const [strategyGateway, setStrategyGateway] = useState(null);
+  const [gatewayModalOpen, setGatewayModalOpen] = useState(false);
+  const [editingGateway, setEditingGateway] = useState(null);
+  const [policyModalOpen, setPolicyModalOpen] = useState(false);
+  const [editingPolicy, setEditingPolicy] = useState(null);
+  const [deletePolicyTarget, setDeletePolicyTarget] = useState(null);
+  const emptyGatewayForm = { id: '', name: '', authMode: 'IP', ipAddress: '', sipAccount: '', sipPassword: '' };
+  const emptyPolicyForm = { name: '', callerMode: 'any', callerValue: '', calleeMode: 'any', calleeValue: '', routeGroup: routeGroups[0].name };
+  const [gatewayForm, setGatewayForm] = useState(emptyGatewayForm);
+  const [policyForm, setPolicyForm] = useState(emptyPolicyForm);
+  const strategyGatewayData = gatewayRows.find((item) => item.id === strategyGateway);
+  const strategyPolicies = strategyGateway
+    ? policyRows.filter((item) => item.gateway === strategyGateway).sort((first, second) => first.priority - second.priority)
+    : [];
+  const formatMatch = (mode, value) => {
+    if (mode === 'equals') return `等于 ${value}`;
+    if (mode === 'prefix') return `前缀 ${value}`;
+    return '不限';
+  };
+  const openCreateGateway = () => {
+    setEditingGateway(null);
+    setGatewayForm(emptyGatewayForm);
+    setGatewayModalOpen(true);
+  };
+  const openEditGateway = (gateway) => {
+    setEditingGateway(gateway);
+    setGatewayForm({
+      id: gateway.id,
+      name: gateway.name,
+      authMode: gateway.authMode,
+      ipAddress: gateway.ipAddress || '',
+      sipAccount: gateway.sipAccount || '',
+      sipPassword: gateway.sipPassword || '',
+    });
+    setGatewayModalOpen(true);
+  };
+  const closeGatewayModal = () => {
+    setGatewayModalOpen(false);
+    setEditingGateway(null);
+    setGatewayForm(emptyGatewayForm);
+  };
+  const submitGateway = (event) => {
+    event.preventDefault();
+    const name = gatewayForm.name.trim();
+    const id = gatewayForm.id.trim();
+    const ipAddress = gatewayForm.ipAddress.trim();
+    const sipAccount = gatewayForm.sipAccount.trim();
+    const sipPassword = gatewayForm.sipPassword.trim();
+    const authValid = gatewayForm.authMode === 'IP' ? ipAddress : sipAccount && sipPassword;
+    if (!id || !name || !authValid) return;
+    const nextGateway = {
+      id,
+      name,
+      authMode: gatewayForm.authMode,
+      ipAddress: gatewayForm.authMode === 'IP' ? ipAddress : '',
+      sipAccount: gatewayForm.authMode === 'SIP注册' ? sipAccount : '',
+      sipPassword: gatewayForm.authMode === 'SIP注册' ? sipPassword : '',
+      routePolicyCount: editingGateway?.routePolicyCount ?? 0,
+      status: editingGateway?.status ?? '启用',
+    };
+    setGatewayRows((rows) => (editingGateway
+      ? rows.map((gateway) => (gateway.id === editingGateway.id ? nextGateway : gateway))
+      : [...rows, nextGateway]));
+    closeGatewayModal();
+  };
+  const toggleGatewayStatus = (gateway) => {
+    setGatewayRows((rows) => rows.map((item) => (
+      item.id === gateway.id ? { ...item, status: item.status === '启用' ? '停用' : '启用' } : item
+    )));
+  };
+  const openPolicyDrawer = (gatewayId) => {
+    setStrategyGateway(gatewayId);
+    setPolicyModalOpen(false);
+    setEditingPolicy(null);
+    setDeletePolicyTarget(null);
+    setPolicyForm(emptyPolicyForm);
+  };
+  const closePolicyDrawer = () => {
+    setStrategyGateway(null);
+    setPolicyModalOpen(false);
+    setEditingPolicy(null);
+    setDeletePolicyTarget(null);
+    setPolicyForm(emptyPolicyForm);
+  };
+  const openCreatePolicy = () => {
+    setEditingPolicy(null);
+    setPolicyForm(emptyPolicyForm);
+    setPolicyModalOpen(true);
+  };
+  const openEditPolicy = (policy) => {
+    setEditingPolicy(policy);
+    setPolicyForm({
+      name: policy.name,
+      callerMode: policy.callerMode,
+      callerValue: policy.callerValue,
+      calleeMode: policy.calleeMode,
+      calleeValue: policy.calleeValue,
+      routeGroup: policy.routeGroup,
+    });
+    setPolicyModalOpen(true);
+  };
+  const closePolicyModal = () => {
+    setPolicyModalOpen(false);
+    setEditingPolicy(null);
+    setPolicyForm(emptyPolicyForm);
+  };
+  const submitPolicy = (event) => {
+    event.preventDefault();
+    if (!strategyGatewayData || !policyForm.name.trim()) return;
+    const callerValue = policyForm.callerValue.trim();
+    const calleeValue = policyForm.calleeValue.trim();
+    const callerValid = policyForm.callerMode === 'any' || callerValue;
+    const calleeValid = policyForm.calleeMode === 'any' || calleeValue;
+    if (!callerValid || !calleeValid || (policyForm.callerMode === 'any' && policyForm.calleeMode === 'any')) return;
+    const nextPriority = strategyPolicies.length ? Math.max(...strategyPolicies.map((policy) => policy.priority)) + 10 : 10;
+    const nextPolicy = {
+      name: policyForm.name.trim(),
+      callerMode: policyForm.callerMode,
+      callerValue: policyForm.callerMode === 'any' ? '' : callerValue,
+      calleeMode: policyForm.calleeMode,
+      calleeValue: policyForm.calleeMode === 'any' ? '' : calleeValue,
+      routeGroup: policyForm.routeGroup,
+    };
+    if (editingPolicy) {
+      setPolicyRows((rows) => rows.map((policy) => (
+        policy.id === editingPolicy.id ? { ...policy, ...nextPolicy } : policy
+      )));
+    } else {
+      setPolicyRows((rows) => [
+        ...rows,
+        {
+          ...nextPolicy,
+        id: `CGP-${Date.now()}`,
+        gateway: strategyGatewayData.id,
+        priority: nextPriority,
+        status: '启用',
+      },
+      ]);
+      setGatewayRows((rows) => rows.map((gateway) => (
+        gateway.id === strategyGatewayData.id ? { ...gateway, routePolicyCount: gateway.routePolicyCount + 1 } : gateway
+      )));
+    }
+    closePolicyModal();
+  };
+  const renumberPolicies = (policies) => policies.map((policy, index) => ({ ...policy, priority: (index + 1) * 10 }));
+  const movePolicy = (policyId, direction) => {
+    if (!strategyGatewayData) return;
+    const ordered = [...strategyPolicies];
+    const currentIndex = ordered.findIndex((policy) => policy.id === policyId);
+    const nextIndex = currentIndex + direction;
+    if (currentIndex < 0 || nextIndex < 0 || nextIndex >= ordered.length) return;
+    [ordered[currentIndex], ordered[nextIndex]] = [ordered[nextIndex], ordered[currentIndex]];
+    const movedPolicies = renumberPolicies(ordered);
+    setPolicyRows((rows) => rows.map((policy) => (
+      policy.gateway === strategyGatewayData.id
+        ? movedPolicies.find((item) => item.id === policy.id) || policy
+        : policy
+    )));
+  };
+  const togglePolicyStatus = (policyId) => {
+    setPolicyRows((rows) => rows.map((policy) => (
+      policy.id === policyId ? { ...policy, status: policy.status === '启用' ? '停用' : '启用' } : policy
+    )));
+  };
+  const deletePolicy = (policyId) => {
+    if (!strategyGatewayData) return;
+    setPolicyRows((rows) => renumberPolicies(rows.filter((policy) => policy.gateway === strategyGatewayData.id && policy.id !== policyId))
+      .concat(rows.filter((policy) => policy.gateway !== strategyGatewayData.id)));
+    setGatewayRows((rows) => rows.map((gateway) => (
+      gateway.id === strategyGatewayData.id ? { ...gateway, routePolicyCount: Math.max(0, gateway.routePolicyCount - 1) } : gateway
+    )));
+    setDeletePolicyTarget(null);
+  };
+
+  return (
+    <>
+      <PageTitle
+        title="客户网关管理"
+        desc="独立管理客户接入网关、认证方式、路由策略数量和启停状态。"
+        actions={<Button icon={<Icon type="plus" />} onClick={openCreateGateway}>新增客户网关</Button>}
+      />
+      <section className="content-grid">
+        <Panel title="客户网关列表" className="wide-panel">
+          <SimpleTable rows={gatewayRows} columns={[
+            { key: 'id', label: 'ID' },
+            { key: 'name', label: '名称' },
+            { key: 'authMode', label: '认证方式' },
+            { key: 'authTarget', label: 'IP地址 / 账号名称', render: (row) => (row.authMode === 'IP' ? row.ipAddress : row.sipAccount) },
+            { key: 'routePolicyCount', label: '路由策略数', render: (row) => policyRows.filter((policy) => policy.gateway === row.id).length },
+            { key: 'status', label: '状态', status: true },
+            {
+              key: 'actions',
+              label: '操作',
+              render: (row) => (
+                <div className="table-actions">
+                  <Button size="sm" variant="outline" onClick={() => openEditGateway(row)}>编辑</Button>
+                  <Button size="sm" variant={row.status === '启用' ? 'ghost' : 'secondary'} onClick={() => toggleGatewayStatus(row)}>
+                    {row.status === '启用' ? '禁用' : '启用'}
+                  </Button>
+                  <Button size="sm" variant="secondary" onClick={() => openPolicyDrawer(row.id)}>策略配置</Button>
+                </div>
+              ),
+            },
+          ]} />
+        </Panel>
+      </section>
+      {gatewayModalOpen ? (
+        <Modal title={editingGateway ? '编辑客户网关' : '新增客户网关'} onClose={closeGatewayModal} size="sm">
+          <form className="modal-form" onSubmit={submitGateway}>
+            <Field label={<span>ID <span className="required-star">*</span></span>}>
+              <Input value={gatewayForm.id} onChange={(event) => setGatewayForm({ ...gatewayForm, id: event.target.value })} placeholder="例如 C-GW-SH-01" required />
+            </Field>
+            <Field label={<span>名称 <span className="required-star">*</span></span>}>
+              <Input value={gatewayForm.name} onChange={(event) => setGatewayForm({ ...gatewayForm, name: event.target.value })} placeholder="请输入客户网关名称" required />
+            </Field>
+            <Field label={<span>认证方式 <span className="required-star">*</span></span>}>
+              <Select value={gatewayForm.authMode} onChange={(event) => setGatewayForm({ ...gatewayForm, authMode: event.target.value, ipAddress: '', sipAccount: '', sipPassword: '' })} required>
+                <option>IP</option>
+                <option>SIP注册</option>
+              </Select>
+            </Field>
+            {gatewayForm.authMode === 'IP' ? (
+              <Field label={<span>IP地址 <span className="required-star">*</span></span>}>
+                <Input value={gatewayForm.ipAddress} onChange={(event) => setGatewayForm({ ...gatewayForm, ipAddress: event.target.value })} placeholder="例如 10.10.1.11" required />
+              </Field>
+            ) : (
+              <>
+                <Field label={<span>SIP账号 <span className="required-star">*</span></span>}>
+                  <Input value={gatewayForm.sipAccount} onChange={(event) => setGatewayForm({ ...gatewayForm, sipAccount: event.target.value })} placeholder="请输入 SIP 账号" required />
+                </Field>
+                <Field label={<span>SIP密码 <span className="required-star">*</span></span>}>
+                  <Input type="password" value={gatewayForm.sipPassword} onChange={(event) => setGatewayForm({ ...gatewayForm, sipPassword: event.target.value })} placeholder="请输入 SIP 密码" required />
+                </Field>
+              </>
+            )}
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={closeGatewayModal}>取消</Button>
+              <Button type="submit">{editingGateway ? '保存修改' : '保存网关'}</Button>
+            </div>
+          </form>
+        </Modal>
+      ) : null}
+      {strategyGatewayData ? (
+        <Drawer title={`${strategyGatewayData.name} 策略配置`} aside={<Badge tone="info">{strategyGatewayData.id}</Badge>} onClose={closePolicyDrawer}>
+            <div className="drawer-toolbar">
+              <div>
+                <strong>{strategyPolicies.length} 条策略</strong>
+                <span>按优先级从小到大匹配，主叫和被叫条件可并存。</span>
+              </div>
+              <Button icon={<Icon type="plus" />} onClick={openCreatePolicy}>添加策略</Button>
+            </div>
+            <SimpleTable rows={strategyPolicies} columns={[
+              { key: 'priority', label: '优先级' },
+              { key: 'name', label: '策略名称' },
+              { key: 'callerMatch', label: '主叫匹配', render: (row) => formatMatch(row.callerMode, row.callerValue) },
+              { key: 'calleeMatch', label: '被叫匹配', render: (row) => formatMatch(row.calleeMode, row.calleeValue) },
+              { key: 'routeGroup', label: '呼叫至线路群组' },
+              { key: 'status', label: '状态', status: true },
+              {
+                key: 'actions',
+                label: '操作',
+                render: (row) => (
+                  <div className="table-actions">
+                    <Button size="sm" variant="outline" onClick={() => openEditPolicy(row)}>编辑</Button>
+                    <Button size="sm" variant="outline" onClick={() => movePolicy(row.id, -1)}>上移</Button>
+                    <Button size="sm" variant="outline" onClick={() => movePolicy(row.id, 1)}>下移</Button>
+                    <Button size="sm" variant={row.status === '启用' ? 'ghost' : 'secondary'} onClick={() => togglePolicyStatus(row.id)}>
+                      {row.status === '启用' ? '停用' : '启用'}
+                    </Button>
+                    <Button size="sm" variant="ghost" onClick={() => setDeletePolicyTarget(row)}>删除</Button>
+                  </div>
+                ),
+              },
+            ]} />
+        </Drawer>
+      ) : null}
+      {policyModalOpen ? (
+        <Modal title={editingPolicy ? '编辑策略' : '添加策略'} onClose={closePolicyModal} size="lg">
+          <form className="strategy-form" onSubmit={submitPolicy}>
+            <Field label={<span>策略名称 <span className="required-star">*</span></span>}>
+              <Input value={policyForm.name} onChange={(event) => setPolicyForm({ ...policyForm, name: event.target.value })} placeholder="例如 华东移动号码优先" required />
+            </Field>
+            <div className="match-grid">
+              <div className="match-card">
+                <strong>主叫号码匹配</strong>
+                <Field label="匹配方式">
+                  <Select value={policyForm.callerMode} onChange={(event) => setPolicyForm({ ...policyForm, callerMode: event.target.value, callerValue: '' })}>
+                    <option value="any">不限</option>
+                    <option value="equals">等于指定号码</option>
+                    <option value="prefix">按前缀匹配</option>
+                  </Select>
+                </Field>
+                {policyForm.callerMode !== 'any' ? (
+                  <Field label={<span>主叫号码 <span className="required-star">*</span></span>}>
+                    <Input value={policyForm.callerValue} onChange={(event) => setPolicyForm({ ...policyForm, callerValue: event.target.value })} placeholder={policyForm.callerMode === 'equals' ? '例如 02160010001' : '例如 0216001'} required />
+                  </Field>
+                ) : null}
+              </div>
+              <div className="match-card">
+                <strong>被叫号码匹配</strong>
+                <Field label="匹配方式">
+                  <Select value={policyForm.calleeMode} onChange={(event) => setPolicyForm({ ...policyForm, calleeMode: event.target.value, calleeValue: '' })}>
+                    <option value="any">不限</option>
+                    <option value="equals">等于指定号码</option>
+                    <option value="prefix">按前缀匹配</option>
+                  </Select>
+                </Field>
+                {policyForm.calleeMode !== 'any' ? (
+                  <Field label={<span>被叫号码 <span className="required-star">*</span></span>}>
+                    <Input value={policyForm.calleeValue} onChange={(event) => setPolicyForm({ ...policyForm, calleeValue: event.target.value })} placeholder={policyForm.calleeMode === 'equals' ? '例如 13800138000' : '例如 13/15/18'} required />
+                  </Field>
+                ) : null}
+              </div>
+            </div>
+            <div className="sub-toolbar">
+              <Field label={<span>呼叫至线路群组 <span className="required-star">*</span></span>}>
+                <Select value={policyForm.routeGroup} onChange={(event) => setPolicyForm({ ...policyForm, routeGroup: event.target.value })} required>
+                  {routeGroups.map((group) => <option key={group.id}>{group.name}</option>)}
+                </Select>
+              </Field>
+            </div>
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={closePolicyModal}>取消</Button>
+              <Button type="submit">{editingPolicy ? '保存修改' : '保存策略'}</Button>
+            </div>
+          </form>
+        </Modal>
+      ) : null}
+      {deletePolicyTarget ? (
+        <Modal title="删除策略确认" onClose={() => setDeletePolicyTarget(null)} size="sm">
+          <div className="confirm-copy">
+            <p>确认删除策略「{deletePolicyTarget.name}」吗？删除后当前网关的策略优先级会自动重排。</p>
+          </div>
+          <div className="modal-actions">
+            <Button type="button" variant="outline" onClick={() => setDeletePolicyTarget(null)}>取消</Button>
+            <Button type="button" variant="primary" onClick={() => deletePolicy(deletePolicyTarget.id)}>确认删除</Button>
+          </div>
+        </Modal>
+      ) : null}
+    </>
+  );
+}
+
+function VendorsPage({ vendorRows, setVendorRows, addRechargeRecord, apiLoading, apiError, refreshApi, onCreateVendor, onUpdateVendor, onRechargeVendor }) {
+  const [showCreateVendor, setShowCreateVendor] = useState(false);
+  const [editingVendor, setEditingVendor] = useState(null);
+  const [rechargeVendor, setRechargeVendor] = useState(null);
+  const [newVendor, setNewVendor] = useState({ name: '' });
+  const [editVendorForm, setEditVendorForm] = useState({ name: '' });
+  const [rechargeForm, setRechargeForm] = useState({ amount: '', remark: '' });
+  const [actionError, setActionError] = useState('');
+  const parseMoney = (value) => Number(String(value).replace(/[^\d.-]/g, '')) || 0;
+  const formatMoney = (value) => `¥${value.toLocaleString('zh-CN', { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;
+  const openEditVendor = (vendor) => {
+    setEditingVendor(vendor);
+    setEditVendorForm({ name: vendor.name || '' });
+  };
+  const closeEditVendor = () => {
+    setEditingVendor(null);
+    setEditVendorForm({ name: '' });
+  };
+  const openRechargeVendor = (vendor) => {
+    setRechargeVendor(vendor);
+    setRechargeForm({ amount: '', remark: '' });
+  };
+  const closeRechargeVendor = () => {
+    setRechargeVendor(null);
+    setRechargeForm({ amount: '', remark: '' });
+  };
+  const submitVendor = async (event) => {
+    event.preventDefault();
+    if (!newVendor.name.trim()) return;
+    setActionError('');
+    try {
+      if (onCreateVendor) {
+        await onCreateVendor({ name: newVendor.name.trim(), creditLimit: '0.000000' });
+      } else {
+        const nextIndex = vendorRows.length + 1;
+        setVendorRows((rows) => [...rows, { id: `V${String(2000 + nextIndex)}`, name: newVendor.name.trim(), balance: '¥0.00', credit: '¥0', gateways: 0, status: '启用', cycle: '待配置', ratePlan: '待配置', contact: '-', createdAt: '2026-06-19' }]);
+      }
+      setNewVendor({ name: '' });
+      setShowCreateVendor(false);
+    } catch (error) {
+      setActionError(explainApiError(error));
+    }
+  };
+  const submitEditVendor = async (event) => {
+    event.preventDefault();
+    if (!editVendorForm.name.trim() || !editingVendor) return;
+    setActionError('');
+    try {
+      if (onUpdateVendor) {
+        await onUpdateVendor(editingVendor.id, { name: editVendorForm.name.trim() });
+      } else {
+        setVendorRows((rows) => rows.map((vendor) => (
+          vendor.id === editingVendor.id ? { ...vendor, name: editVendorForm.name.trim() } : vendor
+        )));
+      }
+      closeEditVendor();
+    } catch (error) {
+      setActionError(explainApiError(error));
+    }
+  };
+  const submitRecharge = async (event) => {
+    event.preventDefault();
+    const amount = Number(rechargeForm.amount);
+    if (!rechargeVendor || !Number.isFinite(amount) || amount <= 0) return;
+    setActionError('');
+    try {
+      if (onRechargeVendor) {
+        await onRechargeVendor(rechargeVendor.id, { amount: amount.toFixed(2), remark: rechargeForm.remark.trim() || undefined });
+      } else {
+        const beforeBalance = parseMoney(rechargeVendor.balance);
+        const afterBalance = beforeBalance + amount;
+        setVendorRows((rows) => rows.map((vendor) => (
+          vendor.id === rechargeVendor.id ? { ...vendor, balance: formatMoney(afterBalance) } : vendor
+        )));
+        addRechargeRecord({ id: `RCG-V-${Date.now()}`, type: 'vendor', owner: rechargeVendor.name, amount: formatMoney(amount), beforeBalance: formatMoney(beforeBalance), afterBalance: formatMoney(afterBalance), remark: rechargeForm.remark.trim() || '-', operator: '运营管理员', time: new Date().toLocaleString('zh-CN', { hour12: false }), status: '成功' });
+      }
+      closeRechargeVendor();
+    } catch (error) {
+      setActionError(explainApiError(error));
+    }
+  };
+
+  return (
+    <>
+      <PageTitle title="供应商管理" desc="管理供应商账户、余额、授信和充值记录。" actions={<Button icon={<Icon type="plus" />} onClick={() => setShowCreateVendor(true)}>新增供应商</Button>} />
+      <ApiNotice loading={apiLoading} error={apiError || actionError} onRetry={refreshApi} />
+      <Toolbar>
+        <Field label="供应商名称"><Input placeholder="搜索供应商名称" /></Field>
+        <Button icon={<Icon type="search" />}>查询</Button>
+      </Toolbar>
+      <section className="master-detail">
+        <Panel title="供应商列表" className="wide-panel">
+          <SimpleTable rows={vendorRows} columns={[
+            { key: 'id', label: '供应商 ID' },
+            { key: 'name', label: '名称' },
+            { key: 'balance', label: '余额' },
+            { key: 'credit', label: '授信额度' },
+            {
+              key: 'actions',
+              label: '操作',
+              render: (row) => (
+                <div className="table-actions">
+                  <Button size="sm" variant="outline" onClick={() => openEditVendor(row)}>编辑</Button>
+                  <Button size="sm" variant="secondary" onClick={() => openRechargeVendor(row)}>充值</Button>
+                </div>
+              ),
+            },
+          ]} />
+        </Panel>
+      </section>
+      {showCreateVendor ? (
+        <Modal title="新增供应商" onClose={() => setShowCreateVendor(false)} size="sm">
+          <form className="modal-form" onSubmit={submitVendor}>
+            <Field label={<span>供应商名称 <span className="required-star">*</span></span>}>
+              <Input value={newVendor.name} onChange={(event) => setNewVendor({ ...newVendor, name: event.target.value })} placeholder="请输入供应商名称" required />
+            </Field>
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={() => setShowCreateVendor(false)}>取消</Button>
+              <Button type="submit">保存供应商</Button>
+            </div>
+          </form>
+        </Modal>
+      ) : null}
+      {editingVendor ? (
+        <Modal title="编辑供应商" onClose={closeEditVendor} size="sm">
+          <form className="modal-form" onSubmit={submitEditVendor}>
+            <Field label={<span>供应商名称 <span className="required-star">*</span></span>}>
+              <Input value={editVendorForm.name} onChange={(event) => setEditVendorForm({ ...editVendorForm, name: event.target.value })} placeholder="请输入供应商名称" required />
+            </Field>
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={closeEditVendor}>取消</Button>
+              <Button type="submit">保存修改</Button>
+            </div>
+          </form>
+        </Modal>
+      ) : null}
+      {rechargeVendor ? (
+        <Modal title={`${rechargeVendor.name} 充值`} onClose={closeRechargeVendor} size="sm">
+          <form className="modal-form" onSubmit={submitRecharge}>
+            <KeyValue label="当前余额" value={rechargeVendor.balance} />
+            <Field label={<span>充值金额 <span className="required-star">*</span></span>}>
+              <Input type="number" min="0.01" step="0.01" value={rechargeForm.amount} onChange={(event) => setRechargeForm({ ...rechargeForm, amount: event.target.value })} placeholder="请输入充值金额" required />
+            </Field>
+            <Field label="备注">
+              <Textarea rows="4" value={rechargeForm.remark} onChange={(event) => setRechargeForm({ ...rechargeForm, remark: event.target.value })} placeholder="请输入备注" />
+            </Field>
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={closeRechargeVendor}>取消</Button>
+              <Button type="submit">确认充值</Button>
+            </div>
+          </form>
+        </Modal>
+      ) : null}
+    </>
+  );
+}
+
+function VendorGatewaysPage() {
+  const [gatewayRows, setGatewayRows] = useState(gateways);
+  const [editingGateway, setEditingGateway] = useState(null);
+  const provinceOptions = ['北京', '上海', '广东', '浙江', '江苏', '新疆', '西藏', '港澳台', '海外'];
+  const codecOptions = ['PCMA', 'PCMU', 'G729', 'G722', 'OPUS'];
+  const splitList = (value) => (value && !['无', '-'].includes(value) ? value.split(/[,，、]/).map((item) => item.trim()).filter(Boolean) : []);
+  const splitTimeRanges = (value) => {
+    const ranges = String(value || '')
+      .split(/[,，、\n]/)
+      .map((item) => {
+        const [start = '', end = ''] = item.split('-').map((part) => part.trim());
+        return { start, end };
+      })
+      .filter((item) => item.start || item.end);
+    return ranges.length ? ranges : [{ start: '', end: '' }];
+  };
+  const splitRate = (value) => {
+    return String(value || '').trim();
+  };
+  const formatMinuteRate = (cycle, rate) => {
+    const billingCycle = Number(cycle);
+    const cycleRate = Number(rate);
+    if (!billingCycle || !Number.isFinite(billingCycle) || !Number.isFinite(cycleRate)) return '-';
+    return `¥${((cycleRate * 60) / billingCycle).toFixed(4)}/分钟`;
+  };
+  const splitTransforms = (value) => {
+    if (!value || value === '-') return [{ from: '', to: '' }];
+    return String(value).split('\n').map((line) => {
+      const [from = '', to = ''] = line.split('->').map((item) => item.trim());
+      return { from, to: to || from };
+    }).filter((item) => item.from || item.to);
+  };
+  const joinTransforms = (rules) => {
+    const text = rules
+      .map((rule) => ({ from: rule.from.trim(), to: rule.to.trim() }))
+      .filter((rule) => rule.from || rule.to)
+      .map((rule) => `${rule.from} -> ${rule.to || rule.from}`)
+      .join('\n');
+    return text || '-';
+  };
+  const emptyGatewayForm = {
+    vendor: vendors[0].name,
+    name: '',
+    authMode: 'IP',
+    ipAddress: '',
+    sipAccount: '',
+    sipPassword: '',
+    concurrencyLimit: '',
+    billingCycle: '60',
+    cycleRate: '',
+    requestRate: '',
+    blockedProvinces: [],
+    forbiddenPeriods: [{ start: '', end: '' }],
+    codecs: [],
+    calleeTransforms: [{ from: '', to: '' }],
+    callerTransforms: [{ from: '', to: '' }],
+  };
+  const [gatewayForm, setGatewayForm] = useState(emptyGatewayForm);
+  const openEditGateway = (gateway) => {
+    setEditingGateway(gateway);
+    const rateValue = splitRate(gateway.requestRate);
+    setGatewayForm({
+      vendor: gateway.vendor,
+      name: gateway.name,
+      authMode: gateway.authMode,
+      ipAddress: gateway.ipAddress || '',
+      sipAccount: gateway.sipAccount || '',
+      sipPassword: gateway.sipPassword || '',
+      concurrencyLimit: String(gateway.concurrencyLimit),
+      billingCycle: String(gateway.billingCycle || 60),
+      cycleRate: String(gateway.cycleRate ?? ''),
+      requestRate: rateValue,
+      blockedProvinces: splitList(gateway.blockedProvinces),
+      forbiddenPeriods: splitTimeRanges(gateway.callTimeLimit),
+      codecs: splitList(gateway.codecs),
+      calleeTransforms: splitTransforms(gateway.calleePrefixTransform),
+      callerTransforms: splitTransforms(gateway.callerPrefixTransform),
+    });
+  };
+  const closeEditGateway = () => {
+    setEditingGateway(null);
+    setGatewayForm(emptyGatewayForm);
+  };
+  const submitGateway = (event) => {
+    event.preventDefault();
+    if (!editingGateway || !gatewayForm.name.trim() || !gatewayForm.concurrencyLimit || !gatewayForm.billingCycle || !gatewayForm.cycleRate) return;
+    const billingCycle = Number(gatewayForm.billingCycle);
+    const cycleRate = Number(gatewayForm.cycleRate);
+    if (!Number.isFinite(billingCycle) || billingCycle <= 0 || billingCycle > 60 || !Number.isFinite(cycleRate) || cycleRate < 0) return;
+    const ipAddress = gatewayForm.ipAddress.trim();
+    const sipAccount = gatewayForm.sipAccount.trim();
+    const sipPassword = gatewayForm.sipPassword.trim();
+    const authValid = gatewayForm.authMode === 'IP' ? ipAddress : sipAccount && sipPassword;
+    if (!authValid) return;
+    setGatewayRows((rows) => rows.map((gateway) => (
+      gateway.id === editingGateway.id
+        ? {
+            ...gateway,
+            vendor: gatewayForm.vendor,
+            name: gatewayForm.name.trim(),
+            authMode: gatewayForm.authMode,
+            ipAddress: gatewayForm.authMode === 'IP' ? ipAddress : '',
+            sipAccount: gatewayForm.authMode === 'SIP注册' ? sipAccount : '',
+            sipPassword: gatewayForm.authMode === 'SIP注册' ? sipPassword : '',
+            concurrencyLimit: Number(gatewayForm.concurrencyLimit),
+            billingCycle,
+            cycleRate,
+            requestRate: gatewayForm.requestRate.trim() || '-',
+            blockedProvinces: gatewayForm.blockedProvinces.length ? gatewayForm.blockedProvinces.join('、') : '无',
+            callTimeLimit: gatewayForm.forbiddenPeriods
+              .filter((period) => period.start || period.end)
+              .map((period) => `${period.start || '00:00'}-${period.end || '23:59'}`)
+              .join('、') || '无',
+            codecs: gatewayForm.codecs.length ? gatewayForm.codecs.join(', ') : '-',
+            calleePrefixTransform: joinTransforms(gatewayForm.calleeTransforms),
+            callerPrefixTransform: joinTransforms(gatewayForm.callerTransforms),
+          }
+        : gateway
+    )));
+    closeEditGateway();
+  };
+  const toggleArrayValue = (field, value) => {
+    setGatewayForm((form) => ({
+      ...form,
+      [field]: form[field].includes(value) ? form[field].filter((item) => item !== value) : [...form[field], value],
+    }));
+  };
+  const updateTransform = (field, index, key, value) => {
+    setGatewayForm((form) => ({
+      ...form,
+      [field]: form[field].map((rule, ruleIndex) => (ruleIndex === index ? { ...rule, [key]: value } : rule)),
+    }));
+  };
+  const addTransform = (field) => {
+    setGatewayForm((form) => ({ ...form, [field]: [...form[field], { from: '', to: '' }] }));
+  };
+  const removeTransform = (field, index) => {
+    setGatewayForm((form) => ({
+      ...form,
+      [field]: form[field].length > 1 ? form[field].filter((_, ruleIndex) => ruleIndex !== index) : [{ from: '', to: '' }],
+    }));
+  };
+  const updateForbiddenPeriod = (index, key, value) => {
+    setGatewayForm((form) => ({
+      ...form,
+      forbiddenPeriods: form.forbiddenPeriods.map((period, periodIndex) => (
+        periodIndex === index ? { ...period, [key]: value } : period
+      )),
+    }));
+  };
+  const addForbiddenPeriod = () => {
+    setGatewayForm((form) => ({ ...form, forbiddenPeriods: [...form.forbiddenPeriods, { start: '', end: '' }] }));
+  };
+  const removeForbiddenPeriod = (index) => {
+    setGatewayForm((form) => ({
+      ...form,
+      forbiddenPeriods: form.forbiddenPeriods.length > 1 ? form.forbiddenPeriods.filter((_, periodIndex) => periodIndex !== index) : [{ start: '', end: '' }],
+    }));
+  };
+  const toggleVendorGatewayStatus = (gateway) => {
+    setGatewayRows((rows) => rows.map((item) => (
+      item.id === gateway.id ? { ...item, status: item.status === '启用' ? '禁用' : '启用' } : item
+    )));
+  };
+
+  return (
+    <>
+      <PageTitle title="落地网关管理" desc="管理供应商落地网关认证、并发、价格和号码限制策略。" actions={<Button icon={<Icon type="plus" />}>新增落地网关</Button>} />
+      <Toolbar>
+        <Field label="供应商"><Select defaultValue="all"><option value="all">全部供应商</option>{vendors.map((vendor) => <option key={vendor.id}>{vendor.name}</option>)}</Select></Field>
+        <Field label="落地网关名称"><Input placeholder="搜索网关名称" /></Field>
+        <Button icon={<Icon type="search" />}>查询</Button>
+      </Toolbar>
+      <section className="content-grid">
+        <Panel title="落地网关列表" className="wide-panel">
+          <SimpleTable rows={gatewayRows} columns={[
+            { key: 'vendor', label: '供应商名称' },
+            { key: 'name', label: '落地网关名称' },
+            { key: 'authMode', label: '认证方式' },
+            { key: 'authTarget', label: 'IP/账号', render: (row) => (row.authMode === 'IP' ? row.ipAddress : row.sipAccount) },
+            { key: 'concurrencyLimit', label: '并发上限' },
+            { key: 'minuteRate', label: '价格', render: (row) => formatMinuteRate(row.billingCycle, row.cycleRate) },
+            { key: 'status', label: '状态', status: true },
+            {
+              key: 'actions',
+              label: '操作',
+              render: (row) => (
+                <div className="table-actions">
+                  <Button size="sm" variant="outline" onClick={() => openEditGateway(row)}>编辑</Button>
+                  <Button size="sm" variant={row.status === '启用' ? 'ghost' : 'secondary'} onClick={() => toggleVendorGatewayStatus(row)}>
+                    {row.status === '启用' ? '禁用' : '启用'}
+                  </Button>
+                </div>
+              ),
+            },
+          ]} />
+        </Panel>
+      </section>
+      {editingGateway ? (
+        <Modal title="编辑落地网关" onClose={closeEditGateway} size="lg">
+          <form className="modal-form" onSubmit={submitGateway}>
+            <div className="match-grid">
+              <Field label={<span>供应商名称 <span className="required-star">*</span></span>}>
+                <Select value={gatewayForm.vendor} onChange={(event) => setGatewayForm({ ...gatewayForm, vendor: event.target.value })} required>
+                  {vendors.map((vendor) => <option key={vendor.id}>{vendor.name}</option>)}
+                </Select>
+              </Field>
+              <Field label={<span>落地网关名称 <span className="required-star">*</span></span>}>
+                <Input value={gatewayForm.name} onChange={(event) => setGatewayForm({ ...gatewayForm, name: event.target.value })} placeholder="请输入落地网关名称" required />
+              </Field>
+              <Field label={<span>认证方式 <span className="required-star">*</span></span>}>
+                <Select value={gatewayForm.authMode} onChange={(event) => setGatewayForm({ ...gatewayForm, authMode: event.target.value, ipAddress: '', sipAccount: '', sipPassword: '' })} required>
+                  <option>IP</option>
+                  <option>SIP注册</option>
+                </Select>
+              </Field>
+              {gatewayForm.authMode === 'IP' ? (
+                <Field label={<span>IP地址 <span className="required-star">*</span></span>}>
+                  <Input value={gatewayForm.ipAddress} onChange={(event) => setGatewayForm({ ...gatewayForm, ipAddress: event.target.value })} placeholder="例如 203.0.113.18" required />
+                </Field>
+              ) : (
+                <>
+                  <Field label={<span>SIP账号 <span className="required-star">*</span></span>}>
+                    <Input value={gatewayForm.sipAccount} onChange={(event) => setGatewayForm({ ...gatewayForm, sipAccount: event.target.value })} placeholder="请输入 SIP 账号" required />
+                  </Field>
+                  <Field label={<span>SIP密码 <span className="required-star">*</span></span>}>
+                    <Input type="password" value={gatewayForm.sipPassword} onChange={(event) => setGatewayForm({ ...gatewayForm, sipPassword: event.target.value })} placeholder="请输入 SIP 密码" required />
+                  </Field>
+                </>
+              )}
+              <Field label={<span>并发上限 <span className="required-star">*</span></span>}>
+                <Input type="number" min="1" value={gatewayForm.concurrencyLimit} onChange={(event) => setGatewayForm({ ...gatewayForm, concurrencyLimit: event.target.value })} placeholder="例如 800" required />
+              </Field>
+              <div className="rate-config-card">
+                <div className="rate-config-head">
+                  <strong>费率配置</strong>
+                  <span>{formatMinuteRate(gatewayForm.billingCycle, gatewayForm.cycleRate)}</span>
+                </div>
+                <div className="rate-config-fields">
+                  <Field label={<span>计费周期 <span className="required-star">*</span></span>}>
+                    <Input type="number" min="1" max="60" value={gatewayForm.billingCycle} onChange={(event) => setGatewayForm({ ...gatewayForm, billingCycle: event.target.value })} placeholder="最大 60 秒" required />
+                  </Field>
+                  <Field label={<span>周期费率 <span className="required-star">*</span></span>}>
+                    <Input type="number" min="0" step="0.0001" value={gatewayForm.cycleRate} onChange={(event) => setGatewayForm({ ...gatewayForm, cycleRate: event.target.value })} placeholder="例如 0.02" required />
+                  </Field>
+                </div>
+              </div>
+              <div className="config-card">
+                <strong>请求速率</strong>
+                <Input value={gatewayForm.requestRate} onChange={(event) => setGatewayForm({ ...gatewayForm, requestRate: event.target.value })} placeholder="例如 120 CPS" />
+              </div>
+              <div className="config-card">
+                <strong>屏蔽省份</strong>
+                <div className="option-grid">
+                  {provinceOptions.map((province) => (
+                    <Checkbox key={province} label={province} checked={gatewayForm.blockedProvinces.includes(province)} onChange={() => toggleArrayValue('blockedProvinces', province)} />
+                  ))}
+                </div>
+              </div>
+              <div className="config-card">
+                <div className="config-card-head">
+                  <strong>禁呼时段</strong>
+                  <Button type="button" size="sm" variant="outline" onClick={addForbiddenPeriod}>添加时段</Button>
+                </div>
+                <div className="rule-list">
+                  {gatewayForm.forbiddenPeriods.map((period, index) => (
+                    <div className="time-range" key={`forbidden-${index}`}>
+                      <Input type="time" value={period.start} onChange={(event) => updateForbiddenPeriod(index, 'start', event.target.value)} />
+                      <span>至</span>
+                      <Input type="time" value={period.end} onChange={(event) => updateForbiddenPeriod(index, 'end', event.target.value)} />
+                      <Button type="button" size="sm" variant="ghost" onClick={() => removeForbiddenPeriod(index)}>删除</Button>
+                    </div>
+                  ))}
+                </div>
+              </div>
+              <div className="config-card">
+                <strong>语音编码限制</strong>
+                <div className="option-grid">
+                  {codecOptions.map((codec) => (
+                    <Checkbox key={codec} label={codec} checked={gatewayForm.codecs.includes(codec)} onChange={() => toggleArrayValue('codecs', codec)} />
+                  ))}
+                </div>
+              </div>
+              <div className="config-card config-card-wide">
+                <div className="config-card-head">
+                  <strong>被叫前缀转换</strong>
+                  <Button type="button" size="sm" variant="outline" onClick={() => addTransform('calleeTransforms')}>添加规则</Button>
+                </div>
+                <div className="rule-list">
+                  {gatewayForm.calleeTransforms.map((rule, index) => (
+                    <div className="prefix-rule" key={`callee-${index}`}>
+                      <Input value={rule.from} onChange={(event) => updateTransform('calleeTransforms', index, 'from', event.target.value)} placeholder="原前缀，如 00" />
+                      <span>转换为</span>
+                      <Input value={rule.to} onChange={(event) => updateTransform('calleeTransforms', index, 'to', event.target.value)} placeholder="目标前缀，如 011" />
+                      <Button type="button" size="sm" variant="ghost" onClick={() => removeTransform('calleeTransforms', index)}>删除</Button>
+                    </div>
+                  ))}
+                </div>
+              </div>
+              <div className="config-card config-card-wide">
+                <div className="config-card-head">
+                  <strong>主叫前缀转换</strong>
+                  <Button type="button" size="sm" variant="outline" onClick={() => addTransform('callerTransforms')}>添加规则</Button>
+                </div>
+                <div className="rule-list">
+                  {gatewayForm.callerTransforms.map((rule, index) => (
+                    <div className="prefix-rule" key={`caller-${index}`}>
+                      <Input value={rule.from} onChange={(event) => updateTransform('callerTransforms', index, 'from', event.target.value)} placeholder="原前缀，如 021" />
+                      <span>转换为</span>
+                      <Input value={rule.to} onChange={(event) => updateTransform('callerTransforms', index, 'to', event.target.value)} placeholder="目标前缀，如 8621" />
+                      <Button type="button" size="sm" variant="ghost" onClick={() => removeTransform('callerTransforms', index)}>删除</Button>
+                    </div>
+                  ))}
+                </div>
+              </div>
+            </div>
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={closeEditGateway}>取消</Button>
+              <Button type="submit">保存修改</Button>
+            </div>
+          </form>
+        </Modal>
+      ) : null}
+    </>
+  );
+}
+
+function VendorLineGroupsPage() {
+  const [lineGroupRows, setLineGroupRows] = useState(vendorLineGroups);
+  const [editingLineGroup, setEditingLineGroup] = useState(null);
+  const [lineGroupForm, setLineGroupForm] = useState({ name: '', gatewayIds: [] });
+  const [showAddGatewayModal, setShowAddGatewayModal] = useState(false);
+  const [addGatewayForm, setAddGatewayForm] = useState({ gatewayId: '' });
+  const findGateway = (gatewayId) => gateways.find((gateway) => gateway.id === gatewayId);
+  const getLineGroupConcurrency = (group) => group.gatewayIds.reduce((total, gatewayId) => total + (findGateway(gatewayId)?.concurrencyLimit || 0), 0);
+  const openEditLineGroup = (group) => {
+    setEditingLineGroup(group);
+    setLineGroupForm({ name: group.name, gatewayIds: [...group.gatewayIds] });
+    setShowAddGatewayModal(false);
+    setAddGatewayForm({ gatewayId: '' });
+  };
+  const closeEditLineGroup = () => {
+    setEditingLineGroup(null);
+    setLineGroupForm({ name: '', gatewayIds: [] });
+    setShowAddGatewayModal(false);
+    setAddGatewayForm({ gatewayId: '' });
+  };
+  const addGatewayToLineGroup = () => {
+    if (!addGatewayForm.gatewayId || lineGroupForm.gatewayIds.includes(addGatewayForm.gatewayId)) return;
+    setLineGroupForm((form) => ({ ...form, gatewayIds: [...form.gatewayIds, addGatewayForm.gatewayId] }));
+    setAddGatewayForm({ gatewayId: '' });
+    setShowAddGatewayModal(false);
+  };
+  const removeGatewayFromLineGroup = (gatewayId) => {
+    setLineGroupForm((form) => ({ ...form, gatewayIds: form.gatewayIds.filter((id) => id !== gatewayId) }));
+  };
+  const moveLineGroupGateway = (gatewayId, direction) => {
+    setLineGroupForm((form) => {
+      const ids = [...form.gatewayIds];
+      const currentIndex = ids.indexOf(gatewayId);
+      const nextIndex = currentIndex + direction;
+      if (currentIndex < 0 || nextIndex < 0 || nextIndex >= ids.length) return form;
+      [ids[currentIndex], ids[nextIndex]] = [ids[nextIndex], ids[currentIndex]];
+      return { ...form, gatewayIds: ids };
+    });
+  };
+  const submitLineGroup = (event) => {
+    event.preventDefault();
+    if (!editingLineGroup || !lineGroupForm.name.trim()) return;
+    setLineGroupRows((rows) => rows.map((group) => (
+      group.id === editingLineGroup.id ? { ...group, name: lineGroupForm.name.trim(), gatewayIds: lineGroupForm.gatewayIds } : group
+    )));
+    closeEditLineGroup();
+  };
+
+  return (
+    <>
+      <PageTitle title="落地线路组" desc="配置落地线路组、组内线路优先级和汇总并发上限。" actions={<Button icon={<Icon type="plus" />}>新增线路组</Button>} />
+      <Toolbar>
+        <Field label="线路组名称"><Input placeholder="搜索线路组名称" /></Field>
+        <Button icon={<Icon type="search" />}>查询</Button>
+      </Toolbar>
+      <section className="content-grid">
+        <Panel title="落地线路组列表" className="wide-panel">
+          <SimpleTable rows={lineGroupRows} columns={[
+            { key: 'name', label: '名称' },
+            { key: 'lineCount', label: '线路数量', render: (row) => row.gatewayIds.length },
+            { key: 'concurrencyLimit', label: '并发上限', render: (row) => getLineGroupConcurrency(row) },
+            {
+              key: 'actions',
+              label: '操作',
+              render: (row) => (
+                <div className="table-actions">
+                  <Button size="sm" variant="outline" onClick={() => openEditLineGroup(row)}>编辑</Button>
+                </div>
+              ),
+            },
+          ]} />
+        </Panel>
+      </section>
+      {editingLineGroup ? (
+        <Drawer title="编辑落地线路组" aside={<Badge tone="info">{editingLineGroup.id}</Badge>} onClose={closeEditLineGroup}>
+          <form className="modal-form" onSubmit={submitLineGroup}>
+            <Field label={<span>线路组名称 <span className="required-star">*</span></span>}>
+              <Input value={lineGroupForm.name} onChange={(event) => setLineGroupForm({ ...lineGroupForm, name: event.target.value })} placeholder="请输入线路组名称" required />
+            </Field>
+            <div className="drawer-toolbar">
+              <div>
+                <strong>{lineGroupForm.gatewayIds.length} 条线路</strong>
+                <span>按优先级从小到大尝试落地网关。</span>
+              </div>
+              <Button type="button" icon={<Icon type="plus" />} onClick={() => setShowAddGatewayModal(true)}>添加网关</Button>
+            </div>
+            <SimpleTable rows={lineGroupForm.gatewayIds.map((gatewayId, index) => {
+              const gateway = findGateway(gatewayId);
+              return {
+                id: gatewayId,
+                priority: index + 1,
+                vendor: gateway?.vendor || '-',
+                name: gateway?.name || gatewayId,
+                concurrencyLimit: gateway?.concurrencyLimit || 0,
+              };
+            })} columns={[
+              { key: 'priority', label: '优先级' },
+              { key: 'vendor', label: '供应商' },
+              { key: 'name', label: '落地网关' },
+              { key: 'concurrencyLimit', label: '并发上限' },
+              {
+                key: 'actions',
+                label: '操作',
+                render: (row) => (
+                  <div className="table-actions">
+                    <Button type="button" size="sm" variant="outline" onClick={() => moveLineGroupGateway(row.id, -1)}>上移</Button>
+                    <Button type="button" size="sm" variant="outline" onClick={() => moveLineGroupGateway(row.id, 1)}>下移</Button>
+                    <Button type="button" size="sm" variant="ghost" onClick={() => removeGatewayFromLineGroup(row.id)}>删除</Button>
+                  </div>
+                ),
+              },
+            ]} />
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={closeEditLineGroup}>取消</Button>
+              <Button type="submit">保存线路组</Button>
+            </div>
+          </form>
+        </Drawer>
+      ) : null}
+      {showAddGatewayModal ? (
+        <Modal title="添加落地网关" onClose={() => setShowAddGatewayModal(false)} size="sm">
+          <form className="modal-form" onSubmit={(event) => { event.preventDefault(); addGatewayToLineGroup(); }}>
+            <Field label={<span>落地网关 <span className="required-star">*</span></span>}>
+              <Select value={addGatewayForm.gatewayId} onChange={(event) => setAddGatewayForm({ gatewayId: event.target.value })} required>
+                <option value="">请选择落地网关</option>
+                {gateways
+                  .filter((gateway) => !lineGroupForm.gatewayIds.includes(gateway.id))
+                  .map((gateway) => <option key={gateway.id} value={gateway.id}>{gateway.vendor} / {gateway.name}</option>)}
+              </Select>
+            </Field>
+            <div className="modal-actions">
+              <Button type="button" variant="outline" onClick={() => setShowAddGatewayModal(false)}>取消</Button>
+              <Button type="submit">确认添加</Button>
+            </div>
+          </form>
+        </Modal>
+      ) : null}
+    </>
+  );
+}
+
+function RoutesPage() {
+  return (
+    <>
+      <PageTitle title="线路与路由" desc="线路组、客户网关业务分流、供应商网关映射、失败重试策略、号码前缀和生效时段。" actions={<Button icon={<Icon type="reload" />}>模拟 dr_reload</Button>} />
+      <section className="content-grid">
+        <Panel title="线路组" className="wide-panel">
+          <SimpleTable rows={routeGroups} columns={[
+            { key: 'id', label: '线路组 ID' },
+            { key: 'name', label: '线路组名称' },
+            { key: 'customers', label: '适用客户' },
+            { key: 'gateways', label: '网关列表' },
+            { key: 'strategy', label: '路由策略' },
+            { key: 'retry', label: '失败重试策略' },
+            { key: 'status', label: '状态', status: true },
+          ]} />
+        </Panel>
+        <Panel title="路由规则" className="wide-panel" aside={<Badge tone="info">dr_rules / dialplan</Badge>}>
+          <SimpleTable rows={routeRules} columns={[
+            { key: 'id', label: '规则 ID' },
+            { key: 'customer', label: '客户' },
+            { key: 'prefix', label: '号码前缀' },
+            { key: 'routeGroup', label: '线路组' },
+            { key: 'priority', label: '优先级' },
+            { key: 'window', label: '生效时间' },
+            { key: 'status', label: '状态', status: true },
+            { key: 'remark', label: '备注' },
+          ]} />
+        </Panel>
+        <Panel title="客户网关业务分流" className="wide-panel">
+          <SimpleTable rows={customerGatewayPolicies} columns={[
+            { key: 'gateway', label: '客户网关' },
+            { key: 'name', label: '策略名称' },
+            { key: 'callerMatch', label: '主叫匹配', render: (row) => row.callerMode === 'any' ? '不限' : `${row.callerMode === 'equals' ? '等于' : '前缀'} ${row.callerValue}` },
+            { key: 'calleeMatch', label: '被叫匹配', render: (row) => row.calleeMode === 'any' ? '不限' : `${row.calleeMode === 'equals' ? '等于' : '前缀'} ${row.calleeValue}` },
+            { key: 'routeGroup', label: '呼叫至线路群组' },
+            { key: 'priority', label: '优先级' },
+            { key: 'status', label: '状态', status: true },
+          ]} />
+        </Panel>
+        <Panel title="供应商网关业务匹配" className="wide-panel">
+          <SimpleTable rows={vendorGatewayPolicies} columns={[
+            { key: 'vendor', label: '供应商' },
+            { key: 'gateway', label: '供应商网关' },
+            { key: 'caller', label: '主叫号码/号段' },
+            { key: 'calleePrefix', label: '被叫前缀' },
+            { key: 'business', label: '成本业务' },
+            { key: 'vendorRate', label: '供应商费率' },
+            { key: 'priority', label: '优先级' },
+            { key: 'status', label: '状态', status: true },
+          ]} />
+        </Panel>
+      </section>
+    </>
+  );
+}
+
+function BillingPage() {
+  return (
+    <>
+      <PageTitle title="费率与计费" desc="客户费率、供应商费率、按业务映射匹配和 Billing Worker 计费链路。" actions={<Button icon={<Icon type="plus" />}>新增费率</Button>} />
+      <section className="content-grid">
+        <Panel title="客户/供应商费率" className="wide-panel">
+          <SimpleTable rows={rates} columns={[
+            { key: 'type', label: '类型' },
+            { key: 'owner', label: '客户/供应商' },
+            { key: 'business', label: '业务名称' },
+            { key: 'gateway', label: '网关' },
+            { key: 'caller', label: '主叫号码/号段' },
+            { key: 'region', label: '国家/地区' },
+            { key: 'prefix', label: '号码前缀' },
+            { key: 'price', label: '单价' },
+            { key: 'cycle', label: '计费周期' },
+            { key: 'first', label: '首周期' },
+            { key: 'start', label: '生效时间' },
+            { key: 'end', label: '失效时间' },
+          ]} />
+        </Panel>
+        <Panel title="计费匹配维度">
+          <div className="flow">
+            {['客户', '客户网关', '来源 IP', '被叫前缀', '主叫号码', '业务类型', '供应商网关'].map((step) => <span key={step}>{step}</span>)}
+          </div>
+          <Alert title="计费说明">客户侧按客户网关 + 来源 IP + 被叫前缀匹配业务与费率；供应商侧按供应商网关 + 被叫前缀或主叫号码匹配成本费率。</Alert>
+        </Panel>
+        <Panel title="Billing Worker 流程">
+          <div className="flow">
+            {['读取未计费 CDR', '识别客户业务', '匹配客户费率', '匹配供应商业务', '匹配供应商费率', '计算费用/成本/毛利', '写入已计费话单', '更新余额/授信'].map((step) => <span key={step}>{step}</span>)}
+          </div>
+          <div className="formula">计费秒数 = ceil(实际通话秒数 / 计费周期) * 计费周期</div>
+        </Panel>
+        <Panel title="Worker 队列">
+          <KeyValue label="未计费 CDR" value="1,284 条" />
+          <Progress value={64} />
+          <KeyValue label="最近计费时间" value="2026-06-15 10:31:52" />
+          <KeyValue label="失败重试" value="12 条" />
+        </Panel>
+        <Panel title="预付费余额实时控制">
+          <div className="balance-control">
+            <KeyValue label="呼叫前检查" value="客户状态、余额、授信、外呼时段" />
+            <KeyValue label="通话中占用" value="按最大可通话时长冻结余额" />
+            <KeyValue label="计费后更新" value="扣减余额或更新授信占用" />
+            <Progress value={72} />
+          </div>
+        </Panel>
+      </section>
+    </>
+  );
+}
+
+function CdrPage() {
+  const [detailCdr, setDetailCdr] = useState(null);
+  const getCustomerGatewayName = (gatewayId) => customerGateways.find((gateway) => gateway.id === gatewayId)?.name || gatewayId;
+  const getVendorGateway = (gatewayId) => gateways.find((gateway) => gateway.id === gatewayId) || {
+    id: gatewayId,
+    name: gatewayId === 'GW-C-01' ? '国际直拨落地' : gatewayId,
+    ipAddress: gatewayId === 'GW-C-01' ? '203.0.113.88' : '-',
+  };
+  const getRatedCdr = (callId) => ratedCdrs.find((item) => callId.includes(item.raw)) || {};
+  const formatDuration = (seconds) => {
+    const value = Number(seconds) || 0;
+    const minutes = Math.floor(value / 60);
+    const remainSeconds = value % 60;
+    return `${String(minutes).padStart(2, '0')}:${String(remainSeconds).padStart(2, '0')}`;
+  };
+  const cdrRows = cdrs.map((cdr) => {
+    const vendorGateway = getVendorGateway(cdr.gateway);
+    const rated = getRatedCdr(cdr.callId);
+    return {
+      ...cdr,
+      customerGatewayName: getCustomerGatewayName(cdr.customerGateway),
+      callIp: cdr.sourceIp,
+      vendorGatewayName: vendorGateway.name,
+      lineIp: vendorGateway.ipAddress || vendorGateway.address || '-',
+      callTime: cdr.started,
+      connectedTime: cdr.answered,
+      endTime: cdr.ended,
+      durationText: formatDuration(cdr.duration),
+      customerFee: rated.fee || '¥0.0000',
+      costFee: rated.cost || '¥0.0000',
+    };
+  });
+
+  return (
+    <>
+      <PageTitle title="话单中心" desc="查询客户网关到落地网关的通话记录、费用、录音与信令详情。" actions={<Button variant="secondary" icon={<Icon type="export" />}>导出 CSV</Button>} />
+      <Toolbar>
+        <Field label="主叫号码"><Input placeholder="输入主叫号码" /></Field>
+        <Field label="被叫号码"><Input placeholder="输入被叫号码" /></Field>
+        <Field label="客户网关"><Select><option>全部客户网关</option>{customerGateways.map((gateway) => <option key={gateway.id}>{gateway.name}</option>)}</Select></Field>
+        <Button icon={<Icon type="search" />}>查询</Button>
+      </Toolbar>
+      <Panel title="话单列表" className="wide-panel">
+        <SimpleTable rows={cdrRows} columns={[
+          { key: 'caller', label: '主叫号码' },
+          { key: 'callee', label: '被叫号码' },
+          { key: 'customerGatewayName', label: '客户网关名称' },
+          { key: 'callIp', label: '呼叫IP地址' },
+          { key: 'vendorGatewayName', label: '落地网关名称' },
+          { key: 'lineIp', label: '线路IP地址' },
+          { key: 'callTime', label: '呼叫时间' },
+          { key: 'durationText', label: '通话时长' },
+          { key: 'hangupReason', label: '挂断原因' },
+          {
+            key: 'actions',
+            label: '操作',
+            render: (row) => (
+              <div className="table-actions">
+                <Button size="sm" variant="outline" onClick={() => setDetailCdr(row)}>查看详情</Button>
+              </div>
+            ),
+          },
+        ]} />
+      </Panel>
+      {detailCdr ? (
+        <Drawer title="话单详情" aside={<Badge tone="info">{detailCdr.callId}</Badge>} onClose={() => setDetailCdr(null)}>
+          <div className="detail-stack">
+            <KeyValue label="主叫号码" value={detailCdr.caller} />
+            <KeyValue label="被叫号码" value={detailCdr.callee} />
+            <KeyValue label="客户网关名称" value={detailCdr.customerGatewayName} />
+            <KeyValue label="呼叫IP地址" value={detailCdr.callIp} />
+            <KeyValue label="落地网关名称" value={detailCdr.vendorGatewayName} />
+            <KeyValue label="线路IP地址" value={detailCdr.lineIp} />
+            <KeyValue label="呼叫时间" value={detailCdr.callTime} />
+            <KeyValue label="接通时间" value={detailCdr.connectedTime} />
+            <KeyValue label="结束时间" value={detailCdr.endTime} />
+            <KeyValue label="通话时长" value={detailCdr.durationText} />
+            <KeyValue label="挂断原因" value={detailCdr.hangupReason} />
+            <KeyValue label="客户费用" value={detailCdr.customerFee} />
+            <KeyValue label="成本费用" value={detailCdr.costFee} />
+          </div>
+          <div className="drawer-toolbar">
+            <div>
+              <strong>录音与信令</strong>
+              <span>用于通话质检、投诉核查和 SIP 排障。</span>
+            </div>
+            <div className="table-actions">
+              <Button variant="secondary">录音播放</Button>
+              <Button variant="outline">信令查看</Button>
+            </div>
+          </div>
+        </Drawer>
+      ) : null}
+    </>
+  );
+}
+
+const emptySamplingRuleForm = { name: '', customer: '', ratio: 5, route: '', start: '2026-06-20', status: '启用' };
+
+function QualityPage() {
+  const [ruleRows, setRuleRows] = useState(samplingRules);
+  const [recordingRows, setRecordingRows] = useState(recordings);
+  const [showRules, setShowRules] = useState(false);
+  const [editingRule, setEditingRule] = useState(undefined);
+  const [ruleForm, setRuleForm] = useState(emptySamplingRuleForm);
+  const [deleteRuleTarget, setDeleteRuleTarget] = useState(null);
+  const [detailRecording, setDetailRecording] = useState(null);
+  const [reviewForm, setReviewForm] = useState({ issue: '', score: '90' });
+  const [isPlaying, setIsPlaying] = useState(false);
+  const [autoPlay, setAutoPlay] = useState(false);
+  const [playbackProgress, setPlaybackProgress] = useState(0);
+  const [saveFeedback, setSaveFeedback] = useState('');
+  const detailRecordingIndex = detailRecording ? recordingRows.findIndex((recording) => recording.callId === detailRecording.callId) : -1;
+  useEffect(() => {
+    if (!isPlaying || !detailRecording) return undefined;
+    const timer = window.setInterval(() => setPlaybackProgress((progress) => Math.min(100, progress + 5)), 120);
+    return () => window.clearInterval(timer);
+  }, [detailRecording?.callId, isPlaying]);
+  useEffect(() => {
+    if (playbackProgress < 100 || !detailRecording) return;
+    if (autoPlay && detailRecordingIndex < recordingRows.length - 1) {
+      const nextRecording = recordingRows[detailRecordingIndex + 1];
+      setDetailRecording(nextRecording);
+      setReviewForm({ issue: nextRecording.issue || '', score: nextRecording.score === '-' ? '90' : nextRecording.score });
+      setPlaybackProgress(0);
+      setSaveFeedback('');
+      return;
+    }
+    setIsPlaying(false);
+  }, [autoPlay, detailRecording, detailRecordingIndex, playbackProgress, recordingRows]);
+  const openCreateRule = () => {
+    setEditingRule(null);
+    setRuleForm({ ...emptySamplingRuleForm, customer: customers[0].name, route: routeGroups[0].name });
+  };
+  const openEditRule = (rule) => {
+    setEditingRule(rule);
+    setRuleForm({ name: rule.name, customer: rule.customer, ratio: rule.ratio, route: rule.route, start: rule.start, status: rule.status });
+  };
+  const closeRuleModal = () => {
+    setEditingRule(undefined);
+    setRuleForm(emptySamplingRuleForm);
+  };
+  const submitRule = (event) => {
+    event.preventDefault();
+    if (!ruleForm.name.trim() || !ruleForm.customer || !ruleForm.route) return;
+    if (editingRule) {
+      setRuleRows((rows) => rows.map((rule) => rule.id === editingRule.id ? { ...rule, ...ruleForm, ratio: Number(ruleForm.ratio) } : rule));
+    } else {
+      setRuleRows((rows) => {
+        const nextNumber = Math.max(0, ...rows.map((rule) => Number(rule.id.replace('QR-', '')) || 0)) + 1;
+        return [...rows, { id: `QR-${String(nextNumber).padStart(3, '0')}`, ...ruleForm, ratio: Number(ruleForm.ratio) }];
+      });
+    }
+    closeRuleModal();
+  };
+  const toggleRuleStatus = (rule) => {
+    setRuleRows((rows) => rows.map((item) => item.id === rule.id ? { ...item, status: item.status === '启用' ? '禁用' : '启用' } : item));
+  };
+  const deleteRule = () => {
+    setRuleRows((rows) => rows.filter((rule) => rule.id !== deleteRuleTarget.id));
+    setDeleteRuleTarget(null);
+  };
+  const openRecordingDetail = (recording) => {
+    setDetailRecording(recording);
+    setReviewForm({ issue: recording.issue || '', score: recording.score === '-' ? '90' : recording.score });
+    setIsPlaying(false);
+    setAutoPlay(false);
+    setPlaybackProgress(0);
+    setSaveFeedback('');
+  };
+  const closeRecordingDetail = () => {
+    setDetailRecording(null);
+    setIsPlaying(false);
+    setPlaybackProgress(0);
+    setSaveFeedback('');
+  };
+  const navigateRecording = (direction) => {
+    const nextIndex = detailRecordingIndex + direction;
+    if (nextIndex < 0 || nextIndex >= recordingRows.length) return;
+    const nextRecording = recordingRows[nextIndex];
+    setDetailRecording(nextRecording);
+    setReviewForm({ issue: nextRecording.issue || '', score: nextRecording.score === '-' ? '90' : nextRecording.score });
+    setIsPlaying(false);
+    setPlaybackProgress(0);
+    setSaveFeedback('');
+  };
+  const togglePlayback = () => {
+    if (!isPlaying && playbackProgress >= 100) setPlaybackProgress(0);
+    setIsPlaying((playing) => !playing);
+  };
+  const saveRecordingReview = () => {
+    const updatedRecording = { ...detailRecording, issue: reviewForm.issue, score: reviewForm.score || '-', review: '已完成' };
+    setRecordingRows((rows) => rows.map((recording) => recording.callId === detailRecording.callId ? updatedRecording : recording));
+    setDetailRecording(updatedRecording);
+    setSaveFeedback('质检结果已保存，可继续试听或切换其他录音。');
+  };
+
+  return (
+    <>
+      <PageTitle
+        title="质检中心"
+        desc="集中查看录音、完成试听、问题标注和人工质检评分。"
+        actions={<Button variant="outline" onClick={() => setShowRules(true)}>抽检规则</Button>}
+      />
+      <Panel title="录音列表" aside={<Badge tone="neutral">共 {recordingRows.length} 条录音</Badge>} className="wide-panel">
+        <SimpleTable rows={recordingRows} columns={[
+          { key: 'callId', label: 'Call-ID' },
+          { key: 'customer', label: '客户' },
+          { key: 'caller', label: '主叫' },
+          { key: 'callee', label: '被叫' },
+          { key: 'business', label: '业务' },
+          { key: 'time', label: '通话时间' },
+          { key: 'duration', label: '时长' },
+          { key: 'review', label: '质检状态', status: true },
+          { key: 'actions', label: '操作', render: (row) => <Button size="sm" variant="outline" onClick={() => openRecordingDetail(row)}>录音详情</Button> },
+        ]} />
+      </Panel>
+
+      {showRules ? (
+        <Drawer title="抽检规则" aside={<Badge tone="info">{ruleRows.length} 条规则</Badge>} onClose={() => setShowRules(false)}>
+          <div className="drawer-toolbar">
+            <div><strong>规则管理</strong><span>按客户和线路设置录音抽检比例。</span></div>
+            <Button icon={<Icon type="plus" />} onClick={openCreateRule}>新增抽检规则</Button>
+          </div>
+          <SimpleTable rows={ruleRows} columns={[
+            { key: 'name', label: '规则名称' },
+            { key: 'customer', label: '客户' },
+            { key: 'ratio', label: '抽检比例', render: (row) => `${row.ratio}%` },
+            { key: 'route', label: '指定线路' },
+            { key: 'start', label: '生效时间' },
+            { key: 'status', label: '状态', status: true },
+            { key: 'actions', label: '操作', render: (row) => <div className="table-actions"><Button size="sm" variant="outline" onClick={() => openEditRule(row)}>编辑</Button><Button size="sm" variant={row.status === '启用' ? 'ghost' : 'secondary'} onClick={() => toggleRuleStatus(row)}>{row.status === '启用' ? '禁用' : '启用'}</Button><Button size="sm" variant="ghost" onClick={() => setDeleteRuleTarget(row)}>删除</Button></div> },
+          ]} />
+        </Drawer>
+      ) : null}
+
+      {editingRule !== undefined ? (
+        <Modal title={editingRule ? '编辑抽检规则' : '新增抽检规则'} onClose={closeRuleModal}>
+          <form className="modal-form" onSubmit={submitRule}>
+            <div className="form-grid admin-form-grid">
+              <Field label={<span>规则名称 <span className="required-star">*</span></span>}><Input value={ruleForm.name} onChange={(event) => setRuleForm({ ...ruleForm, name: event.target.value })} placeholder="请输入规则名称" required /></Field>
+              <Field label={<span>客户 <span className="required-star">*</span></span>}><Select value={ruleForm.customer} onChange={(event) => setRuleForm({ ...ruleForm, customer: event.target.value })} required>{customers.map((customer) => <option key={customer.id} value={customer.name}>{customer.name}</option>)}</Select></Field>
+              <Field label={<span>抽检比例（%） <span className="required-star">*</span></span>}><Input type="number" min="1" max="100" value={ruleForm.ratio} onChange={(event) => setRuleForm({ ...ruleForm, ratio: event.target.value })} required /></Field>
+              <Field label={<span>指定线路 <span className="required-star">*</span></span>}><Select value={ruleForm.route} onChange={(event) => setRuleForm({ ...ruleForm, route: event.target.value })} required>{routeGroups.map((group) => <option key={group.id} value={group.name}>{group.name}</option>)}</Select></Field>
+              <Field label="生效时间"><Input type="date" value={ruleForm.start} onChange={(event) => setRuleForm({ ...ruleForm, start: event.target.value })} /></Field>
+              <Field label="状态"><Select value={ruleForm.status} onChange={(event) => setRuleForm({ ...ruleForm, status: event.target.value })}><option value="启用">启用</option><option value="禁用">禁用</option></Select></Field>
+            </div>
+            <div className="modal-actions"><Button type="button" variant="outline" onClick={closeRuleModal}>取消</Button><Button type="submit">{editingRule ? '保存修改' : '保存规则'}</Button></div>
+          </form>
+        </Modal>
+      ) : null}
+
+      {deleteRuleTarget ? (
+        <Modal title="确认删除抽检规则" onClose={() => setDeleteRuleTarget(null)} size="sm">
+          <div className="confirm-copy"><p>确认删除规则「{deleteRuleTarget.name}」吗？删除后该规则将不再参与后续录音抽检。</p></div>
+          <div className="modal-actions"><Button variant="outline" onClick={() => setDeleteRuleTarget(null)}>取消</Button><Button variant="danger" onClick={deleteRule}>确认删除</Button></div>
+        </Modal>
+      ) : null}
+
+      {detailRecording ? (
+        <Drawer title="录音详情" aside={<StatusBadge>{detailRecording.review}</StatusBadge>} onClose={closeRecordingDetail}>
+          <div className="drawer-toolbar">
+            <div><strong>录音导航</strong><span>第 {detailRecordingIndex + 1} 条，共 {recordingRows.length} 条</span></div>
+            <div className="table-actions"><Button variant="outline" disabled={detailRecordingIndex <= 0} onClick={() => navigateRecording(-1)}>上一个</Button><Button variant="outline" disabled={detailRecordingIndex >= recordingRows.length - 1} onClick={() => navigateRecording(1)}>下一个</Button></div>
+          </div>
+          <div className="detail-stack">
+            <KeyValue label="Call-ID" value={detailRecording.callId} />
+            <KeyValue label="客户" value={detailRecording.customer} />
+            <KeyValue label="主叫号码" value={detailRecording.caller} />
+            <KeyValue label="被叫号码" value={detailRecording.callee} />
+            <KeyValue label="业务" value={detailRecording.business} />
+            <KeyValue label="通话时间" value={detailRecording.time} />
+            <KeyValue label="录音时长" value={detailRecording.duration} />
+          </div>
+          <div className="audio-bar"><span style={{ background: `linear-gradient(90deg, var(--selected) ${playbackProgress}%, #dfe3ec ${playbackProgress}%)` }} /> <strong>{detailRecording.file}</strong></div>
+          <div className="drawer-toolbar"><div><strong>录音试听</strong><span>{isPlaying ? `正在播放 ${playbackProgress}%` : playbackProgress >= 100 ? '播放完成' : '用于人工抽检、申诉复核和服务质量核查。'}</span></div><div className="table-actions"><Button variant="secondary" onClick={togglePlayback}>{isPlaying ? '暂停播放' : '播放录音'}</Button><Button variant={autoPlay ? 'secondary' : 'outline'} onClick={() => setAutoPlay((enabled) => !enabled)}>自动播放：{autoPlay ? '开' : '关'}</Button></div></div>
+          <Field label="问题标注"><Textarea rows="4" value={reviewForm.issue} onChange={(event) => setReviewForm({ ...reviewForm, issue: event.target.value })} placeholder="标注关键词、服务态度、合规风险" /></Field>
+          <Field label="评分"><Input type="number" min="0" max="100" value={reviewForm.score} onChange={(event) => setReviewForm({ ...reviewForm, score: event.target.value })} /></Field>
+          {saveFeedback ? <Alert title="保存成功" tone="success">{saveFeedback}</Alert> : null}
+          <div className="drawer-actions"><Button variant="outline" onClick={closeRecordingDetail}>关闭</Button><Button onClick={saveRecordingReview}>保存质检结果</Button></div>
+        </Drawer>
+      ) : null}
+    </>
+  );
+}
+
+function SipOpsPage() {
+  return (
+    <>
+      <PageTitle title="SIP 运维" desc="面向技术运维的在线注册、在线通话、SIP Trace、网关状态和 RTPEngine 状态原型。" actions={<Button icon={<Icon type="reload" />}>刷新 MI 状态</Button>} />
+      <section className="content-grid">
+        <Panel title="在线注册" className="wide-panel" aside={<Badge tone="info">usrloc</Badge>}>
+          <SimpleTable rows={sipAccounts} columns={[{ key: 'user', label: '账号' }, { key: 'domain', label: 'Domain' }, { key: 'register', label: '注册状态', status: true }, { key: 'contact', label: 'Contact' }, { key: 'expires', label: 'Expires' }]} />
+        </Panel>
+        <Panel title="运行检查">
+          {opsItems.slice(0, 3).map((item) => (
+            <div className="ops-row" key={item.name}><div><strong>{item.name}</strong><span>{item.target}</span></div><StatusBadge>{item.status}</StatusBadge></div>
+          ))}
+        </Panel>
+        <Panel title="SIP Trace 摘要">
+          <pre className="trace-box">{'INVITE sip:13800138000@carrier.example SIP/2.0\n100 Trying\n183 Session Progress\n200 OK\nACK\nBYE\n200 OK'}</pre>
+        </Panel>
+      </section>
+    </>
+  );
+}
+
+function MonitoringPage() {
+  return (
+    <>
+      <PageTitle title="监控告警" desc="OpenSIPS、RTPEngine、端口监听、CDR 堆积、计费队列、录音入库和磁盘空间。" actions={<Button>新增告警规则</Button>} />
+      <section className="content-grid">
+        <Panel title="监控项" className="wide-panel">
+          <SimpleTable rows={opsItems} columns={[{ key: 'name', label: '监控项' }, { key: 'target', label: '目标' }, { key: 'status', label: '状态', status: true }, { key: 'value', label: '当前值' }]} />
+        </Panel>
+        <Panel title="告警方式">
+          <div className="setting-list">
+            <Checkbox label="邮件" checked readOnly />
+            <Checkbox label="企业微信/钉钉/飞书" checked readOnly />
+            <Checkbox label="短信" checked={false} readOnly />
+          </div>
+        </Panel>
+        <Panel title="推荐工具">
+          <div className="tag-cloud">{['Prometheus', 'Grafana', 'Loki', 'ELK', 'Alertmanager', 'Monit'].map((tag) => <Badge key={tag} tone="brand">{tag}</Badge>)}</div>
+        </Panel>
+      </section>
+    </>
+  );
+}
+
+function SettingsPage() {
+  return (
+    <>
+      <PageTitle title="系统设置" desc="SIP 域名、监听地址、MI 连接、RTPEngine、录音存储和全局计费参数。" actions={<Button>保存配置</Button>} />
+      <section className="settings-grid">
+        <Panel title="SIP 与 MI">
+          <Field label="默认 SIP 域名"><Input defaultValue="voice.example.net" /></Field>
+          <Field label="监听地址"><Input defaultValue="udp:0.0.0.0:5060" /></Field>
+          <Field label="MI 连接配置"><Input defaultValue="http://10.0.2.11:8080/mi" /></Field>
+        </Panel>
+        <Panel title="媒体与录音">
+          <Field label="RTPEngine 节点"><Input defaultValue="udp:10.0.2.21:2223" /></Field>
+          <Field label="录音存储"><Input defaultValue="s3://softswitch-recordings" /></Field>
+          <Field label="录音保留策略"><Select defaultValue="180"><option value="30">30 天</option><option value="90">90 天</option><option value="180">180 天</option></Select></Field>
+        </Panel>
+        <Panel title="全局策略">
+          <Switch label="启用预付费余额控制" checked readOnly />
+          <Switch label="启用页面试听录音" checked readOnly />
+          <Switch label="启用操作审计" checked readOnly />
+          <Field label="默认时区"><Input defaultValue="Asia/Shanghai" /></Field>
+          <Field label="时间格式"><Input defaultValue="YYYY-MM-DD HH:mm:ss" /></Field>
+        </Panel>
+        <Panel title="安全策略">
+          <Switch label="强制 MFA" checked={false} readOnly />
+          <Switch label="敏感操作二次确认" checked readOnly />
+          <Field label="会话超时"><Input defaultValue="30 分钟" /></Field>
+          <Field label="导出水印"><Input defaultValue="用户 + 时间 + IP" /></Field>
+        </Panel>
+      </section>
+    </>
+  );
+}
+
+const emptyUserForm = { username: '', name: '', phone: '', email: '', roleId: 'R002', status: '启用' };
+const emptyRoleForm = { name: '', description: '', status: '启用' };
+
+function UsersPage({ userRows, setUserRows, roleRows, apiLoading, apiError, refreshApi }) {
+  const [keyword, setKeyword] = useState('');
+  const [roleFilter, setRoleFilter] = useState('all');
+  const [statusFilter, setStatusFilter] = useState('all');
+  const [editingUser, setEditingUser] = useState(undefined);
+  const [userForm, setUserForm] = useState(emptyUserForm);
+  const [resetTarget, setResetTarget] = useState(null);
+  const [resetMessage, setResetMessage] = useState('');
+  const roleMap = useMemo(() => new Map(roleRows.map((role) => [role.id, role.name])), [roleRows]);
+  const visibleUsers = useMemo(() => {
+    const normalized = keyword.trim().toLowerCase();
+    return userRows.filter((user) => {
+      const matchesKeyword = !normalized || [user.username, user.name, user.phone, user.email].some((value) => value.toLowerCase().includes(normalized));
+      return matchesKeyword && (roleFilter === 'all' || user.roleId === roleFilter) && (statusFilter === 'all' || user.status === statusFilter);
+    });
+  }, [keyword, roleFilter, statusFilter, userRows]);
+  const openCreateUser = () => {
+    setEditingUser(null);
+    setUserForm(emptyUserForm);
+  };
+  const openEditUser = (user) => {
+    setEditingUser(user);
+    setUserForm({ username: user.username, name: user.name, phone: user.phone, email: user.email, roleId: user.roleId, status: user.status });
+  };
+  const closeUserModal = () => {
+    setEditingUser(undefined);
+    setUserForm(emptyUserForm);
+  };
+  const submitUser = (event) => {
+    event.preventDefault();
+    if (!userForm.username.trim() || !userForm.name.trim() || !userForm.roleId) return;
+    if (editingUser) {
+      setUserRows((rows) => rows.map((user) => user.id === editingUser.id ? { ...user, ...userForm } : user));
+    } else {
+      const nextId = `U${String(1001 + userRows.length).padStart(4, '0')}`;
+      setUserRows((rows) => [...rows, { id: nextId, ...userForm, lastLogin: '从未登录', lastIp: '-' }]);
+    }
+    closeUserModal();
+  };
+  const toggleUserStatus = (user) => {
+    setUserRows((rows) => rows.map((item) => item.id === user.id ? { ...item, status: item.status === '启用' ? '禁用' : '启用' } : item));
+  };
+  const confirmResetPassword = () => {
+    setResetMessage(`${resetTarget.name}（${resetTarget.username}）的密码已重置，下次登录需修改密码。`);
+    setResetTarget(null);
+  };
+
+  return (
+    <>
+      <PageTitle title="用户管理" desc="管理运营端登录用户、所属角色、账号状态和登录安全。" actions={<Button icon={<Icon type="plus" />} onClick={openCreateUser}>新增用户</Button>} />
+      <ApiNotice loading={apiLoading} error={apiError} onRetry={refreshApi} />
+      {resetMessage ? <Alert title="密码重置完成" tone="success">{resetMessage}</Alert> : null}
+      <Toolbar>
+        <Field label="用户信息"><Input value={keyword} onChange={(event) => setKeyword(event.target.value)} placeholder="用户名、姓名、手机号或邮箱" /></Field>
+        <Field label="角色"><Select value={roleFilter} onChange={(event) => setRoleFilter(event.target.value)}><option value="all">全部角色</option>{roleRows.map((role) => <option key={role.id} value={role.id}>{role.name}</option>)}</Select></Field>
+        <Field label="状态"><Select value={statusFilter} onChange={(event) => setStatusFilter(event.target.value)}><option value="all">全部状态</option><option value="启用">启用</option><option value="禁用">禁用</option></Select></Field>
+        <Button variant="outline" onClick={() => { setKeyword(''); setRoleFilter('all'); setStatusFilter('all'); }}>重置</Button>
+      </Toolbar>
+      <Panel title="用户列表" aside={<Badge tone="neutral">共 {visibleUsers.length} 个用户</Badge>} className="wide-panel">
+        <SimpleTable rows={visibleUsers.map((user) => ({ ...user, roleName: roleMap.get(user.roleId) || '-' }))} columns={[
+          { key: 'username', label: '用户名' },
+          { key: 'name', label: '姓名' },
+          { key: 'phone', label: '手机号' },
+          { key: 'roleName', label: '角色' },
+          { key: 'status', label: '状态', status: true },
+          { key: 'lastLogin', label: '最后登录时间' },
+          { key: 'lastIp', label: '最后登录 IP' },
+          { key: 'actions', label: '操作', render: (row) => <div className="table-actions"><Button size="sm" variant="outline" onClick={() => openEditUser(row)}>编辑</Button><Button size="sm" variant={row.status === '启用' ? 'ghost' : 'secondary'} onClick={() => toggleUserStatus(row)}>{row.status === '启用' ? '禁用' : '启用'}</Button><Button size="sm" variant="outline" onClick={() => setResetTarget(row)}>重置密码</Button></div> },
+        ]} />
+      </Panel>
+      {editingUser !== undefined ? (
+        <Modal title={editingUser ? '编辑用户' : '新增用户'} onClose={closeUserModal}>
+          <form className="modal-form" onSubmit={submitUser}>
+            <div className="form-grid admin-form-grid">
+              <Field label={<span>用户名 <span className="required-star">*</span></span>}><Input value={userForm.username} onChange={(event) => setUserForm({ ...userForm, username: event.target.value })} placeholder="用于登录，不可重复" disabled={Boolean(editingUser)} required /></Field>
+              <Field label={<span>姓名 <span className="required-star">*</span></span>}><Input value={userForm.name} onChange={(event) => setUserForm({ ...userForm, name: event.target.value })} placeholder="请输入用户姓名" required /></Field>
+              <Field label="手机号"><Input value={userForm.phone} onChange={(event) => setUserForm({ ...userForm, phone: event.target.value })} placeholder="请输入手机号" /></Field>
+              <Field label="邮箱"><Input type="email" value={userForm.email} onChange={(event) => setUserForm({ ...userForm, email: event.target.value })} placeholder="请输入邮箱" /></Field>
+              <Field label={<span>角色 <span className="required-star">*</span></span>}><Select value={userForm.roleId} onChange={(event) => setUserForm({ ...userForm, roleId: event.target.value })} required>{roleRows.filter((role) => role.status === '启用').map((role) => <option key={role.id} value={role.id}>{role.name}</option>)}</Select></Field>
+              <Field label="状态"><Select value={userForm.status} onChange={(event) => setUserForm({ ...userForm, status: event.target.value })}><option value="启用">启用</option><option value="禁用">禁用</option></Select></Field>
+            </div>
+            <div className="modal-actions"><Button type="button" variant="outline" onClick={closeUserModal}>取消</Button><Button type="submit">{editingUser ? '保存修改' : '保存用户'}</Button></div>
+          </form>
+        </Modal>
+      ) : null}
+      {resetTarget ? (
+        <Modal title="确认重置密码" onClose={() => setResetTarget(null)} size="sm">
+          <div className="confirm-copy"><p>确认重置用户「{resetTarget.name}（{resetTarget.username}）」的登录密码吗？重置后该用户需要使用临时密码登录并立即修改密码。</p></div>
+          <div className="modal-actions"><Button variant="outline" onClick={() => setResetTarget(null)}>取消</Button><Button onClick={confirmResetPassword}>确认重置</Button></div>
+        </Modal>
+      ) : null}
+    </>
+  );
+}
+
+function RolesPage({ roleRows, setRoleRows, userRows, apiLoading, apiError, refreshApi }) {
+  const [editingRole, setEditingRole] = useState(undefined);
+  const [roleForm, setRoleForm] = useState(emptyRoleForm);
+  const [permissionRole, setPermissionRole] = useState(null);
+  const [permissionDraft, setPermissionDraft] = useState([]);
+  const roleUserCounts = useMemo(() => userRows.reduce((counts, user) => ({ ...counts, [user.roleId]: (counts[user.roleId] || 0) + 1 }), {}), [userRows]);
+  const openCreateRole = () => { setEditingRole(null); setRoleForm(emptyRoleForm); };
+  const openEditRole = (role) => { setEditingRole(role); setRoleForm({ name: role.name, description: role.description, status: role.status }); };
+  const closeRoleModal = () => { setEditingRole(undefined); setRoleForm(emptyRoleForm); };
+  const submitRole = (event) => {
+    event.preventDefault();
+    if (!roleForm.name.trim()) return;
+    if (editingRole) {
+      setRoleRows((rows) => rows.map((role) => role.id === editingRole.id ? { ...role, ...roleForm } : role));
+    } else {
+      setRoleRows((rows) => [...rows, { id: `R${String(rows.length + 1).padStart(3, '0')}`, ...roleForm, builtIn: false, permissions: [] }]);
+    }
+    closeRoleModal();
+  };
+  const toggleRoleStatus = (role) => {
+    if (role.builtIn) return;
+    setRoleRows((rows) => rows.map((item) => item.id === role.id ? { ...item, status: item.status === '启用' ? '禁用' : '启用' } : item));
+  };
+  const openPermissions = (role) => { setPermissionRole(role); setPermissionDraft(role.permissions); };
+  const togglePermission = (permissionKey) => {
+    setPermissionDraft((permissions) => permissions.includes(permissionKey) ? permissions.filter((key) => key !== permissionKey) : [...permissions, permissionKey]);
+  };
+  const togglePermissionGroup = (group) => {
+    const groupKeys = group.permissions.map((permission) => permission.key);
+    const allSelected = groupKeys.every((key) => permissionDraft.includes(key));
+    setPermissionDraft((permissions) => allSelected ? permissions.filter((key) => !groupKeys.includes(key)) : Array.from(new Set([...permissions, ...groupKeys])));
+  };
+  const savePermissions = () => {
+    setRoleRows((rows) => rows.map((role) => role.id === permissionRole.id ? { ...role, permissions: permissionDraft } : role));
+    setPermissionRole(null);
+  };
+
+  return (
+    <>
+      <PageTitle title="角色与权限" desc="按岗位定义菜单与操作权限，并查看角色关联用户。" actions={<Button icon={<Icon type="plus" />} onClick={openCreateRole}>新增角色</Button>} />
+      <ApiNotice loading={apiLoading} error={apiError} onRetry={refreshApi} />
+      <Panel title="角色列表" aside={<Badge tone="neutral">{roleRows.length} 个角色</Badge>} className="wide-panel">
+        <SimpleTable rows={roleRows.map((role) => ({ ...role, type: role.builtIn ? '系统内置' : '自定义', userCount: roleUserCounts[role.id] || 0, permissionCount: role.permissions.length }))} columns={[
+          { key: 'name', label: '角色名称' },
+          { key: 'type', label: '类型' },
+          { key: 'description', label: '角色说明' },
+          { key: 'userCount', label: '用户数' },
+          { key: 'permissionCount', label: '权限项' },
+          { key: 'status', label: '状态', status: true },
+          { key: 'actions', label: '操作', render: (row) => <div className="table-actions"><Button size="sm" variant="outline" onClick={() => openEditRole(row)}>编辑</Button><Button size="sm" variant="secondary" onClick={() => openPermissions(row)}>{row.builtIn ? '查看权限' : '配置权限'}</Button><Button size="sm" variant="ghost" disabled={row.builtIn} onClick={() => toggleRoleStatus(row)}>{row.status === '启用' ? '禁用' : '启用'}</Button></div> },
+        ]} />
+      </Panel>
+      {editingRole !== undefined ? (
+        <Modal title={editingRole ? '编辑角色' : '新增角色'} onClose={closeRoleModal} size="sm">
+          <form className="modal-form" onSubmit={submitRole}>
+            <Field label={<span>角色名称 <span className="required-star">*</span></span>}><Input value={roleForm.name} onChange={(event) => setRoleForm({ ...roleForm, name: event.target.value })} placeholder="请输入角色名称" disabled={Boolean(editingRole?.builtIn)} required /></Field>
+            <Field label="角色说明"><Textarea rows="4" value={roleForm.description} onChange={(event) => setRoleForm({ ...roleForm, description: event.target.value })} placeholder="说明该角色的职责范围" /></Field>
+            <Field label="状态"><Select value={roleForm.status} onChange={(event) => setRoleForm({ ...roleForm, status: event.target.value })} disabled={Boolean(editingRole?.builtIn)}><option value="启用">启用</option><option value="禁用">禁用</option></Select></Field>
+            <div className="modal-actions"><Button type="button" variant="outline" onClick={closeRoleModal}>取消</Button><Button type="submit">保存角色</Button></div>
+          </form>
+        </Modal>
+      ) : null}
+      {permissionRole ? (
+        <Drawer title={permissionRole.builtIn ? '查看角色权限' : '配置角色权限'} aside={<><Badge tone="info">{permissionRole.name}</Badge><span className="drawer-subtitle">已选择 {permissionDraft.length} 项权限</span></>} onClose={() => setPermissionRole(null)}>
+          {permissionRole.builtIn ? <Alert title="系统内置角色" tone="info">内置角色权限由系统维护，仅支持查看。</Alert> : null}
+          <div className="permission-groups">
+            {permissionGroups.map((group) => {
+              const groupKeys = group.permissions.map((permission) => permission.key);
+              const selectedCount = groupKeys.filter((key) => permissionDraft.includes(key)).length;
+              return (
+                <section className="permission-group" key={group.name}>
+                  <div className="permission-group-head"><div><strong>{group.name}</strong><span>{selectedCount}/{groupKeys.length} 已选择</span></div><Checkbox label="全选" checked={selectedCount === groupKeys.length} disabled={permissionRole.builtIn} onChange={() => togglePermissionGroup(group)} /></div>
+                  <div className="permission-options">{group.permissions.map((permission) => <Checkbox key={permission.key} label={permission.label} checked={permissionDraft.includes(permission.key)} disabled={permissionRole.builtIn} onChange={() => togglePermission(permission.key)} />)}</div>
+                </section>
+              );
+            })}
+          </div>
+          <div className="drawer-actions"><Button variant="outline" onClick={() => setPermissionRole(null)}>关闭</Button>{permissionRole.builtIn ? null : <Button onClick={savePermissions}>保存权限</Button>}</div>
+        </Drawer>
+      ) : null}
+    </>
+  );
+}
+
+function OperationLogsPage({ logRows = operationLogRows, apiLoading, apiError, refreshApi }) {
+  const [keyword, setKeyword] = useState('');
+  const [moduleFilter, setModuleFilter] = useState('all');
+  const [resultFilter, setResultFilter] = useState('all');
+  const [startDate, setStartDate] = useState('');
+  const [endDate, setEndDate] = useState('');
+  const [detailLog, setDetailLog] = useState(null);
+  const modules = useMemo(() => Array.from(new Set(logRows.map((log) => log.module))), [logRows]);
+  const visibleLogs = useMemo(() => {
+    const normalized = keyword.trim().toLowerCase();
+    return logRows.filter((log) => {
+      const matchesKeyword = !normalized || [log.user, log.username, log.action, log.object, log.ip].some((value) => value.toLowerCase().includes(normalized));
+      const logDate = log.time.slice(0, 10);
+      return matchesKeyword && (moduleFilter === 'all' || log.module === moduleFilter) && (resultFilter === 'all' || log.result === resultFilter) && (!startDate || logDate >= startDate) && (!endDate || logDate <= endDate);
+    });
+  }, [endDate, keyword, logRows, moduleFilter, resultFilter, startDate]);
+  const resetFilters = () => { setKeyword(''); setModuleFilter('all'); setResultFilter('all'); setStartDate(''); setEndDate(''); };
+
+  return (
+    <>
+      <PageTitle title="操作日志" desc="审计登录、配置变更、敏感操作及其执行结果。" actions={<Button variant="secondary" icon={<Icon type="export" />}>导出日志</Button>} />
+      <ApiNotice loading={apiLoading} error={apiError} onRetry={refreshApi} />
+      <Toolbar>
+        <Field label="关键词"><Input value={keyword} onChange={(event) => setKeyword(event.target.value)} placeholder="用户、操作对象或 IP" /></Field>
+        <Field label="功能模块"><Select value={moduleFilter} onChange={(event) => setModuleFilter(event.target.value)}><option value="all">全部模块</option>{modules.map((module) => <option key={module} value={module}>{module}</option>)}</Select></Field>
+        <Field label="执行结果"><Select value={resultFilter} onChange={(event) => setResultFilter(event.target.value)}><option value="all">全部结果</option><option value="成功">成功</option><option value="失败">失败</option></Select></Field>
+        <Field label="开始日期"><Input type="date" value={startDate} onChange={(event) => setStartDate(event.target.value)} /></Field>
+        <Field label="结束日期"><Input type="date" value={endDate} onChange={(event) => setEndDate(event.target.value)} /></Field>
+        <Button variant="outline" onClick={resetFilters}>重置</Button>
+      </Toolbar>
+      <Panel title="日志列表" aside={<Badge tone="neutral">共 {visibleLogs.length} 条</Badge>} className="wide-panel">
+        <SimpleTable rows={visibleLogs} columns={[
+          { key: 'time', label: '操作时间' },
+          { key: 'user', label: '操作用户' },
+          { key: 'module', label: '功能模块' },
+          { key: 'action', label: '操作类型' },
+          { key: 'object', label: '操作对象' },
+          { key: 'result', label: '结果', status: true },
+          { key: 'ip', label: '操作 IP' },
+          { key: 'actions', label: '操作', render: (row) => <Button size="sm" variant="outline" onClick={() => setDetailLog(row)}>查看详情</Button> },
+        ]} />
+      </Panel>
+      {detailLog ? (
+        <Drawer title="操作日志详情" aside={<Badge tone={toneForStatus(detailLog.result)}>{detailLog.result}</Badge>} onClose={() => setDetailLog(null)}>
+          <div className="detail-stack">
+            <KeyValue label="日志 ID" value={detailLog.id} />
+            <KeyValue label="操作时间" value={detailLog.time} />
+            <KeyValue label="操作用户" value={`${detailLog.user}（${detailLog.username}）`} />
+            <KeyValue label="功能模块" value={detailLog.module} />
+            <KeyValue label="操作类型" value={detailLog.action} />
+            <KeyValue label="操作对象" value={detailLog.object} />
+            <KeyValue label="执行结果" value={detailLog.result} />
+            <KeyValue label="操作 IP" value={detailLog.ip} />
+            <KeyValue label="客户端" value={detailLog.userAgent} />
+          </div>
+          <section className="log-summary"><strong>操作摘要</strong><p>{detailLog.summary}</p></section>
+        </Drawer>
+      ) : null}
+    </>
+  );
+}
+
+const pages = {
+  dashboard: DashboardPage,
+  customers: CustomersPage,
+  customerGateways: CustomerGatewaysPage,
+  rechargeRecords: RechargeRecordsPage,
+  vendors: VendorsPage,
+  vendorGateways: VendorGatewaysPage,
+  vendorLineGroups: VendorLineGroupsPage,
+  routes: RoutesPage,
+  billing: BillingPage,
+  cdr: CdrPage,
+  quality: QualityPage,
+  sipops: SipOpsPage,
+  monitoring: MonitoringPage,
+  settings: SettingsPage,
+  users: UsersPage,
+  roles: RolesPage,
+  operationLogs: OperationLogsPage,
+};
+
+export default function App() {
+  const [active, setActive] = useState('dashboard');
+  const [collapsed, setCollapsed] = useState(false);
+  const [customerRows, setCustomerRows] = useState([]);
+  const [vendorRows, setVendorRows] = useState([]);
+  const [rechargeRows, setRechargeRows] = useState([]);
+  const [userRows, setUserRows] = useState([]);
+  const [roleRows, setRoleRows] = useState([]);
+  const [logRows, setLogRows] = useState([]);
+  const [dashboardSummary, setDashboardSummary] = useState(null);
+  const [dashboardTrends, setDashboardTrends] = useState(null);
+  const [apiLoading, setApiLoading] = useState(true);
+  const [apiError, setApiError] = useState('');
+  const ActivePage = pages[active];
+  const activeLabel = useMemo(() => navGroups.flatMap((group) => group.items).find((item) => item.key === active)?.label, [active]);
+  const refreshApi = async () => {
+    setApiLoading(true);
+    setApiError('');
+    const [summary, trends, customerList, vendorList, rechargeList, userList, roleList, auditLogList] = await Promise.allSettled([
+      api.dashboardSummary(),
+      api.dashboardTrends(),
+      api.customers(),
+      api.vendors(),
+      api.recharges(),
+      api.users(),
+      api.roles(),
+      api.auditLogs(),
+    ]);
+    const failures = [summary, trends, customerList, vendorList, rechargeList, userList, roleList, auditLogList].filter((result) => result.status === 'rejected');
+    if (summary.status === 'fulfilled') setDashboardSummary(summary.value);
+    if (trends.status === 'fulfilled') setDashboardTrends(trends.value);
+    if (customerList.status === 'fulfilled') setCustomerRows(customerList.value.map(normalizeCustomer));
+    if (vendorList.status === 'fulfilled') setVendorRows(vendorList.value.map(normalizeVendor));
+    if (rechargeList.status === 'fulfilled') setRechargeRows(rechargeList.value.items.map(normalizeRecharge));
+    if (userList.status === 'fulfilled') setUserRows(userList.value.map(normalizeUser));
+    if (roleList.status === 'fulfilled') setRoleRows(roleList.value.map(normalizeRole));
+    if (auditLogList.status === 'fulfilled') setLogRows(auditLogList.value.items.map(normalizeAuditLog));
+    if (failures.length) {
+      setApiError(explainApiError(failures[0].reason));
+    }
+    setApiLoading(false);
+  };
+  useEffect(() => {
+    void refreshApi();
+  }, []);
+  const reloadAfterMutation = async (operation) => {
+    await operation();
+    await refreshApi();
+  };
+  const activePageProps = active === 'customers'
+    ? {
+        customerRows,
+        setCustomerRows,
+        addRechargeRecord: (record) => setRechargeRows((rows) => [record, ...rows]),
+        apiLoading,
+        apiError,
+        refreshApi,
+        onCreateCustomer: (body) => reloadAfterMutation(() => api.createCustomer(body)),
+        onUpdateCustomer: (id, body) => reloadAfterMutation(() => api.updateCustomer(id, body)),
+        onRechargeCustomer: (id, body) => reloadAfterMutation(() => api.rechargeCustomer(id, body)),
+      }
+    : active === 'vendors'
+      ? {
+          vendorRows,
+          setVendorRows,
+          addRechargeRecord: (record) => setRechargeRows((rows) => [record, ...rows]),
+          apiLoading,
+          apiError,
+          refreshApi,
+          onCreateVendor: (body) => reloadAfterMutation(() => api.createVendor(body)),
+          onUpdateVendor: (id, body) => reloadAfterMutation(() => api.updateVendor(id, body)),
+          onRechargeVendor: (id, body) => reloadAfterMutation(() => api.rechargeVendor(id, body)),
+        }
+    : active === 'rechargeRecords'
+      ? { rechargeRows, apiLoading, apiError, refreshApi }
+      : active === 'dashboard'
+        ? { dashboardSummary, dashboardTrends, apiLoading, apiError, refreshApi, customerRows }
+      : active === 'users'
+        ? { userRows, setUserRows, roleRows, apiLoading, apiError, refreshApi }
+      : active === 'roles'
+        ? { roleRows, setRoleRows, userRows, apiLoading, apiError, refreshApi }
+      : active === 'operationLogs'
+        ? { logRows, apiLoading, apiError, refreshApi }
+      : {};
+
+  return (
+    <div className={`prototype-app ${collapsed ? 'sidebar-collapsed' : ''}`}>
+      <aside className="sidebar">
+        <div className="brand-block">
+          <div className="brand-mark">聆</div>
+          <div className="brand-copy">
+            <strong>聆界SIP管理平台</strong>
+            <span>LisgloSIPS</span>
+          </div>
+          <button
+            type="button"
+            className="sidebar-toggle"
+            title={collapsed ? '展开菜单' : '收起菜单'}
+            aria-label={collapsed ? '展开菜单' : '收起菜单'}
+            onClick={() => setCollapsed((value) => !value)}
+          >
+            <Icon type={collapsed ? 'expand' : 'collapse'} />
+          </button>
+        </div>
+        <nav>
+          {navGroups.map((group) => (
+            <div className="nav-group" key={group.title}>
+              <p>{group.title}</p>
+              {group.items.map((item) => (
+                <button key={item.key} className={active === item.key ? 'active' : ''} onClick={() => setActive(item.key)} title={`${item.label}${item.pending ? '（待设计）' : ''}`}>
+                  <span className="nav-short" aria-hidden="true">{item.label.slice(0, 1)}</span>
+                  <span className="nav-label">{item.label}</span>
+                  {item.pending ? <span className="nav-status">待设计</span> : null}
+                </button>
+              ))}
+            </div>
+          ))}
+        </nav>
+      </aside>
+      <div className="main-area">
+        <header className="topbar">
+          <div>
+            <span>当前页面</span>
+            <strong>{activeLabel}</strong>
+          </div>
+          <div className="topbar-right">
+            <Badge tone={apiError ? 'warning' : 'success'}>{apiError ? 'API 待登录' : '真实 API'}</Badge>
+            <span>{new Date().toLocaleString('zh-CN', { hour12: false })}</span>
+            <strong>运营管理员</strong>
+          </div>
+        </header>
+        <main className="page-content">
+          <ActivePage {...activePageProps} />
+        </main>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/web/src/api.js b/apps/web/src/api.js
new file mode 100644
index 0000000..086ad5c
--- /dev/null
+++ b/apps/web/src/api.js
@@ -0,0 +1,88 @@
+const API_BASE = (import.meta.env.VITE_LISGLOSIPS_API_BASE || '/api/v2').replace(/\/$/, '');
+const ACCESS_TOKEN_KEY = 'lisglosips.accessToken';
+
+export class ApiError extends Error {
+  constructor(message, { status, code } = {}) {
+    super(message);
+    this.name = 'ApiError';
+    this.status = status;
+    this.code = code;
+  }
+}
+
+async function request(path, options = {}) {
+  const token = window.localStorage.getItem(ACCESS_TOKEN_KEY);
+  const headers = new Headers(options.headers || {});
+  headers.set('Accept', 'application/json');
+  if (options.body && !headers.has('Content-Type')) {
+    headers.set('Content-Type', 'application/json');
+  }
+  if (token) {
+    headers.set('Authorization', `Bearer ${token}`);
+  }
+
+  const response = await fetch(`${API_BASE}${path}`, {
+    ...options,
+    headers,
+    credentials: 'include',
+  });
+  const contentType = response.headers.get('content-type') || '';
+  const payload = contentType.includes('application/json') ? await response.json() : await response.text();
+
+  if (!response.ok) {
+    throw new ApiError(errorMessage(payload, response.status), {
+      status: response.status,
+      code: typeof payload === 'object' && payload ? payload.code : undefined,
+    });
+  }
+
+  return payload;
+}
+
+function errorMessage(payload, status) {
+  if (payload && typeof payload === 'object') {
+    return payload.message || payload.error || `API request failed with HTTP ${status}.`;
+  }
+  return payload || `API request failed with HTTP ${status}.`;
+}
+
+function jsonBody(value) {
+  return JSON.stringify(value);
+}
+
+function idempotencyKey(scope) {
+  const random = crypto.randomUUID ? crypto.randomUUID() : `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  return `${scope}:${random}`;
+}
+
+export const api = {
+  dashboardSummary: () => request('/dashboard/summary'),
+  dashboardTrends: (params = { hours: 24, bucketMinutes: 60 }) => request(`/dashboard/trends?${new URLSearchParams(params)}`),
+  customers: () => request('/customers'),
+  createCustomer: (body) => request('/customers', { method: 'POST', body: jsonBody(body) }),
+  updateCustomer: (id, body) => request(`/customers/${encodeURIComponent(id)}`, { method: 'PATCH', body: jsonBody(body) }),
+  rechargeCustomer: (id, body) =>
+    request(`/customers/${encodeURIComponent(id)}/recharges`, {
+      method: 'POST',
+      body: jsonBody({ ...body, idempotencyKey: idempotencyKey('customer-recharge') }),
+    }),
+  vendors: () => request('/vendors'),
+  createVendor: (body) => request('/vendors', { method: 'POST', body: jsonBody(body) }),
+  updateVendor: (id, body) => request(`/vendors/${encodeURIComponent(id)}`, { method: 'PATCH', body: jsonBody(body) }),
+  rechargeVendor: (id, body) =>
+    request(`/vendors/${encodeURIComponent(id)}/recharges`, {
+      method: 'POST',
+      body: jsonBody({ ...body, idempotencyKey: idempotencyKey('vendor-recharge') }),
+    }),
+  recharges: () => request('/recharges?take=100'),
+  users: () => request('/users'),
+  roles: () => request('/roles'),
+  auditLogs: () => request('/audit-logs?take=100'),
+};
+
+export function explainApiError(error) {
+  if (error instanceof ApiError && (error.status === 401 || error.status === 403)) {
+    return 'API 已启用鉴权，请先通过登录接口获取会话或在同源环境使用有效 Cookie。';
+  }
+  return error instanceof Error ? error.message : '请求失败，请稍后重试。';
+}
diff --git a/apps/web/src/components/ui.jsx b/apps/web/src/components/ui.jsx
new file mode 100644
index 0000000..7bce6ae
--- /dev/null
+++ b/apps/web/src/components/ui.jsx
@@ -0,0 +1,178 @@
+import React from 'react';
+
+export function Button({
+  children,
+  variant = 'primary',
+  size = 'md',
+  icon,
+  iconOnly = false,
+  className = '',
+  ...props
+}) {
+  return (
+    <button
+      className={`ui-button ui-button-${variant} ui-button-${size} ${iconOnly ? 'ui-button-icon-only' : ''} ${className}`}
+      {...props}
+    >
+      {icon ? <span className="ui-button-icon" aria-hidden="true">{icon}</span> : null}
+      {iconOnly ? <span className="sr-only">{children}</span> : children}
+    </button>
+  );
+}
+
+export function Field({ label, hint, error, children }) {
+  return (
+    <label className="ui-field">
+      <span className="ui-field-label">{label}</span>
+      {children}
+      {error ? <span className="ui-field-error">{error}</span> : hint ? <span className="ui-field-hint">{hint}</span> : null}
+    </label>
+  );
+}
+
+export function Input(props) {
+  return <input className="ui-input" {...props} />;
+}
+
+export function Textarea(props) {
+  return <textarea className="ui-input ui-textarea" {...props} />;
+}
+
+export function Select({ children, ...props }) {
+  return (
+    <select className="ui-input ui-select" {...props}>
+      {children}
+    </select>
+  );
+}
+
+export function Checkbox({ label, checked, ...props }) {
+  return (
+    <label className="ui-check">
+      <input type="checkbox" checked={checked} {...props} />
+      <span className="ui-check-box" aria-hidden="true" />
+      <span>{label}</span>
+    </label>
+  );
+}
+
+export function Radio({ label, checked, ...props }) {
+  return (
+    <label className="ui-check">
+      <input type="radio" checked={checked} {...props} />
+      <span className="ui-radio-dot" aria-hidden="true" />
+      <span>{label}</span>
+    </label>
+  );
+}
+
+export function Switch({ label, checked, ...props }) {
+  return (
+    <label className="ui-switch">
+      <input type="checkbox" checked={checked} {...props} />
+      <span className="ui-switch-track" aria-hidden="true">
+        <span className="ui-switch-thumb" />
+      </span>
+      <span>{label}</span>
+    </label>
+  );
+}
+
+export function SegmentedControl({ value, options, onChange }) {
+  return (
+    <div className="ui-segmented" role="tablist" aria-label="分段选择">
+      {options.map((option) => (
+        <button
+          key={option.value}
+          type="button"
+          className={option.value === value ? 'is-active' : ''}
+          onClick={() => onChange(option.value)}
+        >
+          {option.label}
+        </button>
+      ))}
+    </div>
+  );
+}
+
+export function Tabs({ value, tabs, onChange }) {
+  return (
+    <div className="ui-tabs">
+      <div className="ui-tab-list" role="tablist">
+        {tabs.map((tab) => (
+          <button
+            key={tab.value}
+            type="button"
+            role="tab"
+            aria-selected={tab.value === value}
+            className={tab.value === value ? 'is-active' : ''}
+            onClick={() => onChange(tab.value)}
+          >
+            {tab.label}
+          </button>
+        ))}
+      </div>
+      <div className="ui-tab-panel">{tabs.find((tab) => tab.value === value)?.content}</div>
+    </div>
+  );
+}
+
+export function Badge({ children, tone = 'neutral' }) {
+  return <span className={`ui-badge ui-badge-${tone}`}>{children}</span>;
+}
+
+export function Alert({ title, children, tone = 'info' }) {
+  return (
+    <div className={`ui-alert ui-alert-${tone}`} role="status">
+      <strong>{title}</strong>
+      <span>{children}</span>
+    </div>
+  );
+}
+
+export function Progress({ value }) {
+  return (
+    <div className="ui-progress" aria-label={`进度 ${value}%`}>
+      <span style={{ width: `${value}%` }} />
+    </div>
+  );
+}
+
+export function Slider({ label, value, ...props }) {
+  return (
+    <label className="ui-slider">
+      <span>{label}</span>
+      <input type="range" value={value} {...props} />
+      <output>{value}</output>
+    </label>
+  );
+}
+
+export function DataTable({ rows }) {
+  return (
+    <div className="ui-table-wrap">
+      <table className="ui-table">
+        <thead>
+          <tr>
+            <th>线路</th>
+            <th>状态</th>
+            <th>接通率</th>
+            <th>并发</th>
+            <th>操作</th>
+          </tr>
+        </thead>
+        <tbody>
+          {rows.map((row) => (
+            <tr key={row.name}>
+              <td>{row.name}</td>
+              <td><Badge tone={row.status === '正常' ? 'success' : 'warning'}>{row.status}</Badge></td>
+              <td>{row.answerRate}</td>
+              <td>{row.concurrent}</td>
+              <td><Button variant="ghost" size="sm">查看</Button></td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
diff --git a/apps/web/src/main.jsx b/apps/web/src/main.jsx
new file mode 100644
index 0000000..04a81d1
--- /dev/null
+++ b/apps/web/src/main.jsx
@@ -0,0 +1,10 @@
+import React from 'react';
+import { createRoot } from 'react-dom/client';
+import App from './App.jsx';
+import './styles.css';
+
+createRoot(document.getElementById('root')).render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>
+);
diff --git a/apps/web/src/styles.css b/apps/web/src/styles.css
new file mode 100644
index 0000000..c20f819
--- /dev/null
+++ b/apps/web/src/styles.css
@@ -0,0 +1,1621 @@
+:root {
+  --brand: #12121a;
+  --brand-2: #20212d;
+  --accent: #d9c3a0;
+  --accent-soft: #f5eddf;
+  --selected: #2563eb;
+  --selected-soft: #eff6ff;
+  --danger: #dc2626;
+  --warning: #b45309;
+  --success: #15803d;
+  --surface: #ffffff;
+  --surface-muted: #f7f7f9;
+  --page: #f1f2f5;
+  --line: #dedfe5;
+  --line-strong: #c8cad3;
+  --text: #171820;
+  --muted: #676b76;
+  --shadow: 0 14px 34px rgba(18, 18, 26, 0.08);
+  color: var(--text);
+  font-family: Inter, "Microsoft YaHei", "PingFang SC", Arial, sans-serif;
+  font-size: 15px;
+  line-height: 1.5;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  min-width: 320px;
+  margin: 0;
+  background: var(--page);
+}
+
+button,
+input,
+select,
+textarea {
+  font: inherit;
+}
+
+button {
+  cursor: pointer;
+}
+
+button:disabled {
+  cursor: not-allowed;
+}
+
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  border: 0;
+}
+
+.prototype-app {
+  display: grid;
+  grid-template-columns: 260px minmax(0, 1fr);
+  min-height: 100vh;
+  transition: grid-template-columns 0.18s ease;
+}
+
+.prototype-app.sidebar-collapsed {
+  grid-template-columns: 76px minmax(0, 1fr);
+}
+
+.sidebar {
+  position: sticky;
+  top: 0;
+  height: 100vh;
+  overflow-y: auto;
+  color: var(--text);
+  background: var(--surface);
+  border-right: 1px solid var(--line);
+  box-shadow: 1px 0 0 rgba(18, 18, 26, 0.02);
+}
+
+.brand-block {
+  display: grid;
+  grid-template-columns: 38px minmax(0, 1fr) 34px;
+  align-items: center;
+  gap: 6px;
+  padding: 16px 12px;
+  border-bottom: 1px solid var(--line);
+}
+
+.brand-mark {
+  display: grid;
+  place-items: center;
+  width: 38px;
+  height: 38px;
+  color: var(--brand);
+  background: var(--accent);
+  border-radius: 8px;
+  font-weight: 900;
+}
+
+.brand-copy {
+  display: grid;
+  min-width: 0;
+  gap: 2px;
+}
+
+.brand-block strong {
+  font-size: 19px;
+  letter-spacing: 0;
+  white-space: nowrap;
+}
+
+.sidebar-toggle {
+  display: inline-grid;
+  place-items: center;
+  width: 32px;
+  height: 32px;
+  color: var(--muted);
+  background: var(--surface-muted);
+  border: 1px solid var(--line);
+  border-radius: 7px;
+}
+
+.sidebar-toggle:hover {
+  color: var(--brand);
+  border-color: var(--line-strong);
+}
+
+.brand-block span,
+.topbar span,
+.page-title p,
+.nav-group p,
+.kv span,
+.ops-row span,
+.role-grid span {
+  color: var(--muted);
+}
+
+.brand-block span,
+.nav-group p {
+  color: var(--muted);
+}
+
+.nav-group {
+  display: grid;
+  gap: 4px;
+  padding: 14px 10px;
+}
+
+.nav-group p {
+  margin: 0 8px 6px;
+  font-size: 12px;
+  font-weight: 800;
+}
+
+.nav-group button {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  width: 100%;
+  min-height: 38px;
+  padding: 0 12px;
+  border: 1px solid transparent;
+  border-radius: 6px;
+  color: #3d404a;
+  text-align: left;
+  background: transparent;
+  font-weight: 700;
+}
+
+.nav-group button:hover {
+  color: var(--brand);
+  background: var(--surface-muted);
+}
+
+.nav-group button.active {
+  color: var(--selected);
+  background: var(--selected-soft);
+  border-color: #cfe0ff;
+  font-weight: 800;
+}
+
+.nav-short {
+  display: none;
+  place-items: center;
+  flex: 0 0 30px;
+  width: 30px;
+  height: 30px;
+  border-radius: 7px;
+  color: var(--brand);
+  background: var(--accent-soft);
+  font-size: 14px;
+  font-weight: 900;
+  text-align: center;
+}
+
+.nav-label {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.nav-status {
+  flex: 0 0 auto;
+  margin-left: auto;
+  padding: 2px 5px;
+  color: #854d0e;
+  background: #fff8ed;
+  border: 1px solid #f1d29c;
+  border-radius: 4px;
+  font-size: 10px;
+  font-weight: 800;
+  line-height: 1.2;
+}
+
+.sidebar-collapsed .brand-block {
+  grid-template-columns: 1fr;
+  justify-items: center;
+  padding: 14px 10px;
+}
+
+.sidebar-collapsed .brand-copy,
+.sidebar-collapsed .nav-group p,
+.sidebar-collapsed .nav-label,
+.sidebar-collapsed .nav-status {
+  display: none;
+}
+
+.sidebar-collapsed .sidebar-toggle {
+  width: 38px;
+}
+
+.sidebar-collapsed .nav-group {
+  padding: 12px 8px;
+}
+
+.sidebar-collapsed .nav-group button {
+  justify-content: center;
+  min-height: 42px;
+  padding: 0;
+}
+
+.sidebar-collapsed .nav-short {
+  display: grid;
+}
+
+.sidebar-collapsed .nav-group button.active .nav-short {
+  color: #fff;
+  background: var(--selected);
+}
+
+.main-area {
+  min-width: 0;
+}
+
+.topbar {
+  position: sticky;
+  top: 0;
+  z-index: 5;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 18px;
+  min-height: 64px;
+  padding: 0 24px;
+  background: rgba(255, 255, 255, 0.92);
+  border-bottom: 1px solid var(--line);
+  backdrop-filter: blur(12px);
+}
+
+.topbar > div {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  min-width: 0;
+}
+
+.topbar strong {
+  white-space: nowrap;
+}
+
+.topbar-right {
+  justify-content: flex-end;
+}
+
+.page-content {
+  display: grid;
+  gap: 16px;
+  width: min(100%, 1460px);
+  margin: 0 auto;
+  padding: 22px 24px 36px;
+}
+
+.page-title {
+  display: flex;
+  align-items: flex-end;
+  justify-content: space-between;
+  gap: 18px;
+  padding: 20px;
+  color: var(--text);
+  background: var(--surface);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  box-shadow: 0 1px 2px rgba(18, 18, 26, 0.04);
+}
+
+.page-title h1 {
+  margin: 0 0 6px;
+  font-size: 26px;
+  line-height: 1.15;
+  letter-spacing: 0;
+}
+
+.page-title p {
+  max-width: 760px;
+  margin: 0;
+  color: var(--muted);
+}
+
+.page-actions,
+.toolbar,
+.sub-toolbar,
+.badge-row,
+.tag-cloud {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: flex-end;
+  gap: 10px;
+}
+
+.toolbar {
+  padding: 14px;
+  background: var(--surface);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+}
+
+.toolbar .ui-field,
+.sub-toolbar .ui-field {
+  min-width: min(220px, 100%);
+}
+
+.sub-toolbar {
+  padding: 12px;
+  background: var(--surface-muted);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+}
+
+.strategy-form {
+  display: grid;
+  gap: 12px;
+  margin-bottom: 14px;
+}
+
+.match-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 12px;
+}
+
+.match-card {
+  display: grid;
+  gap: 10px;
+  min-width: 0;
+  padding: 12px;
+  background: var(--surface-muted);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+}
+
+.match-card strong {
+  color: var(--ink);
+  font-size: 14px;
+}
+
+.config-card {
+  display: grid;
+  gap: 10px;
+  min-width: 0;
+  padding: 12px;
+  background: var(--surface-muted);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+}
+
+.config-card-wide {
+  grid-column: 1 / -1;
+}
+
+.config-card strong,
+.config-card-head strong {
+  color: var(--ink);
+  font-size: 14px;
+}
+
+.config-card-head,
+.inline-control,
+.time-range,
+.prefix-rule {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  min-width: 0;
+}
+
+.config-card-head {
+  justify-content: space-between;
+}
+
+.inline-control .ui-input:first-child {
+  flex: 1 1 auto;
+}
+
+.inline-control .ui-select {
+  flex: 0 0 112px;
+}
+
+.time-range .ui-input {
+  flex: 1 1 0;
+}
+
+.time-range span,
+.prefix-rule span {
+  flex: 0 0 auto;
+  color: var(--muted);
+  font-size: 13px;
+  font-weight: 700;
+}
+
+.option-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 8px;
+}
+
+.rule-list {
+  display: grid;
+  gap: 8px;
+}
+
+.prefix-rule {
+  padding: 8px;
+  background: var(--surface);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+}
+
+.prefix-rule .ui-input {
+  flex: 1 1 0;
+}
+
+.rate-config-card {
+  display: grid;
+  grid-column: 1 / -1;
+  gap: 28px;
+  padding: 24px 28px;
+  background: var(--surface);
+  border: 1px solid #858585;
+  border-radius: 2px;
+}
+
+.rate-config-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+}
+
+.rate-config-head strong,
+.rate-config-head span {
+  color: var(--ink);
+  font-size: 22px;
+  font-weight: 500;
+}
+
+.rate-config-fields {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 28px 56px;
+}
+
+.rate-config-fields .ui-field-label {
+  color: var(--ink);
+  font-size: 18px;
+  font-weight: 500;
+}
+
+.metric-grid {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  gap: 12px;
+}
+
+.metric-card,
+.prototype-panel {
+  min-width: 0;
+  background: var(--surface);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  box-shadow: 0 1px 2px rgba(18, 18, 26, 0.04);
+}
+
+.metric-card {
+  display: grid;
+  gap: 7px;
+  padding: 16px;
+}
+
+.metric-card span {
+  color: var(--muted);
+  font-size: 13px;
+  font-weight: 750;
+}
+
+.metric-card strong {
+  font-size: 24px;
+  line-height: 1.1;
+  letter-spacing: 0;
+}
+
+.metric-card em {
+  font-style: normal;
+  font-weight: 750;
+}
+
+.metric-up {
+  color: var(--success);
+}
+
+.metric-down,
+.metric-warn {
+  color: var(--warning);
+}
+
+.metric-neutral {
+  color: var(--selected);
+}
+
+.content-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 16px;
+}
+
+.wide-panel {
+  grid-column: 1 / -1;
+}
+
+.prototype-panel {
+  display: grid;
+  gap: 14px;
+  padding: 16px;
+}
+
+.panel-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  min-width: 0;
+}
+
+.panel-head h2 {
+  margin: 0;
+  font-size: 17px;
+  line-height: 1.25;
+  letter-spacing: 0;
+}
+
+.modal-backdrop {
+  position: fixed;
+  inset: 0;
+  z-index: 50;
+  display: grid;
+  place-items: center;
+  padding: 24px;
+  background: rgba(18, 18, 26, 0.42);
+}
+
+.modal-dialog {
+  display: grid;
+  grid-template-rows: auto minmax(0, 1fr);
+  width: min(920px, 100%);
+  max-height: min(760px, calc(100vh - 48px));
+  overflow: hidden;
+  background: var(--surface);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  box-shadow: 0 24px 70px rgba(18, 18, 26, 0.24);
+}
+
+.modal-xl {
+  width: min(1120px, 100%);
+}
+
+.modal-sm {
+  width: min(520px, 100%);
+}
+
+.drawer-backdrop {
+  position: fixed;
+  inset: 0;
+  z-index: 35;
+  display: flex;
+  justify-content: flex-end;
+  background: rgba(18, 18, 26, 0.24);
+}
+
+.drawer-panel {
+  display: flex;
+  flex-direction: column;
+  width: min(860px, 92vw);
+  height: 100%;
+  background: var(--surface);
+  border-left: 1px solid var(--line);
+  box-shadow: -16px 0 36px rgba(18, 18, 26, 0.18);
+}
+
+.drawer-head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 16px;
+  padding: 18px 20px;
+  border-bottom: 1px solid var(--line);
+}
+
+.drawer-head h2 {
+  margin: 0 0 8px;
+  font-size: 20px;
+  line-height: 1.25;
+}
+
+.drawer-body {
+  display: grid;
+  align-content: start;
+  gap: 14px;
+  min-height: 0;
+  padding: 16px;
+  overflow: auto;
+}
+
+.drawer-toolbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 12px;
+  background: var(--surface-muted);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+}
+
+.drawer-toolbar div {
+  display: grid;
+  gap: 4px;
+}
+
+.drawer-toolbar span,
+.confirm-copy p {
+  margin: 0;
+  color: var(--muted);
+  font-size: 13px;
+  line-height: 1.6;
+}
+
+.modal-head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 16px;
+  padding: 16px;
+  border-bottom: 1px solid var(--line);
+}
+
+.modal-head > div {
+  display: grid;
+  gap: 8px;
+  min-width: 0;
+}
+
+.modal-head h2 {
+  margin: 0;
+  font-size: 19px;
+  line-height: 1.25;
+  letter-spacing: 0;
+}
+
+.modal-body {
+  display: grid;
+  gap: 14px;
+  min-width: 0;
+  overflow: auto;
+  padding: 16px;
+}
+
+.modal-form {
+  display: grid;
+  gap: 14px;
+}
+
+.form-grid {
+  display: grid;
+  gap: 14px;
+}
+
+.admin-form-grid {
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+}
+
+.modal-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 10px;
+  padding-top: 4px;
+}
+
+.master-detail {
+  display: grid;
+  grid-template-columns: minmax(0, 1.35fr) minmax(340px, 0.65fr);
+  gap: 16px;
+}
+
+.main-list,
+.detail-panel {
+  align-content: start;
+}
+
+.table-shell {
+  width: 100%;
+  max-width: 100%;
+  overflow-x: auto;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+}
+
+.proto-table {
+  width: 100%;
+  min-width: 900px;
+  border-collapse: collapse;
+}
+
+.proto-table th,
+.proto-table td {
+  padding: 10px 12px;
+  text-align: left;
+  border-bottom: 1px solid var(--line);
+  white-space: nowrap;
+}
+
+.proto-table th {
+  color: var(--muted);
+  background: var(--surface-muted);
+  font-size: 12px;
+  font-weight: 850;
+}
+
+.proto-table tbody tr {
+  transition: background 0.15s ease;
+}
+
+.proto-table tbody tr:hover,
+.proto-table tbody tr.is-selected {
+  background: var(--selected-soft);
+}
+
+.proto-table tbody tr:last-child td {
+  border-bottom: 0;
+}
+
+.table-actions {
+  display: inline-flex;
+  gap: 8px;
+}
+
+.mini-chart {
+  display: grid;
+  grid-template-columns: repeat(12, 1fr);
+  align-items: end;
+  gap: 8px;
+  height: 220px;
+  padding: 12px;
+  background: linear-gradient(to top, #eef0f4 1px, transparent 1px);
+  background-size: 100% 44px;
+}
+
+.mini-chart span {
+  display: block;
+  border-radius: 5px 5px 0 0;
+  opacity: 0.9;
+}
+
+.line-chart {
+  width: 100%;
+  height: 220px;
+  padding: 12px;
+  background: linear-gradient(to top, #eef0f4 1px, transparent 1px);
+  background-size: 100% 44px;
+  border-radius: 8px;
+}
+
+.rank-list,
+.detail-stack,
+.setting-list,
+.scope-list,
+.balance-control,
+.coverage-grid,
+.role-grid {
+  display: grid;
+  gap: 10px;
+}
+
+.rank-list div,
+.code-grid div,
+.kv,
+.ops-row,
+.scope-list span,
+.role-grid div {
+  min-width: 0;
+  padding: 12px;
+  background: var(--surface-muted);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+}
+
+.scope-list span {
+  display: grid;
+  gap: 3px;
+}
+
+.scope-list strong {
+  color: var(--brand);
+}
+
+.coverage-grid {
+  grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
+}
+
+.coverage-grid span {
+  padding: 9px 10px;
+  color: var(--selected);
+  background: var(--selected-soft);
+  border: 1px solid #cfe0ff;
+  border-radius: 7px;
+  font-size: 13px;
+  font-weight: 800;
+}
+
+.rank-list div,
+.ops-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+}
+
+.rank-list span {
+  display: inline-grid;
+  place-items: center;
+  width: 24px;
+  height: 24px;
+  color: var(--brand);
+  background: var(--accent);
+  border-radius: 999px;
+  font-weight: 850;
+}
+
+.rank-list strong,
+.ops-row strong {
+  flex: 1;
+  min-width: 0;
+}
+
+.rank-list em {
+  color: var(--selected);
+  font-style: normal;
+  font-weight: 850;
+}
+
+.code-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 10px;
+}
+
+.code-grid strong {
+  display: block;
+  font-size: 24px;
+  line-height: 1.1;
+}
+
+.code-grid span {
+  color: var(--muted);
+}
+
+.kv {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+}
+
+.kv strong {
+  text-align: right;
+}
+
+.flow {
+  display: grid;
+  gap: 8px;
+  counter-reset: flow;
+}
+
+.flow span {
+  position: relative;
+  min-height: 36px;
+  padding: 8px 10px 8px 42px;
+  background: var(--surface-muted);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  font-weight: 700;
+}
+
+.flow span::before {
+  position: absolute;
+  top: 7px;
+  left: 10px;
+  display: grid;
+  place-items: center;
+  width: 22px;
+  height: 22px;
+  counter-increment: flow;
+  content: counter(flow);
+  color: #fff;
+  background: var(--selected);
+  border-radius: 999px;
+  font-size: 12px;
+}
+
+.formula,
+.trace-box,
+.transcript {
+  padding: 12px;
+  overflow-x: auto;
+  background: #101118;
+  color: #e8e8ee;
+  border-radius: 8px;
+}
+
+.formula {
+  color: var(--accent);
+  font-weight: 800;
+}
+
+.trace-box {
+  min-height: 188px;
+  margin: 0;
+  white-space: pre-wrap;
+}
+
+.audio-bar {
+  display: grid;
+  grid-template-columns: 110px minmax(0, 1fr);
+  align-items: center;
+  gap: 12px;
+  padding: 12px;
+  background: var(--surface-muted);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+}
+
+.audio-bar span {
+  height: 8px;
+  background: linear-gradient(90deg, var(--selected) 64%, #dfe3ec 64%);
+  border-radius: 999px;
+}
+
+.audio-bar strong {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.transcript {
+  display: grid;
+  gap: 8px;
+  color: #f1f3f8;
+  background: var(--brand);
+}
+
+.transcript p {
+  margin: 0;
+}
+
+.settings-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 16px;
+}
+
+.role-grid {
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+}
+
+.role-grid strong,
+.role-grid span {
+  display: block;
+}
+
+.drawer-subtitle {
+  display: block;
+  margin-top: 6px;
+  color: var(--muted);
+  font-size: 12px;
+}
+
+.permission-groups {
+  display: grid;
+  gap: 12px;
+}
+
+.permission-group {
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  overflow: hidden;
+}
+
+.permission-group-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  padding: 12px 14px;
+  background: var(--surface-muted);
+  border-bottom: 1px solid var(--line);
+}
+
+.permission-group-head > div {
+  display: grid;
+  gap: 3px;
+}
+
+.permission-group-head span {
+  color: var(--muted);
+  font-size: 12px;
+}
+
+.permission-options {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 0;
+  padding: 4px 14px;
+}
+
+.permission-options .ui-check {
+  min-height: 44px;
+  border-bottom: 1px solid var(--line);
+}
+
+.permission-options .ui-check:nth-last-child(-n + 2) {
+  border-bottom: 0;
+}
+
+.drawer-actions {
+  position: sticky;
+  bottom: -16px;
+  display: flex;
+  justify-content: flex-end;
+  gap: 10px;
+  margin: 0 -16px -16px;
+  padding: 14px 16px;
+  background: var(--surface);
+  border-top: 1px solid var(--line);
+}
+
+.log-summary {
+  display: grid;
+  gap: 8px;
+  padding: 14px;
+  background: var(--surface-muted);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+}
+
+.log-summary p {
+  margin: 0;
+  color: var(--muted);
+  line-height: 1.65;
+}
+
+.tag-cloud {
+  align-items: flex-start;
+}
+
+.ui-button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  min-width: 0;
+  height: 38px;
+  gap: 8px;
+  padding: 0 14px;
+  border: 1px solid transparent;
+  border-radius: 6px;
+  font-weight: 750;
+  letter-spacing: 0;
+  white-space: nowrap;
+  transition: background 0.15s ease, border-color 0.15s ease, color 0.15s ease, box-shadow 0.15s ease;
+}
+
+.ui-button:focus-visible,
+.ui-input:focus,
+.ui-check input:focus-visible + span,
+.ui-switch input:focus-visible + .ui-switch-track,
+.ui-tab-list button:focus-visible {
+  outline: 3px solid rgba(37, 99, 235, 0.22);
+  outline-offset: 2px;
+}
+
+.ui-button-primary {
+  color: #fff;
+  background: var(--brand);
+  border-color: var(--brand);
+}
+
+.ui-button-primary:hover {
+  background: var(--brand-2);
+}
+
+.ui-button-secondary {
+  color: var(--brand);
+  background: var(--accent);
+  border-color: var(--accent);
+}
+
+.ui-button-secondary:hover {
+  background: #cdb28a;
+}
+
+.ui-button-outline {
+  color: var(--brand);
+  background: #fff;
+  border-color: #b9bbc4;
+}
+
+.ui-button-outline:hover,
+.ui-button-ghost:hover {
+  background: var(--surface-muted);
+}
+
+.ui-button-ghost {
+  color: var(--brand);
+  background: transparent;
+}
+
+.ui-button-danger {
+  color: #fff;
+  background: var(--danger);
+  border-color: var(--danger);
+}
+
+.ui-button:disabled {
+  color: #9b9da7;
+  background: #ececf0;
+  border-color: #ececf0;
+}
+
+.ui-button-sm {
+  height: 32px;
+  padding: 0 11px;
+  font-size: 14px;
+}
+
+.ui-button-icon-only {
+  width: 38px;
+  padding: 0;
+}
+
+.ui-button-icon {
+  display: inline-flex;
+  flex: 0 0 auto;
+}
+
+.ui-field {
+  display: grid;
+  gap: 7px;
+  min-width: 0;
+}
+
+.ui-field-label {
+  color: var(--brand);
+  font-size: 13px;
+  font-weight: 800;
+}
+
+.required-star {
+  color: var(--danger);
+}
+
+.ui-field-hint,
+.ui-field-error {
+  font-size: 13px;
+}
+
+.ui-field-hint {
+  color: var(--muted);
+}
+
+.ui-field-error {
+  color: var(--danger);
+}
+
+.ui-input {
+  width: 100%;
+  min-width: 0;
+  min-height: 38px;
+  padding: 8px 11px;
+  color: var(--text);
+  background: #fff;
+  border: 1px solid #cfd1d8;
+  border-radius: 6px;
+  transition: border-color 0.15s ease, box-shadow 0.15s ease;
+}
+
+.ui-input:focus {
+  border-color: var(--selected);
+}
+
+.ui-textarea {
+  resize: vertical;
+}
+
+.ui-select {
+  appearance: none;
+  background-image: linear-gradient(45deg, transparent 50%, var(--muted) 50%), linear-gradient(135deg, var(--muted) 50%, transparent 50%);
+  background-position: calc(100% - 16px) 17px, calc(100% - 11px) 17px;
+  background-size: 5px 5px, 5px 5px;
+  background-repeat: no-repeat;
+  padding-right: 32px;
+}
+
+.ui-check,
+.ui-switch {
+  display: inline-flex;
+  align-items: center;
+  width: fit-content;
+  gap: 10px;
+  color: var(--text);
+  font-weight: 650;
+}
+
+.ui-check input,
+.ui-switch input {
+  position: absolute;
+  opacity: 0;
+}
+
+.ui-check-box,
+.ui-radio-dot {
+  display: inline-grid;
+  place-items: center;
+  width: 18px;
+  height: 18px;
+  border: 1px solid #b8bbc5;
+  background: #fff;
+}
+
+.ui-check-box {
+  border-radius: 5px;
+}
+
+.ui-radio-dot {
+  border-radius: 999px;
+}
+
+.ui-check input:checked + .ui-check-box {
+  background: var(--selected);
+  border-color: var(--selected);
+}
+
+.ui-check input:checked + .ui-check-box::after {
+  width: 8px;
+  height: 4px;
+  content: "";
+  border: solid #fff;
+  border-width: 0 0 2px 2px;
+  transform: rotate(-45deg);
+}
+
+.ui-check input:checked + .ui-radio-dot {
+  border-color: var(--selected);
+  box-shadow: inset 0 0 0 5px #fff;
+  background: var(--selected);
+}
+
+.ui-switch-track {
+  position: relative;
+  width: 42px;
+  height: 24px;
+  border-radius: 999px;
+  background: #c9cbd3;
+  transition: background 0.15s ease;
+}
+
+.ui-switch-thumb {
+  position: absolute;
+  top: 3px;
+  left: 3px;
+  width: 18px;
+  height: 18px;
+  border-radius: 999px;
+  background: #fff;
+  box-shadow: 0 1px 3px rgba(18, 18, 26, 0.25);
+  transition: transform 0.15s ease;
+}
+
+.ui-switch input:checked + .ui-switch-track {
+  background: var(--selected);
+}
+
+.ui-switch input:checked + .ui-switch-track .ui-switch-thumb {
+  transform: translateX(18px);
+}
+
+.ui-tabs {
+  display: grid;
+  gap: 14px;
+  min-width: 0;
+}
+
+.ui-tab-list {
+  display: flex;
+  gap: 4px;
+  min-width: 0;
+  overflow-x: auto;
+  border-bottom: 1px solid var(--line);
+}
+
+.ui-tab-list button {
+  position: relative;
+  min-width: max-content;
+  min-height: 38px;
+  padding: 0 12px;
+  border: 0;
+  color: var(--muted);
+  background: transparent;
+  font-weight: 800;
+}
+
+.ui-tab-list button.is-active {
+  color: var(--selected);
+}
+
+.ui-tab-list button.is-active::after {
+  position: absolute;
+  right: 10px;
+  bottom: -1px;
+  left: 10px;
+  height: 2px;
+  content: "";
+  background: var(--selected);
+  border-radius: 999px;
+}
+
+.ui-tab-panel {
+  min-width: 0;
+}
+
+.ui-badge {
+  display: inline-flex;
+  align-items: center;
+  min-height: 24px;
+  padding: 2px 8px;
+  border-radius: 999px;
+  font-size: 12px;
+  font-weight: 850;
+  white-space: nowrap;
+}
+
+.ui-badge-neutral {
+  color: var(--brand);
+  background: #ededf1;
+}
+
+.ui-badge-brand {
+  color: var(--brand);
+  background: var(--accent-soft);
+}
+
+.ui-badge-info {
+  color: #1d4ed8;
+  background: var(--selected-soft);
+}
+
+.ui-badge-success {
+  color: var(--success);
+  background: #eaf7ee;
+}
+
+.ui-badge-warning {
+  color: var(--warning);
+  background: #fff5e6;
+}
+
+.ui-badge-danger {
+  color: var(--danger);
+  background: #fef2f2;
+}
+
+.ui-alert {
+  display: grid;
+  gap: 3px;
+  padding: 12px 14px;
+  border: 1px solid #bad5ff;
+  border-radius: 8px;
+  color: #1e3a8a;
+  background: var(--selected-soft);
+}
+
+.ui-alert strong {
+  color: inherit;
+}
+
+.ui-alert span {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+}
+
+.ui-alert-warning {
+  color: #854d0e;
+  background: #fff8ed;
+  border-color: #f5d7a7;
+}
+
+.ui-alert-success {
+  color: #166534;
+  background: #eefbf2;
+  border-color: #b9e8c7;
+}
+
+.empty-state {
+  display: grid;
+  place-items: center;
+  gap: 4px;
+  min-height: 84px;
+  padding: 14px;
+  color: var(--muted);
+  text-align: center;
+}
+
+.empty-state strong {
+  color: var(--text);
+}
+
+.ui-progress {
+  height: 8px;
+  overflow: hidden;
+  background: #e5e7eb;
+  border-radius: 999px;
+}
+
+.ui-progress span {
+  display: block;
+  height: 100%;
+  background: var(--selected);
+}
+
+@media (max-width: 1120px) {
+  .prototype-app {
+    grid-template-columns: 220px minmax(0, 1fr);
+  }
+
+  .prototype-app.sidebar-collapsed {
+    grid-template-columns: 76px minmax(0, 1fr);
+  }
+
+  .metric-grid,
+  .settings-grid {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+
+  .master-detail,
+  .content-grid {
+    grid-template-columns: minmax(0, 1fr);
+  }
+}
+
+@media (max-width: 760px) {
+  .prototype-app,
+  .prototype-app.sidebar-collapsed {
+    grid-template-columns: minmax(0, 1fr);
+  }
+
+  .sidebar {
+    position: static;
+    height: auto;
+  }
+
+  .nav-group {
+    display: flex;
+    gap: 8px;
+    overflow-x: auto;
+    padding: 10px;
+  }
+
+  .sidebar-collapsed .brand-block {
+    grid-template-columns: 38px minmax(0, 1fr) 34px;
+    justify-items: stretch;
+    padding: 12px;
+  }
+
+  .sidebar-collapsed .brand-copy,
+  .sidebar-collapsed .nav-label {
+    display: grid;
+  }
+
+  .sidebar-collapsed .nav-status {
+    display: inline-block;
+  }
+
+  .sidebar-collapsed .nav-group p {
+    display: block;
+  }
+
+  .sidebar-collapsed .nav-short {
+    display: none;
+  }
+
+  .sidebar-collapsed .nav-group {
+    padding: 10px;
+  }
+
+  .sidebar-collapsed .nav-group button {
+    justify-content: flex-start;
+    min-height: 38px;
+    padding: 0 12px;
+  }
+
+  .nav-group p {
+    flex: 0 0 auto;
+    align-self: center;
+    margin: 0;
+  }
+
+  .nav-group button {
+    flex: 0 0 auto;
+    width: auto;
+  }
+
+  .topbar,
+  .page-title {
+    align-items: flex-start;
+    flex-direction: column;
+  }
+
+  .modal-backdrop {
+    align-items: stretch;
+    padding: 10px;
+  }
+
+  .modal-dialog {
+    max-height: calc(100vh - 20px);
+  }
+
+  .modal-head {
+    align-items: stretch;
+    flex-direction: column;
+  }
+
+  .topbar {
+    position: static;
+    padding: 12px;
+  }
+
+  .topbar-right {
+    justify-content: flex-start;
+  }
+
+  .page-content {
+    padding: 12px;
+  }
+
+  .metric-grid,
+  .settings-grid,
+  .role-grid,
+  .admin-form-grid,
+  .permission-options,
+  .match-grid,
+  .option-grid,
+  .rate-config-fields,
+  .code-grid {
+    grid-template-columns: minmax(0, 1fr);
+  }
+
+  .inline-control,
+  .time-range,
+  .prefix-rule {
+    align-items: stretch;
+    flex-direction: column;
+  }
+
+  .inline-control .ui-select {
+    flex-basis: auto;
+  }
+
+  .toolbar .ui-field,
+  .toolbar .ui-button,
+  .page-actions .ui-button {
+    flex: 1 1 100%;
+  }
+
+  .metric-card strong {
+    font-size: 22px;
+  }
+}
diff --git a/apps/web/vite.config.js b/apps/web/vite.config.js
new file mode 100644
index 0000000..e816e03
--- /dev/null
+++ b/apps/web/vite.config.js
@@ -0,0 +1,15 @@
+import react from '@vitejs/plugin-react';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+  plugins: [react()],
+  server: {
+    host: '127.0.0.1',
+    proxy: {
+      '/api/v2': 'http://127.0.0.1:3000'
+    }
+  },
+  preview: {
+    host: '127.0.0.1'
+  }
+});
diff --git a/apps/worker-cdr/package.json b/apps/worker-cdr/package.json
new file mode 100644
index 0000000..e074b0f
--- /dev/null
+++ b/apps/worker-cdr/package.json
@@ -0,0 +1,20 @@
+{
+  "name": "@lisglosips/worker-cdr",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/main.js",
+  "scripts": {
+    "dev": "cross-env LISGLOSIPS_SERVICE_NAME=worker-cdr tsx watch src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/main.js"
+  },
+  "dependencies": {
+    "@lisglosips/database": "workspace:*",
+    "@lisglosips/observability": "workspace:*",
+    "@lisglosips/redis": "workspace:*"
+  },
+  "devDependencies": {
+    "cross-env": "10.1.0"
+  }
+}
diff --git a/apps/worker-cdr/src/billing.ts b/apps/worker-cdr/src/billing.ts
new file mode 100644
index 0000000..bef47d9
--- /dev/null
+++ b/apps/worker-cdr/src/billing.ts
@@ -0,0 +1,36 @@
+import { Prisma } from '@lisglosips/database';
+
+export interface CycleRateInput {
+  durationSec: number;
+  billingCycleSec: number;
+  cycleRate: Prisma.Decimal | string | number;
+}
+
+export interface CycleCharge {
+  billSec: number;
+  cycles: number;
+  amount: Prisma.Decimal;
+}
+
+export function calculateCycleCharge(input: CycleRateInput): CycleCharge {
+  if (!Number.isInteger(input.durationSec) || input.durationSec < 0) {
+    throw new Error(`Invalid durationSec: ${input.durationSec}`);
+  }
+  if (!Number.isInteger(input.billingCycleSec) || input.billingCycleSec <= 0 || input.billingCycleSec > 60) {
+    throw new Error(`Invalid billingCycleSec: ${input.billingCycleSec}`);
+  }
+
+  const cycles = input.durationSec === 0 ? 0 : Math.ceil(input.durationSec / input.billingCycleSec);
+  const billSec = cycles * input.billingCycleSec;
+  const amount = new Prisma.Decimal(input.cycleRate).mul(cycles).toDecimalPlaces(6);
+
+  return {
+    billSec,
+    cycles,
+    amount
+  };
+}
+
+export function isBillableSipCode(sipCode: number): boolean {
+  return sipCode >= 200 && sipCode < 300;
+}
diff --git a/apps/worker-cdr/src/main.ts b/apps/worker-cdr/src/main.ts
new file mode 100644
index 0000000..10939fd
--- /dev/null
+++ b/apps/worker-cdr/src/main.ts
@@ -0,0 +1,113 @@
+import { createLogger } from '@lisglosips/observability';
+import { PrismaClient } from '@lisglosips/database';
+import {
+  CDR_CONSUMER_GROUP,
+  CDR_STREAM,
+  CdrRetryableError,
+  createRedisClient,
+  ensureCdrConsumerGroup,
+  processCdrBatch,
+  processPendingCdrBatch,
+  type CdrRedisCommands,
+  type CdrStreamHandler
+} from '@lisglosips/redis';
+import { CdrRatingService, PrismaCdrRatingStore } from './rating.js';
+
+const serviceName = process.env.LISGLOSIPS_SERVICE_NAME ?? 'worker-cdr';
+const logger = createLogger(serviceName, process.env.LISGLOSIPS_LOG_LEVEL ?? 'info');
+
+const redisUrl = process.env.REDIS_URL;
+const consumer = process.env.CDR_CONSUMER_NAME ?? `${serviceName}-${process.pid}`;
+const blockMs = Number.parseInt(process.env.CDR_BLOCK_MS ?? '5000', 10);
+const batchSize = Number.parseInt(process.env.CDR_BATCH_SIZE ?? '50', 10);
+const pendingIdleMs = Number.parseInt(process.env.CDR_PENDING_IDLE_MS ?? '60000', 10);
+
+let shuttingDown = false;
+
+async function main(): Promise<void> {
+  if (!redisUrl) {
+    throw new Error('REDIS_URL is required for worker-cdr');
+  }
+
+  const redis = createRedisClient(redisUrl);
+  const prisma = new PrismaClient();
+  const ratingService = new CdrRatingService(new PrismaCdrRatingStore(prisma));
+  const handler: CdrStreamHandler = async (event, redisId) => {
+    let result;
+    try {
+      result = await ratingService.rate(event);
+    } catch (error) {
+      if (isTransientDatabaseError(error)) {
+        throw new CdrRetryableError(error instanceof Error ? error.message : 'Transient database error');
+      }
+      throw error;
+    }
+    logger.info(
+      {
+        redisId,
+        eventId: event.event_id,
+        callId: event.call_id,
+        nodeId: event.node_id,
+        sipCode: event.sipCode,
+        configVersion: event.config_version,
+        rating: result
+      },
+      'CDR stream event rated'
+    );
+    return result.outcome === 'duplicate' ? 'duplicate' : 'processed';
+  };
+
+  await redis.connect();
+  await prisma.$connect();
+  const cdrRedis = redis as unknown as CdrRedisCommands;
+  await ensureCdrConsumerGroup(cdrRedis);
+  logger.info({ stream: CDR_STREAM, group: CDR_CONSUMER_GROUP, consumer }, 'CDR worker started');
+
+  while (!shuttingDown) {
+    const pending = await processPendingCdrBatch(cdrRedis, handler, {
+      consumer,
+      count: batchSize,
+      minIdleMs: pendingIdleMs
+    });
+    if (pending.processed || pending.duplicates || pending.deadlettered) {
+      logger.info(pending, 'CDR pending batch processed');
+    }
+
+    const fresh = await processCdrBatch(cdrRedis, handler, {
+      consumer,
+      count: batchSize,
+      blockMs
+    });
+    if (fresh.processed || fresh.duplicates || fresh.deadlettered) {
+      logger.info(fresh, 'CDR batch processed');
+    }
+  }
+
+  redis.disconnect();
+  await prisma.$disconnect();
+}
+
+process.on('SIGTERM', () => {
+  logger.info('CDR worker stopping');
+  shuttingDown = true;
+});
+
+process.on('SIGINT', () => {
+  logger.info('CDR worker stopping');
+  shuttingDown = true;
+});
+
+main().catch((error: unknown) => {
+  logger.error({ error }, 'CDR worker failed');
+  process.exit(1);
+});
+
+function isTransientDatabaseError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error);
+  return (
+    message.includes("Can't reach database server") ||
+    message.includes('Timed out fetching a new connection') ||
+    message.includes('Connection terminated') ||
+    message.includes('ECONNREFUSED')
+  );
+}
diff --git a/apps/worker-cdr/src/rating.spec.ts b/apps/worker-cdr/src/rating.spec.ts
new file mode 100644
index 0000000..2666fab
--- /dev/null
+++ b/apps/worker-cdr/src/rating.spec.ts
@@ -0,0 +1,139 @@
+import { describe, expect, it } from 'vitest';
+
+import { Prisma } from '@lisglosips/database';
+import type { ParsedCdrStreamEvent } from '@lisglosips/redis';
+
+import { calculateCycleCharge } from './billing.js';
+import { CdrRatingService, type CdrRatingStore, type CdrRatingTransaction, type CreateCustomerChargeInput, type CreateRatedInput } from './rating.js';
+
+class MemoryStore implements CdrRatingStore, CdrRatingTransaction {
+  rawByEventId = new Map<string, { id: string; eventId: string; ratingStatus: 'UNRATED' | 'RATED' | 'SKIPPED' | 'FAILED' }>();
+  ratedByRawId = new Map<string, { id: string; rawCdrId: string; customerFee: Prisma.Decimal }>();
+  vendorGateway = { id: 'vgw_1', vendorId: 'ven_1', billingCycleSec: 6, cycleRate: new Prisma.Decimal('0.012000') };
+  customer = { id: 'cus_1', balance: new Prisma.Decimal('10.000000') };
+  charges: CreateCustomerChargeInput[] = [];
+
+  async transaction<T>(operation: (tx: CdrRatingTransaction) => Promise<T>): Promise<T> {
+    return operation(this);
+  }
+
+  async findRawByEventId(eventId: string) {
+    return this.rawByEventId.get(eventId) ?? null;
+  }
+
+  async createRaw(event: ParsedCdrStreamEvent, rawCdrId: string) {
+    const raw = { id: rawCdrId, eventId: event.event_id, ratingStatus: 'UNRATED' as const };
+    this.rawByEventId.set(event.event_id, raw);
+    return raw;
+  }
+
+  async findRatedByRawCdrId(rawCdrId: string) {
+    return this.ratedByRawId.get(rawCdrId) ?? null;
+  }
+
+  async findVendorGateway() {
+    return this.vendorGateway;
+  }
+
+  async lockCustomer() {
+    return this.customer;
+  }
+
+  async createRated(input: CreateRatedInput) {
+    const rated = { id: input.id, rawCdrId: input.rawCdrId, customerFee: input.customerFee };
+    this.ratedByRawId.set(input.rawCdrId, rated);
+    return rated;
+  }
+
+  async markRawStatus(rawCdrId: string, status: 'RATED' | 'SKIPPED' | 'FAILED'): Promise<void> {
+    for (const [eventId, raw] of this.rawByEventId) {
+      if (raw.id === rawCdrId) {
+        this.rawByEventId.set(eventId, { ...raw, ratingStatus: status });
+      }
+    }
+  }
+
+  async createCustomerCharge(input: CreateCustomerChargeInput): Promise<void> {
+    this.charges.push(input);
+  }
+
+  async updateCustomerBalance(_customerId: string, balance: Prisma.Decimal): Promise<void> {
+    this.customer.balance = balance;
+  }
+}
+
+function event(overrides: Partial<ParsedCdrStreamEvent> = {}): ParsedCdrStreamEvent {
+  return {
+    schema_version: '1',
+    event_id: 'evt_1',
+    idempotency_key: 'call_1:2026-06-21T00:00:30.000Z',
+    call_id: 'call_1',
+    node_id: 'a1',
+    opensips_instance: 'opensips-a1',
+    ingress_a_ip: '100.90.90.90',
+    rtpengine_node: 'a1',
+    customer_id: 'cus_1',
+    customer_gateway_id: 'cgw_1',
+    customer_gateway_policy_id: 'cgp_1',
+    source_ip: '100.93.185.30',
+    caller: '1001',
+    callee: '13800138000',
+    vendor_id: 'ven_1',
+    vendor_gateway_id: 'vgw_1',
+    line_group_id: 'lg_1',
+    started_at: '2026-06-21T00:00:00.000Z',
+    answered_at: '2026-06-21T00:00:02.000Z',
+    ended_at: '2026-06-21T00:00:30.000Z',
+    duration_sec: '28',
+    sip_code: '200',
+    hangup_reason: 'NORMAL_CLEARING',
+    recording_key: '',
+    config_version: '1',
+    created_at: '2026-06-21T00:00:31.000Z',
+    durationSeconds: 28,
+    sipCode: 200,
+    ...overrides
+  };
+}
+
+describe('S23 CDR rating', () => {
+  it('calculates Decimal cycle charges with ceiling billing seconds', () => {
+    const charge = calculateCycleCharge({ durationSec: 28, billingCycleSec: 6, cycleRate: '0.012000' });
+
+    expect(charge.cycles).toBe(5);
+    expect(charge.billSec).toBe(30);
+    expect(charge.amount.toFixed(6)).toBe('0.060000');
+  });
+
+  it('rates a successful CDR and deducts customer balance once', async () => {
+    const store = new MemoryStore();
+    const service = new CdrRatingService(store);
+
+    const result = await service.rate(event());
+    const duplicate = await service.rate(event());
+
+    expect(result).toMatchObject({
+      outcome: 'rated',
+      customerFee: '0.060000',
+      vendorCost: '0.060000',
+      grossProfit: '0.000000',
+      billSec: 30
+    });
+    expect(duplicate.outcome).toBe('duplicate');
+    expect(store.customer.balance.toFixed(6)).toBe('9.940000');
+    expect(store.charges).toHaveLength(1);
+    expect(store.charges[0]?.amount.toFixed(6)).toBe('-0.060000');
+  });
+
+  it('skips failed or zero-duration CDRs without balance changes', async () => {
+    const store = new MemoryStore();
+    const service = new CdrRatingService(store);
+
+    const result = await service.rate(event({ event_id: 'evt_failed', sip_code: '503', sipCode: 503, duration_sec: '0', durationSeconds: 0 }));
+
+    expect(result.outcome).toBe('skipped');
+    expect(result.customerFee).toBe('0.000000');
+    expect(store.customer.balance.toFixed(6)).toBe('10.000000');
+    expect(store.charges).toHaveLength(0);
+  });
+});
diff --git a/apps/worker-cdr/src/rating.ts b/apps/worker-cdr/src/rating.ts
new file mode 100644
index 0000000..352542c
--- /dev/null
+++ b/apps/worker-cdr/src/rating.ts
@@ -0,0 +1,380 @@
+import crypto from 'node:crypto';
+
+import { Prisma, PrismaClient } from '@lisglosips/database';
+import type { ParsedCdrStreamEvent } from '@lisglosips/redis';
+
+import { calculateCycleCharge, isBillableSipCode } from './billing.js';
+
+export type RatingOutcome = 'rated' | 'skipped' | 'duplicate' | 'failed';
+
+export interface RatingResult {
+  outcome: RatingOutcome;
+  rawCdrId: string;
+  ratedCdrId?: string;
+  customerFee: string;
+  vendorCost: string;
+  grossProfit: string;
+  billSec: number;
+}
+
+interface StoredRawCdr {
+  id: string;
+  eventId: string;
+  ratingStatus: 'UNRATED' | 'RATED' | 'SKIPPED' | 'FAILED';
+}
+
+interface StoredRatedCdr {
+  id: string;
+  rawCdrId: string;
+}
+
+interface StoredVendorGateway {
+  id: string;
+  vendorId: string;
+  billingCycleSec: number;
+  cycleRate: Prisma.Decimal;
+}
+
+interface LockedCustomer {
+  id: string;
+  balance: Prisma.Decimal;
+}
+
+export interface CdrRatingTransaction {
+  findRawByEventId(eventId: string): Promise<StoredRawCdr | null>;
+  createRaw(event: ParsedCdrStreamEvent, rawCdrId: string): Promise<StoredRawCdr>;
+  findRatedByRawCdrId(rawCdrId: string): Promise<StoredRatedCdr | null>;
+  findVendorGateway(vendorGatewayId: string): Promise<StoredVendorGateway | null>;
+  lockCustomer(customerId: string): Promise<LockedCustomer | null>;
+  createRated(input: CreateRatedInput): Promise<StoredRatedCdr>;
+  markRawStatus(rawCdrId: string, status: 'RATED' | 'SKIPPED' | 'FAILED'): Promise<void>;
+  createCustomerCharge(input: CreateCustomerChargeInput): Promise<void>;
+  updateCustomerBalance(customerId: string, balance: Prisma.Decimal): Promise<void>;
+}
+
+export interface CdrRatingStore {
+  transaction<T>(operation: (tx: CdrRatingTransaction) => Promise<T>): Promise<T>;
+}
+
+export interface CreateRatedInput {
+  id: string;
+  rawCdrId: string;
+  billSec: number;
+  customerFee: Prisma.Decimal;
+  vendorCost: Prisma.Decimal;
+  grossProfit: Prisma.Decimal;
+  customerRate: Prisma.InputJsonValue;
+  vendorRate: Prisma.InputJsonValue;
+}
+
+export interface CreateCustomerChargeInput {
+  id: string;
+  customerId: string;
+  rawCdrId: string;
+  eventId: string;
+  amount: Prisma.Decimal;
+  beforeBalance: Prisma.Decimal;
+  afterBalance: Prisma.Decimal;
+}
+
+export class CdrRatingService {
+  constructor(private readonly store: CdrRatingStore) {}
+
+  async rate(event: ParsedCdrStreamEvent): Promise<RatingResult> {
+    return this.store.transaction(async (tx) => {
+      const existing = await tx.findRawByEventId(event.event_id);
+      if (existing) {
+        const rated = await tx.findRatedByRawCdrId(existing.id);
+        return {
+          outcome: 'duplicate',
+          rawCdrId: existing.id,
+          ratedCdrId: rated?.id,
+          customerFee: '0.000000',
+          vendorCost: '0.000000',
+          grossProfit: '0.000000',
+          billSec: 0
+        };
+      }
+
+      const raw = await tx.createRaw(event, prefixedId('raw'));
+      if (!isBillableSipCode(event.sipCode) || event.durationSeconds <= 0) {
+        await tx.markRawStatus(raw.id, 'SKIPPED');
+        return zeroResult('skipped', raw.id);
+      }
+
+      if (!billableId(event.customer_id) || !billableId(event.vendor_gateway_id)) {
+        await tx.markRawStatus(raw.id, 'SKIPPED');
+        return zeroResult('skipped', raw.id);
+      }
+
+      const vendorGateway = await tx.findVendorGateway(event.vendor_gateway_id);
+      const customer = await tx.lockCustomer(event.customer_id);
+      if (!vendorGateway || !customer) {
+        await tx.markRawStatus(raw.id, 'FAILED');
+        return zeroResult('failed', raw.id);
+      }
+
+      const vendorCharge = calculateCycleCharge({
+        durationSec: event.durationSeconds,
+        billingCycleSec: vendorGateway.billingCycleSec,
+        cycleRate: vendorGateway.cycleRate
+      });
+      const customerFee = vendorCharge.amount;
+      const vendorCost = vendorCharge.amount;
+      const grossProfit = customerFee.minus(vendorCost).toDecimalPlaces(6);
+      const afterBalance = customer.balance.minus(customerFee).toDecimalPlaces(6);
+      const ratedId = prefixedId('rated');
+
+      await tx.createRated({
+        id: ratedId,
+        rawCdrId: raw.id,
+        billSec: vendorCharge.billSec,
+        customerFee,
+        vendorCost,
+        grossProfit,
+        customerRate: {
+          source: 'S23_MINIMAL_MIRROR_VENDOR_RATE',
+          billingCycleSec: vendorGateway.billingCycleSec,
+          cycleRate: vendorGateway.cycleRate.toFixed(6)
+        },
+        vendorRate: {
+          source: 'vendor_gateway',
+          vendorGatewayId: vendorGateway.id,
+          billingCycleSec: vendorGateway.billingCycleSec,
+          cycleRate: vendorGateway.cycleRate.toFixed(6)
+        }
+      });
+      await tx.createCustomerCharge({
+        id: prefixedId('cdrchg'),
+        customerId: customer.id,
+        rawCdrId: raw.id,
+        eventId: event.event_id,
+        amount: customerFee.negated().toDecimalPlaces(6),
+        beforeBalance: customer.balance,
+        afterBalance
+      });
+      await tx.updateCustomerBalance(customer.id, afterBalance);
+      await tx.markRawStatus(raw.id, 'RATED');
+
+      return {
+        outcome: 'rated',
+        rawCdrId: raw.id,
+        ratedCdrId: ratedId,
+        customerFee: customerFee.toFixed(6),
+        vendorCost: vendorCost.toFixed(6),
+        grossProfit: grossProfit.toFixed(6),
+        billSec: vendorCharge.billSec
+      };
+    });
+  }
+}
+
+export class PrismaCdrRatingStore implements CdrRatingStore {
+  constructor(private readonly prisma: PrismaClient) {}
+
+  async transaction<T>(operation: (tx: CdrRatingTransaction) => Promise<T>): Promise<T> {
+    return this.prisma.$transaction(async (tx) => operation(new PrismaCdrRatingTransaction(tx)), {
+      isolationLevel: Prisma.TransactionIsolationLevel.ReadCommitted,
+      timeout: 30000
+    });
+  }
+}
+
+class PrismaCdrRatingTransaction implements CdrRatingTransaction {
+  constructor(private readonly tx: Prisma.TransactionClient) {}
+
+  async findRawByEventId(eventId: string): Promise<StoredRawCdr | null> {
+    return this.tx.rawCdr.findUnique({
+      where: { eventId: storageEventId(eventId) },
+      select: { id: true, eventId: true, ratingStatus: true }
+    });
+  }
+
+  async createRaw(event: ParsedCdrStreamEvent, rawCdrId: string): Promise<StoredRawCdr> {
+    return this.tx.rawCdr.create({
+      data: {
+        id: rawCdrId,
+        eventId: storageEventId(event.event_id),
+        callId: event.call_id,
+        customerId: nullableId(event.customer_id),
+        customerGatewayId: nullableId(event.customer_gateway_id),
+        customerGatewayPolicyId: nullableId(event.customer_gateway_policy_id),
+        sourceIp: emptyToNull(event.source_ip),
+        caller: event.caller || 'unknown',
+        callee: event.callee || 'unknown',
+        vendorId: nullableId(event.vendor_id),
+        vendorGatewayId: nullableId(event.vendor_gateway_id),
+        lineGroupId: nullableId(event.line_group_id),
+        startedAt: parseCdrDate(event.started_at, event.created_at),
+        answeredAt: parseOptionalCdrDate(event.answered_at),
+        endedAt: parseCdrDate(event.ended_at, event.created_at),
+        durationSec: event.durationSeconds,
+        sipCode: event.sipCode,
+        hangupReason: emptyToNull(event.hangup_reason),
+        recordingKey: emptyToNull(event.recording_key),
+        configVersion: parseOptionalInt(event.config_version),
+        ratingStatus: 'UNRATED',
+        payload: eventToJson(event)
+      },
+      select: { id: true, eventId: true, ratingStatus: true }
+    });
+  }
+
+  async findRatedByRawCdrId(rawCdrId: string): Promise<StoredRatedCdr | null> {
+    return this.tx.ratedCdr.findUnique({
+      where: { rawCdrId },
+      select: { id: true, rawCdrId: true }
+    });
+  }
+
+  async findVendorGateway(vendorGatewayId: string): Promise<StoredVendorGateway | null> {
+    return this.tx.vendorGateway.findUnique({
+      where: { id: vendorGatewayId },
+      select: { id: true, vendorId: true, billingCycleSec: true, cycleRate: true }
+    });
+  }
+
+  async lockCustomer(customerId: string): Promise<LockedCustomer | null> {
+    const [customer] = await this.tx.$queryRaw<LockedCustomer[]>`SELECT id, balance FROM customers WHERE id = ${customerId} AND deleted_at IS NULL FOR UPDATE`;
+    return customer ?? null;
+  }
+
+  async createRated(input: CreateRatedInput): Promise<StoredRatedCdr> {
+    return this.tx.ratedCdr.create({
+      data: input,
+      select: { id: true, rawCdrId: true }
+    });
+  }
+
+  async markRawStatus(rawCdrId: string, status: 'RATED' | 'SKIPPED' | 'FAILED'): Promise<void> {
+    await this.tx.rawCdr.update({
+      where: { id: rawCdrId },
+      data: { ratingStatus: status }
+    });
+  }
+
+  async createCustomerCharge(input: CreateCustomerChargeInput): Promise<void> {
+    await this.tx.customerRecharge.create({
+      data: {
+        id: input.id,
+        customerId: input.customerId,
+        amount: input.amount,
+        beforeBalance: input.beforeBalance,
+        afterBalance: input.afterBalance,
+        idempotencyKey: `cdr:${input.eventId}`,
+        remark: `CDR_CHARGE:${input.rawCdrId}`,
+        status: 'SUCCEEDED',
+        createdBy: 'worker-cdr'
+      }
+    });
+  }
+
+  async updateCustomerBalance(customerId: string, balance: Prisma.Decimal): Promise<void> {
+    await this.tx.customer.update({
+      where: { id: customerId },
+      data: {
+        balance,
+        updatedBy: 'worker-cdr',
+        version: { increment: 1 }
+      }
+    });
+  }
+}
+
+function storageEventId(eventId: string): string {
+  if (eventId.length <= 64) {
+    return eventId;
+  }
+  const hash = crypto.createHash('sha256').update(eventId).digest('hex').slice(0, 16);
+  return `${eventId.slice(0, 47)}-${hash}`;
+}
+
+function zeroResult(outcome: RatingOutcome, rawCdrId: string): RatingResult {
+  return {
+    outcome,
+    rawCdrId,
+    customerFee: '0.000000',
+    vendorCost: '0.000000',
+    grossProfit: '0.000000',
+    billSec: 0
+  };
+}
+
+function prefixedId(prefix: string): string {
+  return `${prefix}_${crypto.randomUUID().replaceAll('-', '').slice(0, 32)}`;
+}
+
+function billableId(value: string): boolean {
+  return Boolean(nullableId(value));
+}
+
+function nullableId(value: string): string | null {
+  const normalized = value.trim();
+  if (!normalized || normalized === 'none' || normalized === 'unknown' || normalized === 'no_active_version') {
+    return null;
+  }
+  return normalized;
+}
+
+function emptyToNull(value: string): string | null {
+  const normalized = value.trim();
+  return !normalized || normalized === 'none' ? null : normalized;
+}
+
+function parseOptionalInt(value: string): number | null {
+  if (!value || value === 'none') {
+    return null;
+  }
+  const parsed = Number.parseInt(value, 10);
+  return Number.isInteger(parsed) ? parsed : null;
+}
+
+function parseOptionalCdrDate(value: string): Date | null {
+  if (!value || value === 'none') {
+    return null;
+  }
+  return parseCdrDate(value, value);
+}
+
+function parseCdrDate(value: string, fallback: string): Date {
+  const candidate = value && value !== 'none' ? value : fallback;
+  if (/^\d+$/.test(candidate)) {
+    return new Date(Number.parseInt(candidate, 10) * 1000);
+  }
+  const parsed = new Date(candidate);
+  if (Number.isNaN(parsed.getTime())) {
+    return new Date();
+  }
+  return parsed;
+}
+
+function eventToJson(event: ParsedCdrStreamEvent): Prisma.InputJsonValue {
+  return {
+    schema_version: event.schema_version,
+    event_id: event.event_id,
+    idempotency_key: event.idempotency_key,
+    call_id: event.call_id,
+    node_id: event.node_id,
+    opensips_instance: event.opensips_instance,
+    ingress_a_ip: event.ingress_a_ip,
+    rtpengine_node: event.rtpengine_node,
+    source_ip: event.source_ip,
+    caller: event.caller,
+    callee: event.callee,
+    customer_id: event.customer_id,
+    customer_gateway_id: event.customer_gateway_id,
+    customer_gateway_policy_id: event.customer_gateway_policy_id,
+    vendor_id: event.vendor_id,
+    vendor_gateway_id: event.vendor_gateway_id,
+    line_group_id: event.line_group_id,
+    started_at: event.started_at,
+    answered_at: event.answered_at,
+    ended_at: event.ended_at,
+    duration_sec: event.duration_sec,
+    sip_code: event.sip_code,
+    hangup_reason: event.hangup_reason,
+    recording_key: event.recording_key,
+    config_version: event.config_version,
+    created_at: event.created_at
+  };
+}
diff --git a/apps/worker-cdr/tsconfig.json b/apps/worker-cdr/tsconfig.json
new file mode 100644
index 0000000..a9d0c92
--- /dev/null
+++ b/apps/worker-cdr/tsconfig.json
@@ -0,0 +1,15 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "tsBuildInfoFile": "dist/tsconfig.tsbuildinfo"
+  },
+  "references": [
+    { "path": "../../packages/database" },
+    { "path": "../../packages/observability" },
+    { "path": "../../packages/redis" }
+  ],
+  "include": ["src/**/*.ts"]
+}
diff --git a/apps/worker-config-publisher/package.json b/apps/worker-config-publisher/package.json
new file mode 100644
index 0000000..c00d0eb
--- /dev/null
+++ b/apps/worker-config-publisher/package.json
@@ -0,0 +1,20 @@
+{
+  "name": "@lisglosips/worker-config-publisher",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/main.js",
+  "scripts": {
+    "dev": "cross-env LISGLOSIPS_SERVICE_NAME=worker-config-publisher tsx watch src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/main.js"
+  },
+  "dependencies": {
+    "@prisma/client": "6.19.0",
+    "@lisglosips/observability": "workspace:*",
+    "@lisglosips/redis": "workspace:*"
+  },
+  "devDependencies": {
+    "cross-env": "10.1.0"
+  }
+}
diff --git a/apps/worker-config-publisher/src/main.ts b/apps/worker-config-publisher/src/main.ts
new file mode 100644
index 0000000..6f49f0e
--- /dev/null
+++ b/apps/worker-config-publisher/src/main.ts
@@ -0,0 +1,54 @@
+import { PrismaClient } from '@prisma/client';
+import { createLogger } from '@lisglosips/observability';
+import { createRedisClient } from '@lisglosips/redis';
+import { publishPendingConfig } from './publisher.js';
+
+const serviceName = process.env.LISGLOSIPS_SERVICE_NAME ?? 'worker-config-publisher';
+const logger = createLogger(serviceName, process.env.LISGLOSIPS_LOG_LEVEL ?? 'info');
+const prisma = new PrismaClient();
+const redis = createRedisClient(process.env.REDIS_URL ?? 'redis://127.0.0.1:6379/0');
+let stopping = false;
+
+async function tick(): Promise<void> {
+  const result = await publishPendingConfig(prisma, redis);
+  if (result.published) {
+    logger.info(
+      {
+        version: result.version,
+        previousVersion: result.previousVersion,
+        outboxCount: result.outboxIds.length,
+        manifest: result.manifest
+      },
+      'Config snapshot published'
+    );
+  }
+}
+
+async function loop(): Promise<void> {
+  await redis.connect();
+  logger.info('Config publisher started');
+  while (!stopping) {
+    try {
+      await tick();
+    } catch (error) {
+      logger.error({ error }, 'Config publisher tick failed');
+    }
+    await new Promise((resolve) => setTimeout(resolve, 2000));
+  }
+}
+
+async function shutdown(): Promise<void> {
+  stopping = true;
+  logger.info('Config publisher stopping');
+  await redis.quit();
+  await prisma.$disconnect();
+}
+
+process.on('SIGTERM', () => {
+  void shutdown().finally(() => process.exit(0));
+});
+process.on('SIGINT', () => {
+  void shutdown().finally(() => process.exit(0));
+});
+
+void loop();
diff --git a/apps/worker-config-publisher/src/publisher.ts b/apps/worker-config-publisher/src/publisher.ts
new file mode 100644
index 0000000..8dbefa0
--- /dev/null
+++ b/apps/worker-config-publisher/src/publisher.ts
@@ -0,0 +1,357 @@
+import crypto from 'node:crypto';
+import type { PrismaClient } from '@prisma/client';
+import {
+  CONFIG_ACTIVE_VERSION_KEY,
+  CONFIG_PREVIOUS_VERSION_KEY,
+  configVersionManifestKey,
+  configVersionPrefix,
+  type RedisClient
+} from '@lisglosips/redis';
+
+export interface PublishConfigResult {
+  published: boolean;
+  version?: string;
+  previousVersion?: string | null;
+  outboxIds: string[];
+  manifest?: ConfigManifest;
+}
+
+export interface ConfigManifest {
+  version: string;
+  generatedAt: string;
+  customerCount: number;
+  gatewayCount: number;
+  policyCount: number;
+  vendorGatewayCount: number;
+  lineGroupCount: number;
+  checksum: string;
+}
+
+type ConfigSnapshot = {
+  customers: Array<{
+    id: string;
+    status: string;
+    balance: string;
+    creditLimit: string;
+    minBalance: string;
+  }>;
+  gateways: Array<{
+    id: string;
+    customerId: string;
+    authMode: string;
+    sourceIp: string | null;
+    sipUsername: string | null;
+    sipDomain: string | null;
+    sipHa1: string | null;
+    status: string;
+  }>;
+  policies: Array<{
+    id: string;
+    customerId: string;
+    gatewayId: string;
+    lineGroupId: string;
+    priority: number;
+    callerMode: string;
+    callerValue: string | null;
+    calleeMode: string;
+    calleeValue: string | null;
+    status: string;
+  }>;
+  vendorGateways: Array<{
+    id: string;
+    vendorId: string;
+    authMode: string;
+    host: string;
+    port: number;
+    transport: string;
+    sipUsername: string | null;
+    sipHa1: string | null;
+    cpsLimit: number;
+    concurrencyLimit: number;
+    billingCycleSec: number;
+    cycleRate: string;
+    status: string;
+    forbiddenPeriods: Array<{ weekdayMask: number; startTime: string; endTime: string }>;
+    codecs: Array<{ codec: string; priority: number }>;
+    prefixRules: Array<{ direction: string; matchPrefix: string; replacePrefix: string; priority: number }>;
+  }>;
+  lineGroups: Array<{
+    id: string;
+    name: string;
+    status: string;
+    items: Array<{
+      id: string;
+      vendorGatewayId: string;
+      priority: number;
+      weight: number;
+      concurrencyCap: number;
+      status: string;
+    }>;
+  }>;
+};
+
+export async function publishPendingConfig(prisma: PrismaClient, redis: RedisClient, now = new Date()): Promise<PublishConfigResult> {
+  const pending = await prisma.outboxEvent.findMany({
+    where: {
+      aggregateType: { in: ['customer_gateway_config', 'vendor_gateway_config', 'line_group_config'] },
+      status: 'PENDING',
+      availableAt: { lte: now }
+    },
+    orderBy: [{ createdAt: 'asc' }],
+    take: 100
+  });
+
+  if (pending.length === 0) {
+    return { published: false, outboxIds: [] };
+  }
+
+  const lockedAt = now;
+  const locked = await prisma.outboxEvent.updateMany({
+    where: {
+      id: { in: pending.map((event) => event.id) },
+      status: 'PENDING'
+    },
+    data: {
+      status: 'PROCESSING',
+      lockedAt,
+      attempts: { increment: 1 }
+    }
+  });
+
+  if (locked.count === 0) {
+    return { published: false, outboxIds: [] };
+  }
+
+  const processingIds = pending.map((event) => event.id);
+  try {
+    const snapshot = await loadSnapshot(prisma);
+    const version = `${now.getTime()}`;
+    const previousVersion = await redis.get(CONFIG_ACTIVE_VERSION_KEY);
+    const manifest = await writeSnapshot(redis, version, snapshot, previousVersion, now);
+
+    await prisma.outboxEvent.updateMany({
+      where: { id: { in: processingIds }, status: 'PROCESSING' },
+      data: {
+        status: 'PUBLISHED',
+        processedAt: new Date(),
+        lastError: null
+      }
+    });
+
+    return {
+      published: true,
+      version,
+      previousVersion,
+      outboxIds: processingIds,
+      manifest
+    };
+  } catch (error) {
+    await prisma.outboxEvent.updateMany({
+      where: { id: { in: processingIds }, status: 'PROCESSING' },
+      data: {
+        status: 'FAILED',
+        lastError: error instanceof Error ? error.message.slice(0, 1000) : 'Unknown publish error'
+      }
+    });
+    throw error;
+  }
+}
+
+export async function rollbackActiveConfig(redis: RedisClient): Promise<{ rolledBack: boolean; activeVersion: string | null; previousVersion: string | null }> {
+  const activeVersion = await redis.get(CONFIG_ACTIVE_VERSION_KEY);
+  const previousVersion = await redis.get(CONFIG_PREVIOUS_VERSION_KEY);
+  if (!previousVersion) {
+    return { rolledBack: false, activeVersion, previousVersion };
+  }
+
+  await redis
+    .multi()
+    .set(CONFIG_ACTIVE_VERSION_KEY, previousVersion)
+    .set(CONFIG_PREVIOUS_VERSION_KEY, activeVersion ?? '')
+    .exec();
+
+  return { rolledBack: true, activeVersion: previousVersion, previousVersion: activeVersion };
+}
+
+async function loadSnapshot(prisma: PrismaClient): Promise<ConfigSnapshot> {
+  const [customers, gateways, policies, vendorGateways, lineGroups] = await prisma.$transaction([
+    prisma.customer.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ id: 'asc' }]
+    }),
+    prisma.customerGateway.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ id: 'asc' }]
+    }),
+    prisma.customerGatewayPolicy.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ gatewayId: 'asc' }, { priority: 'asc' }]
+    }),
+    prisma.vendorGateway.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ id: 'asc' }],
+      include: {
+        forbiddenPeriods: { orderBy: [{ weekdayMask: 'asc' }, { startTime: 'asc' }] },
+        codecs: { orderBy: [{ priority: 'asc' }] },
+        prefixRules: { orderBy: [{ direction: 'asc' }, { priority: 'asc' }] }
+      }
+    }),
+    prisma.landingLineGroup.findMany({
+      where: { deletedAt: null },
+      orderBy: [{ id: 'asc' }],
+      include: {
+        items: { orderBy: [{ priority: 'asc' }] }
+      }
+    })
+  ]);
+
+  return {
+    customers: customers.map((customer) => ({
+      id: customer.id,
+      status: customer.status,
+      balance: customer.balance.toFixed(6),
+      creditLimit: customer.creditLimit.toFixed(6),
+      minBalance: customer.minBalance.toFixed(6)
+    })),
+    gateways: gateways.map((gateway) => ({
+      id: gateway.id,
+      customerId: gateway.customerId,
+      authMode: gateway.authMode,
+      sourceIp: gateway.sourceIp,
+      sipUsername: gateway.sipUsername,
+      sipDomain: gateway.sipDomain,
+      sipHa1: gateway.sipHa1,
+      status: gateway.status
+    })),
+    policies: policies.map((policy) => ({
+      id: policy.id,
+      customerId: policy.customerId,
+      gatewayId: policy.gatewayId,
+      lineGroupId: policy.lineGroupId,
+      priority: policy.priority,
+      callerMode: policy.callerMode,
+      callerValue: policy.callerValue,
+      calleeMode: policy.calleeMode,
+      calleeValue: policy.calleeValue,
+      status: policy.status
+    })),
+    vendorGateways: vendorGateways.map((gateway) => ({
+      id: gateway.id,
+      vendorId: gateway.vendorId,
+      authMode: gateway.authMode,
+      host: gateway.host,
+      port: gateway.port,
+      transport: gateway.transport,
+      sipUsername: gateway.sipUsername,
+      sipHa1: gateway.sipHa1,
+      cpsLimit: gateway.cpsLimit,
+      concurrencyLimit: gateway.concurrencyLimit,
+      billingCycleSec: gateway.billingCycleSec,
+      cycleRate: gateway.cycleRate.toFixed(6),
+      status: gateway.status,
+      forbiddenPeriods: gateway.forbiddenPeriods.map((period) => ({
+        weekdayMask: period.weekdayMask,
+        startTime: period.startTime,
+        endTime: period.endTime
+      })),
+      codecs: gateway.codecs.map((codec) => ({
+        codec: codec.codec,
+        priority: codec.priority
+      })),
+      prefixRules: gateway.prefixRules.map((rule) => ({
+        direction: rule.direction,
+        matchPrefix: rule.matchPrefix,
+        replacePrefix: rule.replacePrefix,
+        priority: rule.priority
+      }))
+    })),
+    lineGroups: lineGroups.map((group) => ({
+      id: group.id,
+      name: group.name,
+      status: group.status,
+      items: group.items.map((item) => ({
+        id: item.id,
+        vendorGatewayId: item.vendorGatewayId,
+        priority: item.priority,
+        weight: item.weight,
+        concurrencyCap: item.concurrencyCap,
+        status: item.status
+      }))
+    }))
+  };
+}
+
+async function writeSnapshot(
+  redis: RedisClient,
+  version: string,
+  snapshot: ConfigSnapshot,
+  previousVersion: string | null,
+  now: Date
+): Promise<ConfigManifest> {
+  const prefix = configVersionPrefix(version);
+  const checksum = crypto.createHash('sha256').update(stableJson(snapshot)).digest('hex');
+  const manifest: ConfigManifest = {
+    version,
+    generatedAt: now.toISOString(),
+    customerCount: snapshot.customers.length,
+    gatewayCount: snapshot.gateways.length,
+    policyCount: snapshot.policies.length,
+    vendorGatewayCount: snapshot.vendorGateways.length,
+    lineGroupCount: snapshot.lineGroups.length,
+    checksum
+  };
+
+  const multi = redis.multi();
+  multi.set(configVersionManifestKey(version), JSON.stringify(manifest));
+
+  for (const customer of snapshot.customers) {
+    multi.set(`${prefix}:customer:${customer.id}`, JSON.stringify(customer));
+  }
+  for (const gateway of snapshot.gateways) {
+    multi.set(`${prefix}:customer_gateway:${gateway.id}`, JSON.stringify(gateway));
+    if ((gateway.authMode === 'IP' || gateway.authMode === 'MIXED') && gateway.sourceIp) {
+      multi.set(`${prefix}:auth:ip:${gateway.sourceIp}`, gateway.id);
+    }
+    if ((gateway.authMode === 'SIP_DIGEST' || gateway.authMode === 'MIXED') && gateway.sipUsername && gateway.sipDomain) {
+      multi.set(`${prefix}:auth:sip:${gateway.sipUsername}@${gateway.sipDomain}`, gateway.id);
+    }
+  }
+  for (const policy of snapshot.policies) {
+    multi.rpush(`${prefix}:customer_gateway:${policy.gatewayId}:policies`, JSON.stringify(policy));
+  }
+  for (const gateway of snapshot.vendorGateways) {
+    multi.set(`${prefix}:vendor_gateway:${gateway.id}`, JSON.stringify(gateway));
+  }
+  for (const lineGroup of snapshot.lineGroups) {
+    multi.set(`${prefix}:line_group:${lineGroup.id}`, JSON.stringify(lineGroup));
+    for (const item of lineGroup.items) {
+      multi.rpush(`${prefix}:line_group:${lineGroup.id}:items`, JSON.stringify(item));
+    }
+  }
+
+  if (previousVersion) {
+    multi.set(CONFIG_PREVIOUS_VERSION_KEY, previousVersion);
+  }
+  multi.set(CONFIG_ACTIVE_VERSION_KEY, version);
+  await multi.exec();
+
+  return manifest;
+}
+
+function stableJson(value: unknown): string {
+  return JSON.stringify(value, Object.keys(flattenKeys(value)).sort());
+}
+
+function flattenKeys(value: unknown, keys: Record<string, true> = {}): Record<string, true> {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      flattenKeys(item, keys);
+    }
+  } else if (value && typeof value === 'object') {
+    for (const [key, nested] of Object.entries(value as Record<string, unknown>)) {
+      keys[key] = true;
+      flattenKeys(nested, keys);
+    }
+  }
+  return keys;
+}
diff --git a/apps/worker-config-publisher/tsconfig.json b/apps/worker-config-publisher/tsconfig.json
new file mode 100644
index 0000000..adbac81
--- /dev/null
+++ b/apps/worker-config-publisher/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "tsBuildInfoFile": "dist/tsconfig.tsbuildinfo"
+  },
+  "references": [
+    { "path": "../../packages/observability" },
+    { "path": "../../packages/redis" }
+  ],
+  "include": ["src/**/*.ts"]
+}
diff --git a/apps/worker-recording/package.json b/apps/worker-recording/package.json
new file mode 100644
index 0000000..47f542f
--- /dev/null
+++ b/apps/worker-recording/package.json
@@ -0,0 +1,19 @@
+{
+  "name": "@lisglosips/worker-recording",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/main.js",
+  "scripts": {
+    "dev": "cross-env LISGLOSIPS_SERVICE_NAME=worker-recording tsx watch src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/main.js"
+  },
+  "dependencies": {
+    "@lisglosips/database": "workspace:*",
+    "@lisglosips/observability": "workspace:*"
+  },
+  "devDependencies": {
+    "cross-env": "10.1.0"
+  }
+}
diff --git a/apps/worker-recording/src/main.ts b/apps/worker-recording/src/main.ts
new file mode 100644
index 0000000..245c435
--- /dev/null
+++ b/apps/worker-recording/src/main.ts
@@ -0,0 +1,70 @@
+import { createLogger } from '@lisglosips/observability';
+import { PrismaClient } from '@lisglosips/database';
+import { PrismaRecordingStore, RecordingTransferService, SshRecordingClient } from './transfer.js';
+
+const serviceName = process.env.LISGLOSIPS_SERVICE_NAME ?? 'worker-recording';
+const logger = createLogger(serviceName, process.env.LISGLOSIPS_LOG_LEVEL ?? 'info');
+
+const remoteHost = process.env.RECORDING_REMOTE_HOST ?? 'lisglosips-a';
+const sshConfig = process.env.RECORDING_SSH_CONFIG;
+const remoteReadyDir = process.env.RECORDING_REMOTE_READY_DIR ?? '/dev/shm/voip_rec/ready';
+const localRoot = process.env.RECORDING_LOCAL_ROOT ?? '/data/recordings';
+const scanIntervalMs = Number.parseInt(process.env.RECORDING_SCAN_INTERVAL_MS ?? '10000', 10);
+const maxFilesPerScan = Number.parseInt(process.env.RECORDING_MAX_FILES_PER_SCAN ?? '50', 10);
+const deleteSourceAfterCopy = process.env.RECORDING_DELETE_SOURCE_AFTER_COPY === 'true';
+
+let shuttingDown = false;
+
+async function main(): Promise<void> {
+  const prisma = new PrismaClient();
+  const remote = new SshRecordingClient({ host: remoteHost, sshConfig, remoteReadyDir });
+  const service = new RecordingTransferService(remote, new PrismaRecordingStore(prisma), {
+    localRoot,
+    deleteSourceAfterCopy,
+    maxFilesPerScan
+  });
+
+  await prisma.$connect();
+  logger.info(
+    {
+      remoteHost,
+      remoteReadyDir,
+      localRoot,
+      scanIntervalMs,
+      maxFilesPerScan,
+      deleteSourceAfterCopy
+    },
+    'Recording worker started'
+  );
+
+  while (!shuttingDown) {
+    const result = await service.scanOnce();
+    if (result.moved || result.failed || result.skipped) {
+      logger.info(result, 'Recording scan completed');
+    }
+    await sleep(scanIntervalMs);
+  }
+
+  await prisma.$disconnect();
+}
+
+process.on('SIGTERM', () => {
+  logger.info('Recording worker stopping');
+  shuttingDown = true;
+});
+
+process.on('SIGINT', () => {
+  logger.info('Recording worker stopping');
+  shuttingDown = true;
+});
+
+main().catch((error: unknown) => {
+  logger.error({ error }, 'Recording worker failed');
+  process.exit(1);
+});
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
diff --git a/apps/worker-recording/src/transfer.spec.ts b/apps/worker-recording/src/transfer.spec.ts
new file mode 100644
index 0000000..f66d841
--- /dev/null
+++ b/apps/worker-recording/src/transfer.spec.ts
@@ -0,0 +1,115 @@
+import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+import {
+  callIdFromStorageKey,
+  normalizeRemoteRelativePath,
+  type PulledRecordingFile,
+  type RecordingStore,
+  RecordingTransferService,
+  type RemoteRecordingClient,
+  type RemoteRecordingFile,
+  storageKeyFromReadyPath
+} from './transfer.js';
+
+class MemoryRemote implements RemoteRecordingClient {
+  readonly deleted: string[] = [];
+
+  constructor(private readonly files: Map<string, Buffer>) {}
+
+  async listReadyFiles(): Promise<RemoteRecordingFile[]> {
+    return Array.from(this.files.entries()).map(([relativePath, content]) => ({
+      relativePath,
+      bytes: content.length
+    }));
+  }
+
+  async pullFile(file: RemoteRecordingFile, localPath: string): Promise<void> {
+    const content = this.files.get(file.relativePath);
+    if (!content) {
+      throw new Error('missing remote file');
+    }
+    await writeFile(localPath, content);
+  }
+
+  async deleteFile(file: RemoteRecordingFile): Promise<void> {
+    this.deleted.push(file.relativePath);
+    this.files.delete(file.relativePath);
+  }
+}
+
+class MemoryStore implements RecordingStore {
+  readonly ready: PulledRecordingFile[] = [];
+
+  async markReady(input: { storageKey: string; storagePath: string; sourceKey: string; sha256: string; bytes: bigint }): Promise<void> {
+    this.ready.push({
+      relativePath: input.sourceKey,
+      bytes: Number(input.bytes),
+      localPath: input.storagePath,
+      sha256: input.sha256
+    });
+  }
+}
+
+describe('recording transfer', () => {
+  it('normalizes ready paths safely', () => {
+    expect(normalizeRemoteRelativePath('/2026/06/21/call.wav.ready')).toBe('2026/06/21/call.wav.ready');
+    expect(storageKeyFromReadyPath('2026/06/21/call.wav.ready')).toBe('2026/06/21/call.wav');
+    expect(() => normalizeRemoteRelativePath('../call.wav.ready')).toThrow(/Unsafe/);
+    expect(() => storageKeyFromReadyPath('2026/06/21/call.wav')).toThrow(/ready/);
+  });
+
+  it('derives call IDs from RTPEngine recording names', () => {
+    expect(callIdFromStorageKey('2026/06/22/s28-1782091361841-kntoq1y9%40lisglosips-t-c68d7ba1de875f62-mix.wav')).toBe(
+      's28-1782091361841-kntoq1y9@lisglosips-t'
+    );
+  });
+
+  it('copies, hashes, marks ready, and deletes source only after verification', async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), 'lisglosips-rec-'));
+    const remote = new MemoryRemote(new Map([['2026/06/21/call.wav.ready', Buffer.from('audio-bytes')]]));
+    const store = new MemoryStore();
+    const service = new RecordingTransferService(remote, store, {
+      localRoot: root,
+      deleteSourceAfterCopy: true,
+      maxFilesPerScan: 10
+    });
+
+    try {
+      const result = await service.scanOnce();
+      expect(result).toEqual({ moved: 1, skipped: 0, failed: 0 });
+      expect(store.ready).toHaveLength(1);
+      expect(store.ready[0]?.sha256).toMatch(/^[a-f0-9]{64}$/);
+      expect(remote.deleted).toEqual(['2026/06/21/call.wav.ready']);
+      expect(await readFile(path.join(root, '2026/06/21/call.wav'), 'utf8')).toBe('audio-bytes');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('keeps source file when local size verification fails', async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), 'lisglosips-rec-'));
+    const remote = new MemoryRemote(new Map([['bad.wav.ready', Buffer.from('abc')]]));
+    const originalList = remote.listReadyFiles.bind(remote);
+    remote.listReadyFiles = async () => (await originalList()).map((file) => ({ ...file, bytes: file.bytes + 1 }));
+    const store = new MemoryStore();
+    const service = new RecordingTransferService(remote, store, {
+      localRoot: root,
+      deleteSourceAfterCopy: true,
+      maxFilesPerScan: 10
+    });
+
+    try {
+      const result = await service.scanOnce();
+      expect(result).toEqual({ moved: 0, skipped: 0, failed: 1 });
+      expect(store.ready).toHaveLength(0);
+      expect(remote.deleted).toHaveLength(0);
+      await expect(stat(path.join(root, 'bad.wav'))).rejects.toThrow();
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/apps/worker-recording/src/transfer.ts b/apps/worker-recording/src/transfer.ts
new file mode 100644
index 0000000..423eeb5
--- /dev/null
+++ b/apps/worker-recording/src/transfer.ts
@@ -0,0 +1,274 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { mkdir, rename, rm, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { pipeline } from 'node:stream/promises';
+
+import { PrismaClient } from '@lisglosips/database';
+
+export interface RemoteRecordingFile {
+  relativePath: string;
+  bytes: number;
+}
+
+export interface PulledRecordingFile extends RemoteRecordingFile {
+  localPath: string;
+  sha256: string;
+}
+
+export interface RemoteRecordingClient {
+  listReadyFiles(): Promise<RemoteRecordingFile[]>;
+  pullFile(file: RemoteRecordingFile, localPath: string): Promise<void>;
+  deleteFile(file: RemoteRecordingFile): Promise<void>;
+}
+
+export interface RecordingStore {
+  markReady(input: {
+    storageKey: string;
+    storagePath: string;
+    sourceKey: string;
+    sha256: string;
+    bytes: bigint;
+  }): Promise<void>;
+}
+
+export interface RecordingTransferOptions {
+  localRoot: string;
+  deleteSourceAfterCopy: boolean;
+  maxFilesPerScan: number;
+}
+
+export interface RecordingTransferResult {
+  moved: number;
+  skipped: number;
+  failed: number;
+}
+
+export class RecordingTransferService {
+  constructor(
+    private readonly remote: RemoteRecordingClient,
+    private readonly store: RecordingStore,
+    private readonly options: RecordingTransferOptions
+  ) {}
+
+  async scanOnce(): Promise<RecordingTransferResult> {
+    const files = (await this.remote.listReadyFiles()).slice(0, this.options.maxFilesPerScan);
+    const result: RecordingTransferResult = { moved: 0, skipped: 0, failed: 0 };
+
+    for (const file of files) {
+      try {
+        await this.moveOne(file);
+        result.moved += 1;
+      } catch {
+        result.failed += 1;
+      }
+    }
+
+    return result;
+  }
+
+  private async moveOne(file: RemoteRecordingFile): Promise<void> {
+    const sourceKey = normalizeRemoteRelativePath(file.relativePath);
+    const storageKey = storageKeyFromReadyPath(sourceKey);
+    const finalPath = safeJoin(this.options.localRoot, storageKey);
+    const tmpPath = `${finalPath}.part-${randomUUID()}`;
+
+    await mkdir(path.dirname(finalPath), { recursive: true });
+    await this.remote.pullFile({ ...file, relativePath: sourceKey }, tmpPath);
+
+    const localStat = await stat(tmpPath);
+    if (localStat.size !== file.bytes) {
+      await rm(tmpPath, { force: true });
+      throw new Error(`Recording size mismatch for ${sourceKey}`);
+    }
+
+    const sha256 = await sha256File(tmpPath);
+    await rename(tmpPath, finalPath);
+    await this.store.markReady({
+      storageKey,
+      storagePath: finalPath,
+      sourceKey,
+      sha256,
+      bytes: BigInt(localStat.size)
+    });
+
+    if (this.options.deleteSourceAfterCopy) {
+      await this.remote.deleteFile({ ...file, relativePath: sourceKey });
+    }
+  }
+}
+
+export class PrismaRecordingStore implements RecordingStore {
+  constructor(private readonly prisma: PrismaClient) {}
+
+  async markReady(input: {
+    storageKey: string;
+    storagePath: string;
+    sourceKey: string;
+    sha256: string;
+    bytes: bigint;
+  }): Promise<void> {
+    const callId = callIdFromStorageKey(input.storageKey);
+    const rawCdr = await this.prisma.rawCdr.findFirst({
+      where: {
+        OR: [{ recordingKey: input.storageKey }, { recordingKey: input.sourceKey }, ...(callId ? [{ callId }] : [])]
+      },
+      orderBy: { createdAt: 'desc' },
+      select: { id: true }
+    });
+
+    await this.prisma.recording.upsert({
+      where: { storageKey: input.storageKey },
+      create: {
+        id: prefixedId('rec'),
+        rawCdrId: rawCdr?.id,
+        storageKey: input.storageKey,
+        storagePath: input.storagePath,
+        sha256: input.sha256,
+        bytes: input.bytes,
+        durationSec: 0,
+        status: 'READY',
+        movedAt: new Date()
+      },
+      update: {
+        rawCdrId: rawCdr?.id,
+        storagePath: input.storagePath,
+        sha256: input.sha256,
+        bytes: input.bytes,
+        status: 'READY',
+        movedAt: new Date()
+      }
+    });
+  }
+}
+
+export interface SshRecordingClientOptions {
+  host: string;
+  sshConfig?: string;
+  remoteReadyDir: string;
+}
+
+export class SshRecordingClient implements RemoteRecordingClient {
+  constructor(private readonly options: SshRecordingClientOptions) {}
+
+  async listReadyFiles(): Promise<RemoteRecordingFile[]> {
+    const command = `find ${shellQuote(this.options.remoteReadyDir)} -type f -name '*.ready' -printf '%P\\t%s\\n'`;
+    const stdout = await runCapture(this.sshArgs(command));
+    return stdout
+      .split('\n')
+      .filter(Boolean)
+      .map((line) => {
+        const [relativePath, sizeText] = line.split('\t');
+        return {
+          relativePath: normalizeRemoteRelativePath(relativePath),
+          bytes: Number.parseInt(sizeText, 10)
+        };
+      })
+      .filter((file) => Number.isSafeInteger(file.bytes) && file.bytes >= 0);
+  }
+
+  async pullFile(file: RemoteRecordingFile, localPath: string): Promise<void> {
+    const remotePath = remotePathFor(this.options.remoteReadyDir, file.relativePath);
+    const command = `cat -- ${shellQuote(remotePath)}`;
+    await pipeline(runStream(this.sshArgs(command)), createWriteStream(localPath, { mode: 0o640 }));
+  }
+
+  async deleteFile(file: RemoteRecordingFile): Promise<void> {
+    const remotePath = remotePathFor(this.options.remoteReadyDir, file.relativePath);
+    await runCapture(this.sshArgs(`rm -- ${shellQuote(remotePath)}`));
+  }
+
+  private sshArgs(command: string): string[] {
+    const args = [];
+    if (this.options.sshConfig) {
+      args.push('-F', this.options.sshConfig);
+    }
+    args.push(this.options.host, command);
+    return args;
+  }
+}
+
+export function storageKeyFromReadyPath(relativePath: string): string {
+  const normalized = normalizeRemoteRelativePath(relativePath);
+  if (!normalized.endsWith('.ready')) {
+    throw new Error('Recording source must end with .ready');
+  }
+  return normalized.slice(0, -'.ready'.length);
+}
+
+export function callIdFromStorageKey(storageKey: string): string | null {
+  const filename = normalizeRemoteRelativePath(storageKey).split('/').at(-1);
+  if (!filename) {
+    return null;
+  }
+  const decoded = decodeURIComponent(filename);
+  const match = /^(?<callId>.+)-[a-f0-9]{16}-(?:mix|tag-\d+)\.(?:wav|mp3)$/i.exec(decoded);
+  return match?.groups?.callId ?? null;
+}
+
+export function normalizeRemoteRelativePath(relativePath: string): string {
+  const normalized = relativePath.replaceAll('\\', '/').replace(/^\/+/, '');
+  const parts = normalized.split('/').filter(Boolean);
+  if (parts.length === 0 || parts.some((part) => part === '.' || part === '..' || part.includes('\0'))) {
+    throw new Error('Unsafe recording relative path');
+  }
+  return parts.join('/');
+}
+
+function safeJoin(root: string, relativePath: string): string {
+  const resolvedRoot = path.resolve(root);
+  const resolvedPath = path.resolve(resolvedRoot, relativePath);
+  if (resolvedPath !== resolvedRoot && !resolvedPath.startsWith(`${resolvedRoot}${path.sep}`)) {
+    throw new Error('Recording path escapes local root');
+  }
+  return resolvedPath;
+}
+
+function remotePathFor(baseDir: string, relativePath: string): string {
+  return `${baseDir.replace(/\/+$/, '')}/${normalizeRemoteRelativePath(relativePath)}`;
+}
+
+async function sha256File(filePath: string): Promise<string> {
+  const hash = createHash('sha256');
+  await pipeline(createReadStream(filePath), hash);
+  return hash.digest('hex');
+}
+
+function runCapture(args: string[]): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const child = spawn('ssh', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+    const stdout: Buffer[] = [];
+    const stderr: Buffer[] = [];
+    child.stdout.on('data', (chunk: Buffer) => stdout.push(chunk));
+    child.stderr.on('data', (chunk: Buffer) => stderr.push(chunk));
+    child.on('error', reject);
+    child.on('close', (code) => {
+      if (code === 0) {
+        resolve(Buffer.concat(stdout).toString('utf8'));
+        return;
+      }
+      reject(new Error(Buffer.concat(stderr).toString('utf8') || `ssh exited with ${code}`));
+    });
+  });
+}
+
+function runStream(args: string[]): NodeJS.ReadableStream {
+  const child = spawn('ssh', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+  const stderr: Buffer[] = [];
+  child.stderr.on('data', (chunk: Buffer) => stderr.push(chunk));
+  child.on('close', (code) => {
+    if (code !== 0) {
+      child.stdout.destroy(new Error(Buffer.concat(stderr).toString('utf8') || `ssh exited with ${code}`));
+    }
+  });
+  return child.stdout;
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+function prefixedId(prefix: string): string {
+  return `${prefix}_${randomUUID().replaceAll('-', '').slice(0, 32)}`;
+}
diff --git a/apps/worker-recording/tsconfig.json b/apps/worker-recording/tsconfig.json
new file mode 100644
index 0000000..dfe375b
--- /dev/null
+++ b/apps/worker-recording/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "tsBuildInfoFile": "dist/tsconfig.tsbuildinfo"
+  },
+  "references": [
+    { "path": "../../packages/database" },
+    { "path": "../../packages/observability" }
+  ],
+  "include": ["src/**/*.ts"]
+}
diff --git a/docs/CDR_MINIMAL_BILLING_RUNBOOK.md b/docs/CDR_MINIMAL_BILLING_RUNBOOK.md
new file mode 100644
index 0000000..21fb319
--- /dev/null
+++ b/docs/CDR_MINIMAL_BILLING_RUNBOOK.md
@@ -0,0 +1,112 @@
+# CDR Minimal Billing Runbook
+
+> 任务：S23 - 最小计费与余额扣减  
+> 完成时间：2026-06-21 19:55 +08:00
+
+## 1. 目标
+
+S23 在 S22 的 Redis Stream 消费基础上完成最小计费闭环：
+
+- 成功通话 CDR 写入 `raw_cdrs` 和 `rated_cdrs`。
+- 按周期秒数和周期费率计算费用。
+- 扣减客户余额，并写入不可变客户余额流水。
+- 同一 `event_id` 或同一 `raw_cdr_id` 不重复扣费。
+
+当前系统尚未建立客户侧费率表，因此 S23 使用落地网关的 `billingCycleSec` 和 `cycleRate` 同时作为供应商成本和临时客户费用，`grossProfit` 为 `0.000000`。正式客户费率和利润计算留给后续计费版本。
+
+## 2. 计费规则
+
+`apps/worker-cdr/src/billing.ts` 提供周期计费函数：
+
+```text
+cycles = ceil(duration_sec / billing_cycle_sec)
+bill_sec = cycles * billing_cycle_sec
+amount = cycles * cycle_rate
+```
+
+约束：
+
+- `duration_sec` 必须为非负整数。
+- `billing_cycle_sec` 必须为 1 到 60 的整数。
+- 金额统一保留 6 位小数。
+- `sip_code` 为 `2xx` 且 `duration_sec > 0` 时才进入计费。
+
+失败 CDR、零时长 CDR、缺少客户或落地网关 ID 的 CDR 只写 `raw_cdrs`，`ratingStatus` 标记为 `SKIPPED`，不扣余额。
+
+## 3. 写库与幂等
+
+`apps/worker-cdr/src/rating.ts` 的 `CdrRatingService` 在单个数据库事务内处理：
+
+1. 按 `raw_cdrs.event_id` 查询是否已处理。
+2. 新建 `raw_cdrs`。
+3. 锁定客户余额行：`SELECT ... FOR UPDATE`。
+4. 读取落地网关周期费率。
+5. 新建 `rated_cdrs`。
+6. 新建一条负数 `customer_recharges` 作为扣费流水。
+7. 更新 `customers.balance`。
+8. 将 `raw_cdrs.ratingStatus` 标记为 `RATED`。
+
+扣费流水约定：
+
+| 字段 | 值 |
+| --- | --- |
+| `amount` | 负数费用 |
+| `idempotencyKey` | `cdr:<event_id>` |
+| `remark` | `CDR_CHARGE:<raw_cdr_id>` |
+| `createdBy` | `worker-cdr` |
+
+数据库唯一约束共同防止重复扣费：
+
+- `raw_cdrs.event_id`
+- `rated_cdrs.raw_cdr_id`
+- `customer_recharges.idempotencyKey`
+
+## 4. Worker 行为
+
+`apps/worker-cdr/src/main.ts` 现在连接 Redis 和 MySQL：
+
+1. 从 `stream:cdr_payload` 的 `billing-workers` Consumer Group 读取 CDR。
+2. 解析成功后调用 `CdrRatingService.rate(event)`。
+3. 处理成功或重复消息后 ACK Redis 消息。
+4. 处理异常时沿用 S22 死信机制写入 `stream:cdr_deadletter`。
+
+必需环境变量：
+
+```text
+REDIS_URL
+DATABASE_URL
+```
+
+可选环境变量：
+
+```text
+CDR_CONSUMER_NAME
+CDR_BLOCK_MS
+CDR_BATCH_SIZE
+CDR_PENDING_IDLE_MS
+LISGLOSIPS_LOG_LEVEL
+```
+
+## 5. 验证结果
+
+- `corepack pnpm@10.33.0 exec vitest run apps/worker-cdr/src/rating.spec.ts` 通过，3 条测试覆盖周期计费、成功 CDR 扣费幂等、失败 CDR 不扣费。
+- `corepack pnpm@10.33.0 --filter @lisglosips/worker-cdr build` 通过。
+- `corepack pnpm@10.33.0 typecheck` 通过。
+- `corepack pnpm@10.33.0 lint` 通过。
+- `corepack pnpm@10.33.0 build` 通过。
+
+本次未连接 B 执行服务部署或真实库写入验证，因为 B sudo 凭据仍未通过校验。S23 仅完成本地代码闭环和构建验收。
+
+## 6. 回滚
+
+代码回滚：
+
+- 恢复 `apps/worker-cdr/src/main.ts` 到 S22 只记录 CDR 的版本。
+- 删除或恢复 `apps/worker-cdr/src/billing.ts`、`apps/worker-cdr/src/rating.ts`、`apps/worker-cdr/src/rating.spec.ts`。
+- 恢复 `apps/worker-cdr/package.json` 和 `apps/worker-cdr/tsconfig.json`。
+- 重新执行 `corepack pnpm@10.33.0 build`。
+
+数据回滚：
+
+- S23 未执行真实数据库写入验证，无需清理远端数据。
+- 若后续环境已运行 worker 并产生扣费数据，回滚前必须先停止 worker，记录待回滚的 `event_id`、`raw_cdr_id`、`rated_cdr_id` 和客户流水；不得直接删除余额流水，应通过受控反向流水或备份恢复方案处理。
diff --git a/docs/CDR_REDIS_STREAM_RUNBOOK.md b/docs/CDR_REDIS_STREAM_RUNBOOK.md
new file mode 100644
index 0000000..1f607ad
--- /dev/null
+++ b/docs/CDR_REDIS_STREAM_RUNBOOK.md
@@ -0,0 +1,108 @@
+# CDR Redis Stream Runbook
+
+> 任务：S22 - CDR Redis Stream  
+> 完成时间：2026-06-21 19:34 +08:00
+
+## 1. 目标
+
+S22 建立原始 CDR 的 Redis Stream 契约和可靠消费基础，不做计费、不扣余额、不写正式 rated CDR。计费与余额扣减留给 S23。
+
+## 2. Redis Key
+
+| Key | 用途 |
+| --- | --- |
+| `stream:cdr_payload` | OpenSIPS 写入的原始 CDR Stream |
+| `stream:cdr_deadletter` | CDR Worker 校验或处理失败后的死信 Stream |
+| `billing-workers` | `stream:cdr_payload` 的 Consumer Group |
+| `lock:cdr:{event_id}` | Worker 处理幂等占位，避免同一 `event_id` 重复处理 |
+
+## 3. 事件字段
+
+S22 事件 schema version 为 `1`。必填字段：
+
+```text
+schema_version
+event_id
+idempotency_key
+call_id
+node_id
+opensips_instance
+ingress_a_ip
+rtpengine_node
+source_ip
+sip_code
+hangup_reason
+created_at
+```
+
+多 A 预留字段已经纳入契约：
+
+- `node_id`：A 节点 ID，当前单 A 为 `a1`。
+- `opensips_instance`：OpenSIPS 实例名，当前为 `opensips-a1`。
+- `ingress_a_ip`：接收 SIP 的 A 节点地址，当前为 `100.90.90.90`。
+- `rtpengine_node`：媒体节点，当前每台 A 绑定本机 RTPEngine，因此为 `a1`。
+
+S22 阶段 A 端尚未进入真实落地路由，因此失败 CDR 的供应商、录音、应答时间等字段使用 `none` 或 `0` 占位。S23/S24 后续在不破坏 schema 的前提下补充真实计费和录音字段。
+
+## 4. Producer
+
+Server A OpenSIPS 在 `route[S20_CDR_XADD]` 中执行：
+
+```text
+XADD stream:cdr_payload * schema_version 1 ... created_at <unix>
+```
+
+当前 A 端字段已从 S20 冒烟格式升级为 S22 正式契约。A 端配置备份：
+
+```text
+/var/backups/lisglosips-s22/20260621T113157Z/opensips.cfg
+```
+
+## 5. Consumer
+
+`packages/redis/src/cdr-stream.ts` 提供：
+
+- `ensureCdrConsumerGroup`
+- `publishCdrEvent`
+- `parseCdrStreamEvent`
+- `processCdrBatch`
+- `processPendingCdrBatch`
+
+`apps/worker-cdr` 已从骨架改为 Redis Stream Worker：
+
+1. 读取 `REDIS_URL`。
+2. 确认 `billing-workers` Consumer Group。
+3. 先用 `XAUTOCLAIM` 重领 Pending，再用 `XREADGROUP` 读取新消息。
+4. 用 `lock:cdr:{event_id}` 做幂等占位。
+5. 处理成功或重复消息后 `XACK`。
+6. 校验失败或处理异常时写入 `stream:cdr_deadletter` 并 `XACK` 原消息。
+
+当前 handler 只记录并接受原始 CDR，不执行计费和余额扣减。
+
+## 6. 验证结果
+
+- 本地 `packages/redis/src/cdr-stream.spec.ts` 6 条测试通过，覆盖发布、解析、Consumer Group 幂等创建、`XREADGROUP`/`XACK`、重复 `event_id`、死信和 `XAUTOCLAIM` Pending 重领。
+- `corepack pnpm@10.33.0 lint` 通过。
+- `corepack pnpm@10.33.0 typecheck` 通过。
+- `corepack pnpm@10.33.0 build` 通过。
+- A `opensips -C -f /etc/opensips/opensips.cfg` 通过，`opensips.service` active。
+- Redis `XGROUP CREATE stream:cdr_payload billing-workers 0 MKSTREAM` 返回 `OK`。
+- Redis `XINFO GROUPS stream:cdr_payload` 显示 `billing-workers`，pending 为 `0`。
+- T 发起 INVITE 后，A 返回 `SIP/2.0 503 Config Missing`，Redis Stream 最新事件包含 `schema_version=1`、`idempotency_key`、`node_id=a1`、`opensips_instance=opensips-a1`、`ingress_a_ip=100.90.90.90`、`rtpengine_node=a1`。
+
+## 7. 回滚
+
+代码回滚：
+
+- 恢复 `packages/redis/src/index.ts`、`packages/redis/src/cdr-stream.ts`、`packages/redis/src/cdr-stream.spec.ts`、`apps/worker-cdr/src/main.ts`。
+- 重新执行 `corepack pnpm@10.33.0 build`。
+
+Server A 回滚：
+
+```bash
+sudo cp -a /var/backups/lisglosips-s22/20260621T113157Z/opensips.cfg /etc/opensips/opensips.cfg
+sudo opensips -C -f /etc/opensips/opensips.cfg
+sudo systemctl restart opensips
+```
+
+Redis Consumer Group 可保留，不影响 Producer；如必须移除，应先确认没有未处理 Pending，再使用受控 Redis 维护窗口删除 group。S22 不删除 Stream 数据。
diff --git a/docs/DASHBOARD_AGGREGATION_RUNBOOK.md b/docs/DASHBOARD_AGGREGATION_RUNBOOK.md
new file mode 100644
index 0000000..f6380b5
--- /dev/null
+++ b/docs/DASHBOARD_AGGREGATION_RUNBOOK.md
@@ -0,0 +1,65 @@
+# S26 Dashboard 聚合 Runbook
+
+## 范围
+
+S26 在 API 中新增 Dashboard 聚合接口：
+
+- `GET /api/v2/dashboard/summary`
+- `GET /api/v2/dashboard/trends?hours=24&bucketMinutes=60`
+
+两个接口均要求 `dashboard.view` 权限。S26 未连接服务器、未重启服务、未执行数据库迁移，也未修改 Redis/OpenSIPS 配置。
+
+## 数据来源
+
+当前实现基于已有 V2 Schema：
+
+- `raw_cdrs`：今日通话数、接通数、失败数、接通率、通话时长、失败响应码、趋势通话量。
+- `rated_cdrs` + `raw_cdrs.started_at`：客户费用、供应商成本、毛利和趋势金额。
+- `customers`、`customer_gateways`、`vendor_gateways`：启用实体数量。
+- `recordings` + `quality_reviews`：待质检录音数。
+- `raw_cdrs.vendor_gateway_id`：今日失败落地网关 Top 10。
+
+实时在线通话和注册数在 S26 返回 `0` 且标记 `source: "not_configured"`。这部分应在后续接入 Redis/OpenSIPS 指标后替换，避免返回伪实时数据。
+
+## 查询窗口
+
+- Summary 的“今日”按 `Asia/Shanghai` 自然日计算，数据库时间仍按 UTC ISO 语义传入。
+- Trends 默认最近 24 小时，支持 `hours=1..168`。
+- `bucketMinutes` 仅允许 `5`、`15`、`60`。
+- 所有 CDR 查询都带 `started_at` 时间窗口，避免首页扫描全量 CDR。
+
+## 后续预聚合演进
+
+设计文档要求 24 小时趋势最终使用 5 分钟或 1 小时预聚合。当前 S26 没有新增指标表，是为了避免把本任务扩大为数据库迁移和 worker 部署。
+
+后续可新增 `worker-metrics` 或复用 CDR Worker 增量写入统计表，例如：
+
+```text
+dashboard_call_buckets(bucket_start, bucket_minutes, total_calls, answered_calls, failed_calls, duration_sec, customer_fee, vendor_cost, gross_profit)
+dashboard_failure_codes(bucket_start, bucket_minutes, sip_code, count)
+dashboard_gateway_health(vendor_gateway_id, status, reason, updated_at)
+```
+
+切换时保持 API 响应结构不变，只替换 `DashboardRepository` 的数据来源。
+
+## 验证
+
+本地验收命令：
+
+```bash
+corepack pnpm@10.33.0 exec vitest run apps/api/src/modules/dashboard/dashboard.service.spec.ts
+corepack pnpm@10.33.0 typecheck
+corepack pnpm@10.33.0 lint
+corepack pnpm@10.33.0 build
+```
+
+## 回滚
+
+代码级回滚：
+
+1. 从 `apps/api/src/modules/app.module.ts` 移除 `DashboardModule`。
+2. 删除 `apps/api/src/modules/dashboard/`。
+3. 删除本 Runbook。
+4. 重新执行 `corepack pnpm@10.33.0 build`。
+
+S26 未执行数据库迁移、服务器写操作或真实数据写入，因此没有远端数据回滚点。
diff --git a/docs/DATABASE_SCHEMA_RUNBOOK.md b/docs/DATABASE_SCHEMA_RUNBOOK.md
new file mode 100644
index 0000000..fe974e8
--- /dev/null
+++ b/docs/DATABASE_SCHEMA_RUNBOOK.md
@@ -0,0 +1,66 @@
+# LisgloSIPS V2 数据库 Schema 与迁移 Runbook
+
+## 范围
+
+本文对应 `S08 - 数据库 Schema 与迁移`。业务数据库使用 MySQL，Schema 由 `prisma/schema.prisma` 管理，初始化迁移位于 `prisma/migrations/20260621090000_init_v2_schema/`。
+
+## 本次产物
+
+- `prisma/schema.prisma`：V2 核心业务表、索引、关系、枚举和审计列。
+- `prisma/migrations/20260621090000_init_v2_schema/migration.sql`：从空库初始化的 SQL 迁移。
+- `prisma/seed.ts`：内置权限和角色种子；不创建默认密码用户。
+- `packages/database/src/schema-contract.spec.ts`：Schema 合同测试。
+
+## 标准初始化
+
+只在空库或明确的新环境执行：
+
+```bash
+export DATABASE_URL='mysql://<APP_USER>@127.0.0.1:3306/<DATABASE_NAME>'
+pnpm prisma:generate
+pnpm exec prisma migrate deploy
+pnpm db:seed
+```
+
+`DATABASE_URL` 示例不包含密码。实际凭据必须来自受控 Secret 文件或部署环境变量，禁止写入仓库。
+
+## 验证命令
+
+```bash
+pnpm prisma:validate
+pnpm typecheck
+pnpm test
+pnpm build
+```
+
+数据库侧验收：
+
+```bash
+pnpm exec prisma migrate deploy
+pnpm exec prisma migrate status
+pnpm db:seed
+pnpm db:seed
+```
+
+重复执行 `migrate deploy` 和 `db:seed` 应安全：迁移不会重复应用，seed 使用 upsert。
+
+## 回滚与恢复
+
+初始化迁移只允许用于空库。若在临时库验证失败：
+
+```sql
+DROP DATABASE <TEMP_DATABASE_NAME>;
+DROP USER '<TEMP_USER>'@'127.0.0.1';
+DROP USER '<TEMP_USER>'@'localhost';
+```
+
+生产或准生产环境禁止依赖破坏性 down migration 回滚。若迁移已进入共享环境，应优先发布向前兼容修复迁移；上线窗口不执行不可逆删列。
+
+## 重要约束
+
+- 金额字段统一 `DECIMAL(20,6)`。
+- 充值、CDR、审计日志不做物理删除。
+- `raw_cdrs.event_id` 和 `raw_cdrs.call_id + ended_at` 保证 CDR 幂等。
+- 充值表和 `idempotency_keys` 均有幂等唯一键。
+- 所有管理类表包含 `created_at`、`updated_at`、`created_by`、`updated_by`、`version`。
+- 密码字段只保存 hash 或 SIP Digest HA1，seed 不写入明文密码。
diff --git a/docs/LISGLOSIPS_DEPLOYMENT_GUIDE.md b/docs/LISGLOSIPS_DEPLOYMENT_GUIDE.md
new file mode 100644
index 0000000..9b447b7
--- /dev/null
+++ b/docs/LISGLOSIPS_DEPLOYMENT_GUIDE.md
@@ -0,0 +1,172 @@
+# LisgloSIPS 部署实施指南
+
+本文是 LisgloSIPS V2 的独立部署交接文档。目标是让新的 Codex 会话在不依赖聊天记忆的情况下，按阶段完成本地开发部署、后端实现、联调和阿里云迁移。
+
+设计依据：`SOFTSWITCH_PLATFORM_DESIGN_V2.md`。进度依据：`IMPLEMENTATION_STATUS.md`。任何会话开始时先读取这两个文件，并且一次只执行当前 Sxx 任务。
+
+## 1. 环境与边界
+
+当前阶段使用三台本地 KVM 开发服务器，通过 Tailscale 通信：
+
+| 服务器 | Tailscale 地址 | 职责 |
+| --- | --- | --- |
+| A | `100.90.90.90` | OpenSIPS、RTPEngine、录音内存盘、HEP、Exporter |
+| B | `100.90.90.91` | API/Worker、MySQL、Redis、Web、HOMER、监控和录音持久化 |
+| T | `100.93.185.30` | 模拟客户 SIP 注册、IP 对接和测试呼叫 |
+
+开发完成后再迁移阿里云。当前 IP、开发证书和防火墙源地址不能原样作为生产配置。
+
+## 2. 凭据规则
+
+- SSH 与 sudo 凭据只存放在 `.codex-private/`，禁止写入文档、脚本、Git、日志或命令回显。
+- 服务账号凭据保存在 `.codex-private/SERVICE_CREDENTIALS.clixml` 和服务器 `/etc/lisglosips/secrets/`。
+- 生产使用云 Secret 服务或权限为 `0600/0640` 的受控文件。
+- 部署文档只记录凭据位置、权限和轮换流程，不记录明文。
+
+## 3. 总体部署顺序
+
+```text
+S00-S02  安全接入、资产与网络
+S03-S06  Server B 基础设施
+S07-S17  后端骨架与运营业务 API
+S18-S21  Server A/T 通信与呼叫基线
+S22-S26  CDR、计费、录音、质检与 Dashboard
+S27      React 接入真实 API
+S28-S29  端到端、性能、故障与安全测试
+S30      阿里云迁移、灰度、回滚和验收
+```
+
+禁止提前跨阶段实施依赖尚未完成的任务。例如 S08 Schema 完成前，不部署真实业务 API；S22 CDR 事件契约完成前，不让 OpenSIPS 写入正式扣费链路。
+
+## 4. 已完成部署基线
+
+截至 S06：
+
+| 阶段 | 结果 | 文档 |
+| --- | --- | --- |
+| S00 | SSH Key、host key 修复、SSH 管理端口调整、凭据轮换；保留密钥登录 | `docs/SSH_ACCESS_RUNBOOK.md` |
+| S01 | 三机资产盘点 | `docs/inventory-summary.md` |
+| S02 | Tailscale 网络和最小端口矩阵 | `docs/infra-check.md` |
+| S03 | B 内核、chrony、nftables、fail2ban、目录和 NFS automount | `docs/SERVER_B_BASELINE_RUNBOOK.md` |
+| S04 | B MySQL、Redis、ACL、持久化、备份与恢复演练 | `docs/SERVER_B_DATA_SERVICES_RUNBOOK.md` |
+| S05 | B Node.js、pnpm、Nginx、systemd、TLS 与发布目录 | `docs/SERVER_B_WEB_RUNTIME_RUNBOOK.md` |
+| S06 | B HOMER、HEP 接收、Prometheus、Grafana、Exporters；A Node Exporter | `docs/SERVER_B_HOMER_MONITORING_RUNBOOK.md` |
+
+所有可提交的 Server B 配置副本位于 `infra/server-b/s03/`、`s04/`、`s05/`、`s06/`，Server A 的 S06 采集配置位于 `infra/server-a/s06/`。服务器私钥、密码和数据库数据不进入这些目录。
+
+## 5. Server B 从基线到 Web 入口
+
+在新 Server B 重建时按以下顺序执行：
+
+1. 完成 Ubuntu 24.04 LTS 补丁、chrony、nftables、fail2ban 和系统用户。
+2. 建立 `/data`、`/opt/lisglosips/releases`、`/etc/lisglosips` 和备份目录。
+3. 安装固定 MySQL/Redis，配置 bind mount、最小权限账号、AOF/RDB、binlog 和备份 timer。
+4. 安装固定 Node.js LTS、Corepack/pnpm 和 Nginx。
+5. 安装 `lisglosips@.service`，创建实例 env 文件。
+6. 发布到新 release，校验后切换 `/opt/lisglosips/current`。
+7. 配置 Nginx 静态站点、API 代理、限流、安全头和内部录音 location。
+8. 开发阶段签发私有 CA 证书；生产阶段安装正式域名证书。
+9. 验证 443、应用本地端口、服务自启、重启恢复和非授权来源拒绝。
+
+具体文件、命令和回滚方式见三个 Server B Runbook，不在本指南重复保存可能过时的命令副本。
+
+## 6. 后端部署模型
+
+S07 起后端使用 TypeScript、NestJS/Fastify、Prisma、ioredis 和 pnpm monorepo。建议发布产物：
+
+```text
+/opt/lisglosips/releases/<release-id>/
+├── apps/api/dist/
+├── apps/cdr-worker/dist/
+├── apps/recording-worker/dist/
+├── apps/config-publisher/dist/
+├── public/
+├── package.json
+├── pnpm-lock.yaml
+└── node_modules/
+```
+
+每个进程使用单独的 systemd 实例和环境文件：
+
+```text
+lisglosips@api.service
+lisglosips@cdr-worker.service
+lisglosips@recording-worker.service
+lisglosips@config-publisher.service
+```
+
+构建应在 CI 或独立构建目录完成，不在生产 `current` 中执行。锁文件必须冻结，安装使用 `pnpm install --frozen-lockfile`。各实例只获得所需数据库、Redis、目录和网络权限。
+
+## 7. 标准发布流程
+
+1. 记录当前 release、数据库版本、Redis 配置版本和服务状态。
+2. 备份 MySQL、Redis 与待修改配置，并校验备份哈希。
+3. 将构建产物传到新的唯一 release 目录。
+4. 核对产物哈希、Node/pnpm 版本和依赖锁文件。
+5. 执行向前兼容数据库迁移；禁止在同一窗口直接删除旧列。
+6. 切换 `current`，按依赖顺序重启 API/Worker。
+7. 执行内部健康、HTTPS 健康、鉴权、数据库、Redis 与队列探针。
+8. 发布 Redis 配置快照，确认 Server A 读取的新版本。
+9. 使用 T 发起真实测试呼叫，检查 SIP、RTP、CDR、费用、录音和 HOMER。
+10. 观察日志、队列积压、错误率和资源指标后再完成发布。
+
+每次发布都要生成一条交接记录，包含 release ID、迁移版本、验证结果和回滚目标。
+
+## 8. 标准回滚流程
+
+- Web/API：将 `current` 指回上一 release 并重启服务。
+- 数据库：优先发布修复迁移；不依赖不可逆 down migration。
+- Redis 配置：切回上一 `cfg:active_version`，不删除 Stream。
+- CDR Worker：停止消费但保留 Pending/Stream，修复后重放。
+- OpenSIPS：恢复已校验配置，先语法检查再 reload。
+- RTPEngine：恢复上一 systemd 参数并验证现有通话影响。
+- 录音：停止源文件删除，保留 A/B 两端待人工核验。
+
+如果变更涉及防火墙、SSH、数据库数据目录或证书，必须先确认独立控制台/恢复路径可用。
+
+## 9. 后续实施清单
+
+### S07-S08
+
+- 创建后端 monorepo、健康检查、结构化日志、配置校验和测试框架。
+- 建立 Prisma Schema、迁移、种子和隔离恢复测试。
+
+### S09-S17
+
+- 实现认证、RBAC、审计、客户/供应商、充值、网关、策略、费率和线路组。
+- 金额统一 Decimal；充值和扣费必须事务、幂等且有不可变流水。
+- Redis 配置发布使用 Outbox、版本号和回滚，不允许数据库与 Redis 双写漂移。
+
+### S18-S26
+
+- 在 A 部署 OpenSIPS、RTPEngine、录音 tmpfs、HEP 和 exporter。
+- 在 T 建立 IP 认证和 SIP 注册两套测试场景。
+- 完成 CDR Stream、计费、录音搬运、质检和 Dashboard 聚合。
+
+### S27-S30
+
+- React 从 Mock 切到生成的 API Client。
+- 完成端到端、并发、故障、安全与恢复测试。
+- 创建阿里云 VPC、安全组、数据盘、正式 DNS/TLS 和监控告警。
+- 灰度低风险客户或线路，验证后再全量切换。
+
+## 10. 每阶段完成条件
+
+每个 Sxx 任务只有同时满足以下条件才可标记完成：
+
+- 配置或代码已落地，并有仓库副本。
+- 语法、单元/集成或服务健康检查通过。
+- 网络暴露和最小权限得到验证。
+- 发生重启的服务完成重启恢复验证。
+- 备份可校验；涉及数据时完成恢复样例。
+- 无明文凭据进入仓库或日志。
+- `IMPLEMENTATION_STATUS.md` 已更新产物、验证、回滚、遗留问题和下一任务。
+
+## 11. 阿里云迁移前确认
+
+- 确认预计 CPS、并发、日话单、录音量和保留期。
+- 为 A/B 配置同 VPC 低时延私网和独立数据盘。
+- 安全组只开放 A 的 SIP/RTP、B 的 443 和受控 SSH 管理端口；SSH 密钥登录必须保留。
+- 使用正式域名和可信 TLS 证书，配置续期与告警。
+- 替换全部开发凭据和证书，不复制本地 CA 私钥。
+- 重新执行防火墙、备份恢复、故障注入和端到端呼叫验收。
diff --git a/docs/QUALITY_BACKEND_RUNBOOK.md b/docs/QUALITY_BACKEND_RUNBOOK.md
new file mode 100644
index 0000000..3c09e99
--- /dev/null
+++ b/docs/QUALITY_BACKEND_RUNBOOK.md
@@ -0,0 +1,110 @@
+# Quality Backend Runbook
+
+> 任务：S25 - 质检后端  
+> 完成时间：2026-06-21 21:05 +08:00
+
+## 1. 目标
+
+S25 完成质检后端最小闭环：
+
+- 质检抽样规则管理。
+- 基于规则的稳定抽样。
+- 录音列表、录音详情和上下条导航。
+- 保存质检结果。
+- RBAC 权限和审计元数据。
+
+本任务不做 Dashboard 聚合，不新增前端页面，不发布 B 当前 placeholder release。
+
+## 2. API
+
+质检规则：
+
+```text
+GET    /api/v2/quality/rules
+GET    /api/v2/quality/rules/:id
+POST   /api/v2/quality/rules
+PATCH  /api/v2/quality/rules/:id
+DELETE /api/v2/quality/rules/:id
+POST   /api/v2/quality/rules/:id/enable
+POST   /api/v2/quality/rules/:id/disable
+```
+
+录音质检：
+
+```text
+GET /api/v2/recordings
+GET /api/v2/recordings/:id
+PUT /api/v2/recordings/:id/review
+```
+
+S24 的播放接口继续保留：
+
+```text
+GET /api/v2/recordings/:id/play
+```
+
+## 3. 权限
+
+| 能力 | 权限 |
+| --- | --- |
+| 查看质检规则、录音列表、录音详情 | `quality.view` |
+| 新增、修改、启停、删除质检规则 | `quality.manage` |
+| 保存质检结果 | `quality.manage` |
+| 播放录音 | `recordings.play` |
+
+质检规则变更和保存质检结果都带 `AuditAction` 元数据，由既有审计拦截器记录。
+
+## 4. 稳定抽样
+
+当前 schema 没有单独“待质检任务表”，S25 采用计算型稳定抽样：
+
+```text
+score = sha256(rule_id + ":" + recording_id) 的前 32 bit 映射到 [0, 100)
+selected = score < ratio
+```
+
+规则匹配条件：
+
+- `customerId` 为空或等于录音关联 raw CDR 的 `customerId`。
+- `lineGroupId` 为空或等于录音关联 raw CDR 的 `lineGroupId`。
+- 规则状态为 `ENABLED`。
+- 当前时间在 `effectiveAt` 与 `expiresAt` 范围内。
+
+同一规则和同一录音的抽样结果稳定不变，列表重复查询不会抖动。
+
+## 5. 数据写入
+
+S25 不新增数据库迁移，复用 S08 已建表：
+
+- `quality_sampling_rules`
+- `quality_reviews`
+- `recordings`
+
+保存质检结果会新增一条 `quality_reviews` 记录，不覆盖历史结果；录音详情返回最新质检结果和历史列表。
+
+## 6. 验证结果
+
+- `corepack pnpm@10.33.0 exec vitest run apps/api/src/modules/quality/sampling.spec.ts apps/api/src/modules/recordings/recordings.service.spec.ts` 通过，2 个测试文件 6 条测试。
+- `corepack pnpm@10.33.0 typecheck` 通过。
+- `corepack pnpm@10.33.0 lint` 通过。
+- `corepack pnpm@10.33.0 build` 通过。
+
+## 7. 当前限制
+
+- B 当前 `/opt/lisglosips/current` 仍是 S05 placeholder release，本次只完成本地代码与构建验证，未部署到 B 当前 API 服务。
+- 录音真实数据仍依赖 S28 端到端路由、媒体、CDR 和录音闭环产生。
+- Dashboard 中的待质检数量和趋势留给 S26 聚合任务。
+
+## 8. 回滚
+
+代码回滚：
+
+- 删除或恢复 `apps/api/src/modules/quality/`。
+- 恢复 `apps/api/src/modules/recordings/` 到 S24 版本。
+- 从 `apps/api/src/modules/app.module.ts` 移除 `QualityModule`。
+- 重新执行 `corepack pnpm@10.33.0 build`。
+
+数据回滚：
+
+- S25 未在远端执行数据库写入验证，无需清理远端数据。
+- 若后续已运行 API 并产生质检记录，不应直接删除历史 `quality_reviews`；应通过审计可见的更正记录或受控数据库维护窗口处理。
diff --git a/docs/RECORDING_TRANSFER_PLAYBACK_RUNBOOK.md b/docs/RECORDING_TRANSFER_PLAYBACK_RUNBOOK.md
new file mode 100644
index 0000000..02c52d3
--- /dev/null
+++ b/docs/RECORDING_TRANSFER_PLAYBACK_RUNBOOK.md
@@ -0,0 +1,138 @@
+# Recording Transfer and Playback Runbook
+
+> 任务：S24 - 录音搬运与播放  
+> 完成时间：2026-06-21 20:20 +08:00
+
+## 1. 目标
+
+S24 完成录音闭环的最小能力：
+
+- Server B 通过 Tailscale 私网从 Server A 拉取 `.ready` 录音文件。
+- 拉取后校验文件大小和 SHA-256。
+- 本地 `.part-*` 临时文件校验成功后原子改名。
+- 校验和数据库标记成功后才允许删除 Server A 源 `.ready` 文件。
+- API 提供受 RBAC 保护的播放入口，通过 Nginx `X-Accel-Redirect` 进入内部 `/_recordings/` location，支持 Range。
+
+## 2. 代码产物
+
+| 文件 | 说明 |
+| --- | --- |
+| `apps/worker-recording/src/transfer.ts` | 录音扫描、SSH 拉取、大小校验、SHA-256、原子落盘、源文件安全删除、`recordings` 入库 |
+| `apps/worker-recording/src/main.ts` | Recording Worker 主循环 |
+| `apps/worker-recording/src/transfer.spec.ts` | 搬运、哈希、删除保护和路径安全测试 |
+| `apps/api/src/modules/recordings/*` | `GET /api/v2/recordings/:id/play` 播放入口 |
+| `apps/api/src/modules/recordings/recordings.service.spec.ts` | Nginx 内部路径和路径穿越防护测试 |
+| `infra/server-a/s19/scripts/lisglosips-recording-finalize` | A 端 finalizer 仓库副本，ready 目录改为 `0770`，便于专用拉取用户校验后删除源文件 |
+
+## 3. Worker 环境变量
+
+```text
+DATABASE_URL
+RECORDING_REMOTE_HOST=lisglosips-a
+RECORDING_SSH_CONFIG=/etc/lisglosips/recording/ssh_config
+RECORDING_REMOTE_READY_DIR=/dev/shm/voip_rec/ready
+RECORDING_LOCAL_ROOT=/data/recordings
+RECORDING_SCAN_INTERVAL_MS=10000
+RECORDING_MAX_FILES_PER_SCAN=50
+RECORDING_DELETE_SOURCE_AFTER_COPY=true
+```
+
+本地开发可使用 `.codex-private/ssh/config`；生产或 B 端 systemd 应使用 `/etc/lisglosips/recording/` 下的受控 key 和 known_hosts。
+
+## 4. 服务器变更
+
+### Server B
+
+- 新增 `/etc/lisglosips/recording/a_pull_ed25519`，权限 `0640 root:lisglosips`。
+- 新增 `/etc/lisglosips/recording/known_hosts`。
+- 录音持久化目录仍为 `/data/recordings`，由 `lisglo-recorder:lisglosips` 管理。
+- 备份目录：`/var/backups/lisglosips-s24/20260621T121100Z`。
+
+### Server A
+
+- 新增专用用户 `lisglo-rec-pull`，加入 `rtpengine` 组。
+- 安装 B 端录音拉取公钥到 `/var/lib/lisglo-rec-pull/.ssh/authorized_keys`。
+- 将 `/dev/shm/voip_rec/ready` 调整为 `0770 rtpengine:rtpengine`。
+- 更新 `/usr/local/sbin/lisglosips-recording-finalize`，让 ready 根目录和 ready 子目录保持 `0770`。
+- 备份目录：`/var/backups/lisglosips-s24/20260621T121130Z`。
+
+未调整 SSH 管理端口，未禁止 SSH key 登录，未重启 OpenSIPS、RTPEngine、Nginx 或 API。
+
+## 5. 播放路径
+
+API：
+
+```text
+GET /api/v2/recordings/:id/play
+Permission: recordings.play
+```
+
+API 只查询状态为 `READY` 的录音，返回：
+
+```text
+X-Accel-Redirect: /_recordings/<storage-key>
+Content-Type: audio/wav 或 audio/mpeg
+Cache-Control: private, no-store
+```
+
+Nginx 已在 S05 配置：
+
+```text
+location /_recordings/ {
+    internal;
+    alias /data/recordings/;
+    add_header Accept-Ranges bytes always;
+}
+```
+
+外部直接访问 `/_recordings/...` 返回 `404`，只能经 API 鉴权后内部转发。
+
+## 6. 验证结果
+
+本地：
+
+- `corepack pnpm@10.33.0 exec vitest run apps/worker-recording/src/transfer.spec.ts apps/api/src/modules/recordings/recordings.service.spec.ts` 通过，5 条测试。
+- `corepack pnpm@10.33.0 --filter @lisglosips/worker-recording build` 通过。
+- `corepack pnpm@10.33.0 typecheck` 通过。
+- `corepack pnpm@10.33.0 lint` 通过。
+- `corepack pnpm@10.33.0 build` 通过。
+
+服务器冒烟：
+
+- A 生成测试文件 `/dev/shm/voip_rec/incoming/s24-smoke/s24-smoke.wav`。
+- A finalizer 生成 `/dev/shm/voip_rec/ready/s24-smoke/s24-smoke.wav.ready`。
+- B 使用 `lisglo-recorder` 和专用 SSH key 从 A 私网拉取。
+- B 落盘 `/data/recordings/s24-smoke/s24-smoke.wav`，大小 `31`，属主 `lisglo-recorder:lisglosips`。
+- A/B SHA-256 一致：`c72dd3909a317ad55817435b7ed5a0db6947455ffc66e09a2dde787fe4a8c348`。
+- 校验成功后 A 源 `.ready` 文件已删除。
+- 外部直接访问 `https://127.0.0.1/_recordings/s24-smoke/s24-smoke.wav` 返回 `404`，内部录音 location 未暴露。
+
+## 7. 当前限制
+
+B 当前 `/opt/lisglosips/current` 仍是 S05 placeholder release，未切换到完整 monorepo API/Worker release。因此 S24 本次完成代码、构建、服务器私网拉取链路和 Nginx 内部播放保护验证；正式 `lisglosips@recording-worker.service` 随完整应用 release 发布时启用。
+
+## 8. 回滚
+
+Server A：
+
+```bash
+sudo cp -a /var/backups/lisglosips-s24/20260621T121130Z/lisglosips-recording-finalize /usr/local/sbin/lisglosips-recording-finalize
+sudo chmod 0755 /usr/local/sbin/lisglosips-recording-finalize
+sudo userdel -r lisglo-rec-pull
+sudo chmod 0750 /dev/shm/voip_rec/ready
+```
+
+Server B：
+
+```bash
+sudo rm -rf /etc/lisglosips/recording
+sudo rm -rf /data/recordings/s24-smoke
+```
+
+代码回滚：
+
+- 恢复 `apps/worker-recording/src/main.ts` 到骨架版本。
+- 删除或恢复 `apps/worker-recording/src/transfer.ts`、`transfer.spec.ts`。
+- 删除 `apps/api/src/modules/recordings/` 并从 `AppModule` 移除 `RecordingsModule`。
+- 恢复 `apps/worker-recording/package.json`、`tsconfig.json`、`pnpm-lock.yaml`。
+- 重新执行 `corepack pnpm@10.33.0 build`。
diff --git a/docs/S29_PERFORMANCE_FAULT_SECURITY_REPORT.md b/docs/S29_PERFORMANCE_FAULT_SECURITY_REPORT.md
new file mode 100644
index 0000000..5f64999
--- /dev/null
+++ b/docs/S29_PERFORMANCE_FAULT_SECURITY_REPORT.md
@@ -0,0 +1,58 @@
+# S29 性能、故障与安全测试报告
+
+## 测试范围
+
+- 环境：本地 KVM 开发环境，A/B/T 通过 Tailscale 联调。
+- 范围：小规模 CPS、并发、录音搬运、CDR/Recording Worker 恢复、Redis/MySQL 短故障、API 越权、重放与 SIP 非法来源/超 CPS 探针。
+- 约束：不做长时间满载压测，不删除 S28 验收数据，不禁用 SSH 密钥登录，不提前执行 S30。
+
+## 执行记录
+
+### 1. 基线健康检查
+
+- B：`lisglosips@api`、`lisglosips@cdr-worker`、`lisglosips@recording-worker`、`mysql`、`redis-server`、`heplify-server`、`grafana-server`、`lisglosips-prometheus.service` 均 active；API `/api/v2/health/ready` 返回 `ok`；Prometheus 实际项目服务 `lisglosips-prometheus.service` 返回 ready。
+- A：`opensips`、`rtpengine-daemon`、`rtpengine-recording-daemon`、`lisglosips-redis-auth-proxy`、`lisglosips-recording-finalize.timer` 均 active。
+- T：`lisglosips-s28-uas`、`opensips` 均 active。
+
+### 2. CPS/并发/录音
+
+- 5 路并发呼叫：T 同时发起 5 路 S28 呼叫，均收到 `100 Giving it a try`、`200 OK`、BYE `200 OK`，用时约 11.92 秒；B 端生成 5 条 raw CDR、5 条 rated CDR、5 条 READY 录音，录音大小均为 55758 bytes。
+- 12 路短突发：T 同时发起 12 路短持话呼叫，均收到 `100 Giving it a try`、`200 OK`、BYE `200 OK`，用时约 2.13 秒；B 端核对 `raws=12`、`rated=12`、`recordingsReady=12`、`totalDuration=72`、录音大小 `55758-56078` bytes。
+- 修复项：T 呼叫脚本原默认固定 `--local-port 50621`，并发时出现 `OSError: [Errno 98] Address already in use`；已改为默认 `--local-port 0` 并在 socket bind 后用实际端口生成 Via/Contact。复测 5 路和 12 路并发均通过。
+
+### 3. Worker 与数据服务故障
+
+- Recording Worker 故障：停止 B `lisglosips@recording-worker` 后发起呼叫，通话成功；恢复 worker 后自动搬运并入库录音，`recordings.status=READY`，大小 55758 bytes。
+- CDR Worker 故障：停止 B `lisglosips@cdr-worker` 后发起呼叫，Redis consumer group 出现 `lag=1`，MySQL 无 raw CDR；恢复 worker 后 `pending=0`、`lag=0`，raw/rated CDR 正常落库。
+- Redis 故障：停止 B `redis-server` 后，A 返回 `503 Redis Unavailable`，符合保护预期；恢复 Redis 后 A 热路径仍持续返回 503，重启 A `lisglosips-redis-auth-proxy` 无效，重启 A `opensips` 后恢复，复测呼叫成功。
+- MySQL 故障：停止 B `mysql` 后发起呼叫，SIP 通话成功但 CDR 入库失败。修复后复测：MySQL 恢复并等待 pending idle 窗口后，CDR Worker 自动处理 pending Redis ID，raw/rated CDR 正常入库，无新增 deadletter。
+
+### 4. Web/API 安全
+
+- 未认证访问 `/api/v2/users` 返回 `401 AUTH_REQUIRED`。
+- 质检角色测试用户 `usr_s29_quality_only` 访问 `/api/v2/users` 返回 `403 RBAC_FORBIDDEN`。
+- 未认证访问录音播放 `/api/v2/recordings/:id/play` 返回 `401 AUTH_REQUIRED`。
+- 伪造录音 ID `..etcpasswd` 通过认证访问播放接口返回 `404 RECORDING_NOT_READY`，未泄露文件内容。
+- 充值重放：对 `cus_s28_t` 使用同一 `idempotencyKey=s29-replay-cus-s28-000001` 连续 POST 两次 `0.000001` 充值，两次返回同一充值 ID `rch_da0bba1c7b1d44428ab92d77a55e503d`；数据库核对 `customer_recharges.rows=1`、`idempotency_keys.rows=1`、余额只从 `99.748000` 增加到 `99.748001`。
+
+### 5. SIP 安全探针
+
+- 从 B `100.90.90.91` 向 A `100.90.90.90:15060/udp` 发送非法来源 INVITE，Call-ID `s29-illegal-1782094573-3991@lisglosips-b`，客户端等待 3 秒无 SIP 响应；A OpenSIPS 最近日志未出现该 Call-ID。该结果说明非允许来源未进入当前业务路由；因无 OpenSIPS 层日志，保守记录为网络/主机边界静默丢弃证据。
+
+## 缺陷与处理
+
+| 编号 | 现象 | 处理 | 复测 |
+| --- | --- | --- | --- |
+| S29-D1 | T 呼叫脚本固定本地 UDP 端口，导致并发发起时端口冲突。 | 修改 `infra/server-t/s28/lisglosips-s28-sip.py`，默认 `--local-port 0`，bind 后写入实际端口到 Via/Contact，并部署到 T。 | 5 路并发和 12 路短突发均成功。 |
+| S29-D2 | MySQL 短故障时 CDR Worker 将可恢复数据库连接错误 deadletter 并 ACK 原 Redis 消息，导致 CDR 不自动重试。 | `packages/redis` 增加 `CdrRetryableError`，retryable 错误不 ACK、不 deadletter，并释放幂等锁；`worker-cdr` 将数据库连接类错误标记为 retryable。 | 停 MySQL 后发起呼叫，恢复 MySQL 并等待 pending idle 窗口后 raw/rated CDR 自动入库，无新增 deadletter。 |
+| S29-D3 | 失败 CDR 的长 `event_id` 超过 `raw_cdrs.event_id varchar(64)`，触发 Prisma 长度错误并 deadletter。 | `worker-cdr` 入库前对超过 64 字符的 `event_id` 做稳定 SHA-256 后缀压缩，原始事件仍保留在 payload 中。 | 本地 Vitest 与 build 通过；B 部署后 MySQL 故障复测无新增长度类 deadletter。 |
+| S29-D4 | Redis 恢复后 A 热路径仍返回 `503 Redis Unavailable`，仅重启 Redis proxy 无法恢复。 | 本次执行运行时恢复：重启 A `opensips`，恢复呼叫。根因需在后续 OpenSIPS Redis 连接池/故障重连策略中继续排查。 | 重启 A `opensips` 后 T->A 呼叫恢复成功。 |
+| S29-D5 | S29 期间本地/T 到 B 的 Tailscale 管理链路出现短时高延迟/丢包，SSH 偶发超时。 | 未改网络配置；采用短命令、分步执行、服务健康复核。 | 后续 SSH 与 API 健康检查恢复；记录为开发环境网络风险。 |
+
+## 结论
+
+S29 在本地 KVM 开发环境完成。单 A/S28 最小闭环在 5 路并发和 12 路短突发下能完成 SIP、CDR、计费、录音入库；Recording Worker、CDR Worker、MySQL 短故障的可恢复路径已验证，其中 MySQL 可恢复缺陷已完成代码修复并部署到 B 当前 release。
+
+API 鉴权、RBAC、录音播放未认证保护和充值幂等重放均通过。SIP 非法来源探针未进入业务路由，但缺少 OpenSIPS 层拒绝日志，建议后续补充明确的非法来源日志/指标。
+
+遗留风险：Redis 恢复后 OpenSIPS 热路径仍需重启 `opensips` 才恢复，当前只有运行时恢复与复测记录，尚未完成根因级修复；多 A、完整生产路由、多 B 高可用不属于 S29 本次范围。
diff --git a/docs/S30_FINAL_ACCEPTANCE_REPORT.md b/docs/S30_FINAL_ACCEPTANCE_REPORT.md
new file mode 100644
index 0000000..1045c1e
--- /dev/null
+++ b/docs/S30_FINAL_ACCEPTANCE_REPORT.md
@@ -0,0 +1,86 @@
+# S30 最终验收报告
+
+## 1. 目标
+
+完成 LisgloSIPS V2 本地 KVM 开发环境的备份恢复演练、上线/回滚脚本、灰度记录和最终验收，不执行真实阿里云生产切流。
+
+## 2. 执行结果
+
+| 项目 | 结果 |
+| --- | --- |
+| 当前 B release | `/opt/lisglosips/releases/s28-v2-20260621220924` |
+| B preflight | 通过 |
+| A OpenSIPS 配置语法 | 通过 |
+| 备份恢复演练 | 通过 |
+| 灰度呼叫 | 通过 |
+| 回滚脚本语法检查 | 通过 |
+
+新增产物：
+
+- `docs/S30_RELEASE_BACKUP_RUNBOOK.md`
+- `docs/S30_FINAL_ACCEPTANCE_REPORT.md`
+- `infra/server-b/s30/lisglosips-release-preflight.sh`
+- `infra/server-b/s30/lisglosips-release-rollback.sh`
+- `infra/server-a/s30/lisglosips-opensips-config-restore.sh`
+
+## 3. 备份恢复演练
+
+执行时间：2026-06-22 10:28 +08:00。
+
+备份：
+
+- MySQL：`/data/backups/mysql/20260622T022811Z`
+- Redis：`/data/backups/redis/20260622T022812Z`
+
+校验：
+
+- MySQL `all-databases.sql.gz`、`lisglosips.sql.gz`、`metadata.tsv` 的 `SHA256SUMS` 校验通过。
+- Redis `dump.rdb`、`metadata.txt` 的 `SHA256SUMS` 校验通过。
+
+恢复演练：
+
+- MySQL 恢复到隔离临时库 `lisglosips_s30_restore`，核对计数：`raw_cdrs=33`、`recordings=27`、`customer_recharges=34`、`users=2`；演练后已删除临时库。
+- Redis 从备份 RDB 启动隔离 Unix socket 临时实例，核对 `DBSIZE=51`、`stream:cdr_payload=54`、`cfg:active_version=s28-v1`；演练后已关闭临时实例并删除临时目录。
+
+未覆盖运行中的 MySQL 或 Redis 数据目录。
+
+## 4. 灰度记录
+
+灰度对象：本地开发环境 T 测试端和 S28 专用测试客户/落地模拟链路。
+
+灰度呼叫：
+
+- Call-ID：`s28-1782095548702-luppqjd4@lisglosips-t`
+- SIP：T 收到 `100 Giving it a try`、`200 OK`、BYE `200 OK`
+- B raw CDR：`raw_7a6356cc76974652aa30a9d7a350041b`
+- 计费：`rated_e0eb8cbe1b90454cb3cf2d9a3bbc9290`，`billSec=6`，客户费用和供应商成本均为 `0.012000`
+- 录音：`rec_5fdf599d679f493a83fc7a2d205a128a`，`READY`，55758 bytes
+
+结论：本地灰度链路在当前冻结 release 下通过。
+
+## 5. 回滚验证
+
+脚本语法检查：
+
+- B：`lisglosips-release-preflight.sh`、`lisglosips-release-rollback.sh` 通过 `bash -n`
+- A：`lisglosips-opensips-config-restore.sh` 通过 `bash -n`
+
+运行验证：
+
+- B `lisglosips-release-preflight.sh` 实际运行通过：current release、MySQL、Redis、Nginx、API、CDR Worker、Recording Worker、HEP、Prometheus、Grafana 均 active，API ready 正常，Nginx 配置测试成功，最近备份目录可见。
+- A `/etc/opensips/opensips.cfg` 通过 `opensips -C` 语法检查。
+
+未实际执行 release 回滚或 OpenSIPS 配置恢复，避免对当前已通过的 S28/S29/S30 环境造成不必要中断。
+
+## 6. 遗留风险
+
+- 本地开发环境不是阿里云生产环境。正式迁移前必须重新执行 VPC、安全组、数据盘、正式 DNS/TLS、备份恢复、故障注入和端到端呼叫验收。
+- S29 遗留风险仍存在：B Redis 恢复后 A/OpenSIPS 热路径可能需要重启 `opensips` 才从 `Redis Unavailable` 恢复。S30 Runbook 已纳入处置步骤，但根因级修复仍需后续单独处理。
+- 当前 A 是单 A/S28 最小真实路由，非完整多落地网关生产路由；真实 3A、多 B、高可用仍不属于本地 V2 闭环上线范围。
+- 开发 CA、Tailscale IP、本地 KVM 根盘布局不能原样用于生产。
+
+## 7. 结论
+
+S30 在本地 KVM 开发环境完成。当前 V2 闭环具备可恢复备份、可执行上线/回滚 Runbook、回滚脚本产物、灰度呼叫记录和最终验收记录。
+
+本地开发阶段可冻结在 `s28-v2-20260621220924` 作为迁移前基线。阿里云生产上线前不得跳过 S30 Runbook 中的重新备份恢复演练、正式网络/TLS 验收和灰度观察。
diff --git a/docs/S30_RELEASE_BACKUP_RUNBOOK.md b/docs/S30_RELEASE_BACKUP_RUNBOOK.md
new file mode 100644
index 0000000..484b64d
--- /dev/null
+++ b/docs/S30_RELEASE_BACKUP_RUNBOOK.md
@@ -0,0 +1,142 @@
+# S30 备份、Runbook、灰度与上线
+
+## 1. 范围
+
+当前 S30 面向本地 KVM 开发环境的 V2 闭环冻结与上线演练，不执行真实阿里云切流。阿里云迁移必须在新 VPC、正式 DNS/TLS、独立数据盘和安全组完成后，按本文重新演练。
+
+## 2. 冻结清单
+
+| 项 | 当前值 |
+| --- | --- |
+| B release | `/opt/lisglosips/releases/s28-v2-20260621220924` |
+| B current | `/opt/lisglosips/current` 指向当前 release |
+| A OpenSIPS | `/etc/opensips/opensips.cfg` |
+| T 测试脚本 | `/opt/lisglosips-s28/lisglosips-s28-sip.py` |
+| 数据库迁移 | 以 `prisma/migrations/` 和 B 当前库为准 |
+| Redis 配置版本 | 以 `cfg:active_version` 为准 |
+
+冻结后只允许以下变更进入上线窗口：
+
+- 修复已确认阻塞缺陷；
+- 更新正式域名/TLS/安全组等环境参数；
+- 文档化灰度和回滚记录。
+
+## 3. 上线前备份
+
+在任何 release 切换、数据库迁移、OpenSIPS 配置替换、Nginx/TLS 调整前执行：
+
+```bash
+sudo systemctl start lisglosips-backup.service
+sudo find /data/backups/mysql -mindepth 1 -maxdepth 1 -type d | sort | tail -1
+sudo find /data/backups/redis -mindepth 1 -maxdepth 1 -type d | sort | tail -1
+sudo sha256sum -c /data/backups/mysql/<stamp>/SHA256SUMS
+sudo sha256sum -c /data/backups/redis/<stamp>/SHA256SUMS
+```
+
+另外备份：
+
+```bash
+sudo install -d -m 0700 /var/backups/lisglosips-s30/<stamp>
+sudo cp -a /etc/lisglosips /etc/nginx /etc/systemd/system/lisglosips@.service /var/backups/lisglosips-s30/<stamp>/
+sudo cp -a /etc/opensips/opensips.cfg /var/backups/lisglosips-s30/<stamp>/opensips.cfg
+```
+
+备份目录只允许 root 读取，不复制明文 secret 到仓库或聊天记录。
+
+## 4. 恢复演练
+
+MySQL 只恢复到隔离临时库：
+
+```bash
+sudo mysql -e 'DROP DATABASE IF EXISTS lisglosips_s30_restore; CREATE DATABASE lisglosips_s30_restore CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;'
+gzip -dc /data/backups/mysql/<stamp>/lisglosips.sql.gz | sudo mysql lisglosips_s30_restore
+sudo mysql -e 'SELECT COUNT(*) FROM lisglosips_s30_restore.raw_cdrs;'
+sudo mysql -e 'DROP DATABASE lisglosips_s30_restore;'
+```
+
+Redis 只启动隔离临时实例：
+
+```bash
+sudo install -d -m 0700 /tmp/lisglosips-s30-redis-restore
+sudo cp /data/backups/redis/<stamp>/dump.rdb /tmp/lisglosips-s30-redis-restore/dump.rdb
+sudo redis-server --dir /tmp/lisglosips-s30-redis-restore --dbfilename dump.rdb --port 0 --unixsocket /tmp/lisglosips-s30-redis.sock --daemonize yes
+sudo redis-cli -s /tmp/lisglosips-s30-redis.sock DBSIZE
+sudo redis-cli -s /tmp/lisglosips-s30-redis.sock SHUTDOWN NOSAVE
+```
+
+禁止把备份直接覆盖运行中 `/var/lib/mysql`、`/var/lib/redis`。
+
+## 5. 发布顺序
+
+1. 记录当前 release、数据库迁移版本、Redis `cfg:active_version`、A OpenSIPS 配置 SHA-256。
+2. 执行 S30 备份与恢复演练。
+3. 上传新 release 到 `/opt/lisglosips/releases/<release-id>`，校验 `package.json`、`pnpm-lock.yaml` 和构建产物。
+4. 执行向前兼容数据库迁移，禁止同窗口不可逆删列。
+5. 原子切换 `/opt/lisglosips/current`。
+6. 重启 `lisglosips@api`、`lisglosips@cdr-worker`、`lisglosips@recording-worker`。
+7. `nginx -t` 后 reload Nginx。
+8. 执行 `infra/server-b/s30/lisglosips-release-preflight.sh`。
+9. 发布 Redis 配置快照并确认 A 使用新版本。
+10. T 发起测试呼叫，按 Call-ID 核对 SIP、CDR、计费、录音、HOMER。
+11. 开始灰度。
+
+## 6. 灰度策略
+
+本地环境使用 `cus_s28_t` 和 T 专用 UAS 作为灰度对象；生产环境选择一个低风险客户或一条低风险线路。
+
+灰度观察项：
+
+- SIP 2xx/4xx/5xx 分布；
+- Redis Stream lag 和 pending；
+- CDR 入库与重复扣费；
+- 余额变化和充值幂等；
+- 录音 READY 比例、A tmpfs 使用率；
+- API 5xx、P95/P99；
+- HOMER 是否可按 Call-ID 查询。
+
+扩大条件：连续观察 24-72 小时无 P1/P2 缺陷、无 CDR/余额异常、录音搬运无持续积压。
+
+## 7. 回滚
+
+### B 应用回滚
+
+```bash
+sudo infra/server-b/s30/lisglosips-release-rollback.sh /opt/lisglosips/releases/<previous-release>
+```
+
+脚本会切换 `current`、重启 API/CDR/Recording Worker、校验 Nginx 并检查 API ready。
+
+### Redis 配置回滚
+
+切回上一个 `cfg:active_version`，不删除 Stream 或 deadletter。回滚后用 T 呼叫验证 A 已读取旧版本。
+
+### OpenSIPS 回滚
+
+```bash
+sudo infra/server-a/s30/lisglosips-opensips-config-restore.sh /var/backups/<path>/opensips.cfg
+```
+
+脚本会先备份当前配置、执行 `opensips -C`，通过后替换并重启 OpenSIPS。重启会影响现有通话，生产必须放在维护窗口或确认可接受。
+
+### 数据库回滚
+
+优先发布向前修复迁移；只有在确认不可用且有完整备份时，才进入维护窗口做数据恢复。充值、CDR、审计、录音记录不直接物理删除。
+
+### S29 Redis 恢复遗留风险
+
+若 B Redis 故障恢复后 A 继续返回 `503 Redis Unavailable`：
+
+1. 确认 B `redis-server` active，A 到 B Redis 端口可达。
+2. 重启 A `lisglosips-redis-auth-proxy`。
+3. 若仍失败，维护窗口内重启 A `opensips`。
+4. 记录 Call-ID、A 日志、Redis proxy 日志，作为后续根因修复输入。
+
+## 8. 阿里云迁移前阻断项
+
+- 正式 DNS/TLS 未完成；
+- A/B 未位于同 VPC 低时延私网；
+- B 未使用独立数据盘承载 MySQL、Redis、录音和监控；
+- 安全组未限制 SSH 管理来源，或禁用了 SSH 密钥登录；
+- 未完成新环境备份恢复演练；
+- 未完成 T 或外部测试端到端呼叫；
+- Redis 恢复后 OpenSIPS 自动恢复风险未纳入告警/Runbook。
diff --git a/docs/SERVER_A_OPENSIPS_BASELINE_RUNBOOK.md b/docs/SERVER_A_OPENSIPS_BASELINE_RUNBOOK.md
new file mode 100644
index 0000000..6062a1a
--- /dev/null
+++ b/docs/SERVER_A_OPENSIPS_BASELINE_RUNBOOK.md
@@ -0,0 +1,112 @@
+# Server A OpenSIPS Baseline Runbook
+
+> Task: S18 - Server A OpenSIPS baseline
+> Environment: local KVM development servers over Tailscale
+
+## Scope
+
+S18 installs and pins OpenSIPS 3.6.x on Server A, binds SIP to the Tailscale address `100.90.90.90:15060/udp`, enables local-only MI HTTP, loads the Redis and HEP/tracer module baseline, and adds basic SIP anti-scan handling.
+
+Full Redis routing, RTPEngine/media handling, CDR Stream emission, and production SIP routing are intentionally left for S19-S22.
+
+## Installed Packages
+
+Packages installed from `https://apt.opensips.org noble 3.6-releases`:
+
+- `opensips` `3.6.7-1`
+- `opensips-auth-modules` `3.6.7-1`
+- `opensips-redis-module` `3.6.7-1`
+- `opensips-http-modules` `3.6.7-1`
+- `opensips-json-module` `3.6.7-1`
+- `opensips-restclient-module` `3.6.7-1`
+- `opensips-prometheus-module` `3.6.7-1`
+- `opensips-tlsmgm-module` `3.6.7-1`
+- `opensips-tls-module` `3.6.7-1`
+- `opensips-tls-openssl-module` `3.6.7-1`
+- `opensips-cli` `0.4.0~20260522~570a9a9-1`
+
+All listed OpenSIPS packages are held with `apt-mark hold`.
+
+## Server Files
+
+- `/etc/opensips/opensips.cfg`
+- `/etc/default/opensips`
+- `/etc/apt/sources.list.d/opensips.list`
+- `/etc/apt/sources.list.d/opensips-cli.list`
+- `/etc/nftables.d/lisglosips-s18-opensips.nft`
+
+Repository copies:
+
+- `infra/server-a/s18/opensips/opensips.cfg`
+- `infra/server-a/s18/opensips/opensips.default`
+- `infra/server-a/s18/nftables/lisglosips-s18-opensips.nft`
+
+## Runtime
+
+- OpenSIPS listens on `100.90.90.90:15060/udp`.
+- HEP transport placeholder listens on `127.0.0.1:9061/udp`.
+- MI HTTP listens on `127.0.0.1:8888/tcp`.
+- Node Exporter remains on `100.90.90.90:9100/tcp` from S06.
+
+## SIP Behavior
+
+- `OPTIONS` without a user part returns `200 Keepalive`.
+- `REGISTER` returns `401 Authentication Required` with a Digest challenge.
+- `INVITE` returns `503 Routing Not Ready` until S20/S21 routes are implemented.
+- `pike` blocks excessive request density.
+- `maxfwd` rejects loops with `483 Too Many Hops`.
+
+## Firewall
+
+The S18 nftables table only filters the new SIP and MI surfaces:
+
+- allow `100.93.185.30 -> 100.90.90.90:15060/udp`;
+- drop other UDP `15060` sources;
+- drop non-local TCP access to `8888`.
+
+The table uses `policy accept` and does not alter SSH. SSH key login remains enabled and unchanged.
+
+## Validation
+
+Commands used:
+
+```bash
+opensips -C -f /etc/opensips/opensips.cfg
+systemctl is-active opensips
+systemctl is-enabled opensips
+ss -lntu | grep -E '15060|8888|9061|9100'
+curl -X POST http://127.0.0.1:8888/mi -H 'Content-Type: application/json' --data-binary @mi-version.json
+```
+
+Observed results:
+
+- OpenSIPS config check: OK.
+- `opensips.service`: active and enabled.
+- MI JSON-RPC `version`: returned `OpenSIPS (3.6.7 (x86_64/linux))`.
+- From Server T, SIP `OPTIONS` returned `SIP/2.0 200 Keepalive`.
+- From Server T, SIP `REGISTER` returned `SIP/2.0 401 Authentication Required` with `WWW-Authenticate`.
+
+## Rollback
+
+Backup directory:
+
+```text
+/var/backups/lisglosips-s18/20260621T051403Z
+```
+
+Basic rollback:
+
+```bash
+sudo systemctl stop opensips
+sudo cp -a /var/backups/lisglosips-s18/20260621T051403Z/opensips-etc-before-deploy/. /etc/opensips/
+sudo cp -a /var/backups/lisglosips-s18/20260621T051403Z/opensips-default-before-deploy /etc/default/opensips
+sudo nft delete table inet lisglosips_s18_opensips
+sudo systemctl daemon-reload
+```
+
+If removing packages is required, do it in a maintenance window after confirming no S19/S20 work depends on them:
+
+```bash
+sudo apt-mark unhold opensips opensips-auth-modules opensips-redis-module opensips-http-modules opensips-json-module opensips-restclient-module opensips-prometheus-module opensips-tlsmgm-module opensips-tls-module opensips-tls-openssl-module opensips-cli
+sudo apt-get remove --purge opensips opensips-auth-modules opensips-redis-module opensips-http-modules opensips-json-module opensips-restclient-module opensips-prometheus-module opensips-tlsmgm-module opensips-tls-module opensips-tls-openssl-module opensips-cli
+```
diff --git a/docs/SERVER_A_REDIS_HEP_METRICS_RUNBOOK.md b/docs/SERVER_A_REDIS_HEP_METRICS_RUNBOOK.md
new file mode 100644
index 0000000..8c99071
--- /dev/null
+++ b/docs/SERVER_A_REDIS_HEP_METRICS_RUNBOOK.md
@@ -0,0 +1,143 @@
+# Server A Redis 热路径、HEP 与指标 Runbook
+
+适用范围：S20 在 Server A 上部署的 OpenSIPS Redis 热路径、HEP 发送、自定义指标和本地 Redis AUTH 代理。
+
+## 部署结果
+
+- OpenSIPS 继续监听 `100.90.90.90:15060/udp`，HEP 本地发送 socket 为 `100.90.90.90:9061/udp`。
+- 本地 Redis AUTH 代理监听 `127.0.0.1:6380/tcp`，上游连接 Server B Redis `100.90.90.91:6379`，凭据通过 systemd encrypted credential 加载，不写入明文配置。
+- OpenSIPS Redis URL 由预处理器注入为本地代理地址。
+- Lua 热路径脚本读取版本化配置：
+  - `cfg:active_version`
+  - `cfg:v:{version}:auth:ip:{source_ip}`
+  - `cfg:v:{version}:customer_gateway:{id}`
+  - `cfg:v:{version}:customer:{id}`
+  - `cfg:v:{version}:customer_gateway:{id}:policies`
+- INVITE 会按 Lua 返回结果降级：
+  - Redis 不可用：`503 Redis Unavailable`
+  - 配置缺失：`503 Config Missing`
+  - 策略缺失：`503 No Route Policy`
+  - 策略允许但 S21/S28 路由未完成：`503 Routing Not Ready`
+- CDR 冒烟事件写入 `stream:cdr_payload`，S20 验证事件已清理。
+- Prometheus 指标：
+  - OpenSIPS MI/Prometheus：`http://127.0.0.1:8888/metrics`
+  - Node Exporter textfile：`/var/lib/prometheus/node-exporter/lisglosips_s20.prom`
+  - Server B 抓取 A：`http://100.90.90.90:9100/metrics`
+
+## 关键文件
+
+- `/etc/opensips/opensips.cfg`
+- `/etc/opensips/lisglosips_hotpath.lua`
+- `/usr/local/sbin/lisglosips-redis-auth-proxy`
+- `/usr/local/sbin/lisglosips-redis-load-hotpath`
+- `/usr/local/sbin/lisglosips-opensips-preprocess`
+- `/usr/local/sbin/lisglosips-s20-metrics`
+- `/etc/systemd/system/lisglosips-redis-auth-proxy.service`
+- `/etc/systemd/system/lisglosips-redis-hotpath-load.service`
+- `/etc/systemd/system/opensips.service.d/20-lisglosips-s20.conf`
+- `/etc/systemd/system/lisglosips-s20-metrics.service`
+- `/etc/systemd/system/lisglosips-s20-metrics.timer`
+- `/etc/default/lisglosips-node-exporter`
+- `/etc/nftables.d/lisglosips-s20-observability.nft`
+- `/etc/systemd/system/lisglosips-a-firewall.service`
+
+仓库副本位于 `infra/server-a/s20/`。
+
+## 服务检查
+
+```bash
+sudo systemctl is-system-running
+sudo systemctl is-active opensips lisglosips-redis-auth-proxy lisglosips-s20-metrics.timer lisglosips-node-exporter lisglosips-a-firewall
+sudo systemctl is-enabled opensips lisglosips-redis-auth-proxy lisglosips-redis-hotpath-load lisglosips-s20-metrics.timer lisglosips-node-exporter lisglosips-a-firewall
+sudo ss -lntup | grep -E ':15060|:9061|:8888|:6380|:9100'
+```
+
+`lisglosips-redis-hotpath-load.service` 是 oneshot，执行成功后显示 inactive 属于正常状态；检查 `systemctl show -p Result lisglosips-redis-hotpath-load.service` 应为 `success`。
+
+## 指标检查
+
+```bash
+curl -fsS http://127.0.0.1:8888/metrics | grep 'lisglosips_opensips_s20_'
+cat /var/lib/prometheus/node-exporter/lisglosips_s20.prom
+```
+
+Server B 可抓取：
+
+```bash
+curl -fsS http://100.90.90.90:9100/metrics | grep -E 'lisglosips_(voip_rec|recording|redis_proxy|rtpengine)'
+```
+
+当前 S20 自定义指标包括：
+
+- `lisglosips_opensips_s20_invite_total`
+- `lisglosips_opensips_s20_hotpath_allow_total`
+- `lisglosips_opensips_s20_hotpath_reject_total`
+- `lisglosips_opensips_s20_redis_error_total`
+- `lisglosips_opensips_s20_cdr_xadd_total`
+- `lisglosips_opensips_s20_cdr_xadd_error_total`
+- `lisglosips_redis_proxy_up`
+- `lisglosips_voip_rec_tmpfs_bytes`
+- `lisglosips_recording_files`
+- `lisglosips_recording_oldest_ready_age_seconds`
+- `lisglosips_rtpengine_sessions`
+
+## HEP 检查
+
+A 侧确认无发送错误：
+
+```bash
+sudo journalctl -u opensips --since '10 minutes ago' --no-pager | grep -E 'Cannot send HEP|Failed to duplicate|S20'
+```
+
+B 侧确认 heplify 收包统计：
+
+```bash
+journalctl -u heplify-server --since '10 minutes ago' --no-pager | tail -n 80
+```
+
+S20 验证中曾因 HEP socket 绑定 `127.0.0.1` 触发发送错误，OpenSIPS 仍按预期返回 SIP 响应；配置修正为 `100.90.90.90:9061` 后，A 侧抓包看到 HEP 发往 B `100.90.90.91:9060`，B heplify 统计显示 HEP 收包且 Error 为 0。
+
+## 降级验证记录
+
+- Redis 配置缺失：T 发 INVITE 后 A 返回 `SIP/2.0 503 Config Missing`，OpenSIPS 记录 `S20 hotpath reject reason=CONFIG_MISSING`，CDR XADD 成功。
+- Redis 代理不可用：短暂停止 `lisglosips-redis-auth-proxy` 后，T 发 INVITE 返回 `SIP/2.0 503 Redis Unavailable`，OpenSIPS 记录 `S20 Redis hotpath unavailable` 和 `S20 CDR XADD failed`；随后启动代理并重新执行 Lua loader 恢复。
+- HEP 发送异常：绑定错误期间 OpenSIPS 记录 HEP 发送失败，但 SIP 降级响应和 CDR 热路径继续执行；绑定修正后无新增 HEP 发送错误。
+
+## 回滚
+
+S20 初始备份目录：
+
+```text
+/var/backups/lisglosips-s20/20260621T061900Z
+```
+
+后续验证阶段重启 OpenSIPS 前，也在该目录下的 `post-verify/` 保存了当时的 `/etc/opensips/opensips.cfg` 副本。
+
+回滚步骤：
+
+1. 停止 S20 新增服务：
+
+   ```bash
+   sudo systemctl stop lisglosips-s20-metrics.timer lisglosips-s20-metrics.service
+   sudo systemctl stop lisglosips-redis-auth-proxy.service
+   ```
+
+2. 从备份恢复 `/etc/opensips/opensips.cfg`、OpenSIPS drop-in、Node Exporter 默认文件和 S20 systemd/nftables 文件。
+3. 执行 OpenSIPS 语法检查：
+
+   ```bash
+   sudo opensips -C -f /etc/opensips/opensips.cfg
+   ```
+
+4. 重载 systemd 并重启相关服务：
+
+   ```bash
+   sudo systemctl daemon-reload
+   sudo systemctl restart opensips
+   sudo systemctl restart lisglosips-node-exporter
+   sudo systemctl restart lisglosips-a-firewall
+   ```
+
+5. 验证 `systemctl is-system-running`、SIP `OPTIONS`、Node Exporter 和 nftables 表。
+
+回滚不删除 Redis Stream 历史数据；如需清理测试事件，只按明确 Call-ID 精确 `XDEL`。
diff --git a/docs/SERVER_A_RTPENGINE_RECORDING_RUNBOOK.md b/docs/SERVER_A_RTPENGINE_RECORDING_RUNBOOK.md
new file mode 100644
index 0000000..f98526d
--- /dev/null
+++ b/docs/SERVER_A_RTPENGINE_RECORDING_RUNBOOK.md
@@ -0,0 +1,135 @@
+# Server A RTPEngine 与录音 tmpfs Runbook
+
+适用阶段：S19  
+服务器：Server A `100.90.90.90`  
+备份目录：`/var/backups/lisglosips-s19/20260621T054645Z`
+
+## 部署内容
+
+- 安装并固定 Ubuntu 仓库 RTPEngine 包 `11.5.1.18-1ubuntu1.2`：
+  - `rtpengine`
+  - `rtpengine-daemon`
+  - `rtpengine-recording-daemon`
+  - `rtpengine-iptables`
+  - `rtpengine-kernel-dkms`
+  - `rtpengine-utils`
+- 安装匹配当前内核的 headers，DKMS 已为 `6.17.0-22-generic` 和 `6.17.0-35-generic` 构建 `rtpengine/11.5.1.18`。
+- 加载内核模块 `xt_RTPENGINE`，RTPEngine 使用 kernel forwarding。
+- 创建 `/dev/shm/voip_rec` 3 GiB tmpfs，子目录：
+  - `spool`
+  - `incoming`
+  - `ready`
+  - `failed`
+  - `tmp`
+- 部署录音 finalizer，将 `incoming` 下完成文件移动为 `ready/<path>.part`，再原子重命名为 `ready/<path>.ready`。
+- 新增 `lisglosips-a-firewall.service`，重启后自动加载 S18/S19 nftables 规则。
+- 新增 OpenSIPS drop-in，等待 Tailscale 地址 `100.90.90.90` 后再启动，避免开机绑定失败。
+- 覆盖 `rtpengine-recording-daemon.service`，移除包默认 NFS/rpcbind 依赖，改为依赖本机 tmpfs 和 `rtpengine-daemon`。
+- 停止并 mask `rpcbind.service`、`rpcbind.socket`。S19 录音缓冲不使用 NFS。
+
+## 关键文件
+
+服务器文件：
+
+- `/etc/rtpengine/rtpengine.conf`
+- `/etc/rtpengine/rtpengine-recording.conf`
+- `/etc/default/rtpengine-daemon`
+- `/etc/default/rtpengine-recording-daemon`
+- `/etc/nftables.d/lisglosips-s19-rtpengine.nft`
+- `/etc/systemd/system/lisglosips-a-firewall.service`
+- `/etc/systemd/system/opensips.service.d/10-lisglosips-wait-tailscale.conf`
+- `/etc/systemd/system/rtpengine-recording-daemon.service`
+- `/etc/systemd/system/lisglosips-recording-finalize.service`
+- `/etc/systemd/system/lisglosips-recording-finalize.timer`
+- `/etc/tmpfiles.d/lisglosips-voip-rec.conf`
+- `/usr/local/sbin/lisglosips-recording-finalize`
+- `/etc/fstab`
+
+仓库副本：
+
+- `infra/server-a/s19/rtpengine/`
+- `infra/server-a/s19/nftables/`
+- `infra/server-a/s19/systemd/`
+- `infra/server-a/s19/tmpfiles/`
+- `infra/server-a/s19/scripts/`
+
+## 运行参数
+
+RTPEngine：
+
+- 媒体地址：`100.90.90.90`
+- RTP 端口范围：`30000-40000/udp`
+- NG 控制口：`127.0.0.1:2223/udp`
+- CLI：`127.0.0.1:2224/tcp`
+- HTTP/metrics：`127.0.0.1:2225/tcp`
+- 录音 spool：`/dev/shm/voip_rec/spool`
+
+防火墙：
+
+- 允许 T `100.93.185.30` 到 A `30000-40000/udp`
+- 丢弃其他来源到 A `30000-40000/udp`
+- 阻断非本地访问 `2223/udp`、`2224/tcp`、`2225/tcp`
+
+## 验收记录
+
+- 重启后 `systemctl is-system-running` 为 `running`，无 failed unit。
+- `opensips`、`rtpengine-daemon`、`rtpengine-recording-daemon`、`lisglosips-recording-finalize.timer`、`lisglosips-a-firewall.service`、`lisglosips-node-exporter.service` 均 active/enabled。
+- `/dev/shm/voip_rec` 为 3.0 GiB tmpfs，目录属主 `rtpengine:rtpengine`，权限 `0750`。
+- `xt_RTPENGINE` 已加载；DKMS 状态为 installed。
+- `rtpengine-ctl -ip 127.0.0.1 -port 2224 list interfaces` 显示 `100.90.90.90`，端口段 `30000 - 40000`。
+- nftables 表 `lisglosips_s19_rtpengine` 重启后存在。
+- 从 T 向 A `30000/udp`、`40000/udp` 发送探针，A 在 `tailscale0` 抓包可见。
+- 从 T 发 SIP `OPTIONS` 到 A `15060/udp` 返回 `SIP/2.0 200 Keepalive`。
+- 从 T 发 SIP `REGISTER` 到 A `15060/udp` 返回 `SIP/2.0 401 Authentication Required` 和 `WWW-Authenticate`。
+- finalizer 冒烟：测试 `.wav` 从 `incoming` 移动到 `ready/...wav.ready`，权限 `0640`，无 `.part` 残留，测试文件已删除。
+
+说明：S19 尚未把 OpenSIPS 呼叫路由接入 RTPEngine，真实双向通话、NAT 媒体锚定和完整录音由 S20/S21/S28 联调完成。本阶段已验证 RTPEngine 服务、内核模块、RTP 端口范围、tmpfs 和录音 ready 生命周期。
+
+## 常用检查
+
+```bash
+systemctl is-system-running
+systemctl is-active opensips rtpengine-daemon rtpengine-recording-daemon lisglosips-recording-finalize.timer
+findmnt /dev/shm/voip_rec
+df -h /dev/shm/voip_rec
+lsmod | grep RTPENGINE
+dkms status | grep rtpengine
+rtpengine-ctl -ip 127.0.0.1 -port 2224 list numsessions
+rtpengine-ctl -ip 127.0.0.1 -port 2224 list interfaces
+nft list table inet lisglosips_s19_rtpengine
+iptables -t mangle -L -n -v
+```
+
+## 回滚
+
+1. 停止 RTPEngine 与录音服务：
+
+   ```bash
+   sudo systemctl stop rtpengine-recording-daemon lisglosips-recording-finalize.timer rtpengine-daemon
+   ```
+
+2. 从备份目录恢复被覆盖的配置：
+
+   ```bash
+   sudo rsync -a /var/backups/lisglosips-s19/20260621T054645Z/etc/ /
+   ```
+
+3. 移除 S19 新增防火墙表和服务：
+
+   ```bash
+   sudo nft delete table inet lisglosips_s19_rtpengine || true
+   sudo systemctl disable --now lisglosips-a-firewall.service || true
+   sudo rm -f /etc/systemd/system/lisglosips-a-firewall.service
+   sudo systemctl daemon-reload
+   ```
+
+4. 如需卸载 RTPEngine 包，先解除 hold，再卸载：
+
+   ```bash
+   sudo apt-mark unhold rtpengine rtpengine-daemon rtpengine-recording-daemon rtpengine-iptables rtpengine-kernel-dkms rtpengine-utils
+   sudo apt-get remove --purge rtpengine rtpengine-daemon rtpengine-recording-daemon rtpengine-iptables rtpengine-kernel-dkms rtpengine-utils
+   ```
+
+5. 如需移除 tmpfs，先确认无待搬运录音，再卸载并删除 `/etc/fstab` 中对应行。
+
+回滚不涉及 SSH 管理策略，不禁用 SSH 密钥登录。
diff --git a/docs/SERVER_B_BASELINE_RUNBOOK.md b/docs/SERVER_B_BASELINE_RUNBOOK.md
new file mode 100644
index 0000000..f378d4c
--- /dev/null
+++ b/docs/SERVER_B_BASELINE_RUNBOOK.md
@@ -0,0 +1,162 @@
+# Server B 基础系统 Runbook
+
+> 对应任务：S03  
+> 完成日期：2026-06-20  
+> 环境：本地开发 Server B，Tailscale IP 100.90.90.91
+
+## 1. 当前基线
+
+| 项目 | 状态 |
+| --- | --- |
+| OS | Ubuntu 24.04.4 LTS |
+| 内核 | 6.17.0-35-generic |
+| 时间同步 | chrony 4.5，阿里云 NTP 优先、腾讯云 NTP 备用 |
+| 防火墙 | nftables 1.0.9，默认拒绝入站 |
+| SSH 防护 | fail2ban 1.0.2，sshd jail |
+| 系统指标 | sysstat enabled |
+| 数据盘 | 无独立盘；开发阶段 `/data` 位于根分区 |
+| NFS | `/home/hector/share` 经 Tailscale automount |
+
+完整变更前备份位于 B：
+
+`/var/backups/lisglosips-s03/20260620184404`
+
+目录权限为 0700，包含变更前 tar、包清单、网络/防火墙快照、变更后配置和 SHA-256 清单。
+
+## 2. 系统用户
+
+| 用户 | 主组 | 用途 | 登录 |
+| --- | --- | --- | --- |
+| lisglosips | lisglosips | API 与通用 Worker | nologin |
+| lisglo-recorder | lisglosips | 录音搬运 | nologin |
+| lisglo-monitor | lisglosips | 自定义监控采集 | nologin |
+
+不要依赖当前数字 UID/GID；部署脚本应按名称解析。
+
+## 3. 目录权限
+
+| 目录 | 所有者 | 模式/说明 |
+| --- | --- | --- |
+| `/data/mysql` | root:root | 0750，S04 安装后交给 mysql |
+| `/data/redis` | root:root | 0750，S04 安装后交给 redis |
+| `/data/recordings` | lisglo-recorder:lisglosips | 2750 |
+| `/data/prometheus` | root:root | 0750，S06 后调整 |
+| `/data/grafana` | root:root | 0750，S06 后调整 |
+| `/data/homer` | root:root | 0750，S06 后调整 |
+| `/data/backups` | root:root | 0700 |
+| `/opt/lisglosips` | root:lisglosips | 2750 |
+| `/etc/lisglosips` | root:lisglosips | 0750 |
+| `/var/log/lisglosips` | lisglosips:lisglosips | 2750 |
+
+`/run/lisglosips`、`/run/lisglo-recorder`、`/run/lisglo-monitor` 由 `/etc/tmpfiles.d/lisglosips.conf` 在启动时重建。
+
+## 4. NFS 自动挂载
+
+`/etc/fstab`：
+
+```fstab
+100.120.96.71:/mnt/share /home/hector/share nfs _netdev,nofail,noatime,x-systemd.automount,x-systemd.requires=tailscaled.service,x-systemd.after=tailscaled.service,x-systemd.mount-timeout=30s 0 0
+```
+
+验证：
+
+```bash
+systemctl status home-hector-share.automount
+ls /home/hector/share
+findmnt /home/hector/share
+```
+
+业务数据库和录音暂不使用该共享。迁移阿里云时重新设计独立数据盘，不复制本地 fstab。
+
+## 5. 时间同步
+
+配置文件：
+
+- `/etc/chrony/sources.d/lisglosips.sources`
+- Ubuntu 默认 pool 与 DHCP 动态 NTP 源已在 `chrony.conf` 中禁用。
+
+当前网络会把部分公网 NTP 请求透明转发到不同响应地址，严格 conntrack 会拒绝该回复。因此选用能原地址响应的两个时间源，没有放宽 UDP 123 入站。
+
+```bash
+chronyc tracking
+chronyc sources -v
+timedatectl
+```
+
+验收标准：Stratum 非 0、Leap status 为 Normal、`System clock synchronized: yes`。
+
+## 6. 防火墙
+
+配置文件：
+
+- `/etc/nftables.conf`
+- `/etc/nftables.d/lisglosips.nft`
+- 仓库副本：`infra/server-b/s03/`
+
+允许项：
+
+| 来源 | 目标端口 | 用途 |
+| --- | --- | --- |
+| 100.91.249.119、100.98.167.119 | TCP `<SSH_ADMIN_PORT>`、443 | 两台现有管理设备；SSH 保留 Key 登录 |
+| 100.90.90.90 | TCP 6379 | A 到 Redis |
+| 100.90.90.90 | UDP 9060 | A 到 HEP |
+| 任意来源 | UDP 41641 | Tailscale 外层直连 |
+| 任意来源 | ICMP/ICMPv6 | 诊断与 IPv6 必需控制报文 |
+
+除此之外的入站流量默认丢弃。MySQL 3306、Prometheus 9090、Grafana 3000 和应用内部端口不得开放。
+
+修改规则时：
+
+```bash
+sudo nft -c -f /etc/nftables.conf
+sudo systemctl restart nftables
+sudo nft list table inet lisglosips_filter
+```
+
+修改 SSH 端口或防火墙时，必须保持一个已验证 SSH 会话，并在另一个新会话中用 Key 登录验证成功后才能关闭旧会话。
+
+## 7. Fail2ban
+
+`/etc/fail2ban/jail.d/lisglosips.local` 启用 sshd jail：
+
+- 10 分钟内失败 5 次；
+- 封禁 1 小时；
+- 使用 nftables multiport action；
+- 当前开发机 100.91.249.119 在 ignoreip 中。
+
+```bash
+sudo fail2ban-client -t
+sudo fail2ban-client status sshd
+```
+
+## 8. 回滚
+
+仅回滚防火墙：
+
+```bash
+sudo /var/backups/lisglosips-s03/20260620184404/rollback-firewall.sh
+```
+
+恢复 fstab：
+
+```bash
+sudo cp -a /var/backups/lisglosips-s03/20260620184404/fstab.before-nfs-fix /etc/fstab
+sudo systemctl daemon-reload
+```
+
+恢复 chrony 配置：
+
+```bash
+sudo cp -a /var/backups/lisglosips-s03/20260620184404/chrony.conf.before-lisglosips /etc/chrony/chrony.conf
+sudo rm -f /etc/chrony/sources.d/lisglosips.sources
+sudo systemctl restart chrony
+```
+
+系统包升级不建议逐包降级。若升级导致系统级故障，应从变更前虚拟机快照恢复；远端备份主要用于配置审计和局部恢复。
+
+## 9. 已知事项
+
+- SSH 由 `ssh.socket` 启动：socket enabled、service active，`ssh.service` 显示 disabled 属正常状态。
+- `findmnt --verify` 对 swapfile 给出常规文件警告，不是解析错误。
+- 桌面、CUPS、Avahi、rpcbind 等服务仍存在，但已被主机防火墙隔离；精简桌面不属于 S03。
+- 本地 `/data` 只是开发布局。迁移阿里云前必须创建独立数据盘并重新验收容量、IOPS、挂载和备份。
diff --git a/docs/SERVER_B_DATA_SERVICES_RUNBOOK.md b/docs/SERVER_B_DATA_SERVICES_RUNBOOK.md
new file mode 100644
index 0000000..d14f94b
--- /dev/null
+++ b/docs/SERVER_B_DATA_SERVICES_RUNBOOK.md
@@ -0,0 +1,234 @@
+# Server B MySQL 与 Redis Runbook
+
+> 对应任务：S04  
+> 完成日期：2026-06-20  
+> 环境：本地开发 Server B
+
+## 1. 版本与状态
+
+| 服务 | 固定版本 | 监听 |
+| --- | --- | --- |
+| MySQL | 8.0.46-0ubuntu0.24.04.2 | 127.0.0.1:3306、127.0.0.1:33060 |
+| Redis | 7.0.15-1ubuntu0.24.04.4 | 127.0.0.1:6379、100.90.90.91:6379 |
+
+固定包：
+
+```bash
+apt-mark showhold | grep -E 'mysql|redis'
+```
+
+更新前必须先阅读安全公告、备份并执行恢复演练，然后显式 `apt-mark unhold`。不要长期忽略安全更新。
+
+版本清单位于：
+
+- B：`/etc/lisglosips/versions.env`
+- 仓库：`infra/server-b/s04/versions.env`
+
+## 2. 数据目录
+
+开发服务器没有独立数据盘。实际数据写入：
+
+- `/data/mysql`
+- `/data/redis`
+
+为兼容 Ubuntu 包、AppArmor 和 systemd，使用 bind mount 保留标准服务路径：
+
+```fstab
+/data/mysql /var/lib/mysql none bind 0 0
+/data/redis /var/lib/redis none bind 0 0
+```
+
+服务分别依赖 `var-lib-mysql.mount` 和 `var-lib-redis.mount`。迁移阿里云时必须改用独立数据盘，不能直接复制本地根盘布局。
+
+## 3. MySQL 基线
+
+配置：`/etc/mysql/mysql.conf.d/99-lisglosips.cnf`
+
+- 仅绑定回环地址；
+- 业务库：`lisglosips`，utf8mb4；
+- binlog 已启用，格式 ROW，保留 7 天；
+- `sync_binlog=1`；
+- `innodb_flush_log_at_trx_commit=1`；
+- 数据库默认时区 UTC；
+- 禁止 `local_infile` 和 DNS 主机名解析；
+- 慢查询阈值 1 秒；
+- InnoDB buffer pool 1 GiB，最大连接数 200。
+
+账号：
+
+| 账号 | 来源 | 权限 |
+| --- | --- | --- |
+| lisglosips_app | 127.0.0.1 | SELECT/INSERT/UPDATE/DELETE/EXECUTE |
+| lisglosips_migrate | 127.0.0.1 | `lisglosips.*` 全权限，用于迁移 |
+
+应用账号不能 DDL；S04 已用实际 ALTER 拒绝测试验证。
+
+## 4. Redis 基线
+
+配置：
+
+- `/etc/redis/redis-lisglosips.conf`
+- `/etc/redis/users.acl`
+
+关键策略：
+
+- protected mode 开启；
+- AOF everysec 与 RDB 快照同时启用；
+- 最大内存 1536 MiB；
+- `maxmemory-policy=noeviction`，业务热数据和 Stream 不静默淘汰；
+- 默认用户关闭；
+- `lisglosips` 允许业务命令但移除 dangerous 类命令；
+- `lisglo-backup` 仅允许 PING、INFO、BGSAVE、LASTSAVE。
+
+Redis 绑定 Tailscale 地址。`lisglosips-tailscale-ready.service` 会先等待 100.90.90.91/32 出现，避免 Redis 开机首次启动竞态。
+
+## 5. 凭据
+
+本地 DPAPI 加密文件：
+
+`.codex-private/SERVICE_CREDENTIALS.clixml`
+
+包含：
+
+- MYSQL_APP
+- MYSQL_MIGRATE
+- REDIS_APP
+- REDIS_BACKUP
+
+B 机：
+
+| 文件 | 权限 |
+| --- | --- |
+| `/etc/lisglosips/secrets/mysql-app.env` | root:lisglosips 0640 |
+| `/etc/lisglosips/secrets/mysql-migrate.env` | root:root 0600 |
+| `/etc/lisglosips/secrets/redis.env` | root:lisglosips 0640 |
+| `/etc/lisglosips/secrets/redis-backup.env` | root:root 0600 |
+| `/etc/redis/users.acl` | root:redis 0640 |
+
+禁止在聊天、日志、状态文件、仓库或命令参数中输出密码。
+
+## 6. 网络安全
+
+- MySQL 不允许远程连接。
+- Redis 仅允许 A 的 Tailscale IP 100.90.90.90 通过 B 的 nftables 访问。
+- T 对 3306/6379 的连接已验证为超时拒绝。
+- A 第一次访问 B 时可能需要先建立 Tailscale direct 路径：
+
+```bash
+tailscale ping --c 1 100.90.90.91
+```
+
+稳态 direct 后 Redis 认证连接正常。
+
+## 7. 自动备份
+
+脚本：
+
+- `/usr/local/sbin/lisglosips-mysql-backup`
+- `/usr/local/sbin/lisglosips-redis-backup`
+
+systemd：
+
+- `lisglosips-backup.service`
+- `lisglosips-backup.timer`
+
+每天 03:15 执行，随机延迟最多 15 分钟，保留 14 天。
+
+备份目录：
+
+```text
+/data/backups/mysql/YYYYMMDDTHHMMSSZ/
+  all-databases.sql.gz
+  lisglosips.sql.gz
+  metadata.tsv
+  SHA256SUMS
+
+/data/backups/redis/YYYYMMDDTHHMMSSZ/
+  dump.rdb
+  redis-check-rdb.txt
+  metadata.txt
+  SHA256SUMS
+```
+
+首次有效备份：`20260620T120955Z`。
+
+检查：
+
+```bash
+sudo systemctl start lisglosips-backup.service
+sudo systemctl show -p Result lisglosips-backup.service
+sudo systemctl list-timers lisglosips-backup.timer
+cd /data/backups/mysql/LATEST_DIRECTORY && sudo sha256sum -c SHA256SUMS
+cd /data/backups/redis/LATEST_DIRECTORY && sudo sha256sum -c SHA256SUMS
+```
+
+MySQL 全库备份包含账号密码哈希，只允许 root 读取。Redis ACL 明文密码不进入自动备份，灾难恢复时从 DPAPI 凭据重新生成。
+
+## 8. 恢复
+
+### MySQL 业务库
+
+先创建空的临时数据库进行验证：
+
+```bash
+sudo mysql -e 'CREATE DATABASE lisglosips_restore_test CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;'
+gzip -dc /data/backups/mysql/TIMESTAMP/lisglosips.sql.gz | sudo mysql lisglosips_restore_test
+sudo mysql -e 'SHOW TABLES FROM lisglosips_restore_test;'
+```
+
+确认数据后再安排正式恢复窗口。禁止直接将 `all-databases.sql.gz` 覆盖到运行中的生产实例。
+
+### Redis RDB
+
+将备份 `dump.rdb` 复制到独立临时目录，用 `port 0` 和独立 Unix socket 启动临时 Redis，验证关键 key 后关闭。不要替换运行中实例的 RDB/AOF。
+
+S04 已完成：
+
+- MySQL 备份后删除源表，恢复到临时库并验证 token；
+- Redis 备份后删除源 key，恢复到独立实例并验证 token；
+- 两类探针和临时实例均已清理。
+
+## 9. 健康检查
+
+```bash
+systemctl is-active mysql redis-server lisglosips-backup.timer
+mysqladmin --protocol=socket ping
+sudo mysql -e 'SELECT @@version, @@log_bin, @@binlog_format, @@time_zone;'
+sudo findmnt /var/lib/mysql
+sudo findmnt /var/lib/redis
+sudo systemctl show redis-server -p Result -p NRestarts
+sudo journalctl -b -u mysql -u redis-server -p err
+```
+
+验收状态：
+
+- 重启后 MySQL/Redis active；
+- Redis 首次启动 `NRestarts=0`；
+- 没有 failed systemd unit；
+- AOF 写入和 RDB BGSAVE 均正常；
+- 重启持久化探针通过并已清理。
+
+## 10. 回滚
+
+S04 前备份：
+
+`/var/backups/lisglosips-s04/20260620195847`
+
+包含配置基线、迁移前 MySQL/Redis 数据目录压缩包、变更后配置、失败演练样本和 SHA-256 清单。
+
+回滚数据目录必须在维护窗口执行：
+
+1. 停止 `lisglosips-backup.timer`、MySQL 和 Redis。
+2. 卸载 `/var/lib/mysql`、`/var/lib/redis`。
+3. 恢复 S04 前 fstab。
+4. 将当前数据目录另行归档，不直接覆盖。
+5. 解压 `mysql.pre-s04.tar.gz` 和 `redis.pre-s04.tar.gz` 到 `/var/lib`。
+6. 恢复配置后执行语法检查，再逐个启动服务。
+
+不要在没有完整备份与控制台访问的情况下卸载、覆盖或降级数据库包。
+
+## 11. 已知事项
+
+- 早期一次备份使用绝对校验路径，已移至 S04 备份目录下的 `failed-backups` 留档，不参与恢复。
+- 本地根盘适合开发，不满足生产数据库与录音故障隔离要求。
+- 软件包处于 hold；上线前需建立定期安全更新和预生产验证流程。
diff --git a/docs/SERVER_B_HOMER_MONITORING_RUNBOOK.md b/docs/SERVER_B_HOMER_MONITORING_RUNBOOK.md
new file mode 100644
index 0000000..c22d328
--- /dev/null
+++ b/docs/SERVER_B_HOMER_MONITORING_RUNBOOK.md
@@ -0,0 +1,123 @@
+# Server B HOMER 与基础监控 Runbook
+
+本文记录 S06 在 Server B 建立的 HOMER、HEP 接收、Prometheus、Grafana 和 Exporter 基线，以及 Server A 的 Node Exporter 采集入口。当前环境是本地 KVM 开发环境，不是阿里云生产环境。
+
+## 1. 固定版本
+
+| 组件 | 版本/来源 | 管理方式 |
+| --- | --- | --- |
+| PostgreSQL | `16.14` | Ubuntu 官方包，用于 HOMER 数据库 |
+| Heplify Server | `github.com/sipcapture/heplify-server@v1.60.2-0.20260512101233-c74dc3d216ac` | Go 构建，二进制 SHA-256 记录在 `infra/server-b/s06/versions.env` |
+| Homer App | `github.com/sipcapture/homer-app@v0.0.0-20251021161517-9b1336352aa0` | Go 构建，监听 `127.0.0.1:9080` |
+| Prometheus | `2.45.3` | Ubuntu security/updates 包，自定义 `lisglosips-prometheus.service` |
+| Grafana | `13.0.2` | Tsinghua HTTPS 镜像包，包哈希来自官方 Packages 元数据 |
+| Node Exporter | `1.7.0` | A/B 两机 Ubuntu 包，自定义 `lisglosips-node-exporter.service` |
+| MySQL Exporter | `0.15.0` | Ubuntu 包，监听 `127.0.0.1:9104` |
+| PostgreSQL Exporter | `0.15.0` | Ubuntu 包，监听 `127.0.0.1:9187` |
+| Redis Exporter | `1.86.0` | Go 构建，监听 `127.0.0.1:9121` |
+
+Docker 与 Compose 已安装但运行时禁用。最初计划使用 HOMER10 Docker 架构，但 Docker/GitHub 对象存储在当前代理链路下下载 blob 反复 EOF；S06 改为原生 HOMER7/PostgreSQL/Heplify 部署。不要在后续会话里反复重试 Docker 镜像，除非网络条件已明确修复。
+
+## 2. 目录与端口
+
+| 项目 | 路径/端口 |
+| --- | --- |
+| HOMER PostgreSQL 数据 | `/data/homer/postgresql` |
+| HOMER 配置 | `/etc/homer/webapp_config.json` |
+| Heplify HEP UDP | `100.90.90.91:9060/udp` |
+| Heplify Metrics | `127.0.0.1:9096` |
+| Homer App | `127.0.0.1:9080`，经 `https://homer.lisglosips.local/` 暴露 |
+| Prometheus | `127.0.0.1:9090` |
+| Grafana | `127.0.0.1:3001`，经 `https://grafana.lisglosips.local/` 暴露 |
+| B Node Exporter | `127.0.0.1:9100` |
+| A Node Exporter | `100.90.90.90:9100`，仅允许 B 访问 |
+
+开发证书已重新签发，SAN 包含 `grafana.lisglosips.local` 与 `homer.lisglosips.local`。本地 CA 公钥副本仍在 `.codex-private/tls/lisglosips-dev-ca.crt`。
+
+## 3. 关键服务
+
+Server B：
+
+```text
+postgresql.service
+heplify-server.service
+homer-app.service
+lisglosips-prometheus.service
+grafana-server.service
+lisglosips-node-exporter.service
+lisglosips-mysqld-exporter.service
+lisglosips-postgres-exporter.service
+lisglosips-redis-exporter.service
+nginx.service
+```
+
+Server A：
+
+```text
+lisglosips-exporter-firewall.service
+lisglosips-node-exporter.service
+```
+
+A 机使用独立 `nftables` 表 `inet lisglosips_s06` 保护 9100，只允许 `100.90.90.91` 抓取。Ubuntu 包自带的 `prometheus-node-exporter.service` 已 mask，避免抢占端口。A/B 两机的 `openipmi.service` 已 mask，因为 KVM 虚拟机不支持该驱动。
+
+## 4. 验收命令
+
+Prometheus targets：
+
+```bash
+curl -fsS http://127.0.0.1:9090/api/v1/targets
+```
+
+预期 7 个 target 全部 `up`：`prometheus`、`node/server-a`、`node/server-b`、`mysql`、`postgresql_homer`、`redis`、`heplify_server`。
+
+HEP 入库测试：从 A 发送 HEPv3 UDP 到 B 的 `9060`，然后在 B 查询 `homer_data.hep_proto_1_call`。S06 验收已确认测试 `INVITE` 入库，`method=INVITE`、`srcIp=100.90.90.90`、`dstIp=100.90.90.91`。
+
+HTTPS：
+
+```bash
+curl --fail --cacert /etc/lisglosips/pki/ca/lisglosips-dev-ca.crt \
+  https://127.0.0.1/api/health
+```
+
+Windows 本机可使用：
+
+```powershell
+curl.exe --ssl-no-revoke --cacert .codex-private/tls/lisglosips-dev-ca.crt \
+  --resolve grafana.lisglosips.local:443:100.90.90.91 \
+  https://grafana.lisglosips.local/api/health
+```
+
+Grafana 已预置两个 datasource：`Prometheus`、`HOMER PostgreSQL`；已预置 Dashboard：`LisgloSIPS Infrastructure Overview`。
+
+## 5. 回滚
+
+S06 变更前备份：
+
+```text
+B: /var/backups/lisglosips-s06/20260620T132440Z
+A: /var/backups/lisglosips-s06/20260620225517
+```
+
+回滚原则：
+
+1. 先停止 S06 新增服务，再恢复备份配置。
+2. PostgreSQL 数据目录 `/data/homer/postgresql` 不直接删除；需要退回时先备份当前目录。
+3. Nginx 只移除 `grafana.lisglosips.local`、`homer.lisglosips.local` 站点，不影响 S05 Web 入口。
+4. A 机只删除 `inet lisglosips_s06` 表和两个 S06 服务，不碰 OpenSIPS/RTP 配置。
+
+常用命令：
+
+```bash
+sudo systemctl stop heplify-server homer-app lisglosips-prometheus grafana-server
+sudo systemctl stop lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter
+sudo systemctl disable --now lisglosips-exporter-firewall lisglosips-node-exporter
+sudo nft delete table inet lisglosips_s06
+```
+
+## 6. 已知事项
+
+- 当前 HOMER Web 为最小状态页，HOMER API、HEP 接收和 PostgreSQL 入库已可用；完整 HOMER UI 静态包等网络条件稳定后再补。
+- Grafana 插件在线检查已关闭，避免受限网络下反复报错。
+- Docker 已安装但禁用，S06 不依赖 Docker 运行。
+- A 机 `nftables` 表只保护 Node Exporter 9100，不替代后续 S18/S20 的 Server A 完整防火墙设计。
+- 生产迁移时必须替换开发 CA、正式域名、正式安全组和云监控告警策略。
diff --git a/docs/SERVER_B_WEB_RUNTIME_RUNBOOK.md b/docs/SERVER_B_WEB_RUNTIME_RUNBOOK.md
new file mode 100644
index 0000000..b7af026
--- /dev/null
+++ b/docs/SERVER_B_WEB_RUNTIME_RUNBOOK.md
@@ -0,0 +1,173 @@
+# Server B Web 运行时 Runbook
+
+本文记录 S05 在 Server B 上建立的 Node.js、pnpm、Nginx、systemd 与开发 TLS 基线。当前环境是本地 KVM 开发环境，不是阿里云生产环境。
+
+## 1. 固定版本
+
+| 组件 | 版本 | 管理方式 |
+| --- | --- | --- |
+| Node.js | `v22.22.2` / Debian 包 `22.22.2-1nodesource1` | NodeSource 22.x，`apt-mark hold` |
+| Corepack | `0.34.6` | Node 全局工具 |
+| pnpm | `10.33.0` | 全局固定版本；项目应再用 `packageManager` 固定 |
+| Nginx | `1.24.0-2ubuntu7.12` | Ubuntu 24.04 security/updates，`apt-mark hold` |
+
+Node.js 22 当前属于 LTS 线。固定包在升级前必须先核对 Node/Nginx 安全公告、NestJS/Prisma 兼容性并完成回归测试。
+
+版本记录：`/etc/lisglosips/web-runtime-versions.env`。
+
+## 2. 目录与发布模型
+
+```text
+/opt/lisglosips/
+├── releases/
+│   └── s05-placeholder-20260620/
+│       ├── public/index.html
+│       └── server.mjs
+└── current -> /opt/lisglosips/releases/s05-placeholder-20260620
+```
+
+- 发布目录由 `root:lisglosips` 持有，程序只读。
+- `current` 必须是指向完整 release 的符号链接。
+- 正式发布先写入新 release，完成校验后再原子切换 `current`。
+- 不允许直接在 `current` 指向的 release 内在线修改代码。
+- systemd 可写状态目录为 `/var/lib/lisglosips`，运行目录为 `/run/lisglosips`。
+
+## 3. systemd 服务模板
+
+模板：`/etc/systemd/system/lisglosips@.service`。
+
+实例环境文件：`/etc/lisglosips/<实例名>.env`，权限必须为 `0640 root:lisglosips`。当前实例：
+
+```text
+lisglosips@api.service -> /etc/lisglosips/api.env
+```
+
+模板默认使用 `lisglosips` 系统用户，启用只读系统、私有临时目录、空 capability、设备隔离和内核保护。后续 Worker 如需写录音目录，应使用实例 drop-in 精确增加 `ReadWritePaths`，不要放宽整个模板。
+
+常用命令：
+
+```bash
+sudo systemctl status lisglosips@api
+sudo systemctl restart lisglosips@api
+sudo journalctl -u lisglosips@api -n 100 --no-pager
+sudo systemd-analyze security lisglosips@api.service
+```
+
+## 4. Nginx 路由
+
+| 路径 | 行为 |
+| --- | --- |
+| `/` | `/opt/lisglosips/current/public` 静态站点，支持 SPA fallback |
+| `/healthz` | 反向代理到 `127.0.0.1:3000` |
+| `/api/` | API 代理，单 IP `20 r/s`、burst 40 |
+| `/api/auth/login` | 登录专用限制，单 IP `5 r/min`、burst 3 |
+| `/_recordings/` | 仅供 `X-Accel-Redirect` 内部访问，外部请求返回 404 |
+
+关键文件：
+
+```text
+/etc/nginx/conf.d/lisglosips-global.conf
+/etc/nginx/sites-available/lisglosips.conf
+/etc/nginx/snippets/lisglosips-proxy.conf
+/etc/nginx/snippets/lisglosips-security-headers.conf
+/etc/nginx/snippets/lisglosips-tls.conf
+```
+
+应用仅监听 `127.0.0.1:3000`。Nginx 监听 80/443，但 nftables 仅允许已登记管理端访问 443；开发阶段没有对外开放 80。
+
+配置变更：
+
+```bash
+sudo nginx -t
+sudo systemctl reload nginx
+```
+
+## 5. 开发 TLS
+
+开发 CA 和证书位于：
+
+```text
+/etc/lisglosips/pki/ca/lisglosips-dev-ca.crt
+/etc/lisglosips/pki/ca/lisglosips-dev-ca.key
+/etc/lisglosips/pki/certs/server.crt
+/etc/lisglosips/pki/private/server.key
+```
+
+CA 私钥为 `0600 root:root`，服务器私钥为 `0640 root:www-data`。证书 SAN 包含 `lisglosips.local`、`yanzi`、`100.90.90.91` 和 `127.0.0.1`。
+
+重新签发开发证书：
+
+```bash
+sudo /usr/local/sbin/lisglosips-issue-dev-cert
+sudo nginx -t
+sudo systemctl reload nginx
+```
+
+本机公有 CA 副本保存在 `.codex-private/tls/lisglosips-dev-ca.crt`，不得把 CA 私钥复制出 Server B。Windows 使用私有 CA 测试时，因开发 CA 不发布 CRL，curl 需附加 `--ssl-no-revoke`；这不会关闭证书链、主机名或签名校验。
+
+迁移阿里云后必须替换为正式域名证书，并完成：
+
+1. 把证书和私钥放入受控 Secret 路径。
+2. 更新 `lisglosips-tls.conf`。
+3. 将 HSTS 从开发值 `300` 调整为生产值，建议先观察再提升至 `31536000`。
+4. 验证自动续期、续期失败告警和回滚证书。
+5. 开放 80 仅用于 ACME/跳转，或使用 DNS-01 后继续关闭 80。
+
+## 6. 健康检查
+
+```bash
+curl --fail http://127.0.0.1:3000/healthz
+curl --fail --cacert /etc/lisglosips/pki/ca/lisglosips-dev-ca.crt \
+  https://127.0.0.1/healthz
+sudo ss -lntp | grep -E ':(80|443|3000)\b'
+sudo systemctl --failed
+```
+
+预期：
+
+- `/healthz` 返回 `status=ok`。
+- 3000 仅出现在 `127.0.0.1`。
+- 443 由 Nginx 监听。
+- 首页响应包含 HSTS、CSP、X-Frame-Options、X-Content-Type-Options 和 Permissions-Policy。
+- TLS 1.2/1.3 可用，TLS 1.1 被拒绝。
+
+## 7. 新版本发布
+
+```bash
+release="2026xxxxTxxxxxxZ"
+sudo install -d -o root -g lisglosips -m 0750 "/opt/lisglosips/releases/$release"
+# 将已经构建和校验的产物放入新 release。
+sudo chown -R root:lisglosips "/opt/lisglosips/releases/$release"
+sudo find "/opt/lisglosips/releases/$release" -type d -exec chmod 0750 {} +
+sudo find "/opt/lisglosips/releases/$release" -type f -exec chmod 0640 {} +
+sudo ln -sfn "/opt/lisglosips/releases/$release" /opt/lisglosips/current
+sudo systemctl restart lisglosips@api
+sudo nginx -t && sudo systemctl reload nginx
+```
+
+发布后必须检查内部健康、HTTPS 健康、日志、应用端口监听和前端静态文件。数据库迁移从 S08 起必须在切换 `current` 前按迁移 Runbook 执行。
+
+## 8. 回滚
+
+应用回滚：把 `current` 指回上一 release，重启应用并检查 HTTPS 健康。
+
+```bash
+sudo ln -sfn /opt/lisglosips/releases/<previous> /opt/lisglosips/current
+sudo systemctl restart lisglosips@api
+```
+
+S05 变更前备份：
+
+```text
+/var/backups/lisglosips-s05/20260620T123432Z
+```
+
+其中 `pre-change.tar.gz` 包含变更前应用与配置，`SHA256SUMS` 用于恢复前校验。恢复 Nginx/systemd 配置后必须执行 `nginx -t`、`systemctl daemon-reload`，再重启对应服务。卸载 Nginx或解除包固定不是常规回滚动作，只有确认恢复目标需要时才执行。
+
+## 9. 已知事项
+
+- NodeSource 仓库在本地代理链路上偶尔出现 TLS 握手中断；现有索引和已安装包可用。升级前必须先确认仓库恢复并校验候选版本。
+- 当前证书仅供开发，不能用于阿里云生产。
+- 80 已监听但被 nftables 拒绝；生产是否开放取决于证书签发方案。
+- 当前 API 是 S05 无依赖占位服务，S07 后端骨架完成后替换。
+
diff --git a/docs/SERVER_T_CUSTOMER_SIMULATION_RUNBOOK.md b/docs/SERVER_T_CUSTOMER_SIMULATION_RUNBOOK.md
new file mode 100644
index 0000000..a4c9ede
--- /dev/null
+++ b/docs/SERVER_T_CUSTOMER_SIMULATION_RUNBOOK.md
@@ -0,0 +1,81 @@
+# Server T 客户模拟配置 Runbook
+
+> 任务：S21 - Server T 客户模拟配置  
+> 完成时间：2026-06-21 15:28 +08:00  
+> 环境：本地 KVM Server T `100.93.185.30`
+
+## 1. 变更范围
+
+- 在 Server T 部署独立脚本目录 `/opt/lisglosips-s21`。
+- 新增受控配置文件 `/etc/lisglosips-s21/sip-accounts.env`，权限 `0640 root:hector`。
+- 新增 OpenSIPS 测试域 `s21.lisglosips.test`。
+- 新增两套 SIP 注册测试账号：
+  - `s21-reg-1001@s21.lisglosips.test`
+  - `s21-reg-1002@s21.lisglosips.test`
+- 新增两套 IP 认证测试条目：
+  - `s21-ip-1001`：`100.93.185.30/32`
+  - `s21-ip-1002`：`100.93.185.30/32`
+- 将 T 的 OpenSIPS `auth_db calculate_ha1` 调整为 `0`，账号只保存 HA1，不保存 SIP 明文密码。
+- 将 T 的 OpenSIPS `mi_fifo fifo_mode` 调整为 `0660`。
+- 将 T 的 OpenSIPS TLS 私钥文件权限收敛为 `0600`。
+
+## 2. 脚本清单
+
+脚本均位于 `/opt/lisglosips-s21`：
+
+| 脚本 | 用途 |
+| --- | --- |
+| `s21-register-primary` | 主 SIP 注册账号成功注册 |
+| `s21-register-secondary` | 备用 SIP 注册账号成功注册 |
+| `s21-register-wrong-ha1` | 错误鉴权失败场景 |
+| `s21-call-a-ip` | 从 T 向 A `100.90.90.90:15060` 发起 IP 认证模拟 INVITE |
+| `s21-call-a-sip` | 从 T 向 A 发起 SIP 注册账号模拟 INVITE |
+| `s21-local-success` | T 本地 200 OK 呼叫场景 |
+| `s21-local-busy` | T 本地 486 Busy Here 场景 |
+| `s21-local-reject` | T 本地 603 Decline 场景 |
+| `s21-local-timeout` | T 本地超时场景 |
+| `s21-over-cps-a` | 从 T 向 A 突发 INVITE，模拟超 CPS/突发压测输入 |
+
+所有脚本都会输出 `call_id=...` 和 SIP 状态，便于后续在 A、B、HOMER、Redis Stream 中按 Call-ID 串联排查。
+
+## 3. 验证结果
+
+- `opensips -C -f /etc/opensips/opensips.cfg` 通过。
+- `opensips.service` 为 `active`。
+- `s21-register-primary`：先收到 `401 Unauthorized` challenge，最终 `200 OK`。
+- `s21-register-secondary`：先收到 `401 Unauthorized` challenge，最终 `200 OK`。
+- `s21-register-wrong-ha1`：最终保持 `401 Unauthorized`。
+- `location` 表已有 `s21-reg-1001` 和 `s21-reg-1002` 注册位置。
+- `subscriber.password` 长度为 `0`，`subscriber.ha1` 长度为 `32`，未保存 SIP 明文密码。
+- 本地场景：
+  - `s21-local-success` 返回 `SIP/2.0 200 OK`
+  - `s21-local-busy` 返回 `SIP/2.0 486 Busy Here`
+  - `s21-local-reject` 返回 `SIP/2.0 603 Decline`
+  - `s21-local-timeout` 返回 `NO RESPONSE`
+- 到 A 的探针：
+  - `s21-call-a-ip` 返回 `SIP/2.0 503 Config Missing`
+  - `s21-call-a-sip` 返回 `SIP/2.0 503 Config Missing`
+  - `s21-over-cps-a 5 0.01` 5 个 Call-ID 均返回 `SIP/2.0 503 Config Missing`
+
+说明：A 端当前处于 S20 热路径阶段，尚未发布真实客户/路由配置，因此到 A 的 INVITE 返回 `503 Config Missing` 是当前预期；S21 验收重点是 T 端脚本可重复执行并输出 Call-ID。
+
+## 4. 回滚方式
+
+回滚点：
+
+```text
+/var/backups/lisglosips-s21/20260621T072316Z
+```
+
+回滚步骤：
+
+```bash
+sudo systemctl stop opensips
+sudo cp -a /var/backups/lisglosips-s21/20260621T072316Z/opensips /etc/opensips
+sudo mysql --protocol=socket -uroot opensips < /var/backups/lisglosips-s21/20260621T072316Z/opensips.sql
+sudo rm -rf /opt/lisglosips-s21 /etc/lisglosips-s21
+sudo opensips -C -f /etc/opensips/opensips.cfg
+sudo systemctl start opensips
+```
+
+回滚会删除 S21 的测试账号、注册位置、IP 认证测试数据和脚本。若后续任务已依赖这些脚本，应先暂停相关测试。
diff --git a/docs/SSH_ACCESS_RUNBOOK.md b/docs/SSH_ACCESS_RUNBOOK.md
new file mode 100644
index 0000000..5e90701
--- /dev/null
+++ b/docs/SSH_ACCESS_RUNBOOK.md
@@ -0,0 +1,81 @@
+# LisgloSIPS SSH 访问与恢复 Runbook
+
+> S00 完成日期：2026-06-20。本文不包含密码。
+
+## 1. 当前访问方式
+
+- 用户：`hector`
+- SSH 管理端口：`<SSH_ADMIN_PORT>`，端口号由用户确认后实施；开发环境未迁移前可能仍为 `22`。
+- 项目 Key：`.codex-private/ssh/lisglosips_codex_ed25519`
+- Key 指纹：`SHA256:avGNUh+0t4tM9Odcaz+NHERAfESQl+ybzPi5oM39oYI`
+- SSH 配置：`.codex-private/ssh/config`
+- known_hosts：`.codex-private/ssh/known_hosts`
+- sudo 密码：`.codex-private/SERVER_CREDENTIALS.clixml`，由 Windows DPAPI 加密。
+
+```powershell
+ssh -F .codex-private\ssh\config lisglosips-a
+ssh -F .codex-private\ssh\config lisglosips-b
+ssh -F .codex-private\ssh\config lisglosips-t
+```
+
+## 2. 主机指纹
+
+| 主机 | 地址 | ED25519 指纹 |
+| --- | --- | --- |
+| A / TonyHouse | `100.90.90.90` | `SHA256:BmJVzUlHD2LPj/SlCnC611DnsHgedC79/eJ7pAMmbtM` |
+| B / YanZi | `100.90.90.91` | `SHA256:Kh1EmcUfG4S+TPDtZ8p+D3A4pGlFc4B8lDMcPeLbxoI` |
+| T / SteveTable | `100.93.185.30` | `SHA256:hlq2q/HIvyZzo2PxcDzzN5vMrfzQAzBW5W9qaeAEkGU` |
+
+三台机器原本因镜像克隆共享同一套 SSH host key，S00 已分别轮换。任何后续指纹变化都必须停止连接并通过云控制台或已认证会话核验。
+
+## 3. SSH 加固状态
+
+当前原则：只调整 SSH 管理端口和允许来源，不禁止 SSH 密钥登录。`PubkeyAuthentication` 必须保持开启；密码登录策略按开发/生产环境另行确认，不再作为 S00 强制禁用项写入需求。
+
+`/etc/ssh/sshd_config.d/00-lisglosips-hardening.conf`：
+
+```text
+Port <SSH_ADMIN_PORT>
+PubkeyAuthentication yes
+MaxAuthTries 4
+LoginGraceTime 30
+```
+
+三台服务器均已通过：
+
+- `sshd -t`
+- Key 新会话登录，且不因端口变更被禁用
+- SSH 管理端口仅允许受控管理来源访问
+- `hector` 新密码 sudo 验证
+
+## 4. 远端备份
+
+| 主机 | host key 轮换前 | SSH 加固前 |
+| --- | --- | --- |
+| A | `/var/backups/lisglosips-s00/etc-ssh-before-hostkey-rotation-20260620150150.tar.gz` | `/var/backups/lisglosips-s00/etc-ssh-before-hardening-20260620150326.tar.gz` |
+| B | `/var/backups/lisglosips-s00/etc-ssh-before-hostkey-rotation-20260620150152.tar.gz` | `/var/backups/lisglosips-s00/etc-ssh-before-hardening-20260620150328.tar.gz` |
+| T | `/var/backups/lisglosips-s00/etc-ssh-before-hostkey-rotation-20260620150153.tar.gz` | `/var/backups/lisglosips-s00/etc-ssh-before-hardening-20260620150329.tar.gz` |
+
+## 5. 配置回滚
+
+必须在一个已验证的 Key 会话中执行，并保持第二个会话不关闭：
+
+```bash
+sudo mkdir -p /var/backups/lisglosips-s00/current-ssh
+sudo cp -a /etc/ssh/. /var/backups/lisglosips-s00/current-ssh/
+sudo tar -xzf /var/backups/lisglosips-s00/etc-ssh-before-hardening-YYYYMMDDHHMMSS.tar.gz -C /
+sudo sshd -t
+sudo systemctl restart ssh
+```
+
+若 Key 登录完全失效，必须通过阿里云控制台/VNC 登录恢复，不要删除本地项目 Key 或 known_hosts。
+
+## 6. DPAPI 凭据使用
+
+```powershell
+$servers = Import-Clixml .codex-private\SERVER_CREDENTIALS.clixml
+$item = $servers | Where-Object Code -eq 'A'
+$sudoPassword = $item.Credential.GetNetworkCredential().Password
+```
+
+禁止输出 `$sudoPassword`。需要自动化 sudo 时，将其通过进程内存或 SSH 标准输入传递，完成后立即清理环境变量。
diff --git a/docs/infra-check.md b/docs/infra-check.md
new file mode 100644
index 0000000..06e00c3
--- /dev/null
+++ b/docs/infra-check.md
@@ -0,0 +1,152 @@
+# S02 网络与端口验收报告
+
+> 验收时间：2026-06-20  
+> 环境：本地 KVM 开发服务器，Tailscale 三机专网  
+> 结论：开发网络满足当前联调要求；阿里云安全组尚未创建，本报告给出未来迁移清单。
+
+## 1. 环境边界
+
+| 代号 | Tailscale IP | 开发阶段角色 |
+| --- | --- | --- |
+| A | 100.90.90.90 | 核心通信网关 |
+| B | 100.90.90.91 | API、缓存、数据库、录音和监控 |
+| T | 100.93.185.30 | 客户/供应商 SIP 测试端 |
+| 开发机 | 100.91.249.119 | SSH 与运营 Web 管理端 |
+
+- 用户确认 A/B/T 均为本地开发服务器，开发完成后再迁移阿里云。
+- 开发阶段服务间通信统一使用 Tailscale IP，不依赖 ens18 上的两个局域网地址。
+- 本次未修改 Tailscale ACL、主机防火墙、路由、云安全组或服务配置。
+- 尚未部署的端口使用绑定到指定 Tailscale IP 的短时测试监听器；测试后已确认进程退出。
+
+## 2. 双向 RTT
+
+每个方向先建立 Tailscale 直连，再发送 20 个 ICMP 样本：
+
+| 来源 | 目标 | 丢包 | 平均 RTT | 最大 RTT |
+| --- | --- | ---: | ---: | ---: |
+| A | B | 0% | 0.648 ms | 2.389 ms |
+| B | A | 0% | 0.595 ms | 0.741 ms |
+| A | T | 0% | 0.434 ms | 0.668 ms |
+| T | A | 0% | 0.559 ms | 1.711 ms |
+| B | T | 0% | 0.593 ms | 0.757 ms |
+| T | B | 0% | 0.561 ms | 1.496 ms |
+
+结论：三机稳态 RTT 均小于 1 ms，丢包为 0，满足开发联调目标。
+
+Tailscale 接口 MTU 为 1280。A 到 B/T 的 1200 字节 ICMP payload、DF 模式各 5 次均为 0% 丢包，平均 RTT 分别为 0.634 ms 和 0.657 ms。
+
+## 3. 路径稳定性
+
+- 三机稳态均为局域网 direct 路径，没有经过 DERP。
+- 当前开发机到 A/B/T 建立直连后的延迟约为 10/9/3 ms。
+- 测试过程中开发机到三机的 Tailscale 路径曾发生一次重新协商，约一分钟内 SSH 新连接超时；恢复后无需重启服务。
+- 开发机测得最近 DERP 为 San Francisco，约 166 ms。若局域网 direct 失败并退化到 DERP，SIP/RTP 联调体验会明显下降。
+- 建议开发时保持局域网 UDP 41641 可达，并监控 `tailscale ping` 是否显示 `direct`。
+
+## 4. 已执行端口验收
+
+| 来源 | 目标 | 协议/端口 | 用途 | 结果 |
+| --- | --- | --- | --- | --- |
+| T | A | UDP 15060 | 规划中的客户 SIP 入口 | PASS，收到双向 ACK |
+| T | A | UDP 30000 | RTP 范围下界 | PASS，收到双向 ACK |
+| T | A | UDP 40000 | RTP 范围上界 | PASS，收到双向 ACK |
+| A | T | UDP 30000 | RTP 反向下界 | PASS，收到双向 ACK |
+| A | T | UDP 40000 | RTP 反向上界 | PASS，收到双向 ACK |
+| A | T | UDP 5060 | T 机现有 OpenSIPS | PASS，OPTIONS 返回 SIP 484 |
+| 开发机 | B | TCP 443 | 规划中的运营 Web HTTPS | PASS，收到 ACK |
+| A | B | UDP 9060 | HEP | PASS，收到 ACK |
+| A | B | TCP 6379 | Redis 热路径 | PASS，收到 ACK |
+| A | B | TCP 3306 | 网络路径测试 | PASS；安全策略仍禁止远程直连 |
+| B | A | TCP 9100 | Prometheus 抓取 Exporter | PASS，收到 ACK |
+| B | A | TCP 22 | 录音拉取/运维路径 | PASS，TCP 建连成功；历史开发端口，后续迁移为 `<SSH_ADMIN_PORT>` |
+
+T 机 SIP OPTIONS 测试产生 1 条 `sip_trace` 记录；`acc` 和 `missed_calls` 未增加。该测试记录保留用于审计。
+
+## 5. 开发阶段最小暴露矩阵
+
+### Server A 入站
+
+| 协议/端口 | 允许来源 | 要求 |
+| --- | --- | --- |
+| TCP `<SSH_ADMIN_PORT>` | 开发机、B | SSH 管理与 B 拉取录音；保留 Key 登录 |
+| UDP 15060 | T | 开发 SIP 信令 |
+| UDP 30000-40000 | T | 开发 RTP；与 RTPEngine 配置一致 |
+| TCP 9100 | B | Node Exporter，仅监控抓取 |
+| RTPEngine 控制端口 | 本机回环 | 不允许 Tailscale 或局域网访问 |
+
+### Server B 入站
+
+| 协议/端口 | 允许来源 | 要求 |
+| --- | --- | --- |
+| TCP `<SSH_ADMIN_PORT>` | 开发机 | SSH，保留 Key 登录 |
+| TCP 443 | 开发机 | 运营端 HTTPS |
+| UDP 9060 | A | HEP |
+| TCP 6379 | A、B 本机 | Redis；密码/ACL、专网绑定 |
+| TCP 3306 | B 本机 | MySQL 仅回环地址，不开放给 A |
+| TCP 3000/9090 | B 本机 | Grafana/Prometheus 经反向代理或 SSH 隧道访问 |
+| 应用内部端口 | B 本机 | 由 Nginx 代理，不直接暴露 |
+
+### Server T 入站
+
+| 协议/端口 | 允许来源 | 要求 |
+| --- | --- | --- |
+| TCP `<SSH_ADMIN_PORT>` | 开发机 | SSH，保留 Key 登录 |
+| UDP 5060 | A | 测试 SIP |
+| UDP 30000-40000 | A | 测试 RTP |
+| TCP 80、TCP/UDP 111 | 默认禁止 | 现有 Apache/rpcbind 非 SIP 联调必需 |
+
+## 6. Tailscale 与主机防火墙要求
+
+- Tailscale ACL 应只允许上述源目标组合；当前主机侧无法读取 tailnet 管理端 ACL，需在 Tailscale 管理台复核。
+- 主机防火墙仍必须实施默认拒绝，不能只依赖 Tailscale ACL。
+- 服务应绑定 Tailscale IP 或 `127.0.0.1`，避免因 ens18 双地址选择错误而暴露到局域网。
+- 开发环境也不得将 Redis、MySQL、RTPEngine 控制端口和 OpenSIPS MI 暴露给整个 tailnet。
+- 防火墙落地分别属于 S03（B）和 S18/S19（A），不在 S02 修改。
+
+## 7. 未来阿里云安全组清单
+
+### 迁移前网络
+
+1. A、B 放在同一 VPC，优先同一可用区；业务间使用私网 IP。
+2. 为 A/B 分配唯一私网地址和唯一默认路由，不复制本地 machine-id、网卡 UUID 或磁盘 UUID。
+3. T 继续作为外部测试端，通过 A 的公网 SIP/RTP 入口验收。
+4. 数据库、Redis、HEP、Exporter 和录音搬运走 VPC 私网。
+
+### 安全组 A
+
+开发阶段采用 UDP 30000-40000；迁移阿里云前应根据并发量重新计算并尽量缩小范围。
+
+| 方向 | 协议/端口 | 来源/目标 |
+| --- | --- | --- |
+| 入站 | UDP 15060 | 已登记客户、供应商和 T 的公网 IP |
+| 入站 | UDP 30000-40000 | 已登记 RTP 对端；无法固定时配合限速和监控 |
+| 入站 | TCP `<SSH_ADMIN_PORT>` | 管理 VPN/堡垒机安全组；B 私网 IP 仅用于录音拉取；保留 Key 登录 |
+| 入站 | TCP 9100 | B 的安全组或私网 IP |
+| 出站 | TCP 6379 | B 私网 IP |
+| 出站 | UDP 9060 | B 私网 IP |
+
+### 安全组 B
+
+| 方向 | 协议/端口 | 来源/目标 |
+| --- | --- | --- |
+| 入站 | TCP 443 | 运营人员允许地址；上线后可按产品策略扩大 |
+| 入站 | TCP 80 | 可选，仅跳转 HTTPS |
+| 入站 | TCP `<SSH_ADMIN_PORT>` | 管理 VPN/堡垒机安全组；保留 Key 登录 |
+| 入站 | UDP 9060 | A 的安全组或私网 IP |
+| 入站 | TCP 6379 | A 的安全组或私网 IP |
+| 入站 | TCP 3306 | 禁止公网；同机应用优先 127.0.0.1 |
+| 入站 | TCP 3000/9090 | 不开放公网，经 Nginx/VPN/隧道访问 |
+| 出站 | TCP `<SSH_ADMIN_PORT>` | A 私网 IP，仅录音拉取需要时 |
+
+实际创建安全组时应先记录规则截图/导出，按最小权限逐条添加，并从允许和禁止来源分别复测。
+
+## 8. 验收结论
+
+- A/B/T 双向可达、稳态 RTT 和 MTU：PASS。
+- SIP 15060、T SIP 5060、RTP 30000-40000 双向路径：PASS。
+- B 的 Web 443、HEP 9060、Redis 6379 路径：PASS。
+- B 到 A 的监控与 SSH 路径：PASS。
+- 最小暴露矩阵：已形成。
+- 阿里云控制台操作清单：已形成，未执行。
+
+S02 验收通过。开发环境的主机防火墙和服务绑定将在后续任务按服务器逐步实施。
diff --git a/docs/inventory-A.md b/docs/inventory-A.md
new file mode 100644
index 0000000..5c4da64
--- /dev/null
+++ b/docs/inventory-A.md
@@ -0,0 +1,86 @@
+# Server A 资产盘点
+
+> 采集时间：2026-06-20 17:55-17:59 +08:00  
+> 采集方式：SSH 只读命令；未安装软件、未修改配置、未重启服务。
+
+## 1. 定位与结论
+
+- 规划角色：核心通信网关机，后续部署 OpenSIPS、RTPEngine、录音内存盘、HEP Client 和指标 Exporter。
+- 当前状态：通用 Ubuntu 桌面虚拟机，尚未安装通信栈。
+- 就绪判断：可作为后续安装目标，但网络身份、防火墙和克隆残留必须先在 S02/S18 前处理。
+
+## 2. 系统与容量
+
+| 项目 | 当前值 |
+| --- | --- |
+| 主机名 | TonyHouse |
+| 虚拟化 | KVM/QEMU |
+| OS | Ubuntu 24.04.4 LTS |
+| 内核 | 6.17.0-20-generic |
+| CPU | 4 vCPU，QEMU Virtual CPU，1 socket/4 cores |
+| 内存 | 7.8 GiB，总可用约 5.7 GiB |
+| Swap | 4.0 GiB，当前未使用 |
+| 系统盘 | 200 GiB ext4，根分区 196 GiB |
+| 磁盘使用 | 已用 21 GiB，可用 166 GiB，使用率 12% |
+| 时间 | Asia/Shanghai，systemd-timesyncd 已同步 |
+| HugePages | 0，尚未配置 |
+
+系统仅有单块系统盘，没有独立数据盘。Ubuntu 安装 ISO 仍挂载在光驱路径。
+
+## 3. 网络
+
+| 接口 | 地址 |
+| --- | --- |
+| ens18 | 192.168.71.90/24、192.168.71.2/24 |
+| tailscale0 | 100.90.90.90/32 |
+
+- ens18 同时存在静态地址和 DHCP 地址。
+- 主路由表同时存在两个相同 metric 的默认路由：192.168.71.253 和 192.168.71.1。
+- 项目 SSH 地址 100.90.90.90 是 Tailscale 地址，不是从本机识别出的公网地址。
+- DNS 同时使用局域网 DNS、公共 DNS 和 Tailscale DNS。
+- 机器没有阿里云实例元数据标识，cloud-init instance-id 为 `iid-datasource-none`。
+
+## 4. 服务、端口与软件
+
+### 监听端口
+
+- TCP 22：SSH，对所有 IPv4/IPv6 地址监听。
+- TCP 18789、18791：Node/OpenClaw，仅回环地址监听。
+- UDP 41641：Tailscale。
+- UDP/TCP 5353、TCP 631：桌面环境的 mDNS/CUPS。
+- 当前没有 SIP 15060、RTPEngine 控制端口或 RTP 端口段监听。
+
+### 软件与服务
+
+- Node.js 22.22.2 已安装。
+- Tailscale 1.96.4 已安装并运行。
+- Docker、OpenSIPS、RTPEngine、Redis、MySQL、Nginx、Prometheus、Grafana、Fail2ban 未发现。
+- GNOME、GDM、CUPS、Avahi、ModemManager 等桌面服务正在运行。
+- systemd 没有失败单元。
+
+## 5. 安全与风险
+
+1. **高：主机防火墙未启用。** UFW 为 inactive，nftables INPUT/FORWARD 默认策略为 accept，仅包含 Tailscale 自动规则。
+2. **高：网络出口不确定。** 双 IPv4、双默认路由且 metric 相同，SIP Contact、Record-Route、SDP 和 RTP 回包可能选择错误源地址。
+3. **高：克隆身份未清理。** A/B/T 的 `/etc/machine-id`、根分区 UUID 和 NetworkManager 连接 UUID 完全相同。
+4. **中：开发与生产网络需分阶段管理。** 用户已确认当前为 KVM 本地开发机加 Tailscale，开发完成后再迁移阿里云；本机配置不能直接原样复制到云端。
+5. **中：资源低于原架构图描述。** 当前为 4 vCPU/8 GiB，与“4 核 8G”一致，但没有独立录音盘；3 GiB tmpfs 会显著压缩系统可用内存。
+6. **低：桌面服务占用资源并扩大攻击面。** 后续应在维护窗口按需精简，不在 S01 处理。
+
+## 6. 后续安装前备份清单
+
+- `/etc/netplan/`、NetworkManager 活动连接导出、`ip addr/route/rule` 快照。
+- `/etc/fstab`、`lsblk`、文件系统 UUID 与挂载快照。
+- `/etc/ssh/` 和 S00 既有备份。
+- `ufw status`、`nft list ruleset`、`iptables-save`、`ip6tables-save`。
+- `sysctl -a` 中网络、conntrack、文件句柄相关基线。
+- 已安装包列表、enabled/running/failed systemd 单元列表。
+- `/etc/systemd/` 本地覆盖项、`/opt/` 和现有 Node/OpenClaw 服务定义。
+- 变更 machine-id 或网络连接 UUID 前制作虚拟机快照并验证云/虚拟化控制台可达。
+
+## 7. S02 输入
+
+- 明确生产访问是公网/VPC、局域网端口映射还是继续使用 Tailscale。
+- 明确 SIP 15060/UDP 的入站地址和 RTP UDP 端口段。
+- 消除双地址、双默认路由歧义后再配置 OpenSIPS/RTPEngine。
+- 建立默认拒绝的主机防火墙和外部安全组端口矩阵。
diff --git a/docs/inventory-B.md b/docs/inventory-B.md
new file mode 100644
index 0000000..27c8b66
--- /dev/null
+++ b/docs/inventory-B.md
@@ -0,0 +1,86 @@
+# Server B 资产盘点
+
+> 采集时间：2026-06-20 17:55-17:59 +08:00  
+> 采集方式：SSH 只读命令；未安装软件、未修改配置、未重启服务。
+
+## 1. 定位与结论
+
+- 规划角色：业务、缓存与监控中心，后续部署 API/Worker、Redis、MySQL、HOMER、Prometheus、Grafana 和 Web。
+- 当前状态：通用 Ubuntu 桌面虚拟机，只有 Node.js 和本地 OpenClaw 进程，业务基础设施尚未安装。
+- 就绪判断：容量可支持原型和小规模联调；生产化之前必须解决网络身份、失败的 NFS 挂载、防火墙和单盘故障域。
+
+## 2. 系统与容量
+
+| 项目 | 当前值 |
+| --- | --- |
+| 主机名/FQDN | YanZi / YanZi.taileedb6e.ts.net |
+| 虚拟化 | KVM/QEMU |
+| OS | Ubuntu 24.04.4 LTS |
+| 内核 | 6.17.0-23-generic |
+| CPU | 4 vCPU，QEMU Virtual CPU，1 socket/4 cores |
+| 内存 | 7.8 GiB，总可用约 6.4 GiB |
+| Swap | 4.0 GiB，当前未使用 |
+| 系统盘 | 200 GiB ext4，根分区 196 GiB |
+| 磁盘使用 | 已用 26 GiB，可用 161 GiB，使用率 14% |
+| 时间 | Asia/Shanghai，systemd-timesyncd 已同步 |
+| HugePages | 0 |
+
+只有单块系统盘，数据库、Redis、录音、日志和监控数据目前没有独立磁盘或独立故障域。
+
+## 3. 网络
+
+| 接口 | 地址 |
+| --- | --- |
+| ens18 | 192.168.71.91/24、192.168.71.3/24 |
+| tailscale0 | 100.90.90.91/32 |
+
+- ens18 同时存在静态地址和 DHCP 地址。
+- 同时存在经 192.168.71.253 与 192.168.71.1 的两个等 metric 默认路由。
+- 项目 SSH 地址 100.90.90.91 是 Tailscale 地址。
+- cloud-init instance-id 为 `iid-datasource-none`，本机未识别到阿里云实例环境。
+- `/etc/fstab` 配置了 `100.120.96.71:/mnt/share` 到 `/home/hector/share`，当前 mount 单元失败。
+
+## 4. 服务、端口与软件
+
+### 监听端口
+
+- TCP 22：SSH，对所有 IPv4/IPv6 地址监听。
+- TCP/UDP 111：rpcbind，对所有地址监听。
+- TCP 18789、18791：Node/OpenClaw，仅回环地址监听。
+- UDP 41641：Tailscale。
+- 当前没有 80/443、3306、6379、9060、Prometheus 或 Grafana 端口。
+
+### 软件与服务
+
+- Node.js 22.22.2 已安装。
+- Tailscale 1.96.4 已安装并运行。
+- Docker、Redis、MySQL/MariaDB、Nginx、HOMER、Prometheus、Grafana、Fail2ban 未发现。
+- GNOME、GDM、CUPS、Avahi、rpcbind 等桌面/通用服务运行中。
+- 失败单元：`home-hector-share.mount`。
+
+## 5. 安全与风险
+
+1. **高：主机防火墙未启用。** UFW inactive，nftables INPUT/FORWARD 默认 accept。
+2. **高：网络出口不确定。** 双 IPv4、双默认路由会影响服务绑定、回调地址和 A/B 数据链路。
+3. **高：克隆身份未清理。** 与 A/T 共享 machine-id、根文件系统 UUID 和 NetworkManager 连接 UUID。
+4. **高：单盘承载全部数据。** MySQL、Redis AOF、录音、HOMER 和监控数据若共用根盘，容量竞争和故障影响过大。
+5. **中：NFS 开机挂载失败。** 需确认该共享是否继续承担录音或备份；生产服务不能依赖未设超时/依赖关系的失败 mount。
+6. **中：rpcbind 对所有地址监听。** 若不再使用 NFS，应移除暴露；若保留，只允许可信网段。
+7. **中：开发与生产网络需分阶段管理。** 当前本地 Tailscale 配置不能直接作为未来阿里云 VPC/安全组配置。
+8. **低：桌面服务会消耗业务机资源并扩大攻击面。**
+
+## 6. 后续安装前备份清单
+
+- A 机同类的网络、路由、DNS、SSH、防火墙、sysctl、包和 systemd 基线。
+- `/etc/fstab`、NFS mount 单元状态及共享端现状。
+- `/opt/`、现有 Node/OpenClaw 进程的服务定义与配置。
+- MySQL/Redis 安装前的磁盘布局、I/O 基线和容量分配表。
+- 部署数据库前制作虚拟机快照；后续数据库备份不得只保存在同一根盘。
+- 修改 machine-id、文件系统 UUID 或 NetworkManager 连接前保留控制台恢复路径。
+
+## 7. S02/S03 输入
+
+- 先确定 B 的稳定业务地址、A/B 私网链路以及 Web 对外入口。
+- 决定录音与数据库是新增独立磁盘、使用可靠 NFS，还是仅在 PoC 阶段共用根盘。
+- 明确 NFS 失败挂载的去留。
+- 建立默认拒绝防火墙；3306/6379 只绑定本地或 A/B 专用内网，不对公网/Tailscale 全网开放。
diff --git a/docs/inventory-T.md b/docs/inventory-T.md
new file mode 100644
index 0000000..8980088
--- /dev/null
+++ b/docs/inventory-T.md
@@ -0,0 +1,108 @@
+# Server T 资产与 OpenSIPS 盘点
+
+> 采集时间：2026-06-20 17:55-17:59 +08:00  
+> 采集方式：SSH、OpenSIPS MI、RTPEngine CLI 和 MariaDB 只读查询；未修改配置、数据或服务状态，未发起 SIP 呼叫。
+
+## 1. 定位与结论
+
+- 规划角色：模拟客户 SIP 注册、IP 认证和呼叫的测试机。
+- 当前状态：OpenSIPS、RTPEngine、录音守护进程、MariaDB、Apache/PHP 和 Monit 已运行。
+- 配置健康：`opensips -C` 通过；OpenSIPS MI 可用；RTPEngine 当前被 OpenSIPS 标记为 enabled。
+- 测试就绪度：基础进程就绪，但数据库中没有 subscriber、location、dispatcher、落地网关或路由规则，当前还不能完成真实注册/呼叫验收。
+
+## 2. 系统与容量
+
+| 项目 | 当前值 |
+| --- | --- |
+| 主机名 | SteveTable |
+| 虚拟化 | KVM/QEMU |
+| OS | Ubuntu 24.04.4 LTS |
+| 内核 | 6.17.0-35-generic |
+| CPU | 4 vCPU，AMD Ryzen 7 3700X 型号透传 |
+| 内存 | 7.8 GiB，总可用约 6.5 GiB |
+| Swap | 4.0 GiB，当前未使用 |
+| 系统盘 | 200 GiB ext4，根分区可用 164 GiB，使用率 13% |
+| NFS | 100.120.96.71:/mnt/share，已挂载，可用约 345 GiB |
+| 时间 | Asia/Shanghai，systemd-timesyncd 已同步 |
+
+## 3. 网络与端口
+
+| 接口 | 地址 |
+| --- | --- |
+| ens18 | 192.168.71.105/24、192.168.71.239/24 |
+| tailscale0 | 100.93.185.30/32 |
+
+- 与 A/B 相同，存在双 IPv4 和两个等 metric 默认路由。
+- OpenSIPS 仅监听 `100.93.185.30:5060/UDP`。
+- RTPEngine 控制端口 2223/UDP、2224/TCP、2225/TCP 只监听回环地址。
+- MariaDB 3306 只监听回环地址。
+- OpenSIPS MI HTTP 8888 只监听回环地址。
+- Apache 80/TCP、SSH 22/TCP、rpcbind 111/TCP/UDP 对所有地址监听。
+- RTPEngine RTP 范围配置为 UDP 30000-40000，但空闲时不表现为固定监听 socket。
+- UFW inactive，nftables INPUT/FORWARD 默认 accept。
+
+## 4. 通信栈
+
+| 组件 | 版本/状态 |
+| --- | --- |
+| OpenSIPS | 3.6.6，active/enabled |
+| RTPEngine | 11.5.1.18，active/enabled |
+| RTPEngine Recording | 11.5.1.18，active/enabled |
+| MariaDB | 10.11.14，active/enabled |
+| Apache | 2.4.58，active/enabled |
+| PHP | 8.3.6 |
+| Monit | 5.33.0，active/enabled |
+
+### OpenSIPS 配置能力
+
+- UDP SIP socket：100.93.185.30:5060。
+- 已加载 auth/auth_db、domain、permissions、usrloc/registrar、dispatcher、drouting、dialog、acc、tracer、rtpengine、rtpproxy。
+- MI HTTP：127.0.0.1:8888；MI FIFO：`/run/opensips/opensips_fifo`。
+- 数据库中已有 domain 2 条、address 1 条、rtpengine 1 条。
+- subscriber、location、dispatcher、dr_gateways、dr_rules、sip_trace 均为 0 条。
+- 自本次启动以来：接收 SIP 请求/回复为 0，注册成功/失败均为 0，dialog 为 0。
+- 64 MiB OpenSIPS shared memory 当前实际使用约 3.8 MiB。
+
+### RTPEngine 与录音
+
+- 控制端：127.0.0.1:2223；CLI：127.0.0.1:2224；HTTP：127.0.0.1:2225。
+- RTP 范围：30000-40000；声明接口为 100.93.185.30。
+- 当前会话 0，总处理会话 0，说明尚未完成过媒体联调。
+- `xt_RTPENGINE` 内核模块不存在，启动日志明确显示 kernel forwarding disabled；目前只能依赖 userspace forwarding。
+- 录音目录 `/var/spool/rtpengine` 与 `/var/lib/rtpengine-recording` 均为空，权限为 rtpengine 用户/组 0770。
+- NFS 共享已挂载，但当前 RTPEngine 录音目录并未直接挂到该 NFS。
+
+## 5. 安全与运行风险
+
+1. **高：TLS 私钥权限错误。** `cakey.pem` 与 `user-privkey.pem` 为 0644，所有本机用户可读。
+2. **高：MI FIFO 为 0666。** 任意本机用户可向 OpenSIPS 管理接口发送命令。
+3. **高：防火墙默认放行。** Apache、SSH、rpcbind 等暴露范围依赖外部网络控制，主机本身没有默认拒绝策略。
+4. **高：克隆身份未清理。** A/B/T 共享 machine-id、根文件系统 UUID 和 NetworkManager 连接 UUID。
+5. **中：RTPEngine 无内核加速。** `xt_RTPENGINE` 与当前 6.17 内核不匹配，无法满足架构图中的内核态加速目标。
+6. **中：服务启动顺序存在竞态。** OpenSIPS 比 RTPEngine 早约 8 秒启动，启动日志中一度禁用 RTPEngine；当前已自动恢复为 enabled。
+7. **中：测试数据为空。** 尚无 SIP 注册账号、注册位置、dispatcher 或路由，T 机目前只能证明进程健康，不能证明呼叫链路健康。
+8. **中：Apache 80 与 rpcbind 111 对所有接口开放。**
+9. **低：fwupd 刷新任务失败。** `fwupd-refresh.service` 当前失败，与 SIP 主链路无关但应清理告警。
+
+## 6. 配置基线与备份清单
+
+正式执行 S21 前至少备份：
+
+- `/etc/opensips/` 全目录，当前主配置 SHA-256：`987498fca01160ba07f380bf870e38c2140e61ac51e0f93c154b56b1480d37af`。
+- `/etc/rtpengine/`、`/etc/default/rtpengine-*` 和相关 systemd unit。
+- `/etc/mysql/` 与 `mysqldump --single-transaction --routines --events --all-databases`。
+- OpenSIPS 数据库各表行数、schema 和现有 domain/address/rtpengine 数据导出。
+- `/etc/apache2/`、`/etc/php/`、`/etc/monit/`。
+- 当前 nftables/iptables、RTPEngine chain、端口和路由快照。
+- NFS/fstab、录音目录权限和挂载状态。
+- 修改 TLS 权限、MI 权限、启动依赖或内核前制作虚拟机快照。
+
+私钥、数据库连接串和 SIP 密码不得写入项目文档或普通日志。
+
+## 7. 后续任务输入
+
+- S02：验证 A/T 的 15060/5060 SIP 可达性、RTP 30000-40000 双向可达性和 Tailscale/真实公网路径。
+- S21：新增专用测试账号与 IP 认证数据，保留失败场景；不要复用生产密码。
+- S21 前先修复 TLS 私钥和 MI FIFO 权限。
+- 决定 T 机是否需要 RTPEngine 内核态加速；若只模拟客户侧信令，可不把它作为 S21 阻塞项。
+- 调整 OpenSIPS 对 RTPEngine 的 systemd 启动顺序，或确认启动后的自动重检策略。
diff --git a/docs/inventory-summary.md b/docs/inventory-summary.md
new file mode 100644
index 0000000..9346cdb
--- /dev/null
+++ b/docs/inventory-summary.md
@@ -0,0 +1,45 @@
+# S01 三机资产盘点汇总
+
+> 结论日期：2026-06-20。详细数据见 `inventory-A.md`、`inventory-B.md`、`inventory-T.md`。
+
+## 1. 差异总览
+
+| 项目 | A | B | T |
+| --- | --- | --- | --- |
+| OS | Ubuntu 24.04.4 | Ubuntu 24.04.4 | Ubuntu 24.04.4 |
+| 内核 | 6.17.0-20 | 6.17.0-23 | 6.17.0-35 |
+| CPU/内存 | 4 vCPU/7.8 GiB | 4 vCPU/7.8 GiB | 4 vCPU/7.8 GiB |
+| 根盘可用 | 166 GiB | 161 GiB | 164 GiB |
+| NFS | 未配置 | 已配置但挂载失败 | 已挂载 |
+| 通信栈 | 未安装 | 未安装 | OpenSIPS/RTPEngine 已运行 |
+| 数据库/缓存 | 无 | 无 | MariaDB 10.11，仅供现有 OpenSIPS |
+| UFW | inactive | inactive | inactive |
+| systemd 失败项 | 无 | NFS mount | fwupd refresh |
+
+## 2. 共同问题
+
+- 三机源于同一镜像，machine-id、根文件系统 UUID、NetworkManager 连接 UUID 完全相同。
+- 三机 ens18 均同时存在静态和 DHCP IPv4，并有两个等 metric 默认路由。
+- 三个项目地址均为 Tailscale 100.64.0.0/10 地址；用户已确认三机是本地开发服务器，完成开发后再迁移阿里云。
+- 三机均为带 GNOME 的桌面安装，不是最小化服务器系统。
+- 三机 UFW 均未启用，nftables 默认接受入站。
+- 三机均仅有一块 200 GiB 系统盘；B 的数据库、录音与监控存储规划尚未落盘。
+
+## 3. S02 前置决策
+
+1. 开发阶段使用 Tailscale 三机专网；另行保留阿里云 VPC/公网迁移清单。
+2. 确认 A 的 SIP 15060 和 RTP UDP 范围，T 的测试 SIP 5060 和 RTP 范围。
+3. 确认是否保留 ens18 DHCP 地址；生产服务必须绑定稳定地址并有唯一默认路由。
+4. 确认 B 的数据盘/录音盘/NFS 方案。
+5. S02 只验收连通和端口矩阵；涉及 machine-id、路由、防火墙的修改应形成独立可回滚步骤。
+
+## 4. 立即风险排序
+
+1. T 的 TLS 私钥 0644 与 OpenSIPS MI FIFO 0666。
+2. A/B/T 主机防火墙默认放行。
+3. 双地址、双默认路由可能导致 SIP/RTP 非对称。
+4. 克隆身份冲突可能影响日志、DHCP、监控和后续自动化。
+5. T 的 RTPEngine 内核模块缺失，当前没有内核态转发能力。
+6. B 的 NFS mount 失败，且没有独立数据盘。
+
+S01 只记录上述事实，没有进行任何修复。
diff --git a/eslint.config.mjs b/eslint.config.mjs
new file mode 100644
index 0000000..df75c12
--- /dev/null
+++ b/eslint.config.mjs
@@ -0,0 +1,35 @@
+import js from '@eslint/js';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+import prettier from 'eslint-config-prettier';
+
+export default [
+  {
+    ignores: [
+      'dist/**',
+      'node_modules/**',
+      '**/dist/**',
+      '**/vendor/**',
+      '**/*.tsbuildinfo',
+      'apps/web/src/**',
+      'apps/web/dist/**',
+      '.codex-private/**'
+    ]
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  prettier,
+  {
+    languageOptions: {
+      ecmaVersion: 2022,
+      sourceType: 'module',
+      globals: {
+        ...globals.node
+      }
+    },
+    rules: {
+      '@typescript-eslint/no-explicit-any': 'error',
+      '@typescript-eslint/no-unused-vars': ['error', { 'argsIgnorePattern': '^_' }]
+    }
+  }
+];
diff --git a/infra/server-a/s06/nftables/node-exporter.nft b/infra/server-a/s06/nftables/node-exporter.nft
new file mode 100644
index 0000000..8451717
--- /dev/null
+++ b/infra/server-a/s06/nftables/node-exporter.nft
@@ -0,0 +1,7 @@
+table inet lisglosips_s06 {
+  chain input {
+    type filter hook input priority filter; policy accept;
+
+    tcp dport 9100 ip saddr != 100.90.90.91 drop
+  }
+}
diff --git a/infra/server-a/s06/node-exporter.env b/infra/server-a/s06/node-exporter.env
new file mode 100644
index 0000000..a8c0711
--- /dev/null
+++ b/infra/server-a/s06/node-exporter.env
@@ -0,0 +1,2 @@
+ARGS=--web.listen-address=100.90.90.90:9100 --collector.systemd --collector.processes
+
diff --git a/infra/server-a/s06/scripts/configure-node-exporter b/infra/server-a/s06/scripts/configure-node-exporter
new file mode 100644
index 0000000..5616a47
--- /dev/null
+++ b/infra/server-a/s06/scripts/configure-node-exporter
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+STAGE=${STAGE:-/tmp/lisglosips-s06-stage}
+
+stamp=$(date +%Y%m%d%H%M%S)
+backup=/var/backups/lisglosips-s06/$stamp
+install -d -m 0700 "$backup"
+systemctl cat prometheus-node-exporter.service >"$backup/prometheus-node-exporter.service.before" 2>/dev/null || true
+systemctl cat lisglosips-node-exporter.service >"$backup/lisglosips-node-exporter.service.before" 2>/dev/null || true
+dpkg-query -W -f='${Package}\t${Version}\n' prometheus-node-exporter >"$backup/packages.before" 2>/dev/null || true
+
+apt-get update -qq
+DEBIAN_FRONTEND=noninteractive apt-get install -y prometheus-node-exporter=1.7.0-1ubuntu0.3
+
+install -d -o root -g root -m 0755 /etc/nftables.d
+install -o root -g root -m 0644 "$STAGE/nftables/node-exporter.nft" /etc/nftables.d/lisglosips-s06-exporter.nft
+install -o root -g root -m 0644 "$STAGE/systemd/lisglosips-exporter-firewall.service" /etc/systemd/system/lisglosips-exporter-firewall.service
+install -o root -g root -m 0644 "$STAGE/systemd/lisglosips-node-exporter.service" /etc/systemd/system/lisglosips-node-exporter.service
+install -o root -g root -m 0644 "$STAGE/node-exporter.env" /etc/default/lisglosips-node-exporter
+
+systemctl daemon-reload
+systemctl disable --now prometheus-node-exporter.service prometheus-node-exporter.socket 2>/dev/null || true
+systemctl kill prometheus-node-exporter.service 2>/dev/null || true
+pkill -f '^/usr/bin/prometheus-node-exporter$' 2>/dev/null || true
+systemctl mask prometheus-node-exporter.service 2>/dev/null || true
+systemctl disable --now openipmi.service 2>/dev/null || true
+systemctl mask openipmi.service 2>/dev/null || true
+systemctl reset-failed prometheus-node-exporter.service openipmi.service lisglosips-node-exporter.service 2>/dev/null || true
+systemctl enable --now lisglosips-exporter-firewall.service lisglosips-node-exporter.service
+
+systemctl is-active --quiet lisglosips-exporter-firewall.service
+systemctl is-active --quiet lisglosips-node-exporter.service
+curl -fsS http://100.90.90.90:9100/metrics >/dev/null
+
+echo "S06 A node exporter configured. Backup: $backup"
diff --git a/infra/server-a/s06/systemd/lisglosips-exporter-firewall.service b/infra/server-a/s06/systemd/lisglosips-exporter-firewall.service
new file mode 100644
index 0000000..1337562
--- /dev/null
+++ b/infra/server-a/s06/systemd/lisglosips-exporter-firewall.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=LisgloSIPS exporter firewall
+Before=lisglosips-node-exporter.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+ExecStartPre=-/usr/sbin/nft delete table inet lisglosips_s06
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/lisglosips-s06-exporter.nft
+ExecStop=-/usr/sbin/nft delete table inet lisglosips_s06
+
+[Install]
+WantedBy=multi-user.target
diff --git a/infra/server-a/s18/nftables/lisglosips-s18-opensips.nft b/infra/server-a/s18/nftables/lisglosips-s18-opensips.nft
new file mode 100644
index 0000000..3c5568d
--- /dev/null
+++ b/infra/server-a/s18/nftables/lisglosips-s18-opensips.nft
@@ -0,0 +1,10 @@
+table inet lisglosips_s18_opensips {
+  chain input {
+    type filter hook input priority -15; policy accept;
+    iif "lo" accept
+    ct state established,related accept
+    ip saddr 100.93.185.30 udp dport 15060 accept
+    udp dport 15060 drop
+    tcp dport 8888 drop
+  }
+}
diff --git a/infra/server-a/s18/opensips/opensips.cfg b/infra/server-a/s18/opensips/opensips.cfg
new file mode 100644
index 0000000..8ecdd04
--- /dev/null
+++ b/infra/server-a/s18/opensips/opensips.cfg
@@ -0,0 +1,92 @@
+#### LisgloSIPS S18 OpenSIPS baseline ####
+
+log_level=3
+xlog_level=3
+stderror_enabled=no
+syslog_enabled=yes
+syslog_facility=LOG_LOCAL0
+
+udp_workers=4
+auto_aliases=no
+socket=udp:100.90.90.90:15060
+socket=hep_udp:127.0.0.1:9061
+
+mpath="/usr/lib/x86_64-linux-gnu/opensips/modules/"
+
+loadmodule "proto_udp.so"
+loadmodule "signaling.so"
+loadmodule "sl.so"
+loadmodule "tm.so"
+modparam("tm", "fr_timeout", 5)
+modparam("tm", "fr_inv_timeout", 30)
+
+loadmodule "maxfwd.so"
+loadmodule "sipmsgops.so"
+loadmodule "textops.so"
+
+loadmodule "mi_fifo.so"
+modparam("mi_fifo", "fifo_name", "/run/opensips/opensips_fifo")
+modparam("mi_fifo", "fifo_mode", 0660)
+
+loadmodule "httpd.so"
+modparam("httpd", "ip", "127.0.0.1")
+modparam("httpd", "port", 8888)
+loadmodule "mi_http.so"
+modparam("mi_http", "root", "mi")
+
+loadmodule "auth.so"
+modparam("auth", "nonce_expire", 300)
+modparam("auth", "disable_nonce_check", 0)
+
+loadmodule "pike.so"
+modparam("pike", "sampling_time_unit", 2)
+modparam("pike", "reqs_density_per_unit", 16)
+modparam("pike", "remove_latency", 120)
+
+loadmodule "ratelimit.so"
+loadmodule "cachedb_redis.so"
+loadmodule "proto_hep.so"
+modparam("proto_hep", "hep_id", "[homer] 100.90.90.91:9060; transport=udp; version=3")
+loadmodule "tracer.so"
+modparam("tracer", "trace_on", 1)
+modparam("tracer", "trace_id", "[s18_hep]uri=hep:homer")
+
+route {
+    if (!mf_process_maxfwd_header(10)) {
+        send_reply(483, "Too Many Hops");
+        exit;
+    }
+
+    trace("s18_hep", "m", "sip|xlog");
+
+    if (!pike_check_req()) {
+        xlog("L_WARN", "S18 pike blocked source=$si method=$rm callid=$ci\n");
+        send_reply(403, "Rate Limited");
+        exit;
+    }
+
+    if (has_totag()) {
+        send_reply(481, "Dialog Not Found");
+        exit;
+    }
+
+    if (is_method("OPTIONS") && $rU == NULL) {
+        send_reply(200, "Keepalive");
+        exit;
+    }
+
+    if (is_method("REGISTER")) {
+        append_to_reply("WWW-Authenticate: Digest realm=\"lisglosips.local\", nonce=\"s18-baseline\", algorithm=MD5, qop=\"auth\"\r\n");
+        send_reply(401, "Authentication Required");
+        exit;
+    }
+
+    if (is_method("INVITE")) {
+        xlog("L_INFO", "S18 route placeholder rejected INVITE source=$si callid=$ci\n");
+        send_reply(503, "Routing Not Ready");
+        exit;
+    }
+
+    send_reply(405, "Method Not Allowed");
+    exit;
+}
diff --git a/infra/server-a/s18/opensips/opensips.default b/infra/server-a/s18/opensips/opensips.default
new file mode 100644
index 0000000..6d31ef5
--- /dev/null
+++ b/infra/server-a/s18/opensips/opensips.default
@@ -0,0 +1,8 @@
+# LisgloSIPS S18 OpenSIPS startup options
+RUN_OPENSIPS=yes
+USER=opensips
+GROUP=opensips
+S_MEMORY=128
+P_MEMORY=16
+DUMP_CORE=no
+OPTIONS=""
diff --git a/infra/server-a/s19/nftables/lisglosips-s19-rtpengine.nft b/infra/server-a/s19/nftables/lisglosips-s19-rtpengine.nft
new file mode 100644
index 0000000..443a0c8
--- /dev/null
+++ b/infra/server-a/s19/nftables/lisglosips-s19-rtpengine.nft
@@ -0,0 +1,11 @@
+table inet lisglosips_s19_rtpengine {
+  chain input {
+    type filter hook input priority -14; policy accept;
+    iif "lo" accept
+    ct state established,related accept
+    ip saddr 100.93.185.30 udp dport 30000-40000 accept
+    udp dport 30000-40000 drop
+    tcp dport { 2224, 2225 } drop
+    udp dport 2223 drop
+  }
+}
diff --git a/infra/server-a/s19/rtpengine/rtpengine-daemon.default b/infra/server-a/s19/rtpengine/rtpengine-daemon.default
new file mode 100644
index 0000000..743c545
--- /dev/null
+++ b/infra/server-a/s19/rtpengine/rtpengine-daemon.default
@@ -0,0 +1,5 @@
+CONFIG_FILE=/etc/rtpengine/rtpengine.conf
+PIDFILE=/run/rtpengine/rtpengine-daemon.pid
+MANAGE_IPTABLES=yes
+SET_USER=rtpengine
+SET_MASK=0x7
diff --git a/infra/server-a/s19/rtpengine/rtpengine-recording-daemon.default b/infra/server-a/s19/rtpengine/rtpengine-recording-daemon.default
new file mode 100644
index 0000000..faed91a
--- /dev/null
+++ b/infra/server-a/s19/rtpengine/rtpengine-recording-daemon.default
@@ -0,0 +1,7 @@
+CONFIG_FILE=/etc/rtpengine/rtpengine-recording.conf
+PIDFILE=/run/rtpengine-recording/rtpengine-recording-daemon.pid
+MUST_NFS=no
+NFS_HOST=127.0.0.1
+NFS_REMOTE_PATH=/unused
+NFS_LOCAL_MOUNT=/dev/shm/voip_rec/incoming
+NFS_OPTIONS=hard,intr,tcp
diff --git a/infra/server-a/s19/rtpengine/rtpengine-recording.conf b/infra/server-a/s19/rtpengine/rtpengine-recording.conf
new file mode 100644
index 0000000..968065a
--- /dev/null
+++ b/infra/server-a/s19/rtpengine/rtpengine-recording.conf
@@ -0,0 +1,16 @@
+[rtpengine-recording]
+
+table = 0
+num-threads = 4
+
+spool-dir = /dev/shm/voip_rec/spool
+output-storage = file
+output-dir = /dev/shm/voip_rec/incoming
+output-format = wav
+output-pattern = %Y/%m/%d/%c-%t
+output-mixed = true
+output-single = false
+output-chmod = 0640
+output-chmod-dir = 0750
+output-chown = rtpengine
+output-chgrp = rtpengine
diff --git a/infra/server-a/s19/rtpengine/rtpengine.conf b/infra/server-a/s19/rtpengine/rtpengine.conf
new file mode 100644
index 0000000..4c28ee5
--- /dev/null
+++ b/infra/server-a/s19/rtpengine/rtpengine.conf
@@ -0,0 +1,22 @@
+[rtpengine]
+
+table = 0
+no-fallback = true
+
+interface = 100.90.90.90
+listen-ng = 127.0.0.1:2223
+listen-cli = 127.0.0.1:2224
+listen-http = 127.0.0.1:2225
+
+timeout = 60
+silent-timeout = 3600
+tos = 184
+
+port-min = 30000
+port-max = 40000
+
+recording-dir = /dev/shm/voip_rec/spool
+recording-method = proc
+
+log-level = 6
+log-facility = daemon
diff --git a/infra/server-a/s19/scripts/lisglosips-recording-finalize b/infra/server-a/s19/scripts/lisglosips-recording-finalize
new file mode 100755
index 0000000..6eb7af5
--- /dev/null
+++ b/infra/server-a/s19/scripts/lisglosips-recording-finalize
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BASE_DIR=${1:-/dev/shm/voip_rec}
+INCOMING_DIR="$BASE_DIR/incoming"
+READY_DIR="$BASE_DIR/ready"
+FAILED_DIR="$BASE_DIR/failed"
+MIN_AGE_SECONDS=${MIN_AGE_SECONDS:-15}
+
+mkdir -p "$INCOMING_DIR" "$READY_DIR" "$FAILED_DIR"
+chmod 0770 "$READY_DIR"
+
+find "$INCOMING_DIR" -type f \( -name '*.wav' -o -name '*.mp3' \) -print0 |
+while IFS= read -r -d '' source; do
+  if [ ! -s "$source" ]; then
+    continue
+  fi
+  now=$(date +%s)
+  mtime=$(stat -c %Y "$source")
+  if [ $((now - mtime)) -lt "$MIN_AGE_SECONDS" ]; then
+    continue
+  fi
+  if command -v fuser >/dev/null 2>&1 && fuser -s -- "$source"; then
+    continue
+  fi
+  rel=${source#"$INCOMING_DIR"/}
+  part="$READY_DIR/$rel.part"
+  ready="$READY_DIR/$rel.ready"
+  failed="$FAILED_DIR/$rel"
+  mkdir -p "$(dirname "$part")" "$(dirname "$failed")"
+  chmod 0770 "$(dirname "$part")"
+  if [ -e "$ready" ] || [ -e "$part" ]; then
+    mv -- "$source" "$failed.$(date -u +%Y%m%dT%H%M%SZ).duplicate"
+    continue
+  fi
+  mv -- "$source" "$part"
+  chmod 0640 "$part"
+  mv -- "$part" "$ready"
+done
diff --git a/infra/server-a/s19/systemd/lisglosips-a-firewall.service b/infra/server-a/s19/systemd/lisglosips-a-firewall.service
new file mode 100644
index 0000000..14736a3
--- /dev/null
+++ b/infra/server-a/s19/systemd/lisglosips-a-firewall.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Load LisgloSIPS Server A nftables rules
+Documentation=file:/etc/nftables.d/
+After=network-online.target
+Wants=network-online.target
+Before=rtpengine-daemon.service opensips.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStartPre=-/usr/sbin/nft delete table inet lisglosips_s19_rtpengine
+ExecStartPre=-/usr/sbin/nft delete table inet lisglosips_s18_opensips
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/lisglosips-s18-opensips.nft
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/lisglosips-s19-rtpengine.nft
+ExecStop=-/usr/sbin/nft delete table inet lisglosips_s19_rtpengine
+ExecStop=-/usr/sbin/nft delete table inet lisglosips_s18_opensips
+
+[Install]
+WantedBy=multi-user.target
diff --git a/infra/server-a/s19/systemd/lisglosips-recording-finalize.service b/infra/server-a/s19/systemd/lisglosips-recording-finalize.service
new file mode 100644
index 0000000..b70e286
--- /dev/null
+++ b/infra/server-a/s19/systemd/lisglosips-recording-finalize.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Finalize RTPEngine recordings into LisgloSIPS ready files
+After=rtpengine-recording-daemon.service
+
+[Service]
+Type=oneshot
+User=rtpengine
+Group=rtpengine
+ExecStart=/usr/local/sbin/lisglosips-recording-finalize /dev/shm/voip_rec
diff --git a/infra/server-a/s19/systemd/lisglosips-recording-finalize.timer b/infra/server-a/s19/systemd/lisglosips-recording-finalize.timer
new file mode 100644
index 0000000..0819cd9
--- /dev/null
+++ b/infra/server-a/s19/systemd/lisglosips-recording-finalize.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Run LisgloSIPS recording finalizer frequently
+
+[Timer]
+OnBootSec=10s
+OnUnitActiveSec=5s
+AccuracySec=1s
+Unit=lisglosips-recording-finalize.service
+
+[Install]
+WantedBy=timers.target
diff --git a/infra/server-a/s19/systemd/opensips.service.d/10-lisglosips-wait-tailscale.conf b/infra/server-a/s19/systemd/opensips.service.d/10-lisglosips-wait-tailscale.conf
new file mode 100644
index 0000000..3220a14
--- /dev/null
+++ b/infra/server-a/s19/systemd/opensips.service.d/10-lisglosips-wait-tailscale.conf
@@ -0,0 +1,6 @@
+[Unit]
+After=network-online.target tailscaled.service lisglosips-a-firewall.service
+Wants=network-online.target tailscaled.service lisglosips-a-firewall.service
+
+[Service]
+ExecStartPre=/bin/sh -c 'for i in $(seq 1 60); do ip address show | grep -q "100.90.90.90" && exit 0; sleep 1; done; echo "Tailscale address 100.90.90.90 not ready" >&2; exit 1'
diff --git a/infra/server-a/s19/systemd/rtpengine-recording-daemon.service b/infra/server-a/s19/systemd/rtpengine-recording-daemon.service
new file mode 100644
index 0000000..4a99689
--- /dev/null
+++ b/infra/server-a/s19/systemd/rtpengine-recording-daemon.service
@@ -0,0 +1,22 @@
+[Unit]
+Description=RTP/media Recording Daemon for LisgloSIPS
+Documentation=man:rtpengine-recording(8)
+After=network-online.target rtpengine-daemon.service dev-shm-voip_rec.mount
+Requires=network-online.target rtpengine-daemon.service
+RequiresMountsFor=/dev/shm/voip_rec
+
+[Service]
+Type=notify
+LimitNOFILE=100000
+RuntimeDirectory=rtpengine-recording
+PIDFile=/run/rtpengine-recording/rtpengine-recording-daemon.pid
+AmbientCapabilities=CAP_NET_ADMIN CAP_CHOWN
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_CHOWN
+User=rtpengine
+Group=rtpengine
+ExecStart=/usr/bin/rtpengine-recording -f -E --no-log-timestamps --pidfile /run/rtpengine-recording/rtpengine-recording-daemon.pid --config-file /etc/rtpengine/rtpengine-recording.conf
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
diff --git a/infra/server-a/s19/systemd/rtpengine-recording-daemon.service.d/10-lisglosips-no-nfs.conf b/infra/server-a/s19/systemd/rtpengine-recording-daemon.service.d/10-lisglosips-no-nfs.conf
new file mode 100644
index 0000000..8a63aeb
--- /dev/null
+++ b/infra/server-a/s19/systemd/rtpengine-recording-daemon.service.d/10-lisglosips-no-nfs.conf
@@ -0,0 +1,9 @@
+[Unit]
+After=
+After=network-online.target rtpengine-daemon.service dev-shm-voip_rec.mount
+Requires=
+Requires=network-online.target rtpengine-daemon.service
+
+[Service]
+CapabilityBoundingSet=
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_CHOWN
diff --git a/infra/server-a/s19/tmpfiles/lisglosips-voip-rec.conf b/infra/server-a/s19/tmpfiles/lisglosips-voip-rec.conf
new file mode 100644
index 0000000..cab5986
--- /dev/null
+++ b/infra/server-a/s19/tmpfiles/lisglosips-voip-rec.conf
@@ -0,0 +1,6 @@
+d /dev/shm/voip_rec 0750 rtpengine rtpengine -
+d /dev/shm/voip_rec/spool 0750 rtpengine rtpengine -
+d /dev/shm/voip_rec/incoming 0750 rtpengine rtpengine -
+d /dev/shm/voip_rec/ready 0750 rtpengine rtpengine -
+d /dev/shm/voip_rec/failed 0750 rtpengine rtpengine -
+d /dev/shm/voip_rec/tmp 0750 rtpengine rtpengine -
diff --git a/infra/server-a/s20/defaults/lisglosips-node-exporter b/infra/server-a/s20/defaults/lisglosips-node-exporter
new file mode 100644
index 0000000..29839d2
--- /dev/null
+++ b/infra/server-a/s20/defaults/lisglosips-node-exporter
@@ -0,0 +1 @@
+ARGS=--web.listen-address=100.90.90.90:9100 --collector.systemd --collector.processes --collector.textfile.directory=/var/lib/prometheus/node-exporter
diff --git a/infra/server-a/s20/lua/lisglosips_hotpath.lua b/infra/server-a/s20/lua/lisglosips_hotpath.lua
new file mode 100644
index 0000000..8a92398
--- /dev/null
+++ b/infra/server-a/s20/lua/lisglosips_hotpath.lua
@@ -0,0 +1,60 @@
+local active = redis.call('GET', KEYS[1])
+if not active or active == '' then
+  return {'reject', 'CONFIG_MISSING', 'none', 'none', 'none', 'none', 'no_active_version'}
+end
+
+local source_ip = ARGV[1]
+local caller = ARGV[2] or ''
+local callee = ARGV[3] or ''
+
+local prefix = 'cfg:v:' .. active
+local gateway_id = redis.call('GET', prefix .. ':auth:ip:' .. source_ip)
+if not gateway_id then
+  return {'reject', 'AUTH_MISSING', 'none', active, 'none', 'none', 'no_auth_ip'}
+end
+
+local gateway_json = redis.call('GET', prefix .. ':customer_gateway:' .. gateway_id)
+if not gateway_json then
+  return {'reject', 'GATEWAY_MISSING', gateway_id, active, 'none', 'none', 'gateway_missing'}
+end
+if not string.find(gateway_json, '"status":"ENABLED"', 1, true) then
+  return {'reject', 'GATEWAY_DISABLED', gateway_id, active, 'none', 'none', 'gateway_disabled'}
+end
+
+local customer_id = string.match(gateway_json, '"customerId":"([^"]+)"')
+if not customer_id then
+  return {'reject', 'CUSTOMER_MISSING', gateway_id, active, 'none', 'none', 'customer_id_missing'}
+end
+
+local customer_json = redis.call('GET', prefix .. ':customer:' .. customer_id)
+if not customer_json then
+  return {'reject', 'CUSTOMER_MISSING', gateway_id, active, 'none', 'none', 'customer_missing'}
+end
+if not string.find(customer_json, '"status":"ENABLED"', 1, true) then
+  return {'reject', 'CUSTOMER_DISABLED', gateway_id, active, 'none', 'none', 'customer_disabled'}
+end
+
+local policies = redis.call('LRANGE', prefix .. ':customer_gateway:' .. gateway_id .. ':policies', 0, -1)
+for _, policy_json in ipairs(policies) do
+  if string.find(policy_json, '"status":"ENABLED"', 1, true) then
+    local caller_mode = string.match(policy_json, '"callerMode":"([^"]+)"') or 'ANY'
+    local caller_value = string.match(policy_json, '"callerValue":"([^"]*)"') or ''
+    local callee_mode = string.match(policy_json, '"calleeMode":"([^"]+)"') or 'ANY'
+    local callee_value = string.match(policy_json, '"calleeValue":"([^"]*)"') or ''
+
+    local caller_ok = caller_mode == 'ANY'
+      or (caller_mode == 'EQUALS' and caller == caller_value)
+      or (caller_mode == 'PREFIX' and string.sub(caller, 1, string.len(caller_value)) == caller_value)
+    local callee_ok = callee_mode == 'ANY'
+      or (callee_mode == 'EQUALS' and callee == callee_value)
+      or (callee_mode == 'PREFIX' and string.sub(callee, 1, string.len(callee_value)) == callee_value)
+
+    if caller_ok and callee_ok then
+      local policy_id = string.match(policy_json, '"id":"([^"]+)"') or 'none'
+      local line_group_id = string.match(policy_json, '"lineGroupId":"([^"]+)"') or 'none'
+      return {'allow', 'OK', gateway_id, active, line_group_id, policy_id, customer_id}
+    end
+  end
+end
+
+return {'reject', 'NO_POLICY', gateway_id, active, 'none', 'none', 'no_policy_match'}
diff --git a/infra/server-a/s20/nftables/lisglosips-s20-observability.nft b/infra/server-a/s20/nftables/lisglosips-s20-observability.nft
new file mode 100644
index 0000000..e714c8b
--- /dev/null
+++ b/infra/server-a/s20/nftables/lisglosips-s20-observability.nft
@@ -0,0 +1,9 @@
+table inet lisglosips_s20_observability {
+  chain input {
+    type filter hook input priority -13; policy accept;
+    iif "lo" accept
+    ct state established,related accept
+    udp dport 9061 drop
+    tcp dport 6380 drop
+  }
+}
diff --git a/infra/server-a/s20/opensips/opensips.cfg b/infra/server-a/s20/opensips/opensips.cfg
new file mode 100644
index 0000000..daf4215
--- /dev/null
+++ b/infra/server-a/s20/opensips/opensips.cfg
@@ -0,0 +1,186 @@
+#### LisgloSIPS S20 OpenSIPS Redis hot path, HEP and metrics baseline ####
+
+log_level=3
+xlog_level=3
+stderror_enabled=no
+syslog_enabled=yes
+syslog_facility=LOG_LOCAL0
+
+udp_workers=4
+auto_aliases=no
+socket=udp:100.90.90.90:15060
+socket=hep_udp:100.90.90.90:9061
+
+mpath="/usr/lib/x86_64-linux-gnu/opensips/modules/"
+
+loadmodule "proto_udp.so"
+loadmodule "signaling.so"
+loadmodule "sl.so"
+loadmodule "tm.so"
+modparam("tm", "fr_timeout", 5)
+modparam("tm", "fr_inv_timeout", 30)
+
+loadmodule "maxfwd.so"
+loadmodule "sipmsgops.so"
+loadmodule "textops.so"
+
+loadmodule "mi_fifo.so"
+modparam("mi_fifo", "fifo_name", "/run/opensips/opensips_fifo")
+modparam("mi_fifo", "fifo_mode", 0660)
+
+loadmodule "httpd.so"
+modparam("httpd", "ip", "127.0.0.1")
+modparam("httpd", "port", 8888)
+loadmodule "mi_http.so"
+modparam("mi_http", "root", "mi")
+
+loadmodule "auth.so"
+modparam("auth", "nonce_expire", 300)
+modparam("auth", "disable_nonce_check", 0)
+
+loadmodule "pike.so"
+modparam("pike", "sampling_time_unit", 2)
+modparam("pike", "reqs_density_per_unit", 16)
+modparam("pike", "remove_latency", 120)
+
+loadmodule "ratelimit.so"
+
+loadmodule "cachedb_redis.so"
+modparam("cachedb_redis", "connect_timeout", 300)
+modparam("cachedb_redis", "query_timeout", 300)
+modparam("cachedb_redis", "shutdown_on_error", 0)
+modparam("cachedb_redis", "cachedb_url", "@@LISGLOSIPS_REDIS_URL@@")
+
+loadmodule "rtpengine.so"
+modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:2223")
+
+loadmodule "statistics.so"
+modparam("statistics", "variable", "s20_invite_total/no_reset")
+modparam("statistics", "variable", "s20_hotpath_allow_total/no_reset")
+modparam("statistics", "variable", "s20_hotpath_reject_total/no_reset")
+modparam("statistics", "variable", "s20_redis_error_total/no_reset")
+modparam("statistics", "variable", "s20_cdr_xadd_total/no_reset")
+modparam("statistics", "variable", "s20_cdr_xadd_error_total/no_reset")
+
+loadmodule "prometheus.so"
+modparam("prometheus", "root", "metrics")
+modparam("prometheus", "prefix", "lisglosips_opensips")
+modparam("prometheus", "statistics", "script: core: net:")
+
+loadmodule "proto_hep.so"
+modparam("proto_hep", "hep_id", "[homer] 100.90.90.91:9060; transport=udp; version=3")
+loadmodule "tracer.so"
+modparam("tracer", "trace_on", 1)
+modparam("tracer", "trace_id", "[s20_hep]uri=hep:homer")
+
+route {
+    if (!mf_process_maxfwd_header(10)) {
+        send_reply(483, "Too Many Hops");
+        exit;
+    }
+
+    trace("s20_hep", "m", "sip|xlog");
+
+    if (!pike_check_req()) {
+        xlog("L_WARN", "S20 pike blocked source=$si method=$rm callid=$ci\n");
+        send_reply(403, "Rate Limited");
+        exit;
+    }
+
+    if (has_totag()) {
+        send_reply(481, "Dialog Not Found");
+        exit;
+    }
+
+    if (is_method("OPTIONS") && $rU == NULL) {
+        send_reply(200, "Keepalive");
+        exit;
+    }
+
+    if (is_method("REGISTER")) {
+        append_to_reply("WWW-Authenticate: Digest realm=\"lisglosips.local\", nonce=\"s20-baseline\", algorithm=MD5, qop=\"auth\"\r\n");
+        send_reply(401, "Authentication Required");
+        exit;
+    }
+
+    if (is_method("INVITE")) {
+        route(S20_INVITE);
+        exit;
+    }
+
+    send_reply(405, "Method Not Allowed");
+    exit;
+}
+
+route[S20_INVITE] {
+    update_stat("s20_invite_total", 1);
+
+    $var(s20_decision) = "reject";
+    $var(s20_reason) = "REDIS_UNAVAILABLE";
+    $var(s20_gateway_id) = "none";
+    $var(s20_config_version) = "none";
+    $var(s20_line_group_id) = "none";
+    $var(s20_policy_id) = "none";
+    $var(s20_customer_id) = "none";
+    $var(s20_reply_code) = 503;
+    $var(s20_reply_text) = "Routing Not Ready";
+
+    if (!cache_raw_query("redis:s20", "EVALSHA cfdc02cbe5528d37fba617947c09e3380770c918 1 cfg:active_version $si $fU $rU $ci", "$avp(s20_hotpath)")) {
+        update_stat("s20_redis_error_total", 1);
+        xlog("L_ERR", "S20 Redis hotpath unavailable source=$si callid=$ci\n");
+        $var(s20_reason) = "REDIS_UNAVAILABLE";
+        $var(s20_reply_code) = 503;
+        $var(s20_reply_text) = "Redis Unavailable";
+        route(S20_CDR_XADD);
+        send_reply($var(s20_reply_code), $var(s20_reply_text));
+        exit;
+    }
+
+    $var(s20_decision) = $(avp(s20_hotpath)[0]);
+    $var(s20_reason) = $(avp(s20_hotpath)[1]);
+    $var(s20_gateway_id) = $(avp(s20_hotpath)[2]);
+    $var(s20_config_version) = $(avp(s20_hotpath)[3]);
+    $var(s20_line_group_id) = $(avp(s20_hotpath)[4]);
+    $var(s20_policy_id) = $(avp(s20_hotpath)[5]);
+    $var(s20_customer_id) = $(avp(s20_hotpath)[6]);
+
+    if ($var(s20_decision) == "allow") {
+        update_stat("s20_hotpath_allow_total", 1);
+        xlog("L_INFO", "S20 hotpath allow source=$si callid=$ci customer=$var(s20_customer_id) gateway=$var(s20_gateway_id) policy=$var(s20_policy_id) line_group=$var(s20_line_group_id) version=$var(s20_config_version)\n");
+        $var(s20_reason) = "ROUTING_NOT_READY";
+        $var(s20_reply_code) = 503;
+        $var(s20_reply_text) = "Routing Not Ready";
+        route(S20_CDR_XADD);
+        send_reply($var(s20_reply_code), $var(s20_reply_text));
+        exit;
+    }
+
+    update_stat("s20_hotpath_reject_total", 1);
+    if ($var(s20_reason) == "CONFIG_MISSING") {
+        $var(s20_reply_code) = 503;
+        $var(s20_reply_text) = "Config Missing";
+    } else if ($var(s20_reason) == "NO_POLICY") {
+        $var(s20_reply_code) = 503;
+        $var(s20_reply_text) = "No Route Policy";
+    } else {
+        $var(s20_reply_code) = 403;
+        $var(s20_reply_text) = "Forbidden";
+    }
+
+    xlog("L_WARN", "S20 hotpath reject reason=$var(s20_reason) source=$si callid=$ci version=$var(s20_config_version)\n");
+    route(S20_CDR_XADD);
+    send_reply($var(s20_reply_code), $var(s20_reply_text));
+    exit;
+}
+
+route[S20_CDR_XADD] {
+    $var(s20_event_id) = "s20-" + $Ts + "-" + $pp + "-" + $ci;
+
+    if (cache_raw_query("redis:s20", "XADD stream:cdr_payload * event_id $var(s20_event_id) call_id $ci source_ip $si caller $fU callee $rU customer_id $var(s20_customer_id) customer_gateway_id $var(s20_gateway_id) customer_gateway_policy_id $var(s20_policy_id) line_group_id $var(s20_line_group_id) sip_code $var(s20_reply_code) hangup_reason $var(s20_reason) config_version $var(s20_config_version) created_at_unix $Ts", "$avp(s20_cdr_id)")) {
+        update_stat("s20_cdr_xadd_total", 1);
+        xlog("L_INFO", "S20 CDR XADD ok redis_id=$avp(s20_cdr_id) event_id=$var(s20_event_id) callid=$ci reason=$var(s20_reason)\n");
+    } else {
+        update_stat("s20_cdr_xadd_error_total", 1);
+        xlog("L_ERR", "S20 CDR XADD failed event_id=$var(s20_event_id) callid=$ci reason=$var(s20_reason)\n");
+    }
+}
diff --git a/infra/server-a/s20/scripts/lisglosips-opensips-preprocess b/infra/server-a/s20/scripts/lisglosips-opensips-preprocess
new file mode 100755
index 0000000..b4d0567
--- /dev/null
+++ b/infra/server-a/s20/scripts/lisglosips-opensips-preprocess
@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+import os
+import sys
+
+
+def main() -> int:
+    redis_url = os.getenv("OPENSIPS_REDIS_URL", "redis:s20://127.0.0.1:6380/")
+    config = sys.stdin.read()
+    sys.stdout.write(config.replace("@@LISGLOSIPS_REDIS_URL@@", redis_url))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/infra/server-a/s20/scripts/lisglosips-redis-auth-proxy b/infra/server-a/s20/scripts/lisglosips-redis-auth-proxy
new file mode 100755
index 0000000..58023ae
--- /dev/null
+++ b/infra/server-a/s20/scripts/lisglosips-redis-auth-proxy
@@ -0,0 +1,100 @@
+#!/usr/bin/env python3
+import os
+import selectors
+import signal
+import socket
+import sys
+
+
+LISTEN_HOST = os.getenv("LISTEN_HOST", "127.0.0.1")
+LISTEN_PORT = int(os.getenv("LISTEN_PORT", "6380"))
+REDIS_HOST = os.getenv("REDIS_HOST", "100.90.90.91")
+REDIS_PORT = int(os.getenv("REDIS_PORT", "6379"))
+REDIS_USER = os.getenv("REDIS_USER", "lisglosips")
+CONNECT_TIMEOUT = float(os.getenv("CONNECT_TIMEOUT", "2.0"))
+
+
+def credential(name: str) -> str:
+    cred_dir = os.getenv("CREDENTIALS_DIRECTORY")
+    if not cred_dir:
+        raise RuntimeError("CREDENTIALS_DIRECTORY is not set")
+    path = os.path.join(cred_dir, name)
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read().strip()
+
+
+def resp_array(parts: list[str]) -> bytes:
+    output = f"*{len(parts)}\r\n".encode("utf-8")
+    for part in parts:
+        data = part.encode("utf-8")
+        output += f"${len(data)}\r\n".encode("utf-8") + data + b"\r\n"
+    return output
+
+
+def read_line(sock: socket.socket) -> bytes:
+    data = b""
+    while not data.endswith(b"\r\n"):
+        chunk = sock.recv(1)
+        if not chunk:
+            break
+        data += chunk
+        if len(data) > 4096:
+            break
+    return data
+
+
+def connect_upstream() -> socket.socket:
+    password = credential("redis_password")
+    upstream = socket.create_connection((REDIS_HOST, REDIS_PORT), timeout=CONNECT_TIMEOUT)
+    upstream.sendall(resp_array(["AUTH", REDIS_USER, password]))
+    reply = read_line(upstream)
+    if not reply.startswith(b"+OK"):
+        upstream.close()
+        raise RuntimeError("Redis AUTH failed")
+    upstream.setblocking(False)
+    return upstream
+
+
+def bridge(client: socket.socket) -> None:
+    upstream = connect_upstream()
+    client.setblocking(False)
+    selector = selectors.DefaultSelector()
+    selector.register(client, selectors.EVENT_READ, upstream)
+    selector.register(upstream, selectors.EVENT_READ, client)
+    try:
+        while True:
+            for key, _ in selector.select(timeout=30):
+                src = key.fileobj
+                dst = key.data
+                data = src.recv(65536)
+                if not data:
+                    return
+                dst.sendall(data)
+    finally:
+        selector.close()
+        client.close()
+        upstream.close()
+
+
+def main() -> int:
+    signal.signal(signal.SIGCHLD, signal.SIG_IGN)
+    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    server.bind((LISTEN_HOST, LISTEN_PORT))
+    server.listen(128)
+    print(f"lisglosips redis auth proxy listening on {LISTEN_HOST}:{LISTEN_PORT}", flush=True)
+    while True:
+        client, _ = server.accept()
+        pid = os.fork()
+        if pid == 0:
+            server.close()
+            try:
+                bridge(client)
+            except Exception as exc:
+                print(f"redis proxy client failed: {exc}", file=sys.stderr, flush=True)
+            return 0
+        client.close()
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/infra/server-a/s20/scripts/lisglosips-redis-load-hotpath b/infra/server-a/s20/scripts/lisglosips-redis-load-hotpath
new file mode 100755
index 0000000..e834cc4
--- /dev/null
+++ b/infra/server-a/s20/scripts/lisglosips-redis-load-hotpath
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+import os
+import socket
+import time
+
+
+SCRIPT_PATH = os.getenv("HOTPATH_LUA", "/etc/opensips/lisglosips_hotpath.lua")
+REDIS_HOST = os.getenv("REDIS_PROXY_HOST", "127.0.0.1")
+REDIS_PORT = int(os.getenv("REDIS_PROXY_PORT", "6380"))
+
+
+def enc(parts: list[str]) -> bytes:
+    output = f"*{len(parts)}\r\n".encode("utf-8")
+    for part in parts:
+        data = part.encode("utf-8")
+        output += f"${len(data)}\r\n".encode("utf-8") + data + b"\r\n"
+    return output
+
+
+with open(SCRIPT_PATH, "r", encoding="utf-8") as handle:
+    script = handle.read()
+
+last_error: Exception | None = None
+for _ in range(20):
+    try:
+        with socket.create_connection((REDIS_HOST, REDIS_PORT), timeout=2) as sock:
+            sock.sendall(enc(["SCRIPT", "LOAD", script]))
+            response = sock.recv(4096)
+            if not response.startswith(b"$"):
+                raise SystemExit(f"unexpected Redis response while loading Lua: {response[:80]!r}")
+            raise SystemExit(0)
+    except OSError as exc:
+        last_error = exc
+        time.sleep(0.25)
+
+raise SystemExit(f"could not connect to Redis proxy: {last_error}")
diff --git a/infra/server-a/s20/scripts/lisglosips-s20-metrics b/infra/server-a/s20/scripts/lisglosips-s20-metrics
new file mode 100755
index 0000000..a04fbdd
--- /dev/null
+++ b/infra/server-a/s20/scripts/lisglosips-s20-metrics
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+OUT_DIR=${1:-/var/lib/prometheus/node-exporter}
+OUT_FILE="$OUT_DIR/lisglosips_s20.prom"
+TMP_FILE="$OUT_FILE.$$"
+BASE_DIR=/dev/shm/voip_rec
+
+mkdir -p "$OUT_DIR"
+
+tmp_total=0
+tmp_used=0
+tmp_avail=0
+if df_out=$(df -B1 "$BASE_DIR" 2>/dev/null | awk 'NR==2 {print $2" "$3" "$4}'); then
+  read -r tmp_total tmp_used tmp_avail <<<"$df_out"
+fi
+
+ready_count=$(find "$BASE_DIR/ready" -type f -name '*.ready' 2>/dev/null | wc -l)
+part_count=$(find "$BASE_DIR/ready" -type f -name '*.part' 2>/dev/null | wc -l)
+oldest_age=0
+oldest_epoch=$(find "$BASE_DIR/ready" -type f -name '*.ready' -printf '%T@\n' 2>/dev/null | sort -n | head -n 1 || true)
+if [ -n "$oldest_epoch" ]; then
+  now_epoch=$(date +%s)
+  oldest_sec=${oldest_epoch%.*}
+  oldest_age=$(( now_epoch - oldest_sec ))
+  if [ "$oldest_age" -lt 0 ]; then
+    oldest_age=0
+  fi
+fi
+
+redis_reachable=0
+if timeout 2 bash -c '</dev/tcp/127.0.0.1/6380' 2>/dev/null; then
+  redis_reachable=1
+fi
+
+rtpengine_sessions=0
+if command -v rtpengine-ctl >/dev/null 2>&1; then
+  rtpengine_sessions=$(rtpengine-ctl -ip 127.0.0.1 -port 2224 list numsessions 2>/dev/null | awk -F: '/Current sessions total/ {gsub(/ /, "", $2); print $2; found=1} END {if (!found) print 0}')
+fi
+
+cat > "$TMP_FILE" <<EOF
+# HELP lisglosips_voip_rec_tmpfs_bytes Server A recording tmpfs bytes.
+# TYPE lisglosips_voip_rec_tmpfs_bytes gauge
+lisglosips_voip_rec_tmpfs_bytes{state="total"} $tmp_total
+lisglosips_voip_rec_tmpfs_bytes{state="used"} $tmp_used
+lisglosips_voip_rec_tmpfs_bytes{state="available"} $tmp_avail
+# HELP lisglosips_recording_files Server A recording staging files.
+# TYPE lisglosips_recording_files gauge
+lisglosips_recording_files{state="ready"} $ready_count
+lisglosips_recording_files{state="part"} $part_count
+# HELP lisglosips_recording_oldest_ready_age_seconds Oldest ready recording age in seconds.
+# TYPE lisglosips_recording_oldest_ready_age_seconds gauge
+lisglosips_recording_oldest_ready_age_seconds $oldest_age
+# HELP lisglosips_redis_proxy_up Local Redis auth proxy TCP reachability.
+# TYPE lisglosips_redis_proxy_up gauge
+lisglosips_redis_proxy_up $redis_reachable
+# HELP lisglosips_rtpengine_sessions Current RTPEngine sessions reported by CLI.
+# TYPE lisglosips_rtpengine_sessions gauge
+lisglosips_rtpengine_sessions $rtpengine_sessions
+EOF
+
+chown prometheus:prometheus "$TMP_FILE" 2>/dev/null || true
+chmod 0644 "$TMP_FILE"
+mv "$TMP_FILE" "$OUT_FILE"
diff --git a/infra/server-a/s20/systemd/lisglosips-a-firewall.service b/infra/server-a/s20/systemd/lisglosips-a-firewall.service
new file mode 100644
index 0000000..f8dfb9f
--- /dev/null
+++ b/infra/server-a/s20/systemd/lisglosips-a-firewall.service
@@ -0,0 +1,22 @@
+[Unit]
+Description=Load LisgloSIPS Server A nftables rules
+Documentation=file:/etc/nftables.d/
+After=network-online.target
+Wants=network-online.target
+Before=rtpengine-daemon.service opensips.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStartPre=-/usr/sbin/nft delete table inet lisglosips_s20_observability
+ExecStartPre=-/usr/sbin/nft delete table inet lisglosips_s19_rtpengine
+ExecStartPre=-/usr/sbin/nft delete table inet lisglosips_s18_opensips
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/lisglosips-s18-opensips.nft
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/lisglosips-s19-rtpengine.nft
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/lisglosips-s20-observability.nft
+ExecStop=-/usr/sbin/nft delete table inet lisglosips_s20_observability
+ExecStop=-/usr/sbin/nft delete table inet lisglosips_s19_rtpengine
+ExecStop=-/usr/sbin/nft delete table inet lisglosips_s18_opensips
+
+[Install]
+WantedBy=multi-user.target
diff --git a/infra/server-a/s20/systemd/lisglosips-redis-auth-proxy.service b/infra/server-a/s20/systemd/lisglosips-redis-auth-proxy.service
new file mode 100644
index 0000000..4d23020
--- /dev/null
+++ b/infra/server-a/s20/systemd/lisglosips-redis-auth-proxy.service
@@ -0,0 +1,33 @@
+[Unit]
+Description=LisgloSIPS local Redis AUTH proxy for OpenSIPS
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=opensips
+Group=opensips
+LoadCredentialEncrypted=redis_password:/etc/credstore.encrypted/lisglosips-redis-password.cred
+Environment=LISTEN_HOST=127.0.0.1
+Environment=LISTEN_PORT=6380
+Environment=REDIS_HOST=100.90.90.91
+Environment=REDIS_PORT=6379
+Environment=REDIS_USER=lisglosips
+ExecStart=/usr/local/sbin/lisglosips-redis-auth-proxy
+Restart=always
+RestartSec=3
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/run
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+IPAddressDeny=any
+IPAddressAllow=127.0.0.0/8
+IPAddressAllow=100.90.90.91/32
+
+[Install]
+WantedBy=multi-user.target
diff --git a/infra/server-a/s20/systemd/lisglosips-redis-hotpath-load.service b/infra/server-a/s20/systemd/lisglosips-redis-hotpath-load.service
new file mode 100644
index 0000000..d3e6dfa
--- /dev/null
+++ b/infra/server-a/s20/systemd/lisglosips-redis-hotpath-load.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Load LisgloSIPS Redis hot path Lua script
+After=lisglosips-redis-auth-proxy.service
+Requires=lisglosips-redis-auth-proxy.service
+Before=opensips.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/lisglosips-redis-load-hotpath
+
+[Install]
+WantedBy=multi-user.target
diff --git a/infra/server-a/s20/systemd/lisglosips-s20-metrics.service b/infra/server-a/s20/systemd/lisglosips-s20-metrics.service
new file mode 100644
index 0000000..ccf8bdf
--- /dev/null
+++ b/infra/server-a/s20/systemd/lisglosips-s20-metrics.service
@@ -0,0 +1,7 @@
+[Unit]
+Description=Collect LisgloSIPS Server A textfile metrics
+After=rtpengine-daemon.service lisglosips-redis-auth-proxy.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/lisglosips-s20-metrics /var/lib/prometheus/node-exporter
diff --git a/infra/server-a/s20/systemd/lisglosips-s20-metrics.timer b/infra/server-a/s20/systemd/lisglosips-s20-metrics.timer
new file mode 100644
index 0000000..9a162b4
--- /dev/null
+++ b/infra/server-a/s20/systemd/lisglosips-s20-metrics.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Run LisgloSIPS Server A textfile metrics collector
+
+[Timer]
+OnBootSec=20s
+OnUnitActiveSec=15s
+AccuracySec=2s
+Unit=lisglosips-s20-metrics.service
+
+[Install]
+WantedBy=timers.target
diff --git a/infra/server-a/s20/systemd/opensips.service.d/20-lisglosips-s20.conf b/infra/server-a/s20/systemd/opensips.service.d/20-lisglosips-s20.conf
new file mode 100644
index 0000000..95a8492
--- /dev/null
+++ b/infra/server-a/s20/systemd/opensips.service.d/20-lisglosips-s20.conf
@@ -0,0 +1,6 @@
+[Unit]
+After=lisglosips-redis-auth-proxy.service lisglosips-redis-hotpath-load.service
+Wants=lisglosips-redis-auth-proxy.service lisglosips-redis-hotpath-load.service
+
+[Service]
+Environment=OPENSIPS_REDIS_URL=redis:s20://127.0.0.1:6380/
diff --git a/infra/server-a/s22/opensips/opensips.cfg b/infra/server-a/s22/opensips/opensips.cfg
new file mode 100644
index 0000000..fc6e6f8
--- /dev/null
+++ b/infra/server-a/s22/opensips/opensips.cfg
@@ -0,0 +1,187 @@
+#### LisgloSIPS S20 OpenSIPS Redis hot path, HEP and metrics baseline ####
+
+log_level=3
+xlog_level=3
+stderror_enabled=no
+syslog_enabled=yes
+syslog_facility=LOG_LOCAL0
+
+udp_workers=4
+auto_aliases=no
+socket=udp:100.90.90.90:15060
+socket=hep_udp:100.90.90.90:9061
+
+mpath="/usr/lib/x86_64-linux-gnu/opensips/modules/"
+
+loadmodule "proto_udp.so"
+loadmodule "signaling.so"
+loadmodule "sl.so"
+loadmodule "tm.so"
+modparam("tm", "fr_timeout", 5)
+modparam("tm", "fr_inv_timeout", 30)
+
+loadmodule "maxfwd.so"
+loadmodule "sipmsgops.so"
+loadmodule "textops.so"
+
+loadmodule "mi_fifo.so"
+modparam("mi_fifo", "fifo_name", "/run/opensips/opensips_fifo")
+modparam("mi_fifo", "fifo_mode", 0660)
+
+loadmodule "httpd.so"
+modparam("httpd", "ip", "127.0.0.1")
+modparam("httpd", "port", 8888)
+loadmodule "mi_http.so"
+modparam("mi_http", "root", "mi")
+
+loadmodule "auth.so"
+modparam("auth", "nonce_expire", 300)
+modparam("auth", "disable_nonce_check", 0)
+
+loadmodule "pike.so"
+modparam("pike", "sampling_time_unit", 2)
+modparam("pike", "reqs_density_per_unit", 16)
+modparam("pike", "remove_latency", 120)
+
+loadmodule "ratelimit.so"
+
+loadmodule "cachedb_redis.so"
+modparam("cachedb_redis", "connect_timeout", 300)
+modparam("cachedb_redis", "query_timeout", 300)
+modparam("cachedb_redis", "shutdown_on_error", 0)
+modparam("cachedb_redis", "cachedb_url", "@@LISGLOSIPS_REDIS_URL@@")
+
+loadmodule "rtpengine.so"
+modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:2223")
+
+loadmodule "statistics.so"
+modparam("statistics", "variable", "s20_invite_total/no_reset")
+modparam("statistics", "variable", "s20_hotpath_allow_total/no_reset")
+modparam("statistics", "variable", "s20_hotpath_reject_total/no_reset")
+modparam("statistics", "variable", "s20_redis_error_total/no_reset")
+modparam("statistics", "variable", "s20_cdr_xadd_total/no_reset")
+modparam("statistics", "variable", "s20_cdr_xadd_error_total/no_reset")
+
+loadmodule "prometheus.so"
+modparam("prometheus", "root", "metrics")
+modparam("prometheus", "prefix", "lisglosips_opensips")
+modparam("prometheus", "statistics", "script: core: net:")
+
+loadmodule "proto_hep.so"
+modparam("proto_hep", "hep_id", "[homer] 100.90.90.91:9060; transport=udp; version=3")
+loadmodule "tracer.so"
+modparam("tracer", "trace_on", 1)
+modparam("tracer", "trace_id", "[s20_hep]uri=hep:homer")
+
+route {
+    if (!mf_process_maxfwd_header(10)) {
+        send_reply(483, "Too Many Hops");
+        exit;
+    }
+
+    trace("s20_hep", "m", "sip|xlog");
+
+    if (!pike_check_req()) {
+        xlog("L_WARN", "S20 pike blocked source=$si method=$rm callid=$ci\n");
+        send_reply(403, "Rate Limited");
+        exit;
+    }
+
+    if (has_totag()) {
+        send_reply(481, "Dialog Not Found");
+        exit;
+    }
+
+    if (is_method("OPTIONS") && $rU == NULL) {
+        send_reply(200, "Keepalive");
+        exit;
+    }
+
+    if (is_method("REGISTER")) {
+        append_to_reply("WWW-Authenticate: Digest realm=\"lisglosips.local\", nonce=\"s20-baseline\", algorithm=MD5, qop=\"auth\"\r\n");
+        send_reply(401, "Authentication Required");
+        exit;
+    }
+
+    if (is_method("INVITE")) {
+        route(S20_INVITE);
+        exit;
+    }
+
+    send_reply(405, "Method Not Allowed");
+    exit;
+}
+
+route[S20_INVITE] {
+    update_stat("s20_invite_total", 1);
+
+    $var(s20_decision) = "reject";
+    $var(s20_reason) = "REDIS_UNAVAILABLE";
+    $var(s20_gateway_id) = "none";
+    $var(s20_config_version) = "none";
+    $var(s20_line_group_id) = "none";
+    $var(s20_policy_id) = "none";
+    $var(s20_customer_id) = "none";
+    $var(s20_reply_code) = 503;
+    $var(s20_reply_text) = "Routing Not Ready";
+
+    if (!cache_raw_query("redis:s20", "EVALSHA cfdc02cbe5528d37fba617947c09e3380770c918 1 cfg:active_version $si $fU $rU $ci", "$avp(s20_hotpath)")) {
+        update_stat("s20_redis_error_total", 1);
+        xlog("L_ERR", "S20 Redis hotpath unavailable source=$si callid=$ci\n");
+        $var(s20_reason) = "REDIS_UNAVAILABLE";
+        $var(s20_reply_code) = 503;
+        $var(s20_reply_text) = "Redis Unavailable";
+        route(S20_CDR_XADD);
+        send_reply($var(s20_reply_code), $var(s20_reply_text));
+        exit;
+    }
+
+    $var(s20_decision) = $(avp(s20_hotpath)[0]);
+    $var(s20_reason) = $(avp(s20_hotpath)[1]);
+    $var(s20_gateway_id) = $(avp(s20_hotpath)[2]);
+    $var(s20_config_version) = $(avp(s20_hotpath)[3]);
+    $var(s20_line_group_id) = $(avp(s20_hotpath)[4]);
+    $var(s20_policy_id) = $(avp(s20_hotpath)[5]);
+    $var(s20_customer_id) = $(avp(s20_hotpath)[6]);
+
+    if ($var(s20_decision) == "allow") {
+        update_stat("s20_hotpath_allow_total", 1);
+        xlog("L_INFO", "S20 hotpath allow source=$si callid=$ci customer=$var(s20_customer_id) gateway=$var(s20_gateway_id) policy=$var(s20_policy_id) line_group=$var(s20_line_group_id) version=$var(s20_config_version)\n");
+        $var(s20_reason) = "ROUTING_NOT_READY";
+        $var(s20_reply_code) = 503;
+        $var(s20_reply_text) = "Routing Not Ready";
+        route(S20_CDR_XADD);
+        send_reply($var(s20_reply_code), $var(s20_reply_text));
+        exit;
+    }
+
+    update_stat("s20_hotpath_reject_total", 1);
+    if ($var(s20_reason) == "CONFIG_MISSING") {
+        $var(s20_reply_code) = 503;
+        $var(s20_reply_text) = "Config Missing";
+    } else if ($var(s20_reason) == "NO_POLICY") {
+        $var(s20_reply_code) = 503;
+        $var(s20_reply_text) = "No Route Policy";
+    } else {
+        $var(s20_reply_code) = 403;
+        $var(s20_reply_text) = "Forbidden";
+    }
+
+    xlog("L_WARN", "S20 hotpath reject reason=$var(s20_reason) source=$si callid=$ci version=$var(s20_config_version)\n");
+    route(S20_CDR_XADD);
+    send_reply($var(s20_reply_code), $var(s20_reply_text));
+    exit;
+}
+
+route[S20_CDR_XADD] {
+    $var(s20_event_id) = "s20-" + $Ts + "-" + $pp + "-" + $ci;
+    $var(s20_idempotency_key) = $ci + ":" + $Ts;
+
+    if (cache_raw_query("redis:s20", "XADD stream:cdr_payload * schema_version 1 event_id $var(s20_event_id) idempotency_key $var(s20_idempotency_key) call_id $ci node_id a1 opensips_instance opensips-a1 ingress_a_ip 100.90.90.90 rtpengine_node a1 source_ip $si caller $fU callee $rU customer_id $var(s20_customer_id) customer_gateway_id $var(s20_gateway_id) customer_gateway_policy_id $var(s20_policy_id) vendor_id none vendor_gateway_id none line_group_id $var(s20_line_group_id) started_at $Ts answered_at none ended_at $Ts duration_sec 0 sip_code $var(s20_reply_code) hangup_reason $var(s20_reason) recording_key none config_version $var(s20_config_version) created_at $Ts", "$avp(s20_cdr_id)")) {
+        update_stat("s20_cdr_xadd_total", 1);
+        xlog("L_INFO", "S20 CDR XADD ok redis_id=$avp(s20_cdr_id) event_id=$var(s20_event_id) callid=$ci reason=$var(s20_reason)\n");
+    } else {
+        update_stat("s20_cdr_xadd_error_total", 1);
+        xlog("L_ERR", "S20 CDR XADD failed event_id=$var(s20_event_id) callid=$ci reason=$var(s20_reason)\n");
+    }
+}
diff --git a/infra/server-a/s28/opensips.cfg b/infra/server-a/s28/opensips.cfg
new file mode 100644
index 0000000..8a8a271
--- /dev/null
+++ b/infra/server-a/s28/opensips.cfg
@@ -0,0 +1,267 @@
+#### LisgloSIPS S28 minimal end-to-end OpenSIPS route ####
+
+log_level=3
+xlog_level=3
+stderror_enabled=no
+syslog_enabled=yes
+syslog_facility=LOG_LOCAL0
+
+udp_workers=4
+auto_aliases=no
+socket=udp:100.90.90.90:15060
+socket=hep_udp:100.90.90.90:9061
+
+mpath="/usr/lib/x86_64-linux-gnu/opensips/modules/"
+
+loadmodule "proto_udp.so"
+loadmodule "signaling.so"
+loadmodule "sl.so"
+loadmodule "tm.so"
+modparam("tm", "fr_timeout", 5)
+modparam("tm", "fr_inv_timeout", 30)
+
+loadmodule "rr.so"
+modparam("rr", "append_fromtag", 1)
+
+loadmodule "maxfwd.so"
+loadmodule "sipmsgops.so"
+loadmodule "textops.so"
+
+loadmodule "mi_fifo.so"
+modparam("mi_fifo", "fifo_name", "/run/opensips/opensips_fifo")
+modparam("mi_fifo", "fifo_mode", 0660)
+
+loadmodule "httpd.so"
+modparam("httpd", "ip", "127.0.0.1")
+modparam("httpd", "port", 8888)
+loadmodule "mi_http.so"
+modparam("mi_http", "root", "mi")
+
+loadmodule "auth.so"
+modparam("auth", "nonce_expire", 300)
+modparam("auth", "disable_nonce_check", 0)
+
+loadmodule "pike.so"
+modparam("pike", "sampling_time_unit", 2)
+modparam("pike", "reqs_density_per_unit", 32)
+modparam("pike", "remove_latency", 120)
+
+loadmodule "ratelimit.so"
+
+loadmodule "cachedb_redis.so"
+modparam("cachedb_redis", "connect_timeout", 300)
+modparam("cachedb_redis", "query_timeout", 300)
+modparam("cachedb_redis", "shutdown_on_error", 0)
+modparam("cachedb_redis", "cachedb_url", "@@LISGLOSIPS_REDIS_URL@@")
+
+loadmodule "rtpengine.so"
+modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:2223")
+
+loadmodule "statistics.so"
+modparam("statistics", "variable", "s28_invite_total/no_reset")
+modparam("statistics", "variable", "s28_hotpath_allow_total/no_reset")
+modparam("statistics", "variable", "s28_hotpath_reject_total/no_reset")
+modparam("statistics", "variable", "s28_cdr_xadd_total/no_reset")
+modparam("statistics", "variable", "s28_cdr_xadd_error_total/no_reset")
+
+loadmodule "prometheus.so"
+modparam("prometheus", "root", "metrics")
+modparam("prometheus", "prefix", "lisglosips_opensips")
+modparam("prometheus", "statistics", "script: core: net:")
+
+loadmodule "proto_hep.so"
+modparam("proto_hep", "hep_id", "[homer] 100.90.90.91:9060; transport=udp; version=3")
+loadmodule "tracer.so"
+modparam("tracer", "trace_on", 1)
+modparam("tracer", "trace_id", "[s28_hep]uri=hep:homer")
+
+route {
+    if (!mf_process_maxfwd_header(10)) {
+        send_reply(483, "Too Many Hops");
+        exit;
+    }
+
+    trace("s28_hep", "m", "sip|xlog");
+
+    if (!pike_check_req()) {
+        xlog("L_WARN", "S28 pike blocked source=$si method=$rm callid=$ci\n");
+        send_reply(403, "Rate Limited");
+        exit;
+    }
+
+    if (has_totag()) {
+        route(S28_IN_DIALOG);
+        exit;
+    }
+
+    if (is_method("OPTIONS") && $rU == NULL) {
+        send_reply(200, "Keepalive");
+        exit;
+    }
+
+    if (is_method("REGISTER")) {
+        append_to_reply("WWW-Authenticate: Digest realm=\"lisglosips.local\", nonce=\"s28-baseline\", algorithm=MD5, qop=\"auth\"\r\n");
+        send_reply(401, "Authentication Required");
+        exit;
+    }
+
+    if (is_method("INVITE")) {
+        route(S28_INVITE);
+        exit;
+    }
+
+    send_reply(405, "Method Not Allowed");
+    exit;
+}
+
+route[S28_IN_DIALOG] {
+    xlog("L_INFO", "S28 in-dialog method=$rm source=$si ruri=$ru callid=$ci\n");
+
+    if (is_method("ACK") && $si == "100.93.185.30") {
+        remove_hf("Route");
+        $du = "sip:100.93.185.30:50620";
+        $ru = "sip:" + $rU + "@100.93.185.30:50620";
+        t_relay();
+        exit;
+    }
+
+    if (is_method("BYE") && $si == "100.93.185.30") {
+        rtpengine_delete();
+        remove_hf("Route");
+        $du = "sip:100.93.185.30:50620";
+        $ru = "sip:" + $rU + "@100.93.185.30:50620";
+        if (!t_relay()) {
+            send_reply(500, "Relay Failed");
+        }
+        exit;
+    }
+
+    if (loose_route()) {
+        if (is_method("BYE")) {
+            rtpengine_delete();
+        }
+        if (!t_relay()) {
+            send_reply(500, "Relay Failed");
+        }
+        exit;
+    }
+
+    if (is_method("ACK")) {
+        if (t_check_trans()) {
+            t_relay();
+        }
+        exit;
+    }
+
+    send_reply(481, "Dialog Not Found");
+    exit;
+}
+
+route[S28_INVITE] {
+    update_stat("s28_invite_total", 1);
+
+    $var(s28_decision) = "reject";
+    $var(s28_reason) = "REDIS_UNAVAILABLE";
+    $var(s28_gateway_id) = "none";
+    $var(s28_config_version) = "none";
+    $var(s28_line_group_id) = "none";
+    $var(s28_policy_id) = "none";
+    $var(s28_customer_id) = "none";
+    $var(s28_reply_code) = 503;
+    $var(s28_reply_text) = "Routing Not Ready";
+
+    if (!cache_raw_query("redis:s20", "EVALSHA cfdc02cbe5528d37fba617947c09e3380770c918 1 cfg:active_version $si $fU $rU $ci", "$avp(s28_hotpath)")) {
+        xlog("L_ERR", "S28 Redis hotpath unavailable source=$si callid=$ci\n");
+        $var(s28_reason) = "REDIS_UNAVAILABLE";
+        $var(s28_reply_code) = 503;
+        $var(s28_reply_text) = "Redis Unavailable";
+        route(S28_CDR_FAILURE);
+        send_reply($var(s28_reply_code), $var(s28_reply_text));
+        exit;
+    }
+
+    $var(s28_decision) = $(avp(s28_hotpath)[0]);
+    $var(s28_reason) = $(avp(s28_hotpath)[1]);
+    $var(s28_gateway_id) = $(avp(s28_hotpath)[2]);
+    $var(s28_config_version) = $(avp(s28_hotpath)[3]);
+    $var(s28_line_group_id) = $(avp(s28_hotpath)[4]);
+    $var(s28_policy_id) = $(avp(s28_hotpath)[5]);
+    $var(s28_customer_id) = $(avp(s28_hotpath)[6]);
+
+    if ($var(s28_decision) != "allow") {
+        update_stat("s28_hotpath_reject_total", 1);
+        if ($var(s28_reason) == "CONFIG_MISSING") {
+            $var(s28_reply_code) = 503;
+            $var(s28_reply_text) = "Config Missing";
+        } else if ($var(s28_reason) == "NO_POLICY") {
+            $var(s28_reply_code) = 503;
+            $var(s28_reply_text) = "No Route Policy";
+        } else {
+            $var(s28_reply_code) = 403;
+            $var(s28_reply_text) = "Forbidden";
+        }
+        route(S28_CDR_FAILURE);
+        send_reply($var(s28_reply_code), $var(s28_reply_text));
+        exit;
+    }
+
+    update_stat("s28_hotpath_allow_total", 1);
+    xlog("L_INFO", "S28 hotpath allow source=$si callid=$ci customer=$var(s28_customer_id) gateway=$var(s28_gateway_id) policy=$var(s28_policy_id) line_group=$var(s28_line_group_id) version=$var(s28_config_version)\n");
+
+    if (has_body("application/sdp")) {
+        if (!rtpengine_offer("replace-origin replace-session-connection record-call=on")) {
+            xlog("L_ERR", "S28 rtpengine_offer failed callid=$ci\n");
+            $var(s28_reason) = "RTPENGINE_OFFER_FAILED";
+            $var(s28_reply_code) = 500;
+            $var(s28_reply_text) = "Media Error";
+            route(S28_CDR_FAILURE);
+            send_reply($var(s28_reply_code), $var(s28_reply_text));
+            exit;
+        }
+    }
+
+    record_route();
+    $du = "sip:100.93.185.30:50620";
+    $ru = "sip:" + $rU + "@100.93.185.30:50620";
+    t_on_reply("S28_REPLY");
+
+    if (!t_relay()) {
+        $var(s28_reason) = "RELAY_FAILED";
+        $var(s28_reply_code) = 500;
+        $var(s28_reply_text) = "Relay Failed";
+        route(S28_CDR_FAILURE);
+        send_reply($var(s28_reply_code), $var(s28_reply_text));
+    }
+    exit;
+}
+
+onreply_route[S28_REPLY] {
+    if (t_check_status("2[0-9][0-9]") && has_body("application/sdp")) {
+        if (!rtpengine_answer("replace-origin replace-session-connection")) {
+            xlog("L_ERR", "S28 rtpengine_answer failed callid=$ci\n");
+        }
+        route(S28_CDR_SUCCESS);
+    }
+}
+
+route[S28_CDR_SUCCESS] {
+    $var(s28_event_id) = "s28-ok-" + $Ts + "-" + $pp + "-" + $ci;
+    $var(s28_idempotency_key) = $ci + ":s28-ok:" + $Ts;
+    if (cache_raw_query("redis:s20", "XADD stream:cdr_payload * schema_version 1 event_id $var(s28_event_id) idempotency_key $var(s28_idempotency_key) call_id $ci node_id a1 opensips_instance opensips-a1 ingress_a_ip 100.90.90.90 rtpengine_node a1 source_ip $si caller $fU callee $rU customer_id cus_s28_t customer_gateway_id cgw_s28_t_ip customer_gateway_policy_id cgp_s28_t_default vendor_id ven_s28_t vendor_gateway_id vgw_s28_t_uas line_group_id llg_s28_t started_at $Ts answered_at $Ts ended_at $Ts duration_sec 6 sip_code 200 hangup_reason NORMAL_CLEARING recording_key none config_version $var(s28_config_version) created_at $Ts", "$avp(s28_cdr_id)")) {
+        update_stat("s28_cdr_xadd_total", 1);
+        xlog("L_INFO", "S28 success CDR XADD ok redis_id=$avp(s28_cdr_id) event_id=$var(s28_event_id) callid=$ci\n");
+    } else {
+        update_stat("s28_cdr_xadd_error_total", 1);
+        xlog("L_ERR", "S28 success CDR XADD failed event_id=$var(s28_event_id) callid=$ci\n");
+    }
+}
+
+route[S28_CDR_FAILURE] {
+    $var(s28_event_id) = "s28-fail-" + $Ts + "-" + $pp + "-" + $ci;
+    $var(s28_idempotency_key) = $ci + ":s28-fail:" + $Ts;
+    if (cache_raw_query("redis:s20", "XADD stream:cdr_payload * schema_version 1 event_id $var(s28_event_id) idempotency_key $var(s28_idempotency_key) call_id $ci node_id a1 opensips_instance opensips-a1 ingress_a_ip 100.90.90.90 rtpengine_node a1 source_ip $si caller $fU callee $rU customer_id $var(s28_customer_id) customer_gateway_id $var(s28_gateway_id) customer_gateway_policy_id $var(s28_policy_id) vendor_id none vendor_gateway_id none line_group_id $var(s28_line_group_id) started_at $Ts answered_at none ended_at $Ts duration_sec 0 sip_code $var(s28_reply_code) hangup_reason $var(s28_reason) recording_key none config_version $var(s28_config_version) created_at $Ts", "$avp(s28_cdr_id)")) {
+        update_stat("s28_cdr_xadd_total", 1);
+    } else {
+        update_stat("s28_cdr_xadd_error_total", 1);
+    }
+}
diff --git a/infra/server-a/s30/lisglosips-opensips-config-restore.sh b/infra/server-a/s30/lisglosips-opensips-config-restore.sh
new file mode 100755
index 0000000..d4ce08f
--- /dev/null
+++ b/infra/server-a/s30/lisglosips-opensips-config-restore.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+set -euo pipefail
+
+if [ "$#" -ne 1 ]; then
+  echo "usage: $0 /path/to/opensips.cfg.backup" >&2
+  exit 64
+fi
+
+source_cfg="$1"
+test -f "$source_cfg"
+
+stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+backup_dir="/var/backups/lisglosips-s30/$stamp"
+install -d -o root -g root -m 0700 "$backup_dir"
+install -o root -g root -m 0600 /etc/opensips/opensips.cfg "$backup_dir/opensips.cfg.pre-restore"
+install -o root -g root -m 0600 "$source_cfg" "$backup_dir/opensips.cfg.candidate"
+
+opensips -C -f "$backup_dir/opensips.cfg.candidate"
+install -o root -g opensips -m 0640 "$backup_dir/opensips.cfg.candidate" /etc/opensips/opensips.cfg
+systemctl restart opensips
+systemctl is-active --quiet opensips
+
+echo "$backup_dir"
diff --git a/infra/server-b/s03/chrony.sources b/infra/server-b/s03/chrony.sources
new file mode 100644
index 0000000..78e987f
--- /dev/null
+++ b/infra/server-b/s03/chrony.sources
@@ -0,0 +1,2 @@
+server ntp.aliyun.com iburst prefer minpoll 4 maxpoll 10
+server time1.cloud.tencent.com iburst minpoll 4 maxpoll 10
diff --git a/infra/server-b/s03/fail2ban.local b/infra/server-b/s03/fail2ban.local
new file mode 100644
index 0000000..3ff7423
--- /dev/null
+++ b/infra/server-b/s03/fail2ban.local
@@ -0,0 +1,11 @@
+[DEFAULT]
+backend = systemd
+bantime = 1h
+findtime = 10m
+maxretry = 5
+
+[sshd]
+enabled = true
+port = 22
+banaction = nftables-multiport
+ignoreip = 127.0.0.1/8 ::1 100.91.249.119
diff --git a/infra/server-b/s03/lisglosips.nft b/infra/server-b/s03/lisglosips.nft
new file mode 100644
index 0000000..416f953
--- /dev/null
+++ b/infra/server-b/s03/lisglosips.nft
@@ -0,0 +1,27 @@
+destroy table inet lisglosips_filter
+
+table inet lisglosips_filter {
+    set admin_ipv4 {
+        type ipv4_addr
+        elements = { 100.91.249.119, 100.98.167.119 }
+    }
+
+    chain input {
+        type filter hook input priority 10; policy drop;
+
+        ct state invalid counter drop
+        ct state established,related counter accept
+        iifname "lo" counter accept
+
+        ip protocol icmp counter accept
+        ip6 nexthdr ipv6-icmp counter accept
+
+        udp dport 41641 counter accept comment "Tailscale direct transport"
+
+        iifname "tailscale0" ip saddr @admin_ipv4 tcp dport { 22, 443 } counter accept comment "Admin SSH and HTTPS"
+        iifname "tailscale0" ip saddr 100.90.90.90 tcp dport 6379 counter accept comment "Server A to Redis"
+        iifname "tailscale0" ip saddr 100.90.90.90 udp dport 9060 counter accept comment "Server A to HEP"
+
+        counter drop
+    }
+}
diff --git a/infra/server-b/s03/nftables.conf b/infra/server-b/s03/nftables.conf
new file mode 100644
index 0000000..f820d0c
--- /dev/null
+++ b/infra/server-b/s03/nftables.conf
@@ -0,0 +1,2 @@
+#!/usr/sbin/nft -f
+include "/etc/nftables.d/lisglosips.nft"
diff --git a/infra/server-b/s03/tmpfiles.conf b/infra/server-b/s03/tmpfiles.conf
new file mode 100644
index 0000000..8186d75
--- /dev/null
+++ b/infra/server-b/s03/tmpfiles.conf
@@ -0,0 +1,3 @@
+d /run/lisglosips 0750 lisglosips lisglosips -
+d /run/lisglo-recorder 0750 lisglo-recorder lisglosips -
+d /run/lisglo-monitor 0750 lisglo-monitor lisglosips -
diff --git a/infra/server-b/s04/fstab-bind-mounts.txt b/infra/server-b/s04/fstab-bind-mounts.txt
new file mode 100644
index 0000000..8fc387b
--- /dev/null
+++ b/infra/server-b/s04/fstab-bind-mounts.txt
@@ -0,0 +1,3 @@
+# LisgloSIPS S04 data bind mounts
+/data/mysql /var/lib/mysql none bind 0 0
+/data/redis /var/lib/redis none bind 0 0
diff --git a/infra/server-b/s04/mysql/99-lisglosips.cnf b/infra/server-b/s04/mysql/99-lisglosips.cnf
new file mode 100644
index 0000000..fd78d6e
--- /dev/null
+++ b/infra/server-b/s04/mysql/99-lisglosips.cnf
@@ -0,0 +1,19 @@
+[mysqld]
+bind-address = 127.0.0.1
+mysqlx-bind-address = 127.0.0.1
+skip_name_resolve = ON
+local_infile = OFF
+server_id = 1
+log_bin = /var/log/mysql/mysql-bin
+binlog_format = ROW
+binlog_expire_logs_seconds = 604800
+sync_binlog = 1
+innodb_flush_log_at_trx_commit = 1
+innodb_buffer_pool_size = 1G
+max_connections = 200
+default_time_zone = +00:00
+character_set_server = utf8mb4
+collation_server = utf8mb4_0900_ai_ci
+slow_query_log = ON
+long_query_time = 1
+slow_query_log_file = /var/log/mysql/mysql-slow.log
diff --git a/infra/server-b/s04/redis/redis-lisglosips.conf b/infra/server-b/s04/redis/redis-lisglosips.conf
new file mode 100644
index 0000000..0893021
--- /dev/null
+++ b/infra/server-b/s04/redis/redis-lisglosips.conf
@@ -0,0 +1,20 @@
+bind 127.0.0.1 100.90.90.91
+protected-mode yes
+port 6379
+unixsocket /run/redis/redis-server.sock
+unixsocketperm 770
+dir /var/lib/redis
+dbfilename dump.rdb
+appendonly yes
+appendfilename "appendonly.aof"
+appenddirname "appendonlydir"
+appendfsync everysec
+save ""
+save 900 1
+save 300 10
+save 60 10000
+stop-writes-on-bgsave-error yes
+maxmemory 1536mb
+maxmemory-policy noeviction
+tcp-keepalive 60
+aclfile /etc/redis/users.acl
diff --git a/infra/server-b/s04/redis/users.acl.example b/infra/server-b/s04/redis/users.acl.example
new file mode 100644
index 0000000..6264eda
--- /dev/null
+++ b/infra/server-b/s04/redis/users.acl.example
@@ -0,0 +1,5 @@
+# Do not deploy this file as-is. Replace both placeholders with independent
+# generated secrets and install the result as /etc/redis/users.acl, mode 0640.
+user default off
+user lisglosips on >GENERATE_APP_SECRET ~* &* +@all -@dangerous
+user lisglo-backup on >GENERATE_BACKUP_SECRET ~* &* +ping +info +bgsave +lastsave
diff --git a/infra/server-b/s04/scripts/lisglosips-mysql-backup b/infra/server-b/s04/scripts/lisglosips-mysql-backup
new file mode 100755
index 0000000..973da64
--- /dev/null
+++ b/infra/server-b/s04/scripts/lisglosips-mysql-backup
@@ -0,0 +1,22 @@
+#!/bin/bash
+set -euo pipefail
+umask 077
+dest=/data/backups/mysql
+install -d -o root -g root -m 0700 "$dest"
+[ "$(realpath "$dest")" = "/data/backups/mysql" ] || exit 2
+exec 9>/run/lock/lisglosips-mysql-backup.lock
+flock -n 9 || { echo "MySQL backup already running" >&2; exit 3; }
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+tmp=$(mktemp -d "$dest/.tmp-$stamp.XXXXXX")
+trap 'rm -rf "$tmp"' EXIT
+mysqladmin --protocol=socket ping --silent
+mysqldump --protocol=socket --all-databases --single-transaction --routines --events --triggers --hex-blob --set-gtid-purged=OFF --no-tablespaces | gzip -9 > "$tmp/all-databases.sql.gz"
+mysqldump --protocol=socket --single-transaction --routines --events --triggers --hex-blob --set-gtid-purged=OFF --no-tablespaces lisglosips | gzip -9 > "$tmp/lisglosips.sql.gz"
+mysql --protocol=socket -N -e "SELECT @@version, @@global.gtid_executed, @@global.binlog_format, UTC_TIMESTAMP();" > "$tmp/metadata.tsv"
+(cd "$tmp" && sha256sum *.gz metadata.tsv > SHA256SUMS)
+chmod 0600 "$tmp"/*
+final="$dest/$stamp"
+mv "$tmp" "$final"
+trap - EXIT
+find "$dest" -mindepth 1 -maxdepth 1 -type d -name '20*T*Z' -mtime +14 -exec rm -rf -- {} +
+echo "$final"
diff --git a/infra/server-b/s04/scripts/lisglosips-redis-backup b/infra/server-b/s04/scripts/lisglosips-redis-backup
new file mode 100755
index 0000000..fadfb51
--- /dev/null
+++ b/infra/server-b/s04/scripts/lisglosips-redis-backup
@@ -0,0 +1,36 @@
+#!/bin/bash
+set -euo pipefail
+umask 077
+dest=/data/backups/redis
+install -d -o root -g root -m 0700 "$dest"
+[ "$(realpath "$dest")" = "/data/backups/redis" ] || exit 2
+exec 9>/run/lock/lisglosips-redis-backup.lock
+flock -n 9 || { echo "Redis backup already running" >&2; exit 3; }
+set -a
+. /etc/lisglosips/secrets/redis-backup.env
+set +a
+export REDISCLI_AUTH="$REDIS_PASSWORD"
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+tmp=$(mktemp -d "$dest/.tmp-$stamp.XXXXXX")
+trap 'rm -rf "$tmp"' EXIT
+redis_cmd=(redis-cli -h "$REDIS_HOST" -p "$REDIS_PORT" --user "$REDIS_USER" --no-auth-warning)
+"${redis_cmd[@]}" PING | grep -qx PONG
+"${redis_cmd[@]}" BGSAVE >/dev/null
+for _ in $(seq 1 60); do
+  info=$("${redis_cmd[@]}" INFO persistence | tr -d '\r')
+  in_progress=$(printf '%s\n' "$info" | awk -F: '/^rdb_bgsave_in_progress:/{print $2}')
+  status=$(printf '%s\n' "$info" | awk -F: '/^rdb_last_bgsave_status:/{print $2}')
+  [ "$in_progress" = "0" ] && [ "$status" = "ok" ] && break
+  sleep 1
+done
+[ "$in_progress" = "0" ] && [ "$status" = "ok" ]
+install -o root -g root -m 0600 /var/lib/redis/dump.rdb "$tmp/dump.rdb"
+redis-check-rdb "$tmp/dump.rdb" > "$tmp/redis-check-rdb.txt"
+"${redis_cmd[@]}" INFO server | tr -d '\r' | grep -E '^(redis_version|os|arch_bits|process_id|tcp_port)' > "$tmp/metadata.txt"
+(cd "$tmp" && sha256sum dump.rdb metadata.txt > SHA256SUMS)
+chmod 0600 "$tmp"/*
+final="$dest/$stamp"
+mv "$tmp" "$final"
+trap - EXIT
+find "$dest" -mindepth 1 -maxdepth 1 -type d -name '20*T*Z' -mtime +14 -exec rm -rf -- {} +
+echo "$final"
diff --git a/infra/server-b/s04/scripts/lisglosips-wait-tailscale-b b/infra/server-b/s04/scripts/lisglosips-wait-tailscale-b
new file mode 100755
index 0000000..5384973
--- /dev/null
+++ b/infra/server-b/s04/scripts/lisglosips-wait-tailscale-b
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+for _ in $(seq 1 60); do
+  if /usr/sbin/ip -4 -o addr show dev tailscale0 2>/dev/null | /usr/bin/grep -q '100.90.90.91/32'; then
+    exit 0
+  fi
+  /usr/bin/sleep 1
+done
+echo 'Tailscale address 100.90.90.91 not ready' >&2
+exit 1
diff --git a/infra/server-b/s04/systemd/lisglosips-backup.service b/infra/server-b/s04/systemd/lisglosips-backup.service
new file mode 100644
index 0000000..0036c9b
--- /dev/null
+++ b/infra/server-b/s04/systemd/lisglosips-backup.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=LisgloSIPS MySQL and Redis backup
+Requires=mysql.service redis-server.service
+After=mysql.service redis-server.service
+ConditionPathIsMountPoint=/var/lib/mysql
+ConditionPathIsMountPoint=/var/lib/redis
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+UMask=0077
+Nice=10
+IOSchedulingClass=idle
+ExecStart=/usr/local/sbin/lisglosips-mysql-backup
+ExecStart=/usr/local/sbin/lisglosips-redis-backup
diff --git a/infra/server-b/s04/systemd/lisglosips-backup.timer b/infra/server-b/s04/systemd/lisglosips-backup.timer
new file mode 100644
index 0000000..93bd6be
--- /dev/null
+++ b/infra/server-b/s04/systemd/lisglosips-backup.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Daily LisgloSIPS database backup
+
+[Timer]
+OnCalendar=*-*-* 03:15:00
+RandomizedDelaySec=15m
+Persistent=true
+Unit=lisglosips-backup.service
+
+[Install]
+WantedBy=timers.target
diff --git a/infra/server-b/s04/systemd/lisglosips-tailscale-ready.service b/infra/server-b/s04/systemd/lisglosips-tailscale-ready.service
new file mode 100644
index 0000000..1121f51
--- /dev/null
+++ b/infra/server-b/s04/systemd/lisglosips-tailscale-ready.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Wait for Server B Tailscale address
+Requires=tailscaled.service
+After=tailscaled.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/lisglosips-wait-tailscale-b
+RemainAfterExit=yes
diff --git a/infra/server-b/s04/systemd/mysql-storage.conf b/infra/server-b/s04/systemd/mysql-storage.conf
new file mode 100644
index 0000000..0d3bec1
--- /dev/null
+++ b/infra/server-b/s04/systemd/mysql-storage.conf
@@ -0,0 +1,3 @@
+[Unit]
+Requires=var-lib-mysql.mount
+After=var-lib-mysql.mount
diff --git a/infra/server-b/s04/systemd/redis-storage.conf b/infra/server-b/s04/systemd/redis-storage.conf
new file mode 100644
index 0000000..0af51b4
--- /dev/null
+++ b/infra/server-b/s04/systemd/redis-storage.conf
@@ -0,0 +1,3 @@
+[Unit]
+Requires=var-lib-redis.mount lisglosips-tailscale-ready.service
+After=var-lib-redis.mount lisglosips-tailscale-ready.service
diff --git a/infra/server-b/s04/versions.env b/infra/server-b/s04/versions.env
new file mode 100644
index 0000000..a56324e
--- /dev/null
+++ b/infra/server-b/s04/versions.env
@@ -0,0 +1,2 @@
+MYSQL_VERSION=8.0.46-0ubuntu0.24.04.2
+REDIS_VERSION=7.0.15-1ubuntu0.24.04.4
diff --git a/infra/server-b/s05/env/api.env.example b/infra/server-b/s05/env/api.env.example
new file mode 100644
index 0000000..520e33d
--- /dev/null
+++ b/infra/server-b/s05/env/api.env.example
@@ -0,0 +1,4 @@
+LISGLOSIPS_ENTRYPOINT=/opt/lisglosips/current/server.mjs
+HOST=127.0.0.1
+PORT=3000
+
diff --git a/infra/server-b/s05/nginx/lisglosips-global.conf b/infra/server-b/s05/nginx/lisglosips-global.conf
new file mode 100644
index 0000000..7f73c0d
--- /dev/null
+++ b/infra/server-b/s05/nginx/lisglosips-global.conf
@@ -0,0 +1,13 @@
+server_tokens off;
+
+limit_req_zone $binary_remote_addr zone=lisglosips_api_per_ip:10m rate=20r/s;
+limit_req_zone $binary_remote_addr zone=lisglosips_auth_per_ip:10m rate=5r/m;
+limit_conn_zone $binary_remote_addr zone=lisglosips_conn_per_ip:10m;
+limit_req_status 429;
+limit_conn_status 429;
+
+map $http_upgrade $lisglosips_connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
diff --git a/infra/server-b/s05/nginx/lisglosips-proxy.conf b/infra/server-b/s05/nginx/lisglosips-proxy.conf
new file mode 100644
index 0000000..0f9bc02
--- /dev/null
+++ b/infra/server-b/s05/nginx/lisglosips-proxy.conf
@@ -0,0 +1,15 @@
+proxy_http_version 1.1;
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Request-ID $request_id;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $lisglosips_connection_upgrade;
+proxy_connect_timeout 3s;
+proxy_send_timeout 30s;
+proxy_read_timeout 30s;
+proxy_buffering on;
+proxy_buffer_size 8k;
+proxy_buffers 8 16k;
+
diff --git a/infra/server-b/s05/nginx/lisglosips-security-headers.conf b/infra/server-b/s05/nginx/lisglosips-security-headers.conf
new file mode 100644
index 0000000..0d2473f
--- /dev/null
+++ b/infra/server-b/s05/nginx/lisglosips-security-headers.conf
@@ -0,0 +1,7 @@
+add_header Strict-Transport-Security "max-age=300" always;
+add_header X-Content-Type-Options "nosniff" always;
+add_header X-Frame-Options "DENY" always;
+add_header Referrer-Policy "same-origin" always;
+add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; object-src 'none'" always;
+
diff --git a/infra/server-b/s05/nginx/lisglosips-tls.conf b/infra/server-b/s05/nginx/lisglosips-tls.conf
new file mode 100644
index 0000000..f7678c6
--- /dev/null
+++ b/infra/server-b/s05/nginx/lisglosips-tls.conf
@@ -0,0 +1,8 @@
+ssl_certificate /etc/lisglosips/pki/certs/server.crt;
+ssl_certificate_key /etc/lisglosips/pki/private/server.key;
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_prefer_server_ciphers off;
+ssl_session_cache shared:LisgloSIPSTLS:10m;
+ssl_session_timeout 1d;
+ssl_session_tickets off;
+
diff --git a/infra/server-b/s05/nginx/lisglosips.conf b/infra/server-b/s05/nginx/lisglosips.conf
new file mode 100644
index 0000000..f7a3ac3
--- /dev/null
+++ b/infra/server-b/s05/nginx/lisglosips.conf
@@ -0,0 +1,68 @@
+upstream lisglosips_api {
+    server 127.0.0.1:3000 max_fails=3 fail_timeout=5s;
+    keepalive 32;
+}
+
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+    return 308 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    server_name _;
+
+    include /etc/nginx/snippets/lisglosips-tls.conf;
+
+    root /opt/lisglosips/current/public;
+    index index.html;
+    client_max_body_size 2m;
+    max_ranges 1;
+
+    include /etc/nginx/snippets/lisglosips-security-headers.conf;
+
+    limit_conn lisglosips_conn_per_ip 30;
+
+    location = /healthz {
+        include /etc/nginx/snippets/lisglosips-proxy.conf;
+        proxy_pass http://lisglosips_api;
+        access_log off;
+    }
+
+    location = /api/auth/login {
+        include /etc/nginx/snippets/lisglosips-proxy.conf;
+        limit_req zone=lisglosips_auth_per_ip burst=3 nodelay;
+        proxy_pass http://lisglosips_api;
+    }
+
+    location /api/ {
+        include /etc/nginx/snippets/lisglosips-proxy.conf;
+        limit_req zone=lisglosips_api_per_ip burst=40 nodelay;
+        proxy_pass http://lisglosips_api;
+    }
+
+    location /_recordings/ {
+        internal;
+        alias /data/recordings/;
+        autoindex off;
+        include /etc/nginx/snippets/lisglosips-security-headers.conf;
+        add_header Accept-Ranges bytes always;
+    }
+
+    location /assets/ {
+        try_files $uri =404;
+        expires 7d;
+        include /etc/nginx/snippets/lisglosips-security-headers.conf;
+        add_header Cache-Control "public, immutable";
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+        expires -1;
+        include /etc/nginx/snippets/lisglosips-security-headers.conf;
+        add_header Cache-Control "no-store";
+    }
+}
diff --git a/infra/server-b/s05/placeholder/public/index.html b/infra/server-b/s05/placeholder/public/index.html
new file mode 100644
index 0000000..6a8286c
--- /dev/null
+++ b/infra/server-b/s05/placeholder/public/index.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>LisgloSIPS</title>
+    <style>
+      :root { color-scheme: light; font-family: Arial, sans-serif; background: #f5f6f8; color: #12121a; }
+      body { margin: 0; min-height: 100vh; display: grid; place-items: center; }
+      main { width: min(560px, calc(100% - 48px)); border-top: 4px solid #d9c3a0; padding: 32px 0; }
+      h1 { margin: 0 0 12px; font-size: 32px; letter-spacing: 0; }
+      p { margin: 0; color: #5d606b; line-height: 1.7; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>LisgloSIPS</h1>
+      <p>聆界SIP管理平台服务入口已就绪。</p>
+    </main>
+  </body>
+</html>
+
diff --git a/infra/server-b/s05/placeholder/server.mjs b/infra/server-b/s05/placeholder/server.mjs
new file mode 100644
index 0000000..5616840
--- /dev/null
+++ b/infra/server-b/s05/placeholder/server.mjs
@@ -0,0 +1,30 @@
+import { createServer } from 'node:http';
+
+const host = process.env.HOST || '127.0.0.1';
+const port = Number.parseInt(process.env.PORT || '3000', 10);
+
+const server = createServer((request, response) => {
+  response.setHeader('Content-Type', 'application/json; charset=utf-8');
+  response.setHeader('Cache-Control', 'no-store');
+  response.setHeader('X-Content-Type-Options', 'nosniff');
+
+  if (request.method === 'GET' && (request.url === '/healthz' || request.url === '/api/health')) {
+    response.writeHead(200);
+    response.end(JSON.stringify({ status: 'ok', service: 'lisglosips-api-placeholder' }));
+    return;
+  }
+
+  response.writeHead(404);
+  response.end(JSON.stringify({ status: 'not_found' }));
+});
+
+server.listen(port, host);
+
+function shutdown() {
+  server.close((error) => process.exit(error ? 1 : 0));
+  setTimeout(() => process.exit(1), 10_000).unref();
+}
+
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
+
diff --git a/infra/server-b/s05/scripts/lisglosips-issue-dev-cert b/infra/server-b/s05/scripts/lisglosips-issue-dev-cert
new file mode 100755
index 0000000..405439f
--- /dev/null
+++ b/infra/server-b/s05/scripts/lisglosips-issue-dev-cert
@@ -0,0 +1,72 @@
+#!/bin/sh
+set -eu
+
+PKI_ROOT=/etc/lisglosips/pki
+CA_DIR="$PKI_ROOT/ca"
+CERT_DIR="$PKI_ROOT/certs"
+PRIVATE_DIR="$PKI_ROOT/private"
+HOST_NAME=${HOST_NAME:-yanzi}
+TAILSCALE_IP=${TAILSCALE_IP:-100.90.90.91}
+
+umask 077
+install -d -m 0700 "$CA_DIR"
+install -d -m 0755 "$CERT_DIR"
+install -d -m 0700 "$PRIVATE_DIR"
+
+if [ ! -s "$CA_DIR/lisglosips-dev-ca.key" ] || [ ! -s "$CA_DIR/lisglosips-dev-ca.crt" ]; then
+  openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
+    -subj '/CN=LisgloSIPS Development CA/O=LisgloSIPS' \
+    -keyout "$CA_DIR/lisglosips-dev-ca.key" \
+    -out "$CA_DIR/lisglosips-dev-ca.crt"
+fi
+
+cat >"$PKI_ROOT/server-cert.cnf" <<EOF
+[req]
+prompt = no
+distinguished_name = dn
+req_extensions = req_ext
+
+[dn]
+CN = lisglosips.local
+O = LisgloSIPS
+
+[req_ext]
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = lisglosips.local
+DNS.2 = $HOST_NAME
+DNS.3 = grafana.lisglosips.local
+DNS.4 = homer.lisglosips.local
+IP.1 = $TAILSCALE_IP
+IP.2 = 127.0.0.1
+
+[server_ext]
+basicConstraints = critical,CA:FALSE
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+EOF
+
+openssl req -new -newkey rsa:3072 -nodes -sha256 \
+  -config "$PKI_ROOT/server-cert.cnf" \
+  -keyout "$PRIVATE_DIR/server.key" \
+  -out "$PKI_ROOT/server.csr"
+
+openssl x509 -req -sha256 -days 397 \
+  -in "$PKI_ROOT/server.csr" \
+  -CA "$CA_DIR/lisglosips-dev-ca.crt" \
+  -CAkey "$CA_DIR/lisglosips-dev-ca.key" \
+  -CAcreateserial \
+  -extfile "$PKI_ROOT/server-cert.cnf" \
+  -extensions server_ext \
+  -out "$CERT_DIR/server.crt"
+
+chown root:root "$CA_DIR/lisglosips-dev-ca.key" "$PKI_ROOT/server.csr" "$PKI_ROOT/server-cert.cnf"
+chown root:www-data "$PRIVATE_DIR/server.key"
+chown root:root "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"
+chmod 0600 "$CA_DIR/lisglosips-dev-ca.key" "$PKI_ROOT/server.csr" "$PKI_ROOT/server-cert.cnf"
+chmod 0640 "$PRIVATE_DIR/server.key"
+chmod 0644 "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"
+
+openssl verify -CAfile "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"
diff --git a/infra/server-b/s05/systemd/lisglosips@.service b/infra/server-b/s05/systemd/lisglosips@.service
new file mode 100644
index 0000000..21c8cb0
--- /dev/null
+++ b/infra/server-b/s05/systemd/lisglosips@.service
@@ -0,0 +1,42 @@
+[Unit]
+Description=LisgloSIPS %i service
+After=network-online.target mysql.service redis-server.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=lisglosips
+Group=lisglosips
+WorkingDirectory=/opt/lisglosips/current
+Environment=NODE_ENV=production
+EnvironmentFile=/etc/lisglosips/%i.env
+ExecStart=/usr/bin/node ${LISGLOSIPS_ENTRYPOINT}
+Restart=on-failure
+RestartSec=3s
+TimeoutStartSec=30s
+TimeoutStopSec=30s
+KillSignal=SIGTERM
+UMask=0027
+
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+StateDirectory=lisglosips
+RuntimeDirectory=lisglosips
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/infra/server-b/s05/versions.env b/infra/server-b/s05/versions.env
new file mode 100644
index 0000000..a691ac8
--- /dev/null
+++ b/infra/server-b/s05/versions.env
@@ -0,0 +1,6 @@
+NODEJS_VERSION=22.22.2-1nodesource1
+NODEJS_RUNTIME=v22.22.2
+PNPM_VERSION=10.33.0
+COREPACK_VERSION=0.34.6
+NGINX_VERSION=1.24.0-2ubuntu7.12
+
diff --git a/infra/server-b/s06/apt/grafana-package.env b/infra/server-b/s06/apt/grafana-package.env
new file mode 100644
index 0000000..8d291bd
--- /dev/null
+++ b/infra/server-b/s06/apt/grafana-package.env
@@ -0,0 +1,5 @@
+GRAFANA_VERSION=13.0.2
+GRAFANA_PACKAGE=grafana_13.0.2_26816849631_linux_amd64.deb
+GRAFANA_SHA256=ce64458852e49b897cabe7dee32741c9cf1bb623092ee4c6f7250aa7c6b83453
+GRAFANA_MIRROR=https://mirrors.tuna.tsinghua.edu.cn/grafana/apt
+
diff --git a/infra/server-b/s06/docker/daemon.json b/infra/server-b/s06/docker/daemon.json
new file mode 100644
index 0000000..791f493
--- /dev/null
+++ b/infra/server-b/s06/docker/daemon.json
@@ -0,0 +1,12 @@
+{
+  "registry-mirrors": [
+    "https://docker.m.daocloud.io"
+  ],
+  "live-restore": true,
+  "log-driver": "local",
+  "log-opts": {
+    "max-size": "20m",
+    "max-file": "3"
+  },
+  "no-new-privileges": true
+}
diff --git a/infra/server-b/s06/grafana/dashboards.yml b/infra/server-b/s06/grafana/dashboards.yml
new file mode 100644
index 0000000..4135114
--- /dev/null
+++ b/infra/server-b/s06/grafana/dashboards.yml
@@ -0,0 +1,12 @@
+apiVersion: 1
+
+providers:
+  - name: LisgloSIPS
+    orgId: 1
+    folder: LisgloSIPS
+    type: file
+    disableDeletion: true
+    editable: false
+    options:
+      path: /etc/grafana/provisioning/dashboards/lisglosips
+
diff --git a/infra/server-b/s06/grafana/datasources.yml b/infra/server-b/s06/grafana/datasources.yml
new file mode 100644
index 0000000..917aacf
--- /dev/null
+++ b/infra/server-b/s06/grafana/datasources.yml
@@ -0,0 +1,32 @@
+apiVersion: 1
+
+deleteDatasources:
+  - name: Prometheus
+    orgId: 1
+  - name: HOMER PostgreSQL
+    orgId: 1
+
+datasources:
+  - name: Prometheus
+    uid: lisglosips-prometheus
+    type: prometheus
+    access: proxy
+    url: http://127.0.0.1:9090
+    isDefault: true
+    editable: false
+
+  - name: HOMER PostgreSQL
+    uid: lisglosips-homer-postgres
+    type: postgres
+    access: proxy
+    url: 127.0.0.1:5432
+    user: homer_user
+    database: homer_data
+    editable: false
+    jsonData:
+      sslmode: disable
+      postgresVersion: 1600
+      timescaledb: false
+    secureJsonData:
+      password: $HOMER_DB_PASSWORD
+
diff --git a/infra/server-b/s06/grafana/grafana-server.default b/infra/server-b/s06/grafana/grafana-server.default
new file mode 100644
index 0000000..3785ffa
--- /dev/null
+++ b/infra/server-b/s06/grafana/grafana-server.default
@@ -0,0 +1,13 @@
+GRAFANA_USER=grafana
+GRAFANA_GROUP=grafana
+GRAFANA_HOME=/usr/share/grafana
+LOG_DIR=/var/log/grafana
+DATA_DIR=/data/grafana
+MAX_OPEN_FILES=10000
+CONF_DIR=/etc/grafana
+CONF_FILE=/etc/grafana/grafana.ini
+RESTART_ON_UPGRADE=true
+PLUGINS_DIR=/data/grafana/plugins
+PROVISIONING_CFG_DIR=/etc/grafana/provisioning
+PID_FILE_DIR=/run/grafana
+
diff --git a/infra/server-b/s06/grafana/lisglosips-overview.json b/infra/server-b/s06/grafana/lisglosips-overview.json
new file mode 100644
index 0000000..7063ecc
--- /dev/null
+++ b/infra/server-b/s06/grafana/lisglosips-overview.json
@@ -0,0 +1,35 @@
+{
+  "annotations": {"list": []},
+  "editable": false,
+  "panels": [
+    {
+      "type": "stat",
+      "title": "Targets Up",
+      "datasource": {"type": "prometheus", "uid": "lisglosips-prometheus"},
+      "targets": [{"expr": "sum(up)", "refId": "A"}],
+      "gridPos": {"h": 8, "w": 8, "x": 0, "y": 0}
+    },
+    {
+      "type": "timeseries",
+      "title": "A/B CPU Usage",
+      "datasource": {"type": "prometheus", "uid": "lisglosips-prometheus"},
+      "targets": [{"expr": "100 - avg by (server) (rate(node_cpu_seconds_total{mode=\"idle\"}[5m])) * 100", "legendFormat": "{{server}}", "refId": "A"}],
+      "gridPos": {"h": 8, "w": 16, "x": 8, "y": 0}
+    },
+    {
+      "type": "timeseries",
+      "title": "A/B Memory Usage",
+      "datasource": {"type": "prometheus", "uid": "lisglosips-prometheus"},
+      "targets": [{"expr": "100 * (1 - node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)", "legendFormat": "{{server}}", "refId": "A"}],
+      "gridPos": {"h": 8, "w": 24, "x": 0, "y": 8}
+    }
+  ],
+  "schemaVersion": 41,
+  "tags": ["lisglosips", "infrastructure"],
+  "templating": {"list": []},
+  "time": {"from": "now-1h", "to": "now"},
+  "title": "LisgloSIPS Infrastructure Overview",
+  "uid": "lisglosips-infra-overview",
+  "version": 1
+}
+
diff --git a/infra/server-b/s06/heplify/heplify.env.example b/infra/server-b/s06/heplify/heplify.env.example
new file mode 100644
index 0000000..2aeb198
--- /dev/null
+++ b/infra/server-b/s06/heplify/heplify.env.example
@@ -0,0 +1,23 @@
+HEPLIFYSERVER_HEPADDR=100.90.90.91:9060
+HEPLIFYSERVER_HEPTCPADDR=
+HEPLIFYSERVER_HEPTLSADDR=
+HEPLIFYSERVER_DBSHEMA=homer7
+HEPLIFYSERVER_DBDRIVER=postgres
+HEPLIFYSERVER_DBADDR=127.0.0.1:5432
+HEPLIFYSERVER_DBUSER=homer_user
+HEPLIFYSERVER_DBPASS=<HOMER_DB_PASSWORD>
+HEPLIFYSERVER_DBDATATABLE=homer_data
+HEPLIFYSERVER_DBCONFTABLE=homer_config
+HEPLIFYSERVER_DBDROPDAYS=7
+HEPLIFYSERVER_DBROTATE=true
+HEPLIFYSERVER_DBBUFFER=200000
+HEPLIFYSERVER_DBBULK=200
+HEPLIFYSERVER_DBWORKER=4
+HEPLIFYSERVER_DBTIMER=2
+HEPLIFYSERVER_LOGLVL=info
+HEPLIFYSERVER_LOGSTD=true
+HEPLIFYSERVER_PROMADDR=127.0.0.1:9096
+HEPLIFYSERVER_PROMTARGETIP=100.90.90.91
+HEPLIFYSERVER_PROMTARGETNAME=server-b
+HEPLIFYSERVER_DEDUP=false
+
diff --git a/infra/server-b/s06/homer/index.html b/infra/server-b/s06/homer/index.html
new file mode 100644
index 0000000..7b0b1d9
--- /dev/null
+++ b/infra/server-b/s06/homer/index.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>LisgloSIPS HOMER</title>
+  </head>
+  <body>
+    <main>
+      <h1>LisgloSIPS HOMER</h1>
+      <p>HOMER API 与 HEP 存储服务已就绪。</p>
+    </main>
+  </body>
+</html>
+
diff --git a/infra/server-b/s06/homer/webapp_config.json.example b/infra/server-b/s06/homer/webapp_config.json.example
new file mode 100644
index 0000000..7f89390
--- /dev/null
+++ b/infra/server-b/s06/homer/webapp_config.json.example
@@ -0,0 +1,73 @@
+{
+  "database_data": {
+    "LocalNode": {
+      "node": "LocalNode",
+      "user": "homer_user",
+      "pass": "<HOMER_DB_PASSWORD>",
+      "name": "homer_data",
+      "keepalive": true,
+      "host": "127.0.0.1"
+    }
+  },
+  "database_config": {
+    "node": "LocalConfig",
+    "user": "homer_user",
+    "pass": "<HOMER_DB_PASSWORD>",
+    "name": "homer_config",
+    "keepalive": true,
+    "host": "127.0.0.1"
+  },
+  "hep_relay": {
+    "host": "100.90.90.91",
+    "port": 9060
+  },
+  "prometheus_config": {
+    "enable": true,
+    "host": "http://127.0.0.1:9090",
+    "api": "api/v1"
+  },
+  "influxdb_config": {
+    "enable": false
+  },
+  "loki_config": {
+    "enable": false
+  },
+  "grafana_config": {
+    "enable": true,
+    "host": "http://127.0.0.1:3001",
+    "path": "grafana",
+    "proxy_control": false
+  },
+  "http_settings": {
+    "host": "127.0.0.1",
+    "port": 9080,
+    "root": "/usr/local/homer/dist",
+    "gzip": false,
+    "gzip_static": false,
+    "path": "/",
+    "debug": false
+  },
+  "swagger": {
+    "enable": true,
+    "api_json": "/etc/homer/swagger.json",
+    "api_host": "homer.lisglosips.local"
+  },
+  "system_settings": {
+    "logpath": "/var/log/homer",
+    "logname": "homer-app.log",
+    "loglevel": "info",
+    "logstdout": true
+  },
+  "auth_settings": {
+    "type": "internal",
+    "jwt_secret": "<HOMER_JWT_SECRET>",
+    "gravatar": false,
+    "token_expire": 1200,
+    "user_groups": ["admin", "user", "support"]
+  },
+  "api_settings": {
+    "enable_token_access": false,
+    "add_captid_to_resolve": false
+  }
+}
+
diff --git a/infra/server-b/s06/nginx/monitoring.conf b/infra/server-b/s06/nginx/monitoring.conf
new file mode 100644
index 0000000..20719f3
--- /dev/null
+++ b/infra/server-b/s06/nginx/monitoring.conf
@@ -0,0 +1,34 @@
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name grafana.lisglosips.local;
+
+    include /etc/nginx/snippets/lisglosips-tls.conf;
+    add_header Strict-Transport-Security "max-age=300" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "same-origin" always;
+
+    location / {
+        include /etc/nginx/snippets/lisglosips-proxy.conf;
+        proxy_pass http://127.0.0.1:3001;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name homer.lisglosips.local;
+
+    include /etc/nginx/snippets/lisglosips-tls.conf;
+    add_header Strict-Transport-Security "max-age=300" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "same-origin" always;
+
+    location / {
+        include /etc/nginx/snippets/lisglosips-proxy.conf;
+        proxy_pass http://127.0.0.1:9080;
+    }
+}
+
diff --git a/infra/server-b/s06/postgresql/lisglosips-homer.conf b/infra/server-b/s06/postgresql/lisglosips-homer.conf
new file mode 100644
index 0000000..c52f584
--- /dev/null
+++ b/infra/server-b/s06/postgresql/lisglosips-homer.conf
@@ -0,0 +1,24 @@
+data_directory = '/data/homer/postgresql'
+listen_addresses = '127.0.0.1'
+port = 5432
+password_encryption = 'scram-sha-256'
+timezone = 'UTC'
+log_timezone = 'UTC'
+
+max_connections = 100
+shared_buffers = '512MB'
+effective_cache_size = '2GB'
+maintenance_work_mem = '128MB'
+work_mem = '8MB'
+min_wal_size = '256MB'
+max_wal_size = '2GB'
+checkpoint_completion_target = 0.9
+random_page_cost = 1.1
+
+logging_collector = on
+log_directory = '/var/log/postgresql'
+log_filename = 'postgresql-homer-%Y-%m-%d.log'
+log_rotation_age = '1d'
+log_truncate_on_rotation = on
+log_min_duration_statement = 1000
+
diff --git a/infra/server-b/s06/prometheus/node-exporter-b.env b/infra/server-b/s06/prometheus/node-exporter-b.env
new file mode 100644
index 0000000..4cf8df5
--- /dev/null
+++ b/infra/server-b/s06/prometheus/node-exporter-b.env
@@ -0,0 +1,2 @@
+ARGS=--web.listen-address=127.0.0.1:9100 --collector.systemd --collector.processes
+
diff --git a/infra/server-b/s06/prometheus/prometheus.env b/infra/server-b/s06/prometheus/prometheus.env
new file mode 100644
index 0000000..ee71b97
--- /dev/null
+++ b/infra/server-b/s06/prometheus/prometheus.env
@@ -0,0 +1,2 @@
+ARGS=--config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/data/prometheus --storage.tsdb.retention.time=15d --storage.tsdb.retention.size=10GB --web.listen-address=127.0.0.1:9090 --web.enable-lifecycle
+
diff --git a/infra/server-b/s06/prometheus/prometheus.yml b/infra/server-b/s06/prometheus/prometheus.yml
new file mode 100644
index 0000000..8e090c7
--- /dev/null
+++ b/infra/server-b/s06/prometheus/prometheus.yml
@@ -0,0 +1,40 @@
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+  external_labels:
+    environment: development
+    platform: lisglosips
+
+rule_files:
+  - /etc/prometheus/rules/*.yml
+
+scrape_configs:
+  - job_name: prometheus
+    static_configs:
+      - targets: ["127.0.0.1:9090"]
+
+  - job_name: node
+    static_configs:
+      - targets: ["100.90.90.90:9100"]
+        labels:
+          server: server-a
+      - targets: ["127.0.0.1:9100"]
+        labels:
+          server: server-b
+
+  - job_name: mysql
+    static_configs:
+      - targets: ["127.0.0.1:9104"]
+
+  - job_name: postgresql_homer
+    static_configs:
+      - targets: ["127.0.0.1:9187"]
+
+  - job_name: redis
+    static_configs:
+      - targets: ["127.0.0.1:9121"]
+
+  - job_name: heplify_server
+    static_configs:
+      - targets: ["127.0.0.1:9096"]
+
diff --git a/infra/server-b/s06/prometheus/rules/lisglosips.yml b/infra/server-b/s06/prometheus/rules/lisglosips.yml
new file mode 100644
index 0000000..12e0755
--- /dev/null
+++ b/infra/server-b/s06/prometheus/rules/lisglosips.yml
@@ -0,0 +1,19 @@
+groups:
+  - name: lisglosips-base
+    rules:
+      - alert: LisgloSIPSTargetDown
+        expr: up == 0
+        for: 2m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Prometheus target {{ $labels.instance }} is down"
+
+      - alert: LisgloSIPSDiskLow
+        expr: 100 * node_filesystem_avail_bytes{fstype!~"tmpfs|overlay"} / node_filesystem_size_bytes{fstype!~"tmpfs|overlay"} < 15
+        for: 10m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Disk free space below 15% on {{ $labels.instance }}"
+
diff --git a/infra/server-b/s06/scripts/configure-s06 b/infra/server-b/s06/scripts/configure-s06
new file mode 100755
index 0000000..528a11d
--- /dev/null
+++ b/infra/server-b/s06/scripts/configure-s06
@@ -0,0 +1,187 @@
+#!/bin/bash
+set -euo pipefail
+
+: "${HOMER_DB_PASSWORD:?missing HOMER_DB_PASSWORD}"
+: "${HOMER_UI_PASSWORD:?missing HOMER_UI_PASSWORD}"
+: "${HOMER_JWT_SECRET:?missing HOMER_JWT_SECRET}"
+: "${GRAFANA_ADMIN_PASSWORD:?missing GRAFANA_ADMIN_PASSWORD}"
+: "${MYSQL_EXPORTER_PASSWORD:?missing MYSQL_EXPORTER_PASSWORD}"
+: "${REDIS_EXPORTER_PASSWORD:?missing REDIS_EXPORTER_PASSWORD}"
+: "${POSTGRES_EXPORTER_PASSWORD:?missing POSTGRES_EXPORTER_PASSWORD}"
+
+STAGE=${STAGE:-/tmp/lisglosips-s06-stage-202606202230}
+BUILD=/var/tmp/lisglosips-s06-go-20260620/bin
+HOMER_SOURCE=/var/tmp/lisglosips-s06-go-20260620/pkg/mod/github.com/sipcapture/homer-app@v0.0.0-20251021161517-9b1336352aa0
+
+test -d "$STAGE/systemd"
+
+export DEBIAN_FRONTEND=noninteractive
+systemctl mask prometheus-postgres-exporter.service 2>/dev/null || true
+apt-get install -y prometheus-postgres-exporter=0.15.0-1ubuntu0.3
+apt-mark hold prometheus-postgres-exporter >/dev/null
+
+for account in homer heplify redis-exporter; do
+  if ! getent passwd "$account" >/dev/null; then
+    useradd --system --home-dir /nonexistent --no-create-home --shell /usr/sbin/nologin "$account"
+  fi
+done
+
+install -o root -g root -m 0755 "$BUILD/heplify-server" /usr/local/bin/heplify-server
+install -o root -g root -m 0755 "$BUILD/homer-app" /usr/local/bin/homer-app
+install -o root -g root -m 0755 "$BUILD/redis_exporter" /usr/local/bin/redis_exporter
+install -o root -g root -m 0644 "$STAGE/versions.env" /etc/lisglosips/monitoring-versions.env
+
+systemctl stop postgresql.service
+chown root:postgres /data/homer
+chmod 0750 /data/homer
+install -d -o postgres -g postgres -m 0700 /data/homer/postgresql
+if [ -z "$(find /data/homer/postgresql -mindepth 1 -maxdepth 1 -print -quit)" ]; then
+  rsync -aHAX /var/lib/postgresql/16/main/ /data/homer/postgresql/
+fi
+chown -R postgres:postgres /data/homer/postgresql
+chmod 0700 /data/homer/postgresql
+install -d -o root -g postgres -m 0750 /etc/postgresql/16/main/conf.d
+install -o root -g postgres -m 0640 "$STAGE/postgresql/lisglosips-homer.conf" /etc/postgresql/16/main/conf.d/lisglosips-homer.conf
+grep -Eq "^[[:space:]]*include_dir[[:space:]]*=[[:space:]]*'conf.d'" /etc/postgresql/16/main/postgresql.conf
+systemctl start postgresql.service
+pg_isready -h 127.0.0.1 -p 5432
+
+runuser -u postgres -- psql -v ON_ERROR_STOP=1 -v homer_pw="$HOMER_DB_PASSWORD" -v exporter_pw="$POSTGRES_EXPORTER_PASSWORD" <<'SQL'
+SELECT format('CREATE ROLE homer_user LOGIN PASSWORD %L', :'homer_pw')
+WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'homer_user') \gexec
+SELECT format('ALTER ROLE homer_user LOGIN PASSWORD %L', :'homer_pw') \gexec
+SELECT 'CREATE DATABASE homer_config OWNER homer_user'
+WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'homer_config') \gexec
+SELECT 'CREATE DATABASE homer_data OWNER homer_user'
+WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'homer_data') \gexec
+SELECT format('CREATE ROLE postgres_exporter LOGIN PASSWORD %L', :'exporter_pw')
+WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'postgres_exporter') \gexec
+SELECT format('ALTER ROLE postgres_exporter LOGIN PASSWORD %L', :'exporter_pw') \gexec
+GRANT pg_monitor TO postgres_exporter;
+SQL
+
+mysql --protocol=socket <<SQL
+CREATE USER IF NOT EXISTS 'mysqld_exporter'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '$MYSQL_EXPORTER_PASSWORD';
+ALTER USER 'mysqld_exporter'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '$MYSQL_EXPORTER_PASSWORD';
+GRANT PROCESS, REPLICATION CLIENT ON *.* TO 'mysqld_exporter'@'127.0.0.1';
+GRANT SELECT ON performance_schema.* TO 'mysqld_exporter'@'127.0.0.1';
+FLUSH PRIVILEGES;
+SQL
+
+sed -i '/^user redis_exporter /d' /etc/redis/users.acl
+printf 'user redis_exporter on >%s ~* -@all +ping +info +client +config|get +latency +memory +select +slowlog +scan +type +strlen +llen +scard +zcard +xlen +hscan +sscan +zscan +get\n' "$REDIS_EXPORTER_PASSWORD" >>/etc/redis/users.acl
+chown root:redis /etc/redis/users.acl
+chmod 0640 /etc/redis/users.acl
+systemctl restart redis-server.service
+
+install -d -o root -g root -m 0755 /etc/lisglosips/secrets
+sed "s/<HOMER_DB_PASSWORD>/$HOMER_DB_PASSWORD/g" "$STAGE/heplify/heplify.env.example" >/etc/lisglosips/secrets/heplify.env
+chown root:heplify /etc/lisglosips/secrets/heplify.env
+chmod 0640 /etc/lisglosips/secrets/heplify.env
+
+cat >/etc/lisglosips/secrets/grafana.env <<EOF
+GF_SECURITY_ADMIN_USER=admin
+GF_SECURITY_ADMIN_PASSWORD=$GRAFANA_ADMIN_PASSWORD
+GF_USERS_ALLOW_SIGN_UP=false
+GF_AUTH_ANONYMOUS_ENABLED=false
+GF_SERVER_HTTP_ADDR=127.0.0.1
+GF_SERVER_HTTP_PORT=3001
+GF_SERVER_DOMAIN=grafana.lisglosips.local
+GF_SERVER_ROOT_URL=https://grafana.lisglosips.local/
+GF_SECURITY_COOKIE_SECURE=true
+GF_SECURITY_COOKIE_SAMESITE=strict
+GF_SECURITY_DISABLE_GRAVATAR=true
+GF_ANALYTICS_REPORTING_ENABLED=false
+GF_ANALYTICS_CHECK_FOR_UPDATES=false
+GF_PLUGINS_PREINSTALL_DISABLED=true
+GF_PLUGINS_CHECK_FOR_PLUGIN_UPDATES=false
+GF_PLUGINS_PLUGIN_ADMIN_ENABLED=false
+HOMER_DB_PASSWORD=$HOMER_DB_PASSWORD
+EOF
+chown root:grafana /etc/lisglosips/secrets/grafana.env
+chmod 0640 /etc/lisglosips/secrets/grafana.env
+
+cat >/etc/prometheus/mysqld-exporter.cnf <<EOF
+[client]
+user=mysqld_exporter
+password=$MYSQL_EXPORTER_PASSWORD
+host=127.0.0.1
+port=3306
+EOF
+chown root:prometheus /etc/prometheus/mysqld-exporter.cnf
+chmod 0640 /etc/prometheus/mysqld-exporter.cnf
+
+cat >/etc/lisglosips/secrets/postgres-exporter.env <<EOF
+DATA_SOURCE_NAME=postgresql://postgres_exporter:$POSTGRES_EXPORTER_PASSWORD@127.0.0.1:5432/postgres?sslmode=disable
+EOF
+chown root:prometheus /etc/lisglosips/secrets/postgres-exporter.env
+chmod 0640 /etc/lisglosips/secrets/postgres-exporter.env
+
+cat >/etc/lisglosips/secrets/redis-exporter.env <<EOF
+REDIS_ADDR=redis://127.0.0.1:6379
+REDIS_USER=redis_exporter
+REDIS_PASSWORD=$REDIS_EXPORTER_PASSWORD
+REDIS_EXPORTER_WEB_LISTEN_ADDRESS=127.0.0.1:9121
+EOF
+chown root:redis-exporter /etc/lisglosips/secrets/redis-exporter.env
+chmod 0640 /etc/lisglosips/secrets/redis-exporter.env
+
+install -d -o root -g homer -m 0750 /etc/homer
+sed -e "s/<HOMER_DB_PASSWORD>/$HOMER_DB_PASSWORD/g" -e "s/<HOMER_JWT_SECRET>/$HOMER_JWT_SECRET/g" "$STAGE/homer/webapp_config.json.example" >/etc/homer/webapp_config.json
+install -o root -g homer -m 0640 "$HOMER_SOURCE/swagger.json" /etc/homer/swagger.json
+chown homer:homer /etc/homer/webapp_config.json
+chmod 0600 /etc/homer/webapp_config.json
+install -d -o root -g homer -m 0750 /usr/local/homer/dist
+install -o root -g homer -m 0640 "$STAGE/homer/index.html" /usr/local/homer/dist/index.html
+install -d -o homer -g homer -m 0750 /var/log/homer
+
+install -d -o prometheus -g prometheus -m 0750 /data/prometheus
+install -d -o root -g prometheus -m 0750 /etc/prometheus/rules
+install -o root -g prometheus -m 0640 "$STAGE/prometheus/prometheus.yml" /etc/prometheus/prometheus.yml
+install -o root -g prometheus -m 0640 "$STAGE/prometheus/rules/lisglosips.yml" /etc/prometheus/rules/lisglosips.yml
+install -o root -g prometheus -m 0640 "$STAGE/prometheus/prometheus.env" /etc/default/lisglosips-prometheus
+install -o root -g prometheus -m 0640 "$STAGE/prometheus/node-exporter-b.env" /etc/default/lisglosips-node-exporter
+promtool check config /etc/prometheus/prometheus.yml
+promtool check rules /etc/prometheus/rules/lisglosips.yml
+
+install -d -o grafana -g grafana -m 0750 /data/grafana /data/grafana/plugins
+install -o root -g root -m 0644 "$STAGE/grafana/grafana-server.default" /etc/default/grafana-server
+install -d -o root -g grafana -m 0750 /etc/grafana/provisioning/datasources /etc/grafana/provisioning/dashboards /etc/grafana/provisioning/dashboards/lisglosips
+install -o root -g grafana -m 0640 "$STAGE/grafana/datasources.yml" /etc/grafana/provisioning/datasources/lisglosips.yml
+install -o root -g grafana -m 0640 "$STAGE/grafana/dashboards.yml" /etc/grafana/provisioning/dashboards/lisglosips.yml
+install -o root -g grafana -m 0640 "$STAGE/grafana/lisglosips-overview.json" /etc/grafana/provisioning/dashboards/lisglosips/lisglosips-overview.json
+
+for unit in heplify-server homer-app lisglosips-prometheus lisglosips-node-exporter lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter; do
+  install -o root -g root -m 0644 "$STAGE/systemd/$unit.service" "/etc/systemd/system/$unit.service"
+done
+install -d -o root -g root -m 0755 /etc/systemd/system/grafana-server.service.d
+install -o root -g root -m 0644 "$STAGE/systemd/grafana-override.conf" /etc/systemd/system/grafana-server.service.d/lisglosips.conf
+systemctl unmask grafana-server.service
+
+install -o root -g root -m 0644 "$STAGE/nginx/monitoring.conf" /etc/nginx/sites-available/lisglosips-monitoring.conf
+ln -sfn /etc/nginx/sites-available/lisglosips-monitoring.conf /etc/nginx/sites-enabled/lisglosips-monitoring.conf
+install -o root -g root -m 0755 /tmp/lisglosips-issue-dev-cert.s06 /usr/local/sbin/lisglosips-issue-dev-cert
+rm -f /tmp/lisglosips-issue-dev-cert.s06
+/usr/local/sbin/lisglosips-issue-dev-cert >/dev/null 2>&1
+nginx -t
+
+runuser -u homer -- /usr/local/bin/homer-app -webapp-config-path=/etc/homer -create-table-db-config >/var/log/homer/init-config.log 2>&1
+runuser -u homer -- /usr/local/bin/homer-app -webapp-config-path=/etc/homer -populate-table-db-config -force-password="$HOMER_UI_PASSWORD" >>/var/log/homer/init-config.log 2>&1
+chmod 0640 /var/log/homer/init-config.log
+
+systemctl daemon-reload
+systemctl disable --now prometheus-node-exporter.service prometheus-node-exporter.socket 2>/dev/null || true
+systemctl mask prometheus-node-exporter.service 2>/dev/null || true
+systemctl disable --now openipmi.service 2>/dev/null || true
+systemctl mask openipmi.service 2>/dev/null || true
+systemctl enable --now heplify-server.service homer-app.service lisglosips-node-exporter.service lisglosips-mysqld-exporter.service lisglosips-postgres-exporter.service lisglosips-redis-exporter.service lisglosips-prometheus.service grafana-server.service
+systemctl reload nginx.service
+
+sleep 5
+for unit in postgresql heplify-server homer-app lisglosips-node-exporter lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter lisglosips-prometheus grafana-server nginx; do
+  systemctl is-active "$unit" >/dev/null
+done
+curl -fsS http://127.0.0.1:9090/-/ready
+curl -fsS http://127.0.0.1:3001/api/health
+curl -fsS http://127.0.0.1:9096/metrics >/dev/null
+printf 'S06_SERVER_B_CONFIG=PASS\n'
diff --git a/infra/server-b/s06/systemd/grafana-override.conf b/infra/server-b/s06/systemd/grafana-override.conf
new file mode 100644
index 0000000..eced97c
--- /dev/null
+++ b/infra/server-b/s06/systemd/grafana-override.conf
@@ -0,0 +1,4 @@
+[Service]
+EnvironmentFile=/etc/lisglosips/secrets/grafana.env
+ReadWritePaths=/data/grafana /var/log/grafana
+
diff --git a/infra/server-b/s06/systemd/heplify-server.service b/infra/server-b/s06/systemd/heplify-server.service
new file mode 100644
index 0000000..da5c58c
--- /dev/null
+++ b/infra/server-b/s06/systemd/heplify-server.service
@@ -0,0 +1,32 @@
+[Unit]
+Description=LisgloSIPS Heplify Server
+After=network-online.target postgresql.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=heplify
+Group=heplify
+EnvironmentFile=/etc/lisglosips/secrets/heplify.env
+ExecStart=/usr/local/bin/heplify-server
+Restart=on-failure
+RestartSec=3s
+TimeoutStopSec=30s
+UMask=0027
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/infra/server-b/s06/systemd/homer-app.service b/infra/server-b/s06/systemd/homer-app.service
new file mode 100644
index 0000000..14c2bad
--- /dev/null
+++ b/infra/server-b/s06/systemd/homer-app.service
@@ -0,0 +1,31 @@
+[Unit]
+Description=LisgloSIPS HOMER App
+After=network-online.target postgresql.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=homer
+Group=homer
+ExecStart=/usr/local/bin/homer-app -webapp-config-path=/etc/homer
+Restart=on-failure
+RestartSec=3s
+TimeoutStopSec=30s
+UMask=0027
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/etc/homer /var/log/homer
+
+[Install]
+WantedBy=multi-user.target
diff --git a/infra/server-b/s06/systemd/lisglosips-mysqld-exporter.service b/infra/server-b/s06/systemd/lisglosips-mysqld-exporter.service
new file mode 100644
index 0000000..b19c7ba
--- /dev/null
+++ b/infra/server-b/s06/systemd/lisglosips-mysqld-exporter.service
@@ -0,0 +1,27 @@
+[Unit]
+Description=LisgloSIPS MySQL Exporter
+After=mysql.service
+Requires=mysql.service
+
+[Service]
+Type=simple
+User=prometheus
+Group=prometheus
+ExecStart=/usr/bin/prometheus-mysqld-exporter --config.my-cnf=/etc/prometheus/mysqld-exporter.cnf --web.listen-address=127.0.0.1:9104
+Restart=on-failure
+RestartSec=3s
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
diff --git a/infra/server-b/s06/systemd/lisglosips-node-exporter.service b/infra/server-b/s06/systemd/lisglosips-node-exporter.service
new file mode 100644
index 0000000..afbc69c
--- /dev/null
+++ b/infra/server-b/s06/systemd/lisglosips-node-exporter.service
@@ -0,0 +1,30 @@
+[Unit]
+Description=LisgloSIPS Node Exporter
+After=network-online.target lisglosips-exporter-firewall.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=prometheus
+Group=prometheus
+EnvironmentFile=/etc/default/lisglosips-node-exporter
+ExecStart=/usr/bin/prometheus-node-exporter $ARGS
+Restart=on-failure
+RestartSec=3s
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+IPAddressDeny=any
+IPAddressAllow=127.0.0.0/8
+IPAddressAllow=100.90.90.91/32
+
+[Install]
+WantedBy=multi-user.target
diff --git a/infra/server-b/s06/systemd/lisglosips-postgres-exporter.service b/infra/server-b/s06/systemd/lisglosips-postgres-exporter.service
new file mode 100644
index 0000000..2caa0b7
--- /dev/null
+++ b/infra/server-b/s06/systemd/lisglosips-postgres-exporter.service
@@ -0,0 +1,29 @@
+[Unit]
+Description=LisgloSIPS PostgreSQL Exporter
+After=postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=prometheus
+Group=prometheus
+EnvironmentFile=/etc/lisglosips/secrets/postgres-exporter.env
+ExecStart=/usr/bin/prometheus-postgres-exporter --web.listen-address=127.0.0.1:9187
+Restart=on-failure
+RestartSec=3s
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/infra/server-b/s06/systemd/lisglosips-prometheus.service b/infra/server-b/s06/systemd/lisglosips-prometheus.service
new file mode 100644
index 0000000..2b7c8da
--- /dev/null
+++ b/infra/server-b/s06/systemd/lisglosips-prometheus.service
@@ -0,0 +1,33 @@
+[Unit]
+Description=LisgloSIPS Prometheus
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=prometheus
+Group=prometheus
+EnvironmentFile=/etc/default/lisglosips-prometheus
+ExecStart=/usr/bin/prometheus $ARGS
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=3s
+TimeoutStopSec=30s
+UMask=0027
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=full
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/data/prometheus
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/infra/server-b/s06/systemd/lisglosips-redis-exporter.service b/infra/server-b/s06/systemd/lisglosips-redis-exporter.service
new file mode 100644
index 0000000..4f257e6
--- /dev/null
+++ b/infra/server-b/s06/systemd/lisglosips-redis-exporter.service
@@ -0,0 +1,28 @@
+[Unit]
+Description=LisgloSIPS Redis Exporter
+After=redis-server.service
+Requires=redis-server.service
+
+[Service]
+Type=simple
+User=redis-exporter
+Group=redis-exporter
+EnvironmentFile=/etc/lisglosips/secrets/redis-exporter.env
+ExecStart=/usr/local/bin/redis_exporter
+Restart=on-failure
+RestartSec=3s
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
diff --git a/infra/server-b/s06/versions.env b/infra/server-b/s06/versions.env
new file mode 100644
index 0000000..97dc9b5
--- /dev/null
+++ b/infra/server-b/s06/versions.env
@@ -0,0 +1,18 @@
+POSTGRESQL_VERSION=16.14
+PROMETHEUS_VERSION=2.45.3
+NODE_EXPORTER_VERSION=1.7.0
+MYSQLD_EXPORTER_VERSION=0.15.0
+POSTGRES_EXPORTER_VERSION=0.15.0
+REDIS_EXPORTER_VERSION=1.86.0
+GRAFANA_VERSION=13.0.2
+GO_BOOTSTRAP_VERSION=1.22.2
+GO_BUILD_TOOLCHAIN_VERSION=1.25.11
+HEPLIFY_SERVER_SOURCE=github.com/sipcapture/heplify-server@v1.60.2-0.20260512101233-c74dc3d216ac
+HEPLIFY_SERVER_SHA256=feab75e8a970190ee41952bae74ce453188f6d7ea973017cbec1f5b75cc2b9c5
+HOMER_APP_SOURCE=github.com/sipcapture/homer-app@v0.0.0-20251021161517-9b1336352aa0
+HOMER_APP_SHA256=240436d1e666db8ca2173679adda9649037c6d5502182f96b25562b7cd757e94
+REDIS_EXPORTER_SHA256=5eda3529bf231a3c841d8261895bc09d2f750a3684c8a224edae71f4f80484db
+DOCKER_VERSION=29.1.3
+DOCKER_COMPOSE_VERSION=2.40.3
+DOCKER_RUNTIME_STATUS=installed-disabled
+
diff --git a/infra/server-b/s30/lisglosips-release-preflight.sh b/infra/server-b/s30/lisglosips-release-preflight.sh
new file mode 100755
index 0000000..d1a9af6
--- /dev/null
+++ b/infra/server-b/s30/lisglosips-release-preflight.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+set -euo pipefail
+
+health_url="${LISGLOSIPS_HEALTH_URL:-http://127.0.0.1:3000/api/v2/health/ready}"
+services=(
+  mysql
+  redis-server
+  nginx
+  lisglosips@api
+  lisglosips@cdr-worker
+  lisglosips@recording-worker
+  heplify-server
+  lisglosips-prometheus.service
+  grafana-server
+)
+
+echo "== release =="
+readlink -f /opt/lisglosips/current
+test -L /opt/lisglosips/current
+test -d "$(readlink -f /opt/lisglosips/current)"
+
+echo "== services =="
+for service in "${services[@]}"; do
+  state="$(systemctl is-active "$service" || true)"
+  printf '%s\t%s\n' "$service" "$state"
+  test "$state" = active
+done
+
+echo "== api =="
+curl --max-time 5 --fail --silent "$health_url"
+echo
+
+echo "== nginx =="
+nginx -t
+
+echo "== backups =="
+find /data/backups/mysql -mindepth 1 -maxdepth 1 -type d | sort | tail -1
+find /data/backups/redis -mindepth 1 -maxdepth 1 -type d | sort | tail -1
+
+echo "preflight ok"
diff --git a/infra/server-b/s30/lisglosips-release-rollback.sh b/infra/server-b/s30/lisglosips-release-rollback.sh
new file mode 100755
index 0000000..1e04108
--- /dev/null
+++ b/infra/server-b/s30/lisglosips-release-rollback.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -euo pipefail
+
+if [ "$#" -ne 1 ]; then
+  echo "usage: $0 /opt/lisglosips/releases/<release-id>" >&2
+  exit 64
+fi
+
+target="$1"
+case "$target" in
+  /opt/lisglosips/releases/*) ;;
+  *)
+    echo "target must be under /opt/lisglosips/releases" >&2
+    exit 64
+    ;;
+esac
+
+target="$(readlink -f "$target")"
+test -d "$target"
+test -f "$target/package.json"
+
+previous="$(readlink -f /opt/lisglosips/current)"
+echo "previous=$previous"
+echo "target=$target"
+
+ln -sfn "$target" /opt/lisglosips/current
+systemctl restart lisglosips@api lisglosips@cdr-worker lisglosips@recording-worker
+nginx -t
+systemctl reload nginx
+curl --max-time 10 --fail --silent http://127.0.0.1:3000/api/v2/health/ready
+echo
+echo "rollback ok"
diff --git a/infra/server-t/s21/deploy-s21.sh b/infra/server-t/s21/deploy-s21.sh
new file mode 100755
index 0000000..ce6b434
--- /dev/null
+++ b/infra/server-t/s21/deploy-s21.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DOMAIN="s21.lisglosips.test"
+U1="s21-reg-1001"
+U2="s21-reg-1002"
+IP1="s21-ip-1001"
+IP2="s21-ip-1002"
+
+P1=$(openssl rand -base64 18 | tr -d '=+/' | cut -c1-20)
+P2=$(openssl rand -base64 18 | tr -d '=+/' | cut -c1-20)
+HA1_1=$(printf "%s:%s:%s" "$U1" "$DOMAIN" "$P1" | md5sum | cut -d " " -f1)
+HA1_2=$(printf "%s:%s:%s" "$U2" "$DOMAIN" "$P2" | md5sum | cut -d " " -f1)
+unset P1 P2
+
+install -d -m 0755 /opt/lisglosips-s21
+install -m 0755 /tmp/lisglosips-s21-sip.py /opt/lisglosips-s21/lisglosips-s21-sip.py
+for f in /tmp/s21-*; do
+  install -m 0755 "$f" "/opt/lisglosips-s21/$(basename "$f")"
+done
+
+install -d -m 0750 -o root -g hector /etc/lisglosips-s21
+cat > /etc/lisglosips-s21/sip-accounts.env <<EOF
+S21_SIP_DOMAIN=$DOMAIN
+S21_SIP_PRIMARY_USER=$U1
+S21_SIP_SECONDARY_USER=$U2
+S21_SIP_PRIMARY_HA1=$HA1_1
+S21_SIP_SECONDARY_HA1=$HA1_2
+S21_IP_PRIMARY_ID=$IP1
+S21_IP_SECONDARY_ID=$IP2
+EOF
+chown root:hector /etc/lisglosips-s21/sip-accounts.env
+chmod 0640 /etc/lisglosips-s21/sip-accounts.env
+
+python3 -m py_compile /opt/lisglosips-s21/lisglosips-s21-sip.py
+
+python3 - <<'PY'
+from pathlib import Path
+
+p = Path("/etc/opensips/opensips.cfg")
+s = p.read_text()
+s = s.replace('modparam("auth_db", "calculate_ha1", 1)', 'modparam("auth_db", "calculate_ha1", 0)')
+s = s.replace('modparam("mi_fifo", "fifo_mode", 0666)', 'modparam("mi_fifo", "fifo_mode", 0660)')
+p.write_text(s)
+PY
+
+find /etc/opensips/tls -type f \( -name "*key*.pem" -o -name "cakey.pem" -o -name "*-privkey.pem" \) -exec chmod 0600 {} + 2>/dev/null || true
+
+mysql --protocol=socket -uroot <<SQL
+USE opensips;
+INSERT INTO domain (domain, attrs, accept_subdomain, last_modified)
+VALUES ('$DOMAIN', 'S21 SIP registration test domain', 0, NOW())
+ON DUPLICATE KEY UPDATE attrs=VALUES(attrs), accept_subdomain=VALUES(accept_subdomain), last_modified=NOW();
+
+DELETE FROM subscriber WHERE username IN ('$U1','$U2') AND domain='$DOMAIN';
+INSERT INTO subscriber (username, domain, password, ha1, ha1_sha256, ha1_sha512t256)
+VALUES
+('$U1', '$DOMAIN', '', '$HA1_1', '', ''),
+('$U2', '$DOMAIN', '', '$HA1_2', '', '');
+
+DELETE FROM address WHERE context_info IN ('$IP1','$IP2');
+INSERT INTO address (grp, ip, mask, port, proto, pattern, context_info)
+VALUES
+(21, '100.93.185.30', 32, 0, 'any', NULL, '$IP1'),
+(22, '100.93.185.30', 32, 0, 'any', NULL, '$IP2');
+SQL
+
+opensips -C -f /etc/opensips/opensips.cfg >/run/lisglosips_s21_opensips_check.log 2>&1
+systemctl restart opensips
+sleep 1
+systemctl is-active --quiet opensips
+
+mysql --protocol=socket -uroot -N <<SQL
+USE opensips;
+SELECT 'domain', domain FROM domain WHERE domain='$DOMAIN';
+SELECT 'subscriber', username, domain, LENGTH(password), LENGTH(ha1) FROM subscriber WHERE domain='$DOMAIN' ORDER BY username;
+SELECT 'address', grp, ip, mask, proto, context_info FROM address WHERE context_info IN ('$IP1','$IP2') ORDER BY context_info;
+SQL
diff --git a/infra/server-t/s21/scripts/lisglosips-s21-sip.py b/infra/server-t/s21/scripts/lisglosips-s21-sip.py
new file mode 100755
index 0000000..6389eae
--- /dev/null
+++ b/infra/server-t/s21/scripts/lisglosips-s21-sip.py
@@ -0,0 +1,336 @@
+#!/usr/bin/env python3
+"""LisgloSIPS S21 SIP scenario runner.
+
+Self-contained UDP SIP helper for Server T customer simulation.
+It intentionally accepts HA1 values instead of plaintext SIP passwords.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import random
+import re
+import socket
+import string
+import sys
+import threading
+import time
+from dataclasses import dataclass
+
+
+CRLF = "\r\n"
+
+
+def md5_hex(value: str) -> str:
+    return hashlib.md5(value.encode("utf-8")).hexdigest()
+
+
+def rand_token(length: int = 10) -> str:
+    alphabet = string.ascii_lowercase + string.digits
+    return "".join(random.choice(alphabet) for _ in range(length))
+
+
+def call_id(prefix: str = "s21") -> str:
+    return f"{prefix}-{int(time.time() * 1000)}-{rand_token(8)}@lisglosips-t"
+
+
+def parse_authenticate(header: str) -> dict[str, str]:
+    header = header.strip()
+    if header.lower().startswith("digest "):
+        header = header[7:]
+    values: dict[str, str] = {}
+    for part in re.split(r",\s*", header):
+        if "=" not in part:
+            continue
+        key, raw = part.split("=", 1)
+        values[key.strip().lower()] = raw.strip().strip('"')
+    return values
+
+
+def header_value(message: str, name: str) -> str | None:
+    pattern = re.compile(rf"^{re.escape(name)}\s*:\s*(.+)$", re.IGNORECASE | re.MULTILINE)
+    match = pattern.search(message)
+    return match.group(1).strip() if match else None
+
+
+def status_line(message: str) -> str:
+    return message.splitlines()[0] if message else "NO RESPONSE"
+
+
+@dataclass
+class SipTarget:
+    host: str
+    port: int
+
+
+def udp_roundtrip(payload: str, target: SipTarget, timeout: float = 3.0, bind_host: str = "0.0.0.0") -> str:
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+        sock.bind((bind_host, 0))
+        sock.settimeout(timeout)
+        sock.sendto(payload.encode("utf-8"), (target.host, target.port))
+        try:
+            data, _ = sock.recvfrom(65535)
+        except socket.timeout:
+            return ""
+        return data.decode("utf-8", errors="replace")
+
+
+def build_register(
+    username: str,
+    domain: str,
+    contact_host: str,
+    local_port: int,
+    cseq: int,
+    cid: str,
+    branch: str,
+    authorization: str | None = None,
+) -> str:
+    lines = [
+        f"REGISTER sip:{domain} SIP/2.0",
+        f"Via: SIP/2.0/UDP {contact_host}:{local_port};branch=z9hG4bK-{branch};rport",
+        "Max-Forwards: 70",
+        f"From: <sip:{username}@{domain}>;tag={rand_token(8)}",
+        f"To: <sip:{username}@{domain}>",
+        f"Call-ID: {cid}",
+        f"CSeq: {cseq} REGISTER",
+        f"Contact: <sip:{username}@{contact_host}:{local_port}>;expires=120",
+        "Expires: 120",
+        "User-Agent: lisglosips-s21",
+    ]
+    if authorization:
+        lines.append(f"Authorization: {authorization}")
+    lines.extend(["Content-Length: 0", "", ""])
+    return CRLF.join(lines)
+
+
+def digest_authorization(username: str, realm: str, uri: str, method: str, ha1: str, challenge: dict[str, str]) -> str:
+    nonce = challenge["nonce"]
+    qop = challenge.get("qop", "").split(",")[0].strip()
+    algorithm = challenge.get("algorithm", "MD5")
+    ha2 = md5_hex(f"{method}:{uri}")
+    if qop:
+        nc = "00000001"
+        cnonce = rand_token(16)
+        response = md5_hex(f"{ha1}:{nonce}:{nc}:{cnonce}:{qop}:{ha2}")
+        return (
+            f'Digest username="{username}", realm="{realm}", nonce="{nonce}", uri="{uri}", '
+            f'response="{response}", algorithm={algorithm}, qop={qop}, nc={nc}, cnonce="{cnonce}"'
+        )
+    response = md5_hex(f"{ha1}:{nonce}:{ha2}")
+    return (
+        f'Digest username="{username}", realm="{realm}", nonce="{nonce}", uri="{uri}", '
+        f'response="{response}", algorithm={algorithm}'
+    )
+
+
+def cmd_register(args: argparse.Namespace) -> int:
+    cid = call_id("s21-register")
+    target = SipTarget(args.host, args.port)
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+        sock.bind((args.bind_host, 0))
+        local_host, local_port = sock.getsockname()
+        if args.contact_host:
+            local_host = args.contact_host
+        sock.settimeout(args.timeout)
+        first = build_register(args.username, args.domain, local_host, local_port, 1, cid, rand_token())
+        sock.sendto(first.encode("utf-8"), (target.host, target.port))
+        try:
+            data, _ = sock.recvfrom(65535)
+        except socket.timeout:
+            print(f"call_id={cid} status=NO_RESPONSE")
+            return 2
+        response = data.decode("utf-8", errors="replace")
+        print(f"call_id={cid} first_status={status_line(response)}")
+        www = header_value(response, "WWW-Authenticate") or header_value(response, "Proxy-Authenticate")
+        if not www:
+            return 0 if response.startswith("SIP/2.0 200") else 1
+        challenge = parse_authenticate(www)
+        realm = challenge.get("realm", args.domain)
+        uri = f"sip:{args.domain}"
+        auth = digest_authorization(args.username, realm, uri, "REGISTER", args.ha1, challenge)
+        second = build_register(args.username, args.domain, local_host, local_port, 2, cid, rand_token(), auth)
+        sock.sendto(second.encode("utf-8"), (target.host, target.port))
+        try:
+            data, _ = sock.recvfrom(65535)
+        except socket.timeout:
+            print(f"call_id={cid} final_status=NO_RESPONSE")
+            return 2
+        final = data.decode("utf-8", errors="replace")
+        print(f"call_id={cid} final_status={status_line(final)}")
+        return 0 if final.startswith("SIP/2.0 200") else 1
+
+
+def build_invite(args: argparse.Namespace, cid: str, cseq: int = 1) -> str:
+    branch = rand_token(10)
+    from_tag = rand_token(8)
+    from_uri = f"sip:{args.caller}@{args.from_domain}"
+    to_uri = f"sip:{args.callee}@{args.to_domain}"
+    request_uri = f"sip:{args.callee}@{args.to_domain}"
+    sdp = (
+        "v=0\r\n"
+        f"o=lisglosips-s21 0 0 IN IP4 {args.media_host}\r\n"
+        "s=lisglosips-s21\r\n"
+        f"c=IN IP4 {args.media_host}\r\n"
+        "t=0 0\r\n"
+        f"m=audio {args.media_port} RTP/AVP 0 8 101\r\n"
+        "a=rtpmap:0 PCMU/8000\r\n"
+        "a=rtpmap:8 PCMA/8000\r\n"
+        "a=rtpmap:101 telephone-event/8000\r\n"
+    )
+    lines = [
+        f"INVITE {request_uri} SIP/2.0",
+        f"Via: SIP/2.0/UDP {args.contact_host}:{args.local_port};branch=z9hG4bK-{branch};rport",
+        "Max-Forwards: 70",
+        f"From: <{from_uri}>;tag={from_tag}",
+        f"To: <{to_uri}>",
+        f"Call-ID: {cid}",
+        f"CSeq: {cseq} INVITE",
+        f"Contact: <sip:{args.caller}@{args.contact_host}:{args.local_port}>",
+        "User-Agent: lisglosips-s21",
+        "Content-Type: application/sdp",
+        f"Content-Length: {len(sdp.encode('utf-8'))}",
+        "",
+        sdp,
+    ]
+    return CRLF.join(lines)
+
+
+def cmd_invite(args: argparse.Namespace) -> int:
+    cid = call_id("s21-invite")
+    target = SipTarget(args.host, args.port)
+    payload = build_invite(args, cid)
+    response = udp_roundtrip(payload, target, args.timeout, args.bind_host)
+    print(f"call_id={cid} status={status_line(response)}")
+    return 0 if response else 2
+
+
+def uas_once(host: str, port: int, mode: str, ready: threading.Event) -> None:
+    code_map = {
+        "success": ("200", "OK"),
+        "busy": ("486", "Busy Here"),
+        "reject": ("603", "Decline"),
+    }
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+        sock.bind((host, port))
+        sock.settimeout(5)
+        ready.set()
+        try:
+            data, addr = sock.recvfrom(65535)
+        except socket.timeout:
+            return
+        if mode == "timeout":
+            time.sleep(3)
+            return
+        request = data.decode("utf-8", errors="replace")
+        via = header_value(request, "Via") or ""
+        from_h = header_value(request, "From") or ""
+        to_h = header_value(request, "To") or ""
+        cid = header_value(request, "Call-ID") or call_id("s21-uas")
+        cseq = header_value(request, "CSeq") or "1 INVITE"
+        code, reason = code_map[mode]
+        if "tag=" not in to_h:
+            to_h = f"{to_h};tag={rand_token(8)}"
+        response = CRLF.join(
+            [
+                f"SIP/2.0 {code} {reason}",
+                f"Via: {via}",
+                f"From: {from_h}",
+                f"To: {to_h}",
+                f"Call-ID: {cid}",
+                f"CSeq: {cseq}",
+                "Server: lisglosips-s21-uas",
+                "Content-Length: 0",
+                "",
+                "",
+            ]
+        )
+        sock.sendto(response.encode("utf-8"), addr)
+
+
+def cmd_local_scenario(args: argparse.Namespace) -> int:
+    ready = threading.Event()
+    thread = threading.Thread(target=uas_once, args=(args.listen_host, args.listen_port, args.mode, ready), daemon=True)
+    thread.start()
+    ready.wait(2)
+    args.host = args.listen_host
+    args.port = args.listen_port
+    args.to_domain = f"{args.listen_host}:{args.listen_port}"
+    rc = cmd_invite(args)
+    thread.join(4)
+    if args.mode == "timeout":
+        return 0 if rc == 2 else 1
+    return rc
+
+
+def cmd_over_cps(args: argparse.Namespace) -> int:
+    target = SipTarget(args.host, args.port)
+    statuses: list[str] = []
+    for index in range(args.count):
+        cid = call_id(f"s21-cps-{index + 1}")
+        args.callee = f"{args.callee_prefix}{index + 1:03d}"
+        payload = build_invite(args, cid)
+        response = udp_roundtrip(payload, target, args.timeout, args.bind_host)
+        line = status_line(response)
+        statuses.append(line)
+        print(f"call_id={cid} status={line}")
+        if args.interval > 0:
+            time.sleep(args.interval)
+    print(f"sent={args.count} unique_statuses={sorted(set(statuses))}")
+    return 0
+
+
+def add_common_invite_args(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--host", default="100.90.90.90")
+    parser.add_argument("--port", type=int, default=15060)
+    parser.add_argument("--bind-host", default="0.0.0.0")
+    parser.add_argument("--contact-host", default="100.93.185.30")
+    parser.add_argument("--local-port", type=int, default=50620)
+    parser.add_argument("--caller", default="s21-ip-1001")
+    parser.add_argument("--callee", default="13800138000")
+    parser.add_argument("--from-domain", default="s21-ip.lisglosips.test")
+    parser.add_argument("--to-domain", default="100.90.90.90:15060")
+    parser.add_argument("--media-host", default="100.93.185.30")
+    parser.add_argument("--media-port", type=int, default=31000)
+    parser.add_argument("--timeout", type=float, default=3.0)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="LisgloSIPS S21 SIP scenario runner")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    reg = sub.add_parser("register")
+    reg.add_argument("--host", default="100.93.185.30")
+    reg.add_argument("--port", type=int, default=5060)
+    reg.add_argument("--bind-host", default="0.0.0.0")
+    reg.add_argument("--contact-host", default="100.93.185.30")
+    reg.add_argument("--username", required=True)
+    reg.add_argument("--domain", required=True)
+    reg.add_argument("--ha1", required=True)
+    reg.add_argument("--timeout", type=float, default=3.0)
+    reg.set_defaults(func=cmd_register)
+
+    inv = sub.add_parser("invite")
+    add_common_invite_args(inv)
+    inv.set_defaults(func=cmd_invite)
+
+    local = sub.add_parser("local-scenario")
+    add_common_invite_args(local)
+    local.add_argument("--mode", choices=["success", "busy", "reject", "timeout"], required=True)
+    local.add_argument("--listen-host", default="127.0.0.1")
+    local.add_argument("--listen-port", type=int, default=15070)
+    local.set_defaults(func=cmd_local_scenario)
+
+    cps = sub.add_parser("over-cps")
+    add_common_invite_args(cps)
+    cps.add_argument("--count", type=int, default=20)
+    cps.add_argument("--interval", type=float, default=0.02)
+    cps.add_argument("--callee-prefix", default="1390000")
+    cps.set_defaults(func=cmd_over_cps)
+
+    args = parser.parse_args()
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/infra/server-t/s21/scripts/s21-call-a-ip b/infra/server-t/s21/scripts/s21-call-a-ip
new file mode 100755
index 0000000..fd99fc3
--- /dev/null
+++ b/infra/server-t/s21/scripts/s21-call-a-ip
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec /opt/lisglosips-s21/lisglosips-s21-sip.py invite \
+  --caller s21-ip-1001 \
+  --from-domain s21-ip.lisglosips.test \
+  --callee "${1:-13800138000}"
diff --git a/infra/server-t/s21/scripts/s21-call-a-sip b/infra/server-t/s21/scripts/s21-call-a-sip
new file mode 100755
index 0000000..e328aab
--- /dev/null
+++ b/infra/server-t/s21/scripts/s21-call-a-sip
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+source /etc/lisglosips-s21/sip-accounts.env
+exec /opt/lisglosips-s21/lisglosips-s21-sip.py invite \
+  --caller "$S21_SIP_PRIMARY_USER" \
+  --from-domain "$S21_SIP_DOMAIN" \
+  --callee "${1:-13800138000}"
diff --git a/infra/server-t/s21/scripts/s21-local-busy b/infra/server-t/s21/scripts/s21-local-busy
new file mode 100755
index 0000000..1c466b1
--- /dev/null
+++ b/infra/server-t/s21/scripts/s21-local-busy
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec /opt/lisglosips-s21/lisglosips-s21-sip.py local-scenario --mode busy --callee "${1:-13800138000}"
diff --git a/infra/server-t/s21/scripts/s21-local-reject b/infra/server-t/s21/scripts/s21-local-reject
new file mode 100755
index 0000000..5865e87
--- /dev/null
+++ b/infra/server-t/s21/scripts/s21-local-reject
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec /opt/lisglosips-s21/lisglosips-s21-sip.py local-scenario --mode reject --callee "${1:-13800138000}"
diff --git a/infra/server-t/s21/scripts/s21-local-success b/infra/server-t/s21/scripts/s21-local-success
new file mode 100755
index 0000000..b434d84
--- /dev/null
+++ b/infra/server-t/s21/scripts/s21-local-success
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec /opt/lisglosips-s21/lisglosips-s21-sip.py local-scenario --mode success --callee "${1:-13800138000}"
diff --git a/infra/server-t/s21/scripts/s21-local-timeout b/infra/server-t/s21/scripts/s21-local-timeout
new file mode 100755
index 0000000..34d54f8
--- /dev/null
+++ b/infra/server-t/s21/scripts/s21-local-timeout
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec /opt/lisglosips-s21/lisglosips-s21-sip.py local-scenario --mode timeout --callee "${1:-13800138000}"
diff --git a/infra/server-t/s21/scripts/s21-over-cps-a b/infra/server-t/s21/scripts/s21-over-cps-a
new file mode 100755
index 0000000..84254b1
--- /dev/null
+++ b/infra/server-t/s21/scripts/s21-over-cps-a
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec /opt/lisglosips-s21/lisglosips-s21-sip.py over-cps --count "${1:-20}" --interval "${2:-0.02}"
diff --git a/infra/server-t/s21/scripts/s21-register-primary b/infra/server-t/s21/scripts/s21-register-primary
new file mode 100755
index 0000000..812895e
--- /dev/null
+++ b/infra/server-t/s21/scripts/s21-register-primary
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+source /etc/lisglosips-s21/sip-accounts.env
+exec /opt/lisglosips-s21/lisglosips-s21-sip.py register \
+  --username "$S21_SIP_PRIMARY_USER" \
+  --domain "$S21_SIP_DOMAIN" \
+  --ha1 "$S21_SIP_PRIMARY_HA1"
diff --git a/infra/server-t/s21/scripts/s21-register-secondary b/infra/server-t/s21/scripts/s21-register-secondary
new file mode 100755
index 0000000..6e13cec
--- /dev/null
+++ b/infra/server-t/s21/scripts/s21-register-secondary
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+source /etc/lisglosips-s21/sip-accounts.env
+exec /opt/lisglosips-s21/lisglosips-s21-sip.py register \
+  --username "$S21_SIP_SECONDARY_USER" \
+  --domain "$S21_SIP_DOMAIN" \
+  --ha1 "$S21_SIP_SECONDARY_HA1"
diff --git a/infra/server-t/s21/scripts/s21-register-wrong-ha1 b/infra/server-t/s21/scripts/s21-register-wrong-ha1
new file mode 100755
index 0000000..5c8eb76
--- /dev/null
+++ b/infra/server-t/s21/scripts/s21-register-wrong-ha1
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+source /etc/lisglosips-s21/sip-accounts.env
+exec /opt/lisglosips-s21/lisglosips-s21-sip.py register \
+  --username "$S21_SIP_PRIMARY_USER" \
+  --domain "$S21_SIP_DOMAIN" \
+  --ha1 "00000000000000000000000000000000"
diff --git a/infra/server-t/s28/lisglosips-s28-sip.py b/infra/server-t/s28/lisglosips-s28-sip.py
new file mode 100755
index 0000000..5acb2be
--- /dev/null
+++ b/infra/server-t/s28/lisglosips-s28-sip.py
@@ -0,0 +1,225 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import random
+import re
+import socket
+import struct
+import string
+import sys
+import threading
+import time
+
+CRLF = "\r\n"
+
+
+def token(n: int = 8) -> str:
+    return "".join(random.choice(string.ascii_lowercase + string.digits) for _ in range(n))
+
+
+def header(msg: str, name: str) -> str:
+    m = re.search(rf"^{re.escape(name)}\s*:\s*(.+)$", msg, re.I | re.M)
+    return m.group(1).strip() if m else ""
+
+
+def call_id() -> str:
+    return f"s28-{int(time.time() * 1000)}-{token()}@lisglosips-t"
+
+
+def status(msg: str) -> str:
+    return msg.splitlines()[0] if msg else "NO RESPONSE"
+
+
+def sdp(host: str, port: int) -> str:
+    return (
+        "v=0\r\n"
+        f"o=lisglosips-s28 0 0 IN IP4 {host}\r\n"
+        "s=lisglosips-s28\r\n"
+        f"c=IN IP4 {host}\r\n"
+        "t=0 0\r\n"
+        f"m=audio {port} RTP/AVP 0 8 101\r\n"
+        "a=rtpmap:0 PCMU/8000\r\n"
+        "a=rtpmap:8 PCMA/8000\r\n"
+        "a=rtpmap:101 telephone-event/8000\r\n"
+    )
+
+
+def parse_sdp_media(msg: str) -> tuple[str, int] | None:
+    body = msg.split("\r\n\r\n", 1)[1] if "\r\n\r\n" in msg else msg.split("\n\n", 1)[1] if "\n\n" in msg else ""
+    media_host = ""
+    media_port = 0
+    for raw in body.splitlines():
+        line = raw.strip()
+        if line.startswith("c=IN IP4 "):
+            media_host = line.split()[-1]
+        elif line.startswith("m=audio "):
+            parts = line.split()
+            if len(parts) >= 2 and parts[1].isdigit():
+                media_port = int(parts[1])
+    if media_host and media_port:
+        return media_host, media_port
+    return None
+
+
+def send_pcmu_rtp(target: tuple[str, int], duration: float, bind_host: str = "0.0.0.0") -> None:
+    payload = b"\xff" * 160
+    seq = random.randint(0, 65535)
+    timestamp = random.randint(0, 2**32 - 1)
+    ssrc = random.randint(1, 2**32 - 1)
+    deadline = time.time() + duration
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+        sock.bind((bind_host, 0))
+        while time.time() < deadline:
+            header = struct.pack("!BBHII", 0x80, 0x00, seq, timestamp, ssrc)
+            sock.sendto(header + payload, target)
+            seq = (seq + 1) % 65536
+            timestamp = (timestamp + 160) % 2**32
+            time.sleep(0.02)
+
+
+def response(code: int, reason: str, req: str, body: str = "") -> str:
+    to_h = header(req, "To")
+    if "tag=" not in to_h:
+        to_h = f"{to_h};tag=s28uas{token(6)}"
+    lines = [
+        f"SIP/2.0 {code} {reason}",
+        f"Via: {header(req, 'Via')}",
+        f"From: {header(req, 'From')}",
+        f"To: {to_h}",
+        f"Call-ID: {header(req, 'Call-ID')}",
+        f"CSeq: {header(req, 'CSeq')}",
+        "Server: lisglosips-s28-uas",
+    ]
+    if body:
+        lines.extend(["Content-Type: application/sdp", f"Content-Length: {len(body.encode())}", "", body])
+    else:
+        lines.extend(["Content-Length: 0", "", ""])
+    return CRLF.join(lines)
+
+
+def uas(args: argparse.Namespace) -> int:
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+        sock.bind((args.host, args.port))
+        while True:
+            data, addr = sock.recvfrom(65535)
+            req = data.decode(errors="replace")
+            method = req.split(" ", 1)[0]
+            if method == "INVITE":
+                sock.sendto(response(100, "Trying", req).encode(), addr)
+                body = sdp(args.media_host, args.media_port)
+                sock.sendto(response(200, "OK", req, body).encode(), addr)
+                media = parse_sdp_media(req)
+                if media:
+                    threading.Thread(target=send_pcmu_rtp, args=(media, args.rtp_duration, args.host), daemon=True).start()
+            elif method == "BYE":
+                sock.sendto(response(200, "OK", req).encode(), addr)
+
+
+def invite(args: argparse.Namespace) -> int:
+    cid = call_id()
+    from_tag = token()
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+        sock.bind((args.bind_host, args.local_port))
+        args.local_port = sock.getsockname()[1]
+        sock.settimeout(args.timeout)
+        body = sdp(args.media_host, args.media_port)
+        req = CRLF.join(
+            [
+                f"INVITE sip:{args.callee}@{args.to_domain} SIP/2.0",
+                f"Via: SIP/2.0/UDP {args.contact_host}:{args.local_port};branch=z9hG4bK-{token(10)};rport",
+                "Max-Forwards: 70",
+                f"From: <sip:{args.caller}@s28.customer.local>;tag={from_tag}",
+                f"To: <sip:{args.callee}@{args.to_domain}>",
+                f"Call-ID: {cid}",
+                "CSeq: 1 INVITE",
+                f"Contact: <sip:{args.caller}@{args.contact_host}:{args.local_port}>",
+                "User-Agent: lisglosips-s28",
+                "Content-Type: application/sdp",
+                f"Content-Length: {len(body.encode())}",
+                "",
+                body,
+            ]
+        )
+        sock.sendto(req.encode(), (args.host, args.port))
+        final = ""
+        route = ""
+        to_h = ""
+        while True:
+            try:
+                msg = sock.recvfrom(65535)[0].decode(errors="replace")
+            except socket.timeout:
+                break
+            print(f"call_id={cid} status={status(msg)}")
+            if msg.startswith("SIP/2.0 2"):
+                final = msg
+                route = header(msg, "Record-Route") or f"<sip:{args.host}:{args.port};lr>"
+                to_h = header(msg, "To")
+                break
+            if msg.startswith("SIP/2.0 3") or msg.startswith("SIP/2.0 4") or msg.startswith("SIP/2.0 5") or msg.startswith("SIP/2.0 6"):
+                final = msg
+                break
+        if not final.startswith("SIP/2.0 2"):
+            print(f"call_id={cid} final={status(final)}")
+            return 1
+        ack = build_in_dialog("ACK", args, cid, from_tag, to_h, 1, route)
+        sock.sendto(ack.encode(), (args.host, args.port))
+        media = parse_sdp_media(final)
+        if media:
+            send_pcmu_rtp(media, args.hold, args.contact_host)
+        time.sleep(args.hold)
+        bye = build_in_dialog("BYE", args, cid, from_tag, to_h, 2, route)
+        sock.sendto(bye.encode(), (args.host, args.port))
+        try:
+            bye_resp = sock.recvfrom(65535)[0].decode(errors="replace")
+        except socket.timeout:
+            bye_resp = ""
+        print(f"call_id={cid} bye_status={status(bye_resp)}")
+        return 0 if bye_resp.startswith("SIP/2.0 200") else 1
+
+
+def build_in_dialog(method: str, args: argparse.Namespace, cid: str, from_tag: str, to_h: str, cseq: int, route: str) -> str:
+    lines = [
+        f"{method} sip:{args.callee}@{args.to_domain} SIP/2.0",
+        f"Via: SIP/2.0/UDP {args.contact_host}:{args.local_port};branch=z9hG4bK-{token(10)};rport",
+        "Max-Forwards: 70",
+        f"From: <sip:{args.caller}@s28.customer.local>;tag={from_tag}",
+        f"To: {to_h}",
+        f"Call-ID: {cid}",
+        f"CSeq: {cseq} {method}",
+        f"Contact: <sip:{args.caller}@{args.contact_host}:{args.local_port}>",
+    ]
+    if route:
+        lines.append(f"Route: {route}")
+    lines.extend(["Content-Length: 0", "", ""])
+    return CRLF.join(lines)
+
+
+def main() -> int:
+    p = argparse.ArgumentParser()
+    sub = p.add_subparsers(dest="cmd", required=True)
+    u = sub.add_parser("uas")
+    u.add_argument("--host", default="100.93.185.30")
+    u.add_argument("--port", type=int, default=50620)
+    u.add_argument("--media-host", default="100.93.185.30")
+    u.add_argument("--media-port", type=int, default=32000)
+    u.add_argument("--rtp-duration", type=float, default=4.0)
+    i = sub.add_parser("invite")
+    i.add_argument("--host", default="100.90.90.90")
+    i.add_argument("--port", type=int, default=15060)
+    i.add_argument("--bind-host", default="0.0.0.0")
+    i.add_argument("--contact-host", default="100.93.185.30")
+    i.add_argument("--local-port", type=int, default=0)
+    i.add_argument("--caller", default="s28-ip-1001")
+    i.add_argument("--callee", default="13800138000")
+    i.add_argument("--to-domain", default="100.90.90.90:15060")
+    i.add_argument("--media-host", default="100.93.185.30")
+    i.add_argument("--media-port", type=int, default=31002)
+    i.add_argument("--timeout", type=float, default=5.0)
+    i.add_argument("--hold", type=float, default=3.0)
+    args = p.parse_args()
+    return uas(args) if args.cmd == "uas" else invite(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/install-opensips-stack.sh b/install-opensips-stack.sh
new file mode 100755
index 0000000..8082551
--- /dev/null
+++ b/install-opensips-stack.sh
@@ -0,0 +1,585 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# One-shot OpenSIPS + OpenSIPS-CP + RTPengine installer for Ubuntu 24.04.
+# Tested against OpenSIPS 3.6.x on Ubuntu Noble.
+#
+# Usage:
+#   sudo bash install-opensips-stack.sh
+#
+# Optional environment variables:
+#   SIP_IP=100.93.185.30 DB_PASS=change-me CP_VERSION=9.3.6 sudo -E bash install-opensips-stack.sh
+
+export DEBIAN_FRONTEND=noninteractive
+export NEEDRESTART_MODE=a
+
+OPEN_SIPS_SERIES="${OPEN_SIPS_SERIES:-3.6}"
+CP_VERSION="${CP_VERSION:-9.3.6}"
+SIP_IP="${SIP_IP:-$(hostname -I | awk '{print $1}')}"
+SIP_DOMAIN="${SIP_DOMAIN:-$SIP_IP}"
+DB_NAME="${DB_NAME:-opensips}"
+DB_USER="${DB_USER:-opensips}"
+DB_PASS="${DB_PASS:-opensipsrw}"
+DB_RO_USER="${DB_RO_USER:-opensipsro}"
+DB_RO_PASS="${DB_RO_PASS:-opensipsro}"
+CP_PATH="${CP_PATH:-/var/www/html/opensips-cp}"
+MI_HTTP_IP="${MI_HTTP_IP:-127.0.0.1}"
+MI_HTTP_PORT="${MI_HTTP_PORT:-8888}"
+RTPENGINE_NG="${RTPENGINE_NG:-127.0.0.1:2223}"
+RTPENGINE_PORT_MIN="${RTPENGINE_PORT_MIN:-30000}"
+RTPENGINE_PORT_MAX="${RTPENGINE_PORT_MAX:-40000}"
+MONIT_IP="${MONIT_IP:-127.0.0.1}"
+MONIT_PORT="${MONIT_PORT:-2812}"
+MONIT_USER="${MONIT_USER:-admin}"
+MONIT_PASS="${MONIT_PASS:-monit}"
+
+log() {
+  printf '\n### %s\n' "$*"
+}
+
+require_root() {
+  if [ "$(id -u)" -ne 0 ]; then
+    echo "Run as root, for example: sudo -E bash $0" >&2
+    exit 1
+  fi
+}
+
+backup_once() {
+  local file="$1"
+  [ -f "$file" ] || return 0
+  cp -an "$file" "$file.bak.$(date +%Y%m%d%H%M%S)" 2>/dev/null || true
+}
+
+apt_install() {
+  apt-get install -y "$@"
+}
+
+setup_apt_repo() {
+  log "Configure OpenSIPS APT repository"
+  apt-get update
+  apt_install ca-certificates curl gnupg lsb-release git unzip sed gawk
+  curl -fsSL https://apt.opensips.org/opensips-org.gpg -o /usr/share/keyrings/opensips-org.gpg
+  cat > /etc/apt/sources.list.d/opensips.list <<EOF
+deb [signed-by=/usr/share/keyrings/opensips-org.gpg] https://apt.opensips.org noble ${OPEN_SIPS_SERIES}-releases
+EOF
+  cat > /etc/apt/sources.list.d/opensips-cli.list <<EOF
+deb [signed-by=/usr/share/keyrings/opensips-org.gpg] https://apt.opensips.org noble cli-nightly
+EOF
+  apt-get update
+}
+
+install_packages() {
+  log "Install OpenSIPS, OpenSIPS-CP dependencies and RTPengine"
+  apt_install \
+    opensips opensips-cli \
+    opensips-mysql-module opensips-mysql-dbschema \
+    opensips-auth-modules opensips-tls-module \
+    opensips-http-modules opensips-json-module \
+    rtpengine-daemon \
+    monit \
+    mariadb-server mariadb-client \
+    apache2 libapache2-mod-php \
+    php php-cli php-mysql php-gd php-pear php-apcu php-curl php-xml php-mbstring \
+    git unzip curl
+}
+
+setup_database() {
+  log "Create OpenSIPS database and users"
+  systemctl enable --now mariadb
+  mysql --protocol=socket -uroot <<SQL
+CREATE DATABASE IF NOT EXISTS \`${DB_NAME}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+CREATE USER IF NOT EXISTS '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';
+GRANT ALL PRIVILEGES ON \`${DB_NAME}\`.* TO '${DB_USER}'@'localhost';
+CREATE USER IF NOT EXISTS '${DB_RO_USER}'@'localhost' IDENTIFIED BY '${DB_RO_PASS}';
+GRANT SELECT ON \`${DB_NAME}\`.* TO '${DB_RO_USER}'@'localhost';
+FLUSH PRIVILEGES;
+SQL
+}
+
+import_schema_file_if_needed() {
+  local sql_file="$1"
+  local first_table
+  first_table="$(awk '/CREATE TABLE/{gsub(/`/, "", $3); print $3; exit}' "$sql_file")"
+  if [ -z "$first_table" ]; then
+    return 0
+  fi
+
+  if mysql --protocol=socket -uroot -D "$DB_NAME" -NBe "SHOW TABLES LIKE '$first_table'" | grep -qx "$first_table"; then
+    echo "schema already present: $(basename "$sql_file")"
+  else
+    echo "importing schema: $(basename "$sql_file")"
+    mysql --protocol=socket -uroot "$DB_NAME" < "$sql_file"
+  fi
+}
+
+setup_opensips_schema() {
+  log "Import OpenSIPS MySQL schemas"
+  if ! mysql --protocol=socket -uroot -D "$DB_NAME" -NBe "SHOW TABLES LIKE 'version'" | grep -qx version; then
+    mysql --protocol=socket -uroot "$DB_NAME" < /usr/share/opensips/mysql/standard-create.sql
+  else
+    echo "standard schema already present"
+  fi
+
+  local schema
+  for schema in \
+    acc alias_db auth_db permissions domain dialog dispatcher drouting dialplan \
+    load_balancer rtpengine rtpproxy tracer usrloc tls_mgm group speeddial
+  do
+    import_schema_file_if_needed "/usr/share/opensips/mysql/${schema}-create.sql"
+  done
+}
+
+configure_opensipsctlrc() {
+  log "Configure opensipsctlrc"
+  backup_once /etc/opensips/opensipsctlrc
+  cat > /etc/opensips/opensipsctlrc <<EOF
+SIP_DOMAIN=${SIP_DOMAIN}
+DBENGINE=MYSQL
+DBHOST=localhost
+DBNAME=${DB_NAME}
+DBRWUSER=${DB_USER}
+DBRWPW="${DB_PASS}"
+DBROUSER=${DB_RO_USER}
+DBROPW=${DB_RO_PASS}
+DBROOTUSER=root
+EOF
+}
+
+patch_opensips_cfg() {
+  log "Configure OpenSIPS listener, MI HTTP and permissions"
+  local cfg=/etc/opensips/opensips.cfg
+  backup_once "$cfg"
+
+  python3 - "$cfg" <<PY
+from pathlib import Path
+cfg = Path("$cfg")
+s = cfg.read_text()
+
+lines = []
+socket_done = False
+for line in s.splitlines():
+    if line.strip().startswith("socket=udp:"):
+        if not socket_done:
+            lines.append("socket=udp:${SIP_IP}:5060   /* installed by install-opensips-stack.sh */")
+            socket_done = True
+        continue
+    lines.append(line)
+s = "\\n".join(lines) + "\\n"
+if not socket_done:
+    marker = "####### Modules Section ########"
+    s = s.replace(marker, f"socket=udp:${SIP_IP}:5060\\n\\n{marker}", 1)
+
+managed = """\
+#### Managed OpenSIPS-CP runtime support
+loadmodule "db_mysql.so"
+
+loadmodule "auth.so"
+loadmodule "auth_db.so"
+modparam("auth_db", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
+modparam("auth_db", "calculate_ha1", 1)
+
+loadmodule "domain.so"
+modparam("domain", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
+modparam("domain", "db_mode", 1)
+
+loadmodule "httpd.so"
+modparam("httpd", "ip", "${MI_HTTP_IP}")
+modparam("httpd", "port", ${MI_HTTP_PORT})
+
+loadmodule "mi_http.so"
+modparam("mi_http", "root", "mi")
+
+loadmodule "permissions.so"
+modparam("permissions", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
+modparam("permissions", "address_table", "address")
+
+loadmodule "dialog.so"
+modparam("dialog", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
+modparam("dialog", "profiles_no_value", "inbound;outbound")
+modparam("dialog", "profiles_with_value", "caller;callee")
+
+loadmodule "dispatcher.so"
+modparam("dispatcher", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
+modparam("dispatcher", "persistent_state", 1)
+
+loadmodule "drouting.so"
+modparam("drouting", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
+modparam("drouting", "drd_table", "dr_gateways")
+modparam("drouting", "drr_table", "dr_rules")
+modparam("drouting", "drg_table", "dr_groups")
+modparam("drouting", "drc_table", "dr_carriers")
+
+loadmodule "rtpengine.so"
+modparam("rtpengine", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
+modparam("rtpengine", "db_table", "rtpengine")
+
+loadmodule "rtpproxy.so"
+modparam("rtpproxy", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
+modparam("rtpproxy", "db_table", "rtpproxy_sockets")
+
+loadmodule "tracer.so"
+modparam("tracer", "trace_on", 1)
+modparam("tracer", "trace_id", "[tid]uri=mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME};table=sip_trace;")
+#### End managed OpenSIPS-CP runtime support
+"""
+
+start = "#### Managed OpenSIPS-CP runtime support"
+end = "#### End managed OpenSIPS-CP runtime support"
+if start in s and end in s:
+    before, rest = s.split(start, 1)
+    _, after = rest.split(end, 1)
+    s = before + managed + after
+else:
+    marker = '#### SIGNALING module\\n'
+    if marker in s:
+        s = s.replace(marker, managed + "\\n" + marker, 1)
+    else:
+        s = s.replace('#### Modules Section ########\\n', '#### Modules Section ########\\n' + managed + "\\n", 1)
+ 
+lines = []
+for line in s.splitlines():
+    stripped = line.strip()
+    if stripped.startswith('modparam("usrloc", "working_mode_preset"'):
+        lines.append('modparam("usrloc", "working_mode_preset", "single-instance-sql-write-through")')
+        continue
+    if stripped.startswith('modparam("usrloc", "db_url"'):
+        lines.append('modparam("usrloc", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")')
+        continue
+    lines.append(line)
+    if stripped == 'loadmodule "usrloc.so"' and 'modparam("usrloc", "db_url"' not in s:
+        lines.append('modparam("usrloc", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")')
+s = "\n".join(lines) + "\n"
+
+old_register = """\tif (is_method("REGISTER")) {
+\t\t# store the registration and generate a SIP reply
+\t\tif (!save("location"))
+\t\t\txlog("failed to register AoR $tu\\n");
+
+\t\texit;
+\t}"""
+new_register = """\tif (is_method("REGISTER")) {
+\t\tif (!www_authorize("$fd", "subscriber")) {
+\t\t\twww_challenge("$fd", "auth");
+\t\t\texit;
+\t\t}
+
+\t\tif (!save("location"))
+\t\t\txlog("failed to register AoR $tu\\n");
+
+\t\texit;
+\t}"""
+if old_register in s:
+    s = s.replace(old_register, new_register, 1)
+
+if 'create_dialog();' not in s:
+    out = []
+    inserted = False
+    lines = s.splitlines()
+    for i, line in enumerate(lines):
+        out.append(line)
+        if line.strip() == 'if (is_method("INVITE")) {' and i > 0 and 'account only INVITEs' in lines[i - 1]:
+            out.append('\t\tcreate_dialog();')
+            out.append('\t\tset_dlg_profile("outbound");')
+            out.append('\t\tset_dlg_profile("caller", "$fU");')
+            out.append('\t\tset_dlg_profile("callee", "$rU");')
+            inserted = True
+    if inserted:
+        s = "\n".join(out) + "\n"
+
+if 'trace("tid", "m", "sip", "$fU");' not in s:
+    s = s.replace('route{\n', 'route{\n\n\ttrace("tid", "m", "sip", "$fU");\n', 1)
+
+cfg.write_text(s)
+PY
+
+  opensips -C -f "$cfg"
+}
+
+deploy_opensips_cp() {
+  log "Deploy OpenSIPS Control Panel ${CP_VERSION}"
+  if [ ! -d "$CP_PATH/.git" ]; then
+    rm -rf "$CP_PATH"
+    git clone --depth 1 --branch "$CP_VERSION" https://github.com/OpenSIPS/opensips-cp.git "$CP_PATH"
+  else
+    git -C "$CP_PATH" fetch --tags --depth 1 origin "$CP_VERSION" || true
+    git -C "$CP_PATH" checkout "$CP_VERSION"
+  fi
+
+  if ! mysql --protocol=socket -uroot -D "$DB_NAME" -NBe "SHOW TABLES LIKE 'ocp_admin_privileges'" | grep -qx ocp_admin_privileges; then
+    mysql --protocol=socket -uroot "$DB_NAME" < "$CP_PATH/config/db_schema.mysql"
+  else
+    echo "OpenSIPS-CP schema already present"
+  fi
+
+  mysql --protocol=socket -uroot "$DB_NAME" <<SQL
+UPDATE ocp_boxes_config
+   SET monit_conn='${MONIT_IP}:${MONIT_PORT}',
+       monit_user='${MONIT_USER}',
+       monit_pass='${MONIT_PASS}',
+       monit_ssl=0
+ WHERE id=1;
+
+INSERT INTO rtpengine (socket, set_id)
+SELECT 'udp:${RTPENGINE_NG}', 0
+WHERE NOT EXISTS (
+  SELECT 1 FROM rtpengine WHERE socket='udp:${RTPENGINE_NG}' AND set_id=0
+);
+SQL
+
+  [ -f "$CP_PATH/config/db.inc.php.sample" ] && [ ! -f "$CP_PATH/config/db.inc.php" ] && cp "$CP_PATH/config/db.inc.php.sample" "$CP_PATH/config/db.inc.php"
+  [ -f "$CP_PATH/config/boxes.global.inc.php.sample" ] && [ ! -f "$CP_PATH/config/boxes.global.inc.php" ] && cp "$CP_PATH/config/boxes.global.inc.php.sample" "$CP_PATH/config/boxes.global.inc.php"
+
+  python3 - "$CP_PATH/config/db.inc.php" <<PY
+from pathlib import Path
+p = Path("$CP_PATH/config/db.inc.php")
+s = p.read_text()
+repls = {
+    "db_host": "localhost",
+    "db_user": "${DB_USER}",
+    "db_pass": "${DB_PASS}",
+    "db_name": "${DB_NAME}",
+}
+out = []
+for line in s.splitlines():
+    stripped = line.strip()
+    replaced = False
+    for key, value in repls.items():
+        needle = f"\$config->{key}"
+        if stripped.startswith(needle) and "=" in line:
+            out.append(f" \$config->{key} = '{value}';")
+            replaced = True
+            break
+    if not replaced:
+        if "db_port" in line and "db_host" in line and "port=" in line:
+            out.append(' if (!empty(\$config->db_port) ) \$config->db_host = \$config->db_host . ";port=" . \$config->db_port;')
+        else:
+            out.append(line)
+p.write_text("\\n".join(out) + "\\n")
+PY
+
+  find "$CP_PATH/config" -type f \( -name '*.inc.php' -o -name '*.php' \) -print0 | xargs -0 sed -i \
+    -e "s/'db_host'[[:space:]]*=>[[:space:]]*'[^']*'/'db_host' => 'localhost'/g" \
+    -e "s/'db_name'[[:space:]]*=>[[:space:]]*'[^']*'/'db_name' => '${DB_NAME}'/g" \
+    -e "s/'db_user'[[:space:]]*=>[[:space:]]*'[^']*'/'db_user' => '${DB_USER}'/g" \
+    -e "s/'db_pass'[[:space:]]*=>[[:space:]]*'[^']*'/'db_pass' => '${DB_PASS}'/g" || true
+
+  # OpenSIPS-CP 9.3.6 passes validation regexes to browser-side JavaScript
+  # through preg_quote(), which turns regexes into literal strings for
+  # JavaScript's RegExp(). This breaks forms such as Domains, where both IPs
+  # and FQDNs are intended to be valid. Keep regex semantics and only escape
+  # quotes for the generated JS string.
+  local forms_file="$CP_PATH/web/common/forms.php"
+  backup_once "$forms_file"
+  python3 - "$forms_file" <<'PY'
+from pathlib import Path
+import sys
+
+p = Path(sys.argv[1])
+s = p.read_text()
+s = s.replace("preg_quote($re, '/')", "addslashes($re)")
+s = s.replace("preg_quote($value['validation_regex'], '/')", "addslashes($value['validation_regex'])")
+p.write_text(s)
+PY
+
+  # Some OpenSIPS-CP 9.3.6 Domains installs still over-escape the SIP Domain
+  # field regex after the common generator patch. Keep the field required, but
+  # let the backend accept normal SIP domains such as an IP or an FQDN.
+  local domains_form="$CP_PATH/web/tools/system/domains/template/domains.form.php"
+  if [ -f "$domains_form" ]; then
+    backup_once "$domains_form"
+    python3 - "$domains_form" <<'PY'
+from pathlib import Path
+import sys
+
+p = Path(sys.argv[1])
+s = p.read_text()
+lines = []
+changed = False
+for line in s.splitlines():
+    if '"domain", "n", $domain_form' in line:
+        indent = line[:len(line) - len(line.lstrip())]
+        lines.append(indent + '"domain", "n", $domain_form[\'domain\'], 128, null);')
+        changed = True
+    else:
+        lines.append(line)
+if changed:
+    p.write_text("\n".join(lines) + "\n")
+PY
+    php -l "$domains_form"
+  fi
+
+  php -l "$CP_PATH/config/db.inc.php"
+  php -l "$forms_file"
+}
+
+configure_apache() {
+  log "Configure Apache /cp alias"
+  cat > /etc/apache2/conf-available/opensips-cp.conf <<EOF
+Alias /cp ${CP_PATH}/web
+
+<Directory ${CP_PATH}/web>
+    Options Indexes FollowSymLinks MultiViews
+    AllowOverride None
+    Require all granted
+</Directory>
+
+<Directory ${CP_PATH}>
+    Options Indexes FollowSymLinks MultiViews
+    AllowOverride None
+    Require all denied
+</Directory>
+
+<DirectoryMatch "${CP_PATH}/web/tools/.*/.*/(template|custom_actions|lib)/">
+    Require all denied
+</DirectoryMatch>
+EOF
+  a2enconf opensips-cp >/dev/null || true
+  chown -R www-data:www-data "$CP_PATH"
+  systemctl enable --now apache2
+  systemctl reload apache2
+}
+
+configure_rtpengine() {
+  log "Configure RTPengine"
+  local defaults=/etc/default/rtpengine-daemon
+  [ -f "$defaults" ] || defaults=/etc/default/rtpengine
+  backup_once "$defaults"
+
+  if [ -f "$defaults" ]; then
+    grep -q '^RUN_RTPENGINE=' "$defaults" && sed -i 's|^#*RUN_RTPENGINE=.*|RUN_RTPENGINE=yes|' "$defaults" || echo 'RUN_RTPENGINE=yes' >> "$defaults"
+    local opts="OPTIONS=\"--interface=${SIP_IP} --listen-ng=${RTPENGINE_NG} --port-min=${RTPENGINE_PORT_MIN} --port-max=${RTPENGINE_PORT_MAX} --log-level=6\""
+    grep -q '^OPTIONS=' "$defaults" && sed -i "s|^OPTIONS=.*|${opts}|" "$defaults" || echo "$opts" >> "$defaults"
+  fi
+
+  systemctl enable rtpengine-daemon
+  systemctl restart rtpengine-daemon || true
+}
+
+configure_monit() {
+  log "Configure Monit HTTP interface for OpenSIPS-CP"
+  local monitrc=/etc/monit/monitrc
+  backup_once "$monitrc"
+
+  python3 - "$monitrc" <<PY
+from pathlib import Path
+import sys
+
+p = Path(sys.argv[1])
+s = p.read_text()
+block = """set httpd port ${MONIT_PORT} and
+    use address ${MONIT_IP}
+    allow ${MONIT_IP}
+    allow ${MONIT_USER}:${MONIT_PASS}
+"""
+lines = s.splitlines()
+out = []
+i = 0
+inserted = False
+while i < len(lines):
+    line = lines[i]
+    stripped = line.strip()
+    if stripped.startswith("set httpd port") or stripped.startswith("# set httpd port"):
+        if not inserted:
+            out.extend(block.rstrip("\\n").splitlines())
+            inserted = True
+        i += 1
+        while i < len(lines):
+            nxt = lines[i]
+            nstr = nxt.strip()
+            if not nstr:
+                out.append(nxt)
+                i += 1
+                break
+            if nstr.startswith("set ") and not nstr.startswith("set httpd port"):
+                break
+            if nxt.startswith(" ") or nxt.startswith("\\t") or nstr.startswith("#"):
+                i += 1
+                continue
+            break
+        continue
+    out.append(line)
+    i += 1
+if not inserted:
+    out.append("")
+    out.extend(block.rstrip("\\n").splitlines())
+p.write_text("\\n".join(out) + "\\n")
+PY
+
+  monit -t
+  systemctl enable monit
+  systemctl restart monit
+}
+
+enable_runtime_services() {
+  log "Enable runtime services at boot"
+
+  # OpenSIPS-CP is served by Apache and uses MariaDB; it is not a separate
+  # daemon. Enabling these services makes http://SERVER_IP/cp/ available after
+  # reboot, while enabling opensips starts the SIP proxy itself.
+  systemctl enable --now mariadb
+  systemctl enable --now apache2
+  systemctl enable opensips
+  systemctl restart opensips
+  systemctl enable rtpengine-daemon
+  systemctl restart rtpengine-daemon || true
+  systemctl enable monit
+  systemctl restart monit
+}
+
+restart_and_verify() {
+  log "Restart services and verify"
+  enable_runtime_services
+  systemctl reload apache2
+
+  systemctl is-active mariadb apache2 opensips rtpengine-daemon monit
+  systemctl is-enabled mariadb apache2 opensips rtpengine-daemon monit
+  opensips -V | head -n 4
+  curl -fsS --max-time 10 "http://127.0.0.1/cp/" | grep -m1 "OpenSIPS Control Panel"
+  curl -fsS --max-time 10 -u "${MONIT_USER}:${MONIT_PASS}" "http://${MONIT_IP}:${MONIT_PORT}/" | grep -m1 "Monit"
+  curl -fsS --max-time 10 -X POST "http://${MI_HTTP_IP}:${MI_HTTP_PORT}/mi" \
+    -H 'Content-Type: application/json' \
+    -d '{"jsonrpc":"2.0","id":1,"method":"rtpengine_show"}'
+  curl -fsS --max-time 10 -X POST "http://${MI_HTTP_IP}:${MI_HTTP_PORT}/mi" \
+    -H 'Content-Type: application/json' \
+    -d '{"jsonrpc":"2.0","id":2,"method":"rtpproxy_show"}'
+  curl -fsS --max-time 10 -X POST "http://${MI_HTTP_IP}:${MI_HTTP_PORT}/mi" \
+    -H 'Content-Type: application/json' \
+    -d '{"jsonrpc":"2.0","id":3,"method":"trace"}'
+  curl -fsS --max-time 10 -X POST "http://${MI_HTTP_IP}:${MI_HTTP_PORT}/mi" \
+    -H 'Content-Type: application/json' \
+    -d '{"jsonrpc":"2.0","id":4,"method":"dr_gw_status"}'
+  curl -fsS --max-time 10 -X POST "http://${MI_HTTP_IP}:${MI_HTTP_PORT}/mi" \
+    -H 'Content-Type: application/json' \
+    -d '{"jsonrpc":"2.0","id":1,"method":"address_reload"}'
+  ss -ltnup | grep -E "(:80|:5060|:${MI_HTTP_PORT}|:2223)" || true
+}
+
+main() {
+  require_root
+  setup_apt_repo
+  install_packages
+  setup_database
+  setup_opensips_schema
+  configure_opensipsctlrc
+  patch_opensips_cfg
+  deploy_opensips_cp
+  configure_apache
+  configure_rtpengine
+  configure_monit
+  restart_and_verify
+
+  cat <<EOF
+
+Install complete.
+
+OpenSIPS-CP URL: http://${SIP_IP}/cp/
+Default OpenSIPS-CP login:
+  username: admin
+  password: opensips
+
+MI HTTP endpoint is bound to ${MI_HTTP_IP}:${MI_HTTP_PORT}/mi for local CP usage.
+Do not expose MI HTTP to the public Internet.
+EOF
+}
+
+main "$@"
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..74e787c
--- /dev/null
+++ b/package.json
@@ -0,0 +1,64 @@
+{
+  "name": "lisglosips",
+  "version": "0.2.0",
+  "private": true,
+  "packageManager": "pnpm@10.33.0",
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@nestjs/core",
+      "@prisma/client",
+      "@prisma/engines",
+      "@scarf/scarf",
+      "esbuild",
+      "prisma"
+    ],
+    "supportedArchitectures": {
+      "os": [
+        "current",
+        "linux"
+      ],
+      "cpu": [
+        "current",
+        "x64"
+      ],
+      "libc": [
+        "current",
+        "glibc"
+      ]
+    }
+  },
+  "scripts": {
+    "dev:api": "node scripts/pnpm-run.mjs --filter @lisglosips/api dev",
+    "dev:web": "node scripts/pnpm-run.mjs --filter @lisglosips/web dev",
+    "build": "node scripts/pnpm-run.mjs -r build",
+    "lint": "eslint .",
+    "typecheck": "tsc -b tsconfig.build.json --pretty",
+    "test": "vitest run",
+    "ci": "node scripts/pnpm-run.mjs lint && node scripts/pnpm-run.mjs typecheck && node scripts/pnpm-run.mjs test && node scripts/pnpm-run.mjs build",
+    "prisma:generate": "prisma generate",
+    "prisma:validate": "cross-env DATABASE_URL=mysql://lisglosips_app@127.0.0.1:3306/lisglosips prisma validate",
+    "db:seed": "prisma db seed"
+  },
+  "devDependencies": {
+    "@eslint/js": "9.39.1",
+    "@nestjs/testing": "11.1.9",
+    "@prisma/client": "6.19.0",
+    "@types/node": "22.19.0",
+    "@types/supertest": "6.0.3",
+    "@typescript-eslint/eslint-plugin": "8.48.0",
+    "@typescript-eslint/parser": "8.48.0",
+    "eslint": "9.39.1",
+    "eslint-config-prettier": "10.1.8",
+    "cross-env": "10.1.0",
+    "globals": "16.5.0",
+    "prisma": "6.19.0",
+    "supertest": "7.1.4",
+    "tsx": "4.20.6",
+    "typescript": "5.9.3",
+    "typescript-eslint": "8.48.0",
+    "vitest": "4.0.14"
+  }
+}
diff --git a/packages/auth/package.json b/packages/auth/package.json
new file mode 100644
index 0000000..4a2d093
--- /dev/null
+++ b/packages/auth/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "@lisglosips/auth",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  }
+}
diff --git a/packages/auth/src/index.spec.ts b/packages/auth/src/index.spec.ts
new file mode 100644
index 0000000..83801a3
--- /dev/null
+++ b/packages/auth/src/index.spec.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from 'vitest';
+import crypto from 'node:crypto';
+import {
+  hashPasswordArgon2id,
+  randomToken,
+  sha256Token,
+  signAccessToken,
+  verifyAccessToken,
+  verifyPasswordArgon2id
+} from './index.js';
+
+describe('auth primitives', () => {
+  it('hashes and verifies Argon2id passwords with PHC metadata', async () => {
+    const secret = crypto.randomUUID();
+    const hash = await hashPasswordArgon2id(secret, {
+      salt: Buffer.alloc(16, 7),
+      memoryKiB: 1024,
+      passes: 1
+    });
+
+    expect(hash).toMatch(/^\$argon2id\$v=19\$m=1024,t=1,p=1\$/);
+    await expect(verifyPasswordArgon2id(secret, hash)).resolves.toBe(true);
+    await expect(verifyPasswordArgon2id(crypto.randomUUID(), hash)).resolves.toBe(false);
+  });
+
+  it('hashes refresh tokens without retaining token material', () => {
+    const token = randomToken();
+    const digest = sha256Token(token);
+
+    expect(token).not.toContain(digest);
+    expect(digest).toMatch(/^[a-f0-9]{64}$/);
+  });
+
+  it('signs and verifies expiring access tokens', () => {
+    const secret = 'test-only-access-token-secret-min-32-bytes';
+    const token = signAccessToken(
+      {
+        sub: 'usr_test',
+        username: 'operator',
+        roles: ['admin'],
+        typ: 'access'
+      },
+      {
+        secret,
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        ttlSeconds: 60,
+        now: new Date('2026-06-21T00:00:00.000Z')
+      }
+    );
+
+    expect(
+      verifyAccessToken(token, {
+        secret,
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        now: new Date('2026-06-21T00:00:30.000Z')
+      })?.sub
+    ).toBe('usr_test');
+
+    expect(
+      verifyAccessToken(token, {
+        secret,
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        now: new Date('2026-06-21T00:02:00.000Z')
+      })
+    ).toBeNull();
+  });
+});
diff --git a/packages/auth/src/index.ts b/packages/auth/src/index.ts
new file mode 100644
index 0000000..7b67373
--- /dev/null
+++ b/packages/auth/src/index.ts
@@ -0,0 +1,276 @@
+export const AUTH_COOKIE_NAME = 'lisglosips_session';
+export const REFRESH_COOKIE_NAME = 'lisglosips_refresh';
+export const ACCESS_TOKEN_TYPE = 'Bearer';
+export const PASSWORD_ALGO_ARGON2ID = 'argon2id';
+
+export type PermissionKey =
+  | 'dashboard.view'
+  | 'customers.view'
+  | 'customers.manage'
+  | 'customer_gateways.view'
+  | 'customer_gateways.manage'
+  | 'vendors.view'
+  | 'vendors.manage'
+  | 'vendor_gateways.view'
+  | 'vendor_gateways.manage'
+  | 'line_groups.view'
+  | 'line_groups.manage'
+  | 'recharges.view'
+  | 'recharges.manage'
+  | 'cdr.view'
+  | 'recordings.play'
+  | 'quality.view'
+  | 'quality.manage'
+  | 'users.view'
+  | 'users.manage'
+  | 'roles.view'
+  | 'roles.manage'
+  | 'audit.view';
+
+import crypto from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const ARGON2_MEMORY_KIB = 19_456;
+const ARGON2_PASSES = 2;
+const ARGON2_PARALLELISM = 1;
+const ARGON2_TAG_LENGTH = 32;
+const ARGON2_SALT_LENGTH = 16;
+
+type NodeArgon2Sync = (
+  algorithm: 'argon2id',
+  options: {
+    message: string | Buffer;
+    nonce: Buffer;
+    parallelism: number;
+    tagLength: number;
+    memory: number;
+    passes: number;
+  }
+) => Buffer;
+
+type WasmArgon2idHash = (params: {
+  password: Uint8Array;
+  salt: Uint8Array;
+  parallelism: number;
+  passes: number;
+  memorySize: number;
+  tagLength: number;
+}) => Uint8Array;
+type WasmImports = Record<string, Record<string, unknown>>;
+type WasmInstantiatedSource = {
+  instance: {
+    exports: Record<string, unknown>;
+  };
+};
+type WasmGlobal = {
+  WebAssembly: {
+    instantiate(bytes: Buffer, imports: WasmImports): Promise<WasmInstantiatedSource>;
+  };
+};
+
+let wasmArgon2id: Promise<WasmArgon2idHash> | null = null;
+
+function b64url(input: Buffer | string): string {
+  return Buffer.from(input).toString('base64url');
+}
+
+function fromB64url(input: string): Buffer {
+  return Buffer.from(input, 'base64url');
+}
+
+export interface Argon2idPasswordHashOptions {
+  memoryKiB?: number;
+  passes?: number;
+  parallelism?: number;
+  tagLength?: number;
+  salt?: Buffer;
+}
+
+async function loadWasmArgon2id(): Promise<WasmArgon2idHash> {
+  if (!wasmArgon2id) {
+    wasmArgon2id = (async () => {
+      const baseDir = dirname(fileURLToPath(import.meta.url));
+      const setupModule = (await import(pathToFileURL(join(baseDir, '../vendor/argon2id/lib/setup.js')).href)) as {
+        default: (
+          getSIMD: (imports: WasmImports) => Promise<WasmInstantiatedSource>,
+          getNonSIMD: (imports: WasmImports) => Promise<WasmInstantiatedSource>
+        ) => Promise<WasmArgon2idHash>;
+      };
+      const wasm = (globalThis as unknown as WasmGlobal).WebAssembly;
+      const instantiate = async (fileName: string, imports: WasmImports): Promise<WasmInstantiatedSource> =>
+        wasm.instantiate(await readFile(join(baseDir, '../vendor/argon2id/dist', fileName)), imports);
+
+      return setupModule.default(
+        (imports) => instantiate('simd.wasm', imports),
+        (imports) => instantiate('no-simd.wasm', imports)
+      );
+    })();
+  }
+
+  return wasmArgon2id;
+}
+
+async function computeArgon2idDigest(params: {
+  password: string;
+  salt: Buffer;
+  parallelism: number;
+  tagLength: number;
+  memory: number;
+  passes: number;
+}): Promise<Buffer> {
+  const nodeArgon2 = (crypto as unknown as { argon2Sync?: NodeArgon2Sync }).argon2Sync;
+  if (typeof nodeArgon2 === 'function') {
+    return nodeArgon2('argon2id', {
+      message: params.password,
+      nonce: params.salt,
+      parallelism: params.parallelism,
+      tagLength: params.tagLength,
+      memory: params.memory,
+      passes: params.passes
+    });
+  }
+
+  const wasmHash = await loadWasmArgon2id();
+  return Buffer.from(
+    wasmHash({
+      password: Buffer.from(params.password, 'utf8'),
+      salt: params.salt,
+      parallelism: params.parallelism,
+      tagLength: params.tagLength,
+      memorySize: params.memory,
+      passes: params.passes
+    })
+  );
+}
+
+export async function hashPasswordArgon2id(password: string, options: Argon2idPasswordHashOptions = {}): Promise<string> {
+  if (password.length === 0) {
+    throw new Error('Password must not be empty.');
+  }
+
+  const memory = options.memoryKiB ?? ARGON2_MEMORY_KIB;
+  const passes = options.passes ?? ARGON2_PASSES;
+  const parallelism = options.parallelism ?? ARGON2_PARALLELISM;
+  const tagLength = options.tagLength ?? ARGON2_TAG_LENGTH;
+  const salt = options.salt ?? crypto.randomBytes(ARGON2_SALT_LENGTH);
+  const digest = await computeArgon2idDigest({
+    password,
+    salt,
+    parallelism,
+    tagLength,
+    memory,
+    passes
+  });
+
+  return `$argon2id$v=19$m=${memory},t=${passes},p=${parallelism}$${b64url(salt)}$${b64url(digest)}`;
+}
+
+export async function verifyPasswordArgon2id(password: string, storedHash: string): Promise<boolean> {
+  const parts = storedHash.split('$');
+  if (parts.length !== 6 || parts[1] !== 'argon2id' || parts[2] !== 'v=19') {
+    return false;
+  }
+
+  const params = Object.fromEntries(
+    parts[3].split(',').map((pair) => {
+      const [key, value] = pair.split('=');
+      return [key, Number(value)];
+    })
+  );
+
+  if (!params.m || !params.t || !params.p) {
+    return false;
+  }
+
+  const salt = fromB64url(parts[4]);
+  const expected = fromB64url(parts[5]);
+  const actual = await computeArgon2idDigest({
+    password,
+    salt,
+    parallelism: params.p,
+    tagLength: expected.length,
+    memory: params.m,
+    passes: params.t
+  });
+
+  return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
+}
+
+export function randomToken(byteLength = 48): string {
+  return crypto.randomBytes(byteLength).toString('base64url');
+}
+
+export function sha256Token(token: string): string {
+  return crypto.createHash('sha256').update(token, 'utf8').digest('hex');
+}
+
+export interface AccessTokenPayload {
+  sub: string;
+  username: string;
+  roles: string[];
+  typ: 'access';
+}
+
+export interface SignedAccessTokenPayload extends AccessTokenPayload {
+  iss: string;
+  aud: string;
+  iat: number;
+  exp: number;
+}
+
+export function signAccessToken(
+  payload: AccessTokenPayload,
+  options: {
+    secret: string;
+    issuer: string;
+    audience: string;
+    ttlSeconds: number;
+    now?: Date;
+  }
+): string {
+  const nowSeconds = Math.floor((options.now ?? new Date()).getTime() / 1000);
+  const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+  const body = b64url(
+    JSON.stringify({
+      ...payload,
+      iss: options.issuer,
+      aud: options.audience,
+      iat: nowSeconds,
+      exp: nowSeconds + options.ttlSeconds
+    } satisfies SignedAccessTokenPayload)
+  );
+  const signature = crypto.createHmac('sha256', options.secret).update(`${header}.${body}`).digest('base64url');
+
+  return `${header}.${body}.${signature}`;
+}
+
+export function verifyAccessToken(
+  token: string,
+  options: {
+    secret: string;
+    issuer: string;
+    audience: string;
+    now?: Date;
+  }
+): SignedAccessTokenPayload | null {
+  const [header, body, signature] = token.split('.');
+  if (!header || !body || !signature) {
+    return null;
+  }
+
+  const expected = crypto.createHmac('sha256', options.secret).update(`${header}.${body}`).digest('base64url');
+  if (expected.length !== signature.length || !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
+    return null;
+  }
+
+  const payload = JSON.parse(fromB64url(body).toString('utf8')) as SignedAccessTokenPayload;
+  const nowSeconds = Math.floor((options.now ?? new Date()).getTime() / 1000);
+
+  if (payload.typ !== 'access' || payload.iss !== options.issuer || payload.aud !== options.audience || payload.exp <= nowSeconds) {
+    return null;
+  }
+
+  return payload;
+}
diff --git a/packages/auth/tsconfig.json b/packages/auth/tsconfig.json
new file mode 100644
index 0000000..94b3d86
--- /dev/null
+++ b/packages/auth/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "tsBuildInfoFile": "dist/tsconfig.tsbuildinfo"
+  },
+  "include": ["src/**/*.ts"]
+}
diff --git a/packages/auth/vendor/argon2id/LICENSE b/packages/auth/vendor/argon2id/LICENSE
new file mode 100644
index 0000000..826ee17
--- /dev/null
+++ b/packages/auth/vendor/argon2id/LICENSE
@@ -0,0 +1,20 @@
+Copyright (c) 2022, Proton AG
+Copyright (c) 2017, Emil Bay github@tixz.dk (for original blake2b code from https://github.com/emilbayes/blake2b)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
\ No newline at end of file
diff --git a/packages/auth/vendor/argon2id/README.md b/packages/auth/vendor/argon2id/README.md
new file mode 100644
index 0000000..26821d0
--- /dev/null
+++ b/packages/auth/vendor/argon2id/README.md
@@ -0,0 +1,73 @@
+# Argon2id
+
+Fast, lightweight Argon2id implementation for both browser and Node:
+- optimized for bundle size (< 7KB minified and gizipped, with wasm inlined as base64)
+- SIMD support, with automatic fallback to non-SIMD binary if not supported (e.g. in Safari)
+- performance is comparable to or better than [argon2-browser](https://github.com/antelle/argon2-browser).
+
+We initially tried implementing a solution in pure JS (no Wasm) but the running time was unacceptable.
+We resorted to implement part of the module in Wasm, to take advantage of 64-bit multiplications and SIMD instructions. The Wasm binary remains small thanks to the fact that the memory is fully managed by the JS side, hence no memory management function gets included in the Wasm binary.
+
+## Install
+
+Install from npm (compiled wasm files included):
+
+```sh
+npm i argon2id
+```
+
+## Usage
+
+With bundlers like Rollup (through [plugin-wasm](https://www.npmjs.com/package/@rollup/plugin-wasm)) or Webpack (through [wasm-loader](https://www.npmjs.com/package/wasm-loader)), that automatically translate import statements like `import wasmModule from '*.wasm'` to a loader of type `wasmModule: (instanceOptions) => WebAssembly.WebAssemblyInstantiatedSource` (either sync or async), you can simply use the default export like so:
+
+```js
+import loadArgon2idWasm from 'argon2id';
+
+const argon2id = await loadArgon2idWasm();
+const hash = argon2id({
+  password: new Uint8Array(...),
+  salt: crypto.getRandomValues(new Uint8Array(32)),
+  parallelism: 4,
+  passes: 3,
+  memorySize: 2**16
+});
+```
+Refer to the [Argon2 RFC](https://www.rfc-editor.org/rfc/rfc9106.html#name-parameter-choice) for details about how to pick the parameters.
+
+**Note about memory usage:** every call to `loadArgon2idWasm` will instantiate and run a separate Wasm instance, with separate memory.
+The used Wasm memory is cleared after each call to `argon2id`, but it isn't deallocated (this is due to Wasm limitations).
+Re-loading the Wasm module is thus recommended in order to free the memory if multiple `argon2id` hashes are computed and some of them require considerably more memory than the rest.
+
+### Custom Wasm loaders
+
+The library does not require a particular toolchain. If the aforementioned bundlers are not an option, you can manually take care of setting up the Wasm modules.
+
+For instance, **in Node, the library can be used without bundlers**. You will need to pass two functions that instantiate the Wasm modules to `setupWasm` (first function is expected to take care of the SIMD binary, second one the non-SIMD one):
+
+```js
+import fs from 'fs';
+import setupWasm from 'argon2id/lib/setup.js';
+
+// point to compiled binaries
+const SIMD_FILENAME = 'argon2id/dist/simd.wasm';
+const NON_SIMD_FILENAME = 'argon2id/dist/no-simd.wasm';
+
+const argon2id = await setupWasm(
+  (importObject) => WebAssembly.instantiate(fs.readFileSync(SIMD_FILENAME), importObject),
+  (importObject) => WebAssembly.instantiate(fs.readFileSync(NON_SIMD_FILENAME), importObject),
+);
+```
+
+Using the same principle, for browsers you can use bundlers with simple base-64 file loaders. 
+
+## Compiling
+
+**The npm package already includes the compiled binaries.**<br>
+If you fork the repo, you'll have to manually compile wasm (Docker required):
+```sh
+npm run build
+```
+
+The resulting binaries will be under `dist/`.
+If you do not want to use docker, you can look into installing [emscripten](https://emscripten.org/); you'll find the compilation commands to use in `build_wasm.sh`.
+
diff --git a/packages/auth/vendor/argon2id/UPSTREAM.md b/packages/auth/vendor/argon2id/UPSTREAM.md
new file mode 100644
index 0000000..6d5b6b8
--- /dev/null
+++ b/packages/auth/vendor/argon2id/UPSTREAM.md
@@ -0,0 +1,16 @@
+# Vendored argon2id
+
+- Package: `argon2id`
+- Version: `1.0.1`
+- Source: `https://www.npmjs.com/package/argon2id`
+- Repository: `https://github.com/openpgpjs/argon2id`
+- License: MIT, see `LICENSE`.
+
+This package is vendored because the local npm registry path was unavailable during S09, while Server B runs Node.js 22 and does not expose built-in `crypto.argon2Sync`. The project code first uses Node's native Argon2id when present and falls back to this WASM implementation.
+
+WASM SHA-256:
+
+```text
+dist/no-simd.wasm  1F16D8DE5A6D8A3A4FAD5885C4784F57713D3626FD7D55F852FD79ECADBC4F8E
+dist/simd.wasm     50647E10FC8E0ADBA4F60726F3F0D77DB0E3C73516B05A83AD10390B3A8B4B0E
+```
diff --git a/packages/auth/vendor/argon2id/index.d.ts b/packages/auth/vendor/argon2id/index.d.ts
new file mode 100644
index 0000000..1878084
--- /dev/null
+++ b/packages/auth/vendor/argon2id/index.d.ts
@@ -0,0 +1,13 @@
+import type { computeHash, Argon2idParams } from "./lib/setup";
+
+/**
+ * Setup an `argon2id` instance, by loading the Wasm module that is used under the hood. The SIMD version is used as long as the platform supports it.
+ * The loaded module is then cached across `argon2id` calls.
+ * NB: the used Wasm memory is cleared across runs, but not de-allocated.
+ * Re-loading is thus recommended in order to free the memory if multiple `argon2id` hashes are computed
+ * and some of them require considerably more memory than the rest.
+ * @returns argon2id function
+ */
+export function loadWasm(): Promise<computeHash>;
+export default loadWasm;
+export type { Argon2idParams, computeHash };
diff --git a/packages/auth/vendor/argon2id/index.js b/packages/auth/vendor/argon2id/index.js
new file mode 100644
index 0000000..f6d395e
--- /dev/null
+++ b/packages/auth/vendor/argon2id/index.js
@@ -0,0 +1,10 @@
+import setupWasm from './lib/setup.js';
+import wasmSIMD from './dist/simd.wasm';
+import wasmNonSIMD from './dist/no-simd.wasm';
+
+const loadWasm = async () => setupWasm(
+  (instanceObject) => wasmSIMD(instanceObject),
+  (instanceObject) => wasmNonSIMD(instanceObject),
+);
+
+export default loadWasm;
diff --git a/packages/auth/vendor/argon2id/lib/argon2id.js b/packages/auth/vendor/argon2id/lib/argon2id.js
new file mode 100644
index 0000000..0bdbb8d
--- /dev/null
+++ b/packages/auth/vendor/argon2id/lib/argon2id.js
@@ -0,0 +1,354 @@
+import blake2b from "./blake2b.js"
+const TYPE = 2;  // Argon2id
+const VERSION = 0x13;
+const TAGBYTES_MAX = 0xFFFFFFFF; // Math.pow(2, 32) - 1;
+const TAGBYTES_MIN = 4; // Math.pow(2, 32) - 1;
+const SALTBYTES_MAX = 0xFFFFFFFF; // Math.pow(2, 32) - 1;
+const SALTBYTES_MIN = 8;
+const passwordBYTES_MAX = 0xFFFFFFFF;// Math.pow(2, 32) - 1;
+const passwordBYTES_MIN = 8;
+const MEMBYTES_MAX = 0xFFFFFFFF;// Math.pow(2, 32) - 1;
+const ADBYTES_MAX = 0xFFFFFFFF; // Math.pow(2, 32) - 1; // associated data (optional)
+const SECRETBYTES_MAX = 32; // key (optional)
+
+const ARGON2_BLOCK_SIZE = 1024;
+const ARGON2_PREHASH_DIGEST_LENGTH = 64;
+
+const isLittleEndian = new Uint8Array(new Uint16Array([0xabcd]).buffer)[0] === 0xcd;
+
+// store n as a little-endian 32-bit Uint8Array inside buf (at buf[i:i+3])
+function LE32(buf, n, i) {
+  buf[i+0] = n;
+  buf[i+1] = n >>  8;
+  buf[i+2] = n >> 16;
+  buf[i+3] = n >> 24;
+  return buf;
+}
+
+/**
+ * Store n as a 64-bit LE number in the given buffer (from buf[i] to buf[i+7])
+ * @param {Uint8Array} buf
+ * @param {Number} n
+ * @param {Number} i
+ */
+function LE64(buf, n, i) {
+  if (n > Number.MAX_SAFE_INTEGER) throw new Error("LE64: large numbers unsupported");
+  // ECMAScript standard has engines convert numbers to 32-bit integers for bitwise operations
+  // shifting by 32 or more bits is not supported (https://stackoverflow.com/questions/6729122/javascript-bit-shift-number-wraps)
+  // so we manually extract each byte
+  let remainder = n;
+  for (let offset = i; offset < i+7; offset++) { // last byte can be ignored as it would overflow MAX_SAFE_INTEGER
+    buf[offset] = remainder; // implicit & 0xff
+    remainder = (remainder - buf[offset]) / 256;
+  }
+  return buf;
+}
+
+/**
+ * Variable-Length Hash Function H'
+ * @param {Number} outlen - T
+ * @param {Uint8Array} X - value to hash
+ * @param {Uint8Array} res - output buffer, of length `outlength` or larger
+ */
+function H_(outlen, X, res) {
+  const V = new Uint8Array(64); // no need to keep around all V_i
+
+  const V1_in = new Uint8Array(4 + X.length);
+  LE32(V1_in, outlen, 0);
+  V1_in.set(X, 4);
+  if (outlen <= 64) {
+    // H'^T(A) = H^T(LE32(T)||A)
+    blake2b(outlen).update(V1_in).digest(res);
+    return res
+  }
+
+  const r = Math.ceil(outlen / 32) - 2;
+
+  // Let V_i be a 64-byte block and W_i be its first 32 bytes.
+  // V_1 = H^(64)(LE32(T)||A)
+  // V_2 = H^(64)(V_1)
+  // ...
+  // V_r = H^(64)(V_{r-1})
+  // V_{r+1} = H^(T-32*r)(V_{r})
+  // H'^T(X) = W_1 || W_2 || ... || W_r || V_{r+1}
+  for (let i = 0; i < r; i++) {
+    blake2b(64).update(i === 0 ? V1_in : V).digest(V);
+    // store W_i in result buffer already
+    res.set(V.subarray(0, 32), i*32)
+  }
+  // V_{r+1}
+  const V_r1 = new Uint8Array(blake2b(outlen - 32*r).update(V).digest());
+  res.set(V_r1, r*32);
+
+  return res;
+}
+
+// compute buf = xs ^ ys
+function XOR(wasmContext, buf, xs, ys) {
+  wasmContext.fn.XOR(
+    buf.byteOffset,
+    xs.byteOffset,
+    ys.byteOffset,
+  );
+  return buf
+}
+
+/**
+ * @param {Uint8Array} X (read-only)
+ * @param {Uint8Array} Y (read-only)
+ * @param {Uint8Array} R - output buffer
+ * @returns
+ */
+function G(wasmContext, X, Y, R) {
+  wasmContext.fn.G(
+    X.byteOffset,
+    Y.byteOffset,
+    R.byteOffset,
+    wasmContext.refs.gZ.byteOffset
+  );
+  return R;
+}
+
+function G2(wasmContext, X, Y, R) {
+  wasmContext.fn.G2(
+    X.byteOffset,
+    Y.byteOffset,
+    R.byteOffset,
+    wasmContext.refs.gZ.byteOffset
+  );
+  return R;
+}
+
+// Generator for data-independent J1, J2. Each `next()` invocation returns a new pair of values.
+function* makePRNG(wasmContext, pass, lane, slice, m_, totalPasses, segmentLength, segmentOffset) {
+  // For each segment, we do the following. First, we compute the value Z as:
+  // Z= ( LE64(r) || LE64(l) || LE64(sl) || LE64(m') || LE64(t) || LE64(y) )
+  wasmContext.refs.prngTmp.fill(0);
+  const Z = wasmContext.refs.prngTmp.subarray(0, 6 * 8);
+  LE64(Z, pass, 0);
+  LE64(Z, lane, 8);
+  LE64(Z, slice, 16);
+  LE64(Z, m_, 24);
+  LE64(Z, totalPasses, 32);
+  LE64(Z, TYPE, 40);
+
+  // Then we compute q/(128*SL) 1024-byte values
+  // G( ZERO(1024),
+  //    G( ZERO(1024), Z || LE64(1) || ZERO(968) ) ),
+  // ...,
+  // G( ZERO(1024),
+  //    G( ZERO(1024), Z || LE64(q/(128*SL)) || ZERO(968) )),
+  for(let i = 1; i <= segmentLength; i++) {
+    // tmp.set(Z); // no need to re-copy
+    LE64(wasmContext.refs.prngTmp, i, Z.length); // tmp.set(ZER0968) not necessary, memory already zeroed
+    const g2 = G2(wasmContext, wasmContext.refs.ZERO1024, wasmContext.refs.prngTmp, wasmContext.refs.prngR );
+
+    // each invocation of G^2 outputs 1024 bytes that are to be partitioned into 8-bytes values, take as X1 || X2
+    // NB: the first generated pair must be used for the first block of the segment, and so on.
+    // Hence, if some blocks are skipped (e.g. during the first pass), the corresponding J1J2 are discarded based on the given segmentOffset.
+    for(let k = i === 1 ? segmentOffset*8 : 0; k < g2.length; k += 8) {
+       yield g2.subarray(k, k+8);
+    }
+  }
+  return [];
+}
+
+function validateParams({ type, version, tagLength, password, salt, ad, secret, parallelism, memorySize, passes }) {
+  const assertLength = (name, value, min, max) => {
+    if (value < min || value > max) { throw new Error(`${name} size should be between ${min} and ${max} bytes`); }
+  }
+
+  if (type !== TYPE || version !== VERSION) throw new Error('Unsupported type or version');
+  assertLength('password', password, passwordBYTES_MIN, passwordBYTES_MAX);
+  assertLength('salt', salt, SALTBYTES_MIN, SALTBYTES_MAX);
+  assertLength('tag', tagLength, TAGBYTES_MIN, TAGBYTES_MAX);
+  assertLength('memory', memorySize, 8*parallelism, MEMBYTES_MAX);
+  // optional fields
+  ad && assertLength('associated data', ad, 0, ADBYTES_MAX);
+  secret && assertLength('secret', secret, 0, SECRETBYTES_MAX);
+
+  return { type, version, tagLength, password, salt, ad, secret, lanes: parallelism, memorySize, passes };
+}
+
+const KB = 1024;
+const WASM_PAGE_SIZE = 64 * KB;
+
+export default function argon2id(params, { memory, instance: wasmInstance }) {
+  if (!isLittleEndian) throw new Error('BigEndian system not supported'); // optmisations assume LE system
+
+  const ctx = validateParams({ type: TYPE, version: VERSION, ...params });
+
+  const { G:wasmG, G2:wasmG2, xor:wasmXOR, getLZ:wasmLZ } = wasmInstance.exports;
+  const wasmRefs = {};
+  const wasmFn = {};
+  wasmFn.G = wasmG;
+  wasmFn.G2 = wasmG2;
+  wasmFn.XOR = wasmXOR;
+
+  // The actual number of blocks is m', which is m rounded down to the nearest multiple of 4*p.
+  const m_ = 4 * ctx.lanes * Math.floor(ctx.memorySize / (4 * ctx.lanes));
+  const requiredMemory = m_ * ARGON2_BLOCK_SIZE + 10 * KB; // Additional KBs for utility references
+  if (memory.buffer.byteLength < requiredMemory) {
+    const missing = Math.ceil((requiredMemory - memory.buffer.byteLength) / WASM_PAGE_SIZE)
+    // If enough memory is available, the `memory.buffer` is internally detached and the reference updated.
+    // Otherwise, the operation fails, and the original memory can still be used.
+    memory.grow(missing)
+  }
+
+  let offset = 0;
+  // Init wasm memory needed in other functions
+  wasmRefs.gZ = new Uint8Array(memory.buffer, offset, ARGON2_BLOCK_SIZE); offset+= wasmRefs.gZ.length;
+  wasmRefs.prngR = new Uint8Array(memory.buffer, offset, ARGON2_BLOCK_SIZE); offset+=wasmRefs.prngR.length;
+  wasmRefs.prngTmp = new Uint8Array(memory.buffer, offset, ARGON2_BLOCK_SIZE); offset+=wasmRefs.prngTmp.length;
+  wasmRefs.ZERO1024 = new Uint8Array(memory.buffer, offset, 1024); offset+=wasmRefs.ZERO1024.length;
+  // Init wasm memory needed locally
+  const lz = new Uint32Array(memory.buffer, offset, 2); offset+=lz.length * Uint32Array.BYTES_PER_ELEMENT;
+  const wasmContext = { fn: wasmFn, refs: wasmRefs };
+  const newBlock = new Uint8Array(memory.buffer, offset, ARGON2_BLOCK_SIZE); offset+=newBlock.length;
+  const blockMemory = new Uint8Array(memory.buffer, offset, ctx.memorySize * ARGON2_BLOCK_SIZE);
+  const allocatedMemory = new Uint8Array(memory.buffer, 0, offset);
+
+  // 1. Establish H_0
+  const H0 = getH0(ctx);
+
+  // 2. Allocate the memory as m' 1024-byte blocks
+  // For p lanes, the memory is organized in a matrix B[i][j] of blocks with p rows (lanes) and q = m' / p columns.
+  const q = m_ / ctx.lanes;
+  const B = new Array(ctx.lanes).fill(null).map(() => new Array(q));
+  const initBlock = (i, j) => {
+    B[i][j] = blockMemory.subarray(i*q*1024 + j*1024, (i*q*1024 + j*1024) + ARGON2_BLOCK_SIZE);
+    return B[i][j];
+  }
+
+  for (let i = 0; i < ctx.lanes; i++) {
+    // const LEi = LE0; //  since p = 1 for us
+    const tmp = new Uint8Array(H0.length + 8);
+    // 3. Compute B[i][0] for all i ranging from (and including) 0 to (not including) p
+    // B[i][0] = H'^(1024)(H_0 || LE32(0) || LE32(i))
+    tmp.set(H0); LE32(tmp, 0, H0.length); LE32(tmp, i, H0.length + 4);
+    H_(ARGON2_BLOCK_SIZE, tmp, initBlock(i, 0));
+    // 4. Compute B[i][1] for all i ranging from (and including) 0 to (not including) p
+    // B[i][1] = H'^(1024)(H_0 || LE32(1) || LE32(i))
+    LE32(tmp, 1, H0.length);
+    H_(ARGON2_BLOCK_SIZE, tmp, initBlock(i, 1));
+  }
+
+    // 5. Compute B[i][j] for all i ranging from (and including) 0 to (not including) p and for all j ranging from (and including) 2
+    // to (not including) q. The computation MUST proceed slicewise (Section 3.4) : first, blocks from slice 0 are computed for all lanes
+    // (in an arbitrary order of lanes), then blocks from slice 1 are computed, etc.
+  const SL = 4; // vertical slices
+  const segmentLength = q / SL;
+  for (let pass = 0; pass < ctx.passes; pass++) {
+      // The intersection of a slice and a lane is called a segment, which has a length of q/SL. Segments of the same slice can be computed in parallel
+    for (let sl = 0; sl < SL; sl++) {
+      const isDataIndependent = pass === 0 && sl <= 1;
+      for (let i = 0; i < ctx.lanes; i++) { // lane
+        // On the first slice of the first pass, blocks 0 and 1 are already filled
+        let segmentOffset = sl === 0 && pass === 0 ? 2 : 0;
+        // no need to generate all J1J2s, use iterator/generator that creates the value on the fly (to save memory)
+        const PRNG = isDataIndependent ? makePRNG(wasmContext, pass, i, sl, m_, ctx.passes, segmentLength, segmentOffset) : null;
+        for (segmentOffset; segmentOffset < segmentLength; segmentOffset++) {
+          const j = sl * segmentLength + segmentOffset;
+          const prevBlock = j > 0 ? B[i][j-1] : B[i][q-1]; // B[i][(j-1) mod q]
+
+          // we can assume the PRNG is never done
+          const J1J2 = isDataIndependent ? PRNG.next().value : prevBlock; // .subarray(0, 8) not required since we only pass the byteOffset to wasm
+          // The block indices l and z are determined for each i, j differently for Argon2d, Argon2i, and Argon2id.
+          wasmLZ(lz.byteOffset, J1J2.byteOffset, i, ctx.lanes, pass, sl, segmentOffset, SL, segmentLength)
+          const l = lz[0]; const z = lz[1];
+          // for (let i = 0; i < p; i++ )
+          // B[i][j] = G(B[i][j-1], B[l][z])
+          // The block indices l and z are determined for each i, j differently for Argon2d, Argon2i, and Argon2id.
+          if (pass === 0) initBlock(i, j);
+          G(wasmContext, prevBlock, B[l][z], pass > 0 ? newBlock : B[i][j]);
+
+          // 6. If the number of passes t is larger than 1, we repeat step 5. However, blocks are computed differently as the old value is XORed with the new one
+          if (pass > 0) XOR(wasmContext, B[i][j], newBlock, B[i][j])
+        }
+      }
+    }
+  }
+
+  // 7. After t steps have been iterated, the final block C is computed as the XOR of the last column:
+  // C = B[0][q-1] XOR B[1][q-1] XOR ... XOR B[p-1][q-1]
+  const C = B[0][q-1];
+  for(let i = 1; i < ctx.lanes; i++) {
+    XOR(wasmContext, C, C, B[i][q-1])
+  }
+
+  const tag = H_(ctx.tagLength, C, new Uint8Array(ctx.tagLength));
+  // clear memory since the module might be cached
+  allocatedMemory.fill(0) // clear sensitive contents
+  memory.grow(0) // allow deallocation
+  // 8. The output tag is computed as H'^T(C).
+  return tag;
+
+}
+
+function getH0(ctx) {
+  const H = blake2b(ARGON2_PREHASH_DIGEST_LENGTH);
+  const ZERO32 = new Uint8Array(4);
+  const params = new Uint8Array(24);
+  LE32(params, ctx.lanes, 0);
+  LE32(params, ctx.tagLength, 4);
+  LE32(params, ctx.memorySize, 8);
+  LE32(params, ctx.passes, 12);
+  LE32(params, ctx.version, 16);
+  LE32(params, ctx.type, 20);
+
+  const toHash = [params];
+  if (ctx.password) {
+    toHash.push(LE32(new Uint8Array(4), ctx.password.length, 0))
+    toHash.push(ctx.password)
+  } else {
+    toHash.push(ZERO32) // context.password.length
+  }
+
+  if (ctx.salt) {
+    toHash.push(LE32(new Uint8Array(4), ctx.salt.length, 0))
+    toHash.push(ctx.salt)
+  } else {
+    toHash.push(ZERO32) // context.salt.length
+  }
+
+  if (ctx.secret) {
+    toHash.push(LE32(new Uint8Array(4), ctx.secret.length, 0))
+    toHash.push(ctx.secret)
+    // todo clear secret?
+  } else {
+    toHash.push(ZERO32) // context.secret.length
+  }
+
+  if (ctx.ad) {
+    toHash.push(LE32(new Uint8Array(4), ctx.ad.length, 0))
+    toHash.push(ctx.ad)
+  } else {
+    toHash.push(ZERO32) // context.ad.length
+  }
+  H.update(concatArrays(toHash))
+
+  const outputBuffer = H.digest();
+  return new Uint8Array(outputBuffer);
+}
+
+function concatArrays(arrays) {
+  if (arrays.length === 1) return arrays[0];
+
+  let totalLength = 0;
+  for (let i = 0; i < arrays.length; i++) {
+      if (!(arrays[i] instanceof Uint8Array)) {
+          throw new Error('concatArrays: Data must be in the form of a Uint8Array');
+      }
+
+      totalLength += arrays[i].length;
+  }
+
+  const result = new Uint8Array(totalLength);
+  let pos = 0;
+  arrays.forEach((element) => {
+      result.set(element, pos);
+      pos += element.length;
+  });
+
+  return result;
+}
diff --git a/packages/auth/vendor/argon2id/lib/blake2b.js b/packages/auth/vendor/argon2id/lib/blake2b.js
new file mode 100644
index 0000000..c23f60c
--- /dev/null
+++ b/packages/auth/vendor/argon2id/lib/blake2b.js
@@ -0,0 +1,256 @@
+// Adapted from the reference implementation in RFC7693
+// Initial port to Javascript by https://github.com/dcposch and https://github.com/emilbayes
+
+// Uint64 values are represented using two Uint32s, stored as little endian
+// NB: Uint32Arrays endianness depends on the underlying system, so for interoperability, conversions between Uint8Array and Uint32Arrays
+// need to be manually handled
+
+// 64-bit unsigned addition (little endian, in place)
+// Sets a[i,i+1] += b[j,j+1]
+// `a` and `b` must be Uint32Array(2)
+function ADD64 (a, i, b, j) {
+  a[i] += b[j];
+  a[i+1] += b[j+1] + (a[i] < b[j]); // add carry
+}
+
+// Increment 64-bit little-endian unsigned value by `c` (in place)
+// `a` must be Uint32Array(2)
+function INC64 (a, c) {
+  a[0] += c;
+  a[1] += (a[0] < c);
+}
+
+// G Mixing function
+// The ROTRs are inlined for speed
+function G (v, m, a, b, c, d, ix, iy) {
+  ADD64(v, a, v, b) // v[a,a+1] += v[b,b+1]
+  ADD64(v, a, m, ix) // v[a, a+1] += x ... x0
+
+  // v[d,d+1] = (v[d,d+1] xor v[a,a+1]) rotated to the right by 32 bits
+  let xor0 = v[d] ^ v[a]
+  let xor1 = v[d + 1] ^ v[a + 1]
+  v[d] = xor1
+  v[d + 1] = xor0
+
+  ADD64(v, c, v, d)
+
+  // v[b,b+1] = (v[b,b+1] xor v[c,c+1]) rotated right by 24 bits
+  xor0 = v[b] ^ v[c]
+  xor1 = v[b + 1] ^ v[c + 1]
+  v[b] = (xor0 >>> 24) ^ (xor1 << 8)
+  v[b + 1] = (xor1 >>> 24) ^ (xor0 << 8)
+
+  ADD64(v, a, v, b)
+  ADD64(v, a, m, iy)
+
+  // v[d,d+1] = (v[d,d+1] xor v[a,a+1]) rotated right by 16 bits
+  xor0 = v[d] ^ v[a]
+  xor1 = v[d + 1] ^ v[a + 1]
+  v[d] = (xor0 >>> 16) ^ (xor1 << 16)
+  v[d + 1] = (xor1 >>> 16) ^ (xor0 << 16)
+
+  ADD64(v, c, v, d)
+
+  // v[b,b+1] = (v[b,b+1] xor v[c,c+1]) rotated right by 63 bits
+  xor0 = v[b] ^ v[c]
+  xor1 = v[b + 1] ^ v[c + 1]
+  v[b] = (xor1 >>> 31) ^ (xor0 << 1)
+  v[b + 1] = (xor0 >>> 31) ^ (xor1 << 1)
+}
+
+// Initialization Vector
+const BLAKE2B_IV32 = new Uint32Array([
+  0xF3BCC908, 0x6A09E667, 0x84CAA73B, 0xBB67AE85,
+  0xFE94F82B, 0x3C6EF372, 0x5F1D36F1, 0xA54FF53A,
+  0xADE682D1, 0x510E527F, 0x2B3E6C1F, 0x9B05688C,
+  0xFB41BD6B, 0x1F83D9AB, 0x137E2179, 0x5BE0CD19
+])
+
+// These are offsets into a Uint64 buffer.
+// Multiply them all by 2 to make them offsets into a Uint32 buffer
+const SIGMA = new Uint8Array([
+  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+  14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3,
+  11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4,
+  7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8,
+  9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13,
+  2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9,
+  12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11,
+  13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10,
+  6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5,
+  10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0,
+  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+  14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3
+].map(x => x * 2))
+
+// Compression function. 'last' flag indicates last block.
+// Note: we're representing 16 uint64s as 32 uint32s
+function compress(S, last) {
+  const v = new Uint32Array(32)
+  const m = new Uint32Array(S.b.buffer, S.b.byteOffset, 32)
+
+  // init work variables
+  for (let i = 0; i < 16; i++) {
+    v[i] = S.h[i]
+    v[i + 16] = BLAKE2B_IV32[i]
+  }
+
+  // low 64 bits of offset
+  v[24] ^= S.t0[0]
+  v[25] ^= S.t0[1]
+  // high 64 bits not supported (`t1`), offset may not be higher than 2**53-1
+
+  // if last block
+  const f0 = last ? 0xFFFFFFFF : 0;
+  v[28] ^= f0;
+  v[29] ^= f0;
+
+  // twelve rounds of mixing
+  for (let i = 0; i < 12; i++) {
+    // ROUND(r)
+    const i16 = i << 4;
+    G(v, m, 0, 8, 16, 24,  SIGMA[i16 + 0], SIGMA[i16 + 1])
+    G(v, m, 2, 10, 18, 26, SIGMA[i16 + 2], SIGMA[i16 + 3])
+    G(v, m, 4, 12, 20, 28, SIGMA[i16 + 4], SIGMA[i16 + 5])
+    G(v, m, 6, 14, 22, 30, SIGMA[i16 + 6], SIGMA[i16 + 7])
+    G(v, m, 0, 10, 20, 30, SIGMA[i16 + 8], SIGMA[i16 + 9])
+    G(v, m, 2, 12, 22, 24, SIGMA[i16 + 10], SIGMA[i16 + 11])
+    G(v, m, 4, 14, 16, 26, SIGMA[i16 + 12], SIGMA[i16 + 13])
+    G(v, m, 6, 8, 18, 28,  SIGMA[i16 + 14], SIGMA[i16 + 15])
+  }
+
+  for (let i = 0; i < 16; i++) {
+    S.h[i] ^= v[i] ^ v[i + 16]
+  }
+}
+
+// Creates a BLAKE2b hashing context
+// Requires an output length between 1 and 64 bytes
+// Takes an optional Uint8Array key
+class Blake2b {
+  constructor(outlen, key, salt, personal) {
+    const params = new Uint8Array(64)
+    //  0: outlen, keylen, fanout, depth
+    //  4: leaf length, sequential mode
+    //  8: node offset
+    // 12: node offset
+    // 16: node depth, inner length, rfu
+    // 20: rfu
+    // 24: rfu
+    // 28: rfu
+    // 32: salt
+    // 36: salt
+    // 40: salt
+    // 44: salt
+    // 48: personal
+    // 52: personal
+    // 56: personal
+    // 60: personal
+
+    // init internal state
+    this.S = {
+      b: new Uint8Array(BLOCKBYTES),
+      h: new Uint32Array(OUTBYTES_MAX / 4),
+      t0: new Uint32Array(2), // input counter `t`, lower 64-bits only
+      c: 0, // `fill`, pointer within buffer, up to `BLOCKBYTES`
+      outlen // output length in bytes
+    }
+
+    // init parameter block
+    params[0] = outlen
+    if (key) params[1] = key.length
+    params[2] = 1 // fanout
+    params[3] = 1 // depth
+    if (salt) params.set(salt, 32)
+    if (personal) params.set(personal, 48)
+    const params32 = new Uint32Array(params.buffer, params.byteOffset, params.length / Uint32Array.BYTES_PER_ELEMENT);
+
+    // initialize hash state
+    for (let i = 0; i < 16; i++) {
+      this.S.h[i] = BLAKE2B_IV32[i] ^ params32[i];
+    }
+
+    // key the hash, if applicable
+    if (key) {
+      const block = new Uint8Array(BLOCKBYTES)
+      block.set(key)
+      this.update(block)
+    }
+  }
+
+  // Updates a BLAKE2b streaming hash
+  // Requires Uint8Array (byte array)
+  update(input) {
+    if (!(input instanceof Uint8Array)) throw new Error('Input must be Uint8Array or Buffer')
+    // for (let i = 0; i < input.length; i++) {
+    //   if (this.S.c === BLOCKBYTES) { // buffer full
+    //     INC64(this.S.t0, this.S.c) // add counters
+    //     compress(this.S, false)
+    //     this.S.c = 0 // empty buffer
+    //   }
+    //   this.S.b[this.S.c++] = input[i]
+    // }
+    let i = 0
+    while(i < input.length) {
+      if (this.S.c === BLOCKBYTES) { // buffer full
+        INC64(this.S.t0, this.S.c) // add counters
+        compress(this.S, false)
+        this.S.c = 0 // empty buffer
+      }
+      let left = BLOCKBYTES - this.S.c
+      this.S.b.set(input.subarray(i, i + left), this.S.c) // end index can be out of bounds
+      const fill = Math.min(left, input.length - i)
+      this.S.c += fill
+      i += fill
+    }
+    return this
+  }
+
+  /**
+   * Return a BLAKE2b hash, either filling the given Uint8Array or allocating a new one
+   * @param {Uint8Array} [prealloc] - optional preallocated buffer
+   * @returns {ArrayBuffer} message digest
+   */
+  digest(prealloc) {
+    INC64(this.S.t0, this.S.c) // mark last block offset
+
+    // final block, padded
+    this.S.b.fill(0, this.S.c);
+    this.S.c = BLOCKBYTES;
+    compress(this.S, true)
+
+    const out = prealloc || new Uint8Array(this.S.outlen);
+    for (let i = 0; i < this.S.outlen; i++) {
+      // must be loaded individually since default Uint32 endianness is platform dependant
+      out[i] = this.S.h[i >> 2] >> (8 * (i & 3))
+    }
+    this.S.h = null; // prevent calling `update` after `digest`
+    return out.buffer;
+  }
+}
+
+
+export default function createHash(outlen, key, salt, personal) {
+  if (outlen > OUTBYTES_MAX) throw new Error(`outlen must be at most ${OUTBYTES_MAX} (given: ${outlen})`)
+  if (key) {
+    if (!(key instanceof Uint8Array)) throw new Error('key must be Uint8Array or Buffer')
+    if (key.length > KEYBYTES_MAX) throw new Error(`key size must be at most ${KEYBYTES_MAX} (given: ${key.length})`)
+  }
+  if (salt) {
+    if (!(salt instanceof Uint8Array)) throw new Error('salt must be Uint8Array or Buffer')
+    if (salt.length !== SALTBYTES) throw new Error(`salt must be exactly ${SALTBYTES} (given: ${salt.length}`)
+  }
+  if (personal) {
+    if (!(personal instanceof Uint8Array)) throw new Error('personal must be Uint8Array or Buffer')
+    if (personal.length !== PERSONALBYTES) throw new Error(`salt must be exactly ${PERSONALBYTES} (given: ${personal.length}`)
+  }
+
+  return new Blake2b(outlen, key, salt, personal)
+}
+
+const OUTBYTES_MAX = 64;
+const KEYBYTES_MAX = 64;
+const SALTBYTES = 16;
+const PERSONALBYTES = 16;
+const BLOCKBYTES = 128;
+
diff --git a/packages/auth/vendor/argon2id/lib/setup.d.ts b/packages/auth/vendor/argon2id/lib/setup.d.ts
new file mode 100644
index 0000000..51c1428
--- /dev/null
+++ b/packages/auth/vendor/argon2id/lib/setup.d.ts
@@ -0,0 +1,35 @@
+export interface Argon2idParams {
+  password: Uint8Array;
+  salt: Uint8Array;
+  /** Degree of parallelism (number of lanes) */
+  parallelism: number;
+  /** Number of iterations */
+  passes: number;
+  /** Memory cost in kibibytes */
+  memorySize: number;
+  /** Output tag length */
+  tagLength: number;
+  /** Associated Data */
+  ad?: Uint8Array;
+  /** Secret Data */
+  secret?: Uint8Array;
+}
+
+declare function argon2id(params: Argon2idParams): Uint8Array;
+export type computeHash = typeof argon2id;
+
+type MaybePromise<T> = T | Promise<T>;
+
+declare function customInstanceLoader(importObject: WebAssembly.Imports): MaybePromise<WebAssembly.WebAssemblyInstantiatedSource>;
+
+/**
+ * Load Wasm module and return argon2id wrapper.
+ * It is platform-independent and it relies on the two functions given in input to instatiate the Wasm instances.
+ * @param getSIMD - function instantiating and returning the SIMD Wasm instance
+ * @param getNonSIMD - function instantiating and returning the non-SIMD Wasm instance
+ * @returns {computeHash}
+ */
+export default function setupWasm(
+  getSIMD: typeof customInstanceLoader,
+  getNonSIMD: typeof customInstanceLoader,
+): Promise<computeHash>;
diff --git a/packages/auth/vendor/argon2id/lib/setup.js b/packages/auth/vendor/argon2id/lib/setup.js
new file mode 100644
index 0000000..65c1670
--- /dev/null
+++ b/packages/auth/vendor/argon2id/lib/setup.js
@@ -0,0 +1,46 @@
+import argon2id from "./argon2id.js";
+
+let isSIMDSupported;
+async function wasmLoader(memory, getSIMD, getNonSIMD) {
+  const importObject = { env: { memory } };
+  if (isSIMDSupported === undefined) {
+    try {
+      const loaded = await getSIMD(importObject);
+      isSIMDSupported = true;
+      return loaded;
+    } catch(e) {
+      isSIMDSupported = false;
+    }
+  }
+
+  const loader = isSIMDSupported ? getSIMD : getNonSIMD;
+  return loader(importObject);
+}
+
+export default async function setupWasm(getSIMD, getNonSIMD) {
+  const memory = new WebAssembly.Memory({
+    // in pages of 64KiB each
+    // these values need to be compatible with those declared when building in `build-wasm`
+    initial: 1040,  // 65MB
+    maximum: 65536, // 4GB
+  });
+  const wasmModule = await wasmLoader(memory, getSIMD, getNonSIMD);
+
+  /**
+   * Argon2id hash function
+   * @callback computeHash
+   * @param {Object} params
+   * @param {Uint8Array} params.password - password
+   * @param {Uint8Array} params.salt - salt
+   * @param {Integer} params.parallelism
+   * @param {Integer} params.passes
+   * @param {Integer} params.memorySize - in kibibytes
+   * @param {Integer} params.tagLength - output tag length
+   * @param {Uint8Array} [params.ad] - associated data (optional)
+   * @param {Uint8Array} [params.secret] - secret data (optional)
+   * @return {Uint8Array} argon2id hash
+   */
+  const computeHash = (params) => argon2id(params, { instance: wasmModule.instance, memory });
+
+  return computeHash;
+}
diff --git a/packages/auth/vendor/argon2id/lib/wasm.c b/packages/auth/vendor/argon2id/lib/wasm.c
new file mode 100644
index 0000000..7d01d6c
--- /dev/null
+++ b/packages/auth/vendor/argon2id/lib/wasm.c
@@ -0,0 +1,308 @@
+/**
+ * Vectorised code mostly taken from: Argon2 reference C implementations (www.github.com/P-H-C/phc-winner-argon2)
+ * Copyright 2015 Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves
+ * Licence: CC0 1.0 Universal (https://creativecommons.org/publicdomain/zero/1.0)
+ */
+#include <stdint.h>
+// #include <stdio.h>
+#undef EMSCRIPTEN_KEEPALIVE
+#define EMSCRIPTEN_KEEPALIVE __attribute__((used)) __attribute__((retain))
+
+#if defined(__SSSE3__) || defined(__SSE2__)
+#include <emmintrin.h>
+
+#if defined(__SSSE3__)
+#include <tmmintrin.h>
+  #define r16                                                                    \
+      (_mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9))
+  #define r24                                                                    \
+      (_mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10))
+  #define _mm_roti_epi64(x, c)                                                   \
+      (-(c) == 32)                                                               \
+          ? _mm_shuffle_epi32((x), _MM_SHUFFLE(2, 3, 0, 1))                      \
+          : (-(c) == 24)                                                         \
+                ? _mm_shuffle_epi8((x), r24)                                     \
+                : (-(c) == 16)                                                   \
+                      ? _mm_shuffle_epi8((x), r16)                               \
+                      : (-(c) == 63)                                             \
+                            ? _mm_xor_si128(_mm_srli_epi64((x), -(c)),           \
+                                            _mm_add_epi64((x), (x)))             \
+                            : _mm_xor_si128(_mm_srli_epi64((x), -(c)),           \
+                                            _mm_slli_epi64((x), 64 - (-(c))))
+#else /* SSE2 */
+  #define _mm_roti_epi64(r, c)                                                   \
+      _mm_xor_si128(_mm_srli_epi64((r), -(c)), _mm_slli_epi64((r), 64 - (-(c))))
+#endif
+static __m128i fBlaMka(__m128i x, __m128i y) {
+    const __m128i z = _mm_mul_epu32(x, y);
+    return _mm_add_epi64(_mm_add_epi64(x, y), _mm_add_epi64(z, z));
+}
+
+#define GB1(A0, B0, C0, D0, A1, B1, C1, D1)                                \
+  do {                                                                     \
+    A0 = fBlaMka(A0, B0);                                                  \
+    A1 = fBlaMka(A1, B1);                                                  \
+                                                                           \
+    D0 = _mm_xor_si128(D0, A0);                                            \
+    D1 = _mm_xor_si128(D1, A1);                                            \
+                                                                           \
+    D0 = _mm_roti_epi64(D0, -32);                                          \
+    D1 = _mm_roti_epi64(D1, -32);                                          \
+                                                                           \
+    C0 = fBlaMka(C0, D0);                                                  \
+    C1 = fBlaMka(C1, D1);                                                  \
+                                                                           \
+    B0 = _mm_xor_si128(B0, C0);                                            \
+    B1 = _mm_xor_si128(B1, C1);                                            \
+                                                                           \
+    B0 = _mm_roti_epi64(B0, -24);                                          \
+    B1 = _mm_roti_epi64(B1, -24);                                          \
+  } while ((void)0, 0) 
+
+#define GB2(A0, B0, C0, D0, A1, B1, C1, D1)                                \
+  do {                                                                     \
+    A0 = fBlaMka(A0, B0);                                                  \
+    A1 = fBlaMka(A1, B1);                                                  \
+                                                                           \
+    D0 = _mm_xor_si128(D0, A0);                                            \
+    D1 = _mm_xor_si128(D1, A1);                                            \
+                                                                           \
+    D0 = _mm_roti_epi64(D0, -16);                                          \
+    D1 = _mm_roti_epi64(D1, -16);                                          \
+                                                                           \
+    C0 = fBlaMka(C0, D0);                                                  \
+    C1 = fBlaMka(C1, D1);                                                  \
+                                                                           \
+    B0 = _mm_xor_si128(B0, C0);                                            \
+    B1 = _mm_xor_si128(B1, C1);                                            \
+                                                                           \
+    B0 = _mm_roti_epi64(B0, -63);                                          \
+    B1 = _mm_roti_epi64(B1, -63);                                          \
+  } while ((void)0, 0)
+
+#if defined(__SSSE3__)
+  #define DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1)                            \
+      do {                                                                       \
+          __m128i t0 = _mm_alignr_epi8(B1, B0, 8);                               \
+          __m128i t1 = _mm_alignr_epi8(B0, B1, 8);                               \
+          B0 = t0;                                                               \
+          B1 = t1;                                                               \
+                                                                                \
+          t0 = C0;                                                               \
+          C0 = C1;                                                               \
+          C1 = t0;                                                               \
+                                                                                \
+          t0 = _mm_alignr_epi8(D1, D0, 8);                                       \
+          t1 = _mm_alignr_epi8(D0, D1, 8);                                       \
+          D0 = t1;                                                               \
+          D1 = t0;                                                               \
+      } while ((void)0, 0)
+
+  #define UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1)                          \
+      do {                                                                       \
+          __m128i t0 = _mm_alignr_epi8(B0, B1, 8);                               \
+          __m128i t1 = _mm_alignr_epi8(B1, B0, 8);                               \
+          B0 = t0;                                                               \
+          B1 = t1;                                                               \
+                                                                                \
+          t0 = C0;                                                               \
+          C0 = C1;                                                               \
+          C1 = t0;                                                               \
+                                                                                \
+          t0 = _mm_alignr_epi8(D0, D1, 8);                                       \
+          t1 = _mm_alignr_epi8(D1, D0, 8);                                       \
+          D0 = t1;                                                               \
+          D1 = t0;                                                               \
+      } while ((void)0, 0)
+#else /* SSE2 */
+  #define DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1)                        \
+    do {                                                                     \
+      __m128i t0 = D0;                                                       \
+      __m128i t1 = B0;                                                       \
+      D0 = C0;                                                               \
+      C0 = C1;                                                               \
+      C1 = D0;                                                               \
+      D0 = _mm_unpackhi_epi64(D1, _mm_unpacklo_epi64(t0, t0));               \
+      D1 = _mm_unpackhi_epi64(t0, _mm_unpacklo_epi64(D1, D1));               \
+      B0 = _mm_unpackhi_epi64(B0, _mm_unpacklo_epi64(B1, B1));               \
+      B1 = _mm_unpackhi_epi64(B1, _mm_unpacklo_epi64(t1, t1));               \
+    } while ((void)0, 0)
+
+  #define UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1)                      \
+    do {                                                                     \
+      __m128i t0, t1;                                                        \
+      t0 = C0;                                                               \
+      C0 = C1;                                                               \
+      C1 = t0;                                                               \
+      t0 = B0;                                                               \
+      t1 = D0;                                                               \
+      B0 = _mm_unpackhi_epi64(B1, _mm_unpacklo_epi64(B0, B0));               \
+      B1 = _mm_unpackhi_epi64(t0, _mm_unpacklo_epi64(B1, B1));               \
+      D0 = _mm_unpackhi_epi64(D0, _mm_unpacklo_epi64(D1, D1));               \
+      D1 = _mm_unpackhi_epi64(D1, _mm_unpacklo_epi64(t1, t1));               \
+    } while ((void)0, 0)
+#endif
+// BLAKE2_ROUND in reference code
+#define P(A0, A1, B0, B1, C0, C1, D0, D1)                                  \
+  do {                                                                     \
+    GB1(A0, B0, C0, D0, A1, B1, C1, D1);                                   \
+    GB2(A0, B0, C0, D0, A1, B1, C1, D1);                                   \
+                                                                           \
+    DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1);                           \
+                                                                           \
+    GB1(A0, B0, C0, D0, A1, B1, C1, D1);                                   \
+    GB2(A0, B0, C0, D0, A1, B1, C1, D1);                                   \
+                                                                           \
+    UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1);                         \
+  } while ((void)0, 0)
+
+
+EMSCRIPTEN_KEEPALIVE void xor(__m128i* out, __m128i* x, __m128i* y){
+  for(uint8_t i = 0; i < 64; i++) { // ARGON2_BLOCK_SIZE (1024) / 16 bytes (128bits) = 64
+    out[i] = _mm_xor_si128(x[i], y[i]);
+  }
+}
+
+// G will be given uint64_t* values by JS, which can be automatically casted to _m128i*:
+// see https://stackoverflow.com/questions/11034302/sse-difference-between-mm-load-store-vs-using-direct-pointer-access
+EMSCRIPTEN_KEEPALIVE void G(__m128i* X, __m128i* Y, __m128i* R, __m128i* Z) {
+    for (uint8_t i = 0; i < 64; i++) { // inlined `xor` to set both R and Z
+      R[i] = Z[i] = _mm_xor_si128(X[i], Y[i]);
+    }
+
+    for (uint8_t i = 0; i < 8; ++i) {
+      P(Z[8 * i + 0], Z[8 * i + 1], Z[8 * i + 2],
+        Z[8 * i + 3], Z[8 * i + 4], Z[8 * i + 5],
+        Z[8 * i + 6], Z[8 * i + 7]);
+    }
+
+    for (uint8_t i = 0; i < 8; ++i) {
+      P(Z[8 * 0 + i], Z[8 * 1 + i], Z[8 * 2 + i],
+        Z[8 * 3 + i], Z[8 * 4 + i], Z[8 * 5 + i],
+        Z[8 * 6 + i], Z[8 * 7 + i]);
+    }
+
+    xor(R, R, Z);
+}
+
+// G^2
+EMSCRIPTEN_KEEPALIVE void G2(__m128i* X, __m128i* Y, __m128i* R, __m128i* Z) {
+  G( X, Y, R, Z );
+  G( X, R, R, Z );
+}
+
+#else // no vectorization
+
+uint64_t rotr64(uint64_t x, uint64_t n) { return (x >> n) ^ (x << (64 - n)); }
+
+#define LSB(x) ((x) & 0xffffffff)
+EMSCRIPTEN_KEEPALIVE void xor(uint64_t* out, uint64_t* x, uint64_t* y){for(uint8_t i = 0; i < 128; i++) out[i] = x[i] ^ y[i];}
+
+
+void GB(uint64_t* v, int a, int b, int c, int d) {
+
+  // a = (a + b + 2 * trunc(a) * trunc(b)) mod 2^(64)
+  v[a] += v[b] + 2 * LSB(v[a]) * LSB(v[b]);
+
+  // d = (d XOR a) >>> 32, where >>> is a rotation
+  v[d] = rotr64(v[d] ^ v[a], 32);
+  // c = (c + d + 2 * trunc(c) * trunc(d)) mod 2^(64)
+  v[c] += v[d] + 2 * LSB(v[c]) * LSB(v[d]);
+
+  // b = (b XOR c) >>> 24
+  v[b] = rotr64(v[b] ^ v[c], 24);
+
+  // a = (a + b + 2 * trunc(a) * trunc(b)) mod 2^(64)
+  v[a] += v[b] + 2 * LSB(v[a]) * LSB(v[b]);
+
+
+  // d = (d XOR a) >>> 16
+  v[d] = rotr64(v[d] ^ v[a], 16);
+
+
+  // c = (c + d + 2 * trunc(c) * trunc(d)) mod 2^(64)
+  v[c] += v[d] + 2 * LSB(v[c]) * LSB(v[d]);
+
+
+
+  // b = (b XOR c) >>> 63
+  v[b] = rotr64(v[b] ^ v[c], 63);
+
+}
+
+void P(uint64_t* v, uint16_t i0,uint16_t i1,uint16_t i2,uint16_t i3,uint16_t i4,uint16_t i5,uint16_t i6,uint16_t i7, uint16_t i8,uint16_t i9,uint16_t i10,uint16_t i11,uint16_t i12,uint16_t i13,uint16_t i14,uint16_t i15) {
+  // v stores 16 64-bit values
+
+  GB(v, i0,  i4, i8, i12);
+  GB(v, i1,  i5, i9, i13);
+  GB(v, i2, i6, i10, i14);
+  GB(v, i3, i7, i11, i15);
+
+  GB(v, i0, i5, i10, i15);
+  GB(v, i1, i6, i11, i12);
+  GB(v, i2, i7, i8, i13);
+  GB(v, i3,  i4, i9, i14);
+}
+// given a copy of R, compute Z (in-place) 
+EMSCRIPTEN_KEEPALIVE void G(uint64_t* X, uint64_t* Y, uint64_t* R, uint64_t* Z) {
+  xor(R, X, Y);
+  // // we need to store S_i = (v_{2*i+1} || v_{2*i}), for v[i] of 64 bits
+  // // S[0] = R[8:15] || R[0:7]
+  for(uint8_t i = 0; i < 128; i+=16) {
+    Z[i+0] = R[i+0]; Z[i+1] = R[i+1]; Z[i+2] = R[i+2]; Z[i+3] = R[i+3];
+    Z[i+4] = R[i+4]; Z[i+5] = R[i+5]; Z[i+6] = R[i+6]; Z[i+7] = R[i+7];
+    Z[i+8] = R[i+8]; Z[i+9] = R[i+9]; Z[i+10] = R[i+10]; Z[i+11] = R[i+11];
+    Z[i+12] = R[i+12]; Z[i+13] = R[i+13]; Z[i+14] = R[i+14]; Z[i+15] = R[i+15];
+    // const ids = [0, 1, 2, 3, 4, 5, 6, 7].map(j => i*128 + j*16); // 0, 16, .. 112 | 128, 144...
+    // ( Q_0,  Q_1,  Q_2, ... ,  Q_7) <- P( R_0,  R_1,  R_2, ... ,  R_7) of 16-bytes each
+    P(Z,i+0,  i+1,  i+2,  i+3,
+        i+4,  i+5,  i+6,  i+7,
+        i+8,  i+9,  i+10, i+11,
+        i+12, i+13, i+14, i+15);
+  }
+
+  for(uint8_t i = 0; i < 16; i+=2) {
+    // Q_0 = Q[8:15] || Q[0:7]
+    // const ids = [0, 1, 2, 3, 4, 5, 6, 7].map(j => i*16 + j*128); // 128 .. 896 | 16, 144 .. 912 | ..
+    // ( Z_0,  Z_8, Z_16, ... , Z_56) <- P( Q_0,  Q_8, Q_16, ... , Q_56) of 16-bytes each
+    // ( Z_1,  Z_9, Z_17, ... , Z_57) <- P( Q_1,  Q_9, Q_17, ... , Q_57) ...
+    P(Z, i+0, i+1, i+16, i+17,
+         i+32, i+33, i+48, i+49,
+         i+64, i+65, i+80, i+81,
+         i+96, i+97, i+112, i+113); // store one column of Z at a time
+  }
+
+  xor(R, R, Z);
+  
+}
+
+// G^2
+EMSCRIPTEN_KEEPALIVE void G2(uint64_t* X, uint64_t* Y, uint64_t* R, uint64_t* Z) {
+  G( X, Y, R, Z );
+  G( X, R, R, Z );
+}
+#endif
+
+// Returns out = [l, z]
+EMSCRIPTEN_KEEPALIVE uint32_t* getLZ(uint32_t* out, uint32_t* J1J2, uint32_t currentLane, uint32_t p, uint32_t pass, uint32_t slice, uint32_t segmentOffset, uint32_t SL, uint32_t segmentLength) {
+  // For the first pass (r=0) and the first slice (sl=0), the block is taken from the current lane.
+  uint32_t l = (pass == 0 && slice == 0) ? currentLane : J1J2[1] % p;
+
+  // W includes the indices of all blocks in the last SL - 1 = 3 segments computed and finished (possibly from previous pass, if any).
+  // Plus, if `l` is on the current lane, we can also reference the finished blocks in the current segment (up to 'offset')
+  uint32_t offset = l == currentLane
+    ? segmentOffset - 1
+    : segmentOffset == 0 ? -1 : 0; // If B[i][j] is the first block of a segment, then the very last index from W is excluded.
+  uint32_t segmentCount = pass == 0 ? slice : SL-1;
+  uint64_t W_area  = segmentCount * segmentLength + offset;
+  // cast to uint64_t since we don't want the multiplication to be in uint32_t space
+  uint32_t x = ((uint64_t)J1J2[0] * J1J2[0]) >> 32;
+  uint32_t y = (W_area * x) >> 32;
+  uint32_t zz = W_area - 1 - y;
+  uint32_t startPos = pass == 0 ? 0 : (slice + 1) * segmentLength; // next segment (except for first pass)
+  // TODO (?) possible optimisation: zz < 2 * (SL * segmentLength) so we can use an if instead of %
+  uint32_t z = (startPos + zz) % (SL * segmentLength);
+  out[0] = l;
+  out[1] = z;
+  return out;
+}
\ No newline at end of file
diff --git a/packages/auth/vendor/argon2id/package.json b/packages/auth/vendor/argon2id/package.json
new file mode 100644
index 0000000..c781783
--- /dev/null
+++ b/packages/auth/vendor/argon2id/package.json
@@ -0,0 +1,55 @@
+{
+  "name": "argon2id",
+  "version": "1.0.1",
+  "description": "Argon2id implementation in pure Javascript",
+  "main": "index.js",
+  "type": "module",
+  "types": "index.d.ts",
+  "files": [
+    "dist/",
+    "lib/",
+    "index.d.ts"
+  ],
+  "scripts": {
+    "test": "mocha --loader=ts-node/esm test/blake2b.spec.js test/argon2id.spec.ts",
+    "lint": "eslint index.js lib test",
+    "build": "rm -rf dist && mkdir dist && ./build-wasm.sh",
+    "test-browser": "karma start karma.config.cjs",
+    "preversion": "npm run build && npm test"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openpgpjs/argon2id.git"
+  },
+  "keywords": [
+    "argon2",
+    "argon2id",
+    "rfc9106"
+  ],
+  "license": "MIT",
+  "devDependencies": {
+    "@types/chai": "^4.3.4",
+    "@types/mocha": "^10.0.1",
+    "@typescript-eslint/eslint-plugin": "^5.51.0",
+    "@typescript-eslint/parser": "^5.51.0",
+    "chai": "^4.3.7",
+    "eslint": "^8.32.0",
+    "eslint-plugin-import": "^2.27.5",
+    "karma": "^6.4.1",
+    "karma-browserstack-launcher": "^1.6.0",
+    "karma-chrome-launcher": "^3.1.1",
+    "karma-firefox-launcher": "^2.1.2",
+    "karma-mocha": "^2.0.1",
+    "karma-mocha-reporter": "^2.2.5",
+    "karma-webkit-launcher": "^2.1.0",
+    "karma-webpack": "^5.0.0",
+    "mocha": "^10.2.0",
+    "playwright": "^1.30.0",
+    "string-replace-loader": "^3.1.0",
+    "ts-loader": "^9.4.2",
+    "ts-node": "^10.9.1",
+    "wasm-loader": "^1.3.0",
+    "webpack": "^5.75.0",
+    "webpack-cli": "^5.0.1"
+  }
+}
diff --git a/packages/contracts/package.json b/packages/contracts/package.json
new file mode 100644
index 0000000..6e4e29d
--- /dev/null
+++ b/packages/contracts/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "@lisglosips/contracts",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  }
+}
diff --git a/packages/contracts/src/index.ts b/packages/contracts/src/index.ts
new file mode 100644
index 0000000..45ea0f4
--- /dev/null
+++ b/packages/contracts/src/index.ts
@@ -0,0 +1,10 @@
+export const API_PREFIX = '/api/v2';
+
+export type HealthStatus = 'ok' | 'degraded' | 'down';
+
+export interface HealthCheckResponse {
+  status: HealthStatus;
+  service: string;
+  timestamp: string;
+  checks: Record<string, HealthStatus>;
+}
diff --git a/packages/contracts/tsconfig.json b/packages/contracts/tsconfig.json
new file mode 100644
index 0000000..94b3d86
--- /dev/null
+++ b/packages/contracts/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "tsBuildInfoFile": "dist/tsconfig.tsbuildinfo"
+  },
+  "include": ["src/**/*.ts"]
+}
diff --git a/packages/database/package.json b/packages/database/package.json
new file mode 100644
index 0000000..c1ffbc2
--- /dev/null
+++ b/packages/database/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "@lisglosips/database",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "@prisma/client": "6.19.0"
+  }
+}
diff --git a/packages/database/src/index.ts b/packages/database/src/index.ts
new file mode 100644
index 0000000..a03832b
--- /dev/null
+++ b/packages/database/src/index.ts
@@ -0,0 +1,3 @@
+export { Prisma, PrismaClient } from '@prisma/client';
+
+export const DATABASE_PROVIDER = 'mysql';
diff --git a/packages/database/src/schema-contract.spec.ts b/packages/database/src/schema-contract.spec.ts
new file mode 100644
index 0000000..d57d6e5
--- /dev/null
+++ b/packages/database/src/schema-contract.spec.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const schema = readFileSync(join(process.cwd(), 'prisma/schema.prisma'), 'utf8');
+const migration = readFileSync(join(process.cwd(), 'prisma/migrations/20260621090000_init_v2_schema/migration.sql'), 'utf8');
+const authMigration = readFileSync(join(process.cwd(), 'prisma/migrations/20260621093000_auth_sessions/migration.sql'), 'utf8');
+
+describe('Prisma schema contract', () => {
+  it('defines every V2 core business table', () => {
+    const tables = [
+      'customers',
+      'customer_gateways',
+      'customer_gateway_policies',
+      'customer_recharges',
+      'vendors',
+      'vendor_recharges',
+      'vendor_gateways',
+      'vendor_gateway_forbidden_periods',
+      'vendor_gateway_codecs',
+      'vendor_gateway_prefix_rules',
+      'landing_line_groups',
+      'landing_line_group_items',
+      'raw_cdrs',
+      'rated_cdrs',
+      'recordings',
+      'quality_sampling_rules',
+      'quality_reviews',
+      'users',
+      'roles',
+      'permissions',
+      'user_roles',
+      'user_sessions',
+      'role_permissions',
+      'audit_logs',
+      'outbox_events',
+      'idempotency_keys'
+    ];
+
+    for (const table of tables) {
+      expect(schema).toContain(`@@map("${table}")`);
+      expect(`${migration}\n${authMigration}`).toContain(`CREATE TABLE \`${table}\``);
+    }
+  });
+
+  it('keeps money and idempotent facts constrained', () => {
+    expect(migration).toContain('DECIMAL(20, 6)');
+    expect(migration).toContain('UNIQUE INDEX `raw_cdrs_event_id_key`');
+    expect(migration).toContain('UNIQUE INDEX `raw_cdrs_call_id_ended_at_key`');
+    expect(migration).toContain('UNIQUE INDEX `customer_recharges_idempotency_key_key`');
+    expect(migration).toContain('UNIQUE INDEX `vendor_recharges_idempotency_key_key`');
+    expect(migration).toContain('UNIQUE INDEX `idempotency_keys_key_key`');
+  });
+
+  it('models audit columns and outbox publishing state', () => {
+    expect(schema).toContain('createdAt');
+    expect(schema).toContain('updatedAt');
+    expect(schema).toContain('version');
+    expect(schema).toContain('model OutboxEvent');
+    expect(schema).toContain('enum OutboxStatus');
+  });
+
+  it('stores refresh sessions as revocable token digests', () => {
+    expect(schema).toContain('model UserSession');
+    expect(authMigration).toContain('`refresh_token_hash` CHAR(64) NOT NULL');
+    expect(authMigration).toContain('UNIQUE INDEX `user_sessions_refresh_token_hash_key`');
+    expect(authMigration).toContain('`revoked_at` DATETIME(3) NULL');
+    expect(authMigration).toContain('`rotated_from_id` VARCHAR(40) NULL');
+  });
+});
diff --git a/packages/database/tsconfig.json b/packages/database/tsconfig.json
new file mode 100644
index 0000000..94b3d86
--- /dev/null
+++ b/packages/database/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "tsBuildInfoFile": "dist/tsconfig.tsbuildinfo"
+  },
+  "include": ["src/**/*.ts"]
+}
diff --git a/packages/domain/package.json b/packages/domain/package.json
new file mode 100644
index 0000000..30c7705
--- /dev/null
+++ b/packages/domain/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "@lisglosips/domain",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  }
+}
diff --git a/packages/domain/src/index.ts b/packages/domain/src/index.ts
new file mode 100644
index 0000000..10d49c8
--- /dev/null
+++ b/packages/domain/src/index.ts
@@ -0,0 +1,12 @@
+export const MONEY_SCALE = 6;
+
+export type EntityStatus = 'enabled' | 'disabled';
+
+export interface AuditedEntity {
+  id: string;
+  createdAt: Date;
+  updatedAt: Date;
+  createdBy: string | null;
+  updatedBy: string | null;
+  version: number;
+}
diff --git a/packages/domain/tsconfig.json b/packages/domain/tsconfig.json
new file mode 100644
index 0000000..94b3d86
--- /dev/null
+++ b/packages/domain/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "tsBuildInfoFile": "dist/tsconfig.tsbuildinfo"
+  },
+  "include": ["src/**/*.ts"]
+}
diff --git a/packages/observability/package.json b/packages/observability/package.json
new file mode 100644
index 0000000..eb5eb34
--- /dev/null
+++ b/packages/observability/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "@lisglosips/observability",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "pino": "9.14.0"
+  }
+}
diff --git a/packages/observability/src/index.ts b/packages/observability/src/index.ts
new file mode 100644
index 0000000..f096909
--- /dev/null
+++ b/packages/observability/src/index.ts
@@ -0,0 +1,29 @@
+import pino, { type Logger, type LoggerOptions } from 'pino';
+
+export const LOG_REDACT_PATHS = [
+  'req.headers.authorization',
+  'req.headers.cookie',
+  'res.headers["set-cookie"]',
+  '*.password',
+  '*.sipPassword',
+  '*.sipHa1',
+  '*.token',
+  '*.refreshToken'
+];
+
+export function createLogger(service: string, level = 'info'): Logger {
+  const options: LoggerOptions = {
+    name: service,
+    level,
+    redact: {
+      paths: LOG_REDACT_PATHS,
+      censor: '[REDACTED]'
+    },
+    base: {
+      service
+    },
+    timestamp: pino.stdTimeFunctions.isoTime
+  };
+
+  return pino(options);
+}
diff --git a/packages/observability/tsconfig.json b/packages/observability/tsconfig.json
new file mode 100644
index 0000000..94b3d86
--- /dev/null
+++ b/packages/observability/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "tsBuildInfoFile": "dist/tsconfig.tsbuildinfo"
+  },
+  "include": ["src/**/*.ts"]
+}
diff --git a/packages/redis/package.json b/packages/redis/package.json
new file mode 100644
index 0000000..918d5b9
--- /dev/null
+++ b/packages/redis/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "@lisglosips/redis",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "ioredis": "5.8.2"
+  }
+}
diff --git a/packages/redis/src/cdr-stream.spec.ts b/packages/redis/src/cdr-stream.spec.ts
new file mode 100644
index 0000000..40d6528
--- /dev/null
+++ b/packages/redis/src/cdr-stream.spec.ts
@@ -0,0 +1,273 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  CDR_CONSUMER_GROUP,
+  CDR_DEADLETTER_STREAM,
+  CDR_STREAM,
+  ensureCdrConsumerGroup,
+  parseCdrStreamEvent,
+  processCdrBatch,
+  processPendingCdrBatch,
+  publishCdrEvent,
+  CdrRetryableError,
+  type CdrStreamPublishInput,
+  type CdrRedisCommands,
+  type RedisAutoClaimResponse,
+  type RedisStreamEntry,
+  type RedisStreamReadResponse
+} from './index.js';
+
+class FakeRedis implements CdrRedisCommands {
+  readonly streams = new Map<string, RedisStreamEntry[]>();
+  readonly groups = new Map<string, { delivered: number; pending: Map<string, RedisStreamEntry> }>();
+  readonly locks = new Set<string>();
+
+  async xadd(stream: string, id: string, ...fieldValues: string[]): Promise<string> {
+    const entries = this.streams.get(stream) ?? [];
+    const redisId = id === '*' ? `${entries.length + 1}-0` : id;
+    entries.push([redisId, fieldValues]);
+    this.streams.set(stream, entries);
+    return redisId;
+  }
+
+  async xack(stream: string, group: string, ...ids: string[]): Promise<number> {
+    const state = this.group(stream, group);
+    let count = 0;
+    for (const id of ids) {
+      if (state.pending.delete(id)) {
+        count += 1;
+      }
+    }
+    return count;
+  }
+
+  async xgroup(...args: string[]): Promise<string> {
+    const [command, stream, group] = args;
+    if (command !== 'CREATE' || !stream || !group) {
+      throw new Error(`Unsupported xgroup call: ${args.join(' ')}`);
+    }
+    const key = this.groupKey(stream, group);
+    if (this.groups.has(key)) {
+      throw new Error('BUSYGROUP Consumer Group name already exists');
+    }
+    this.groups.set(key, { delivered: 0, pending: new Map() });
+    if (!this.streams.has(stream)) {
+      this.streams.set(stream, []);
+    }
+    return 'OK';
+  }
+
+  async xreadgroup(...args: Array<string | number>): Promise<RedisStreamReadResponse | null> {
+    const group = String(args[1]);
+    const consumer = String(args[2]);
+    const countIndex = args.indexOf('COUNT');
+    const streamIndex = args.indexOf('STREAMS');
+    const count = countIndex === -1 ? 10 : Number(args[countIndex + 1]);
+    const stream = String(args[streamIndex + 1]);
+    const state = this.group(stream, group);
+    const entries = this.streams.get(stream) ?? [];
+    const selected = entries.slice(state.delivered, state.delivered + count);
+    if (selected.length === 0) {
+      return null;
+    }
+    state.delivered += selected.length;
+    for (const entry of selected) {
+      state.pending.set(entry[0], entry);
+    }
+    void consumer;
+    return [[stream, selected]];
+  }
+
+  async xautoclaim(...args: Array<string | number>): Promise<RedisAutoClaimResponse> {
+    const stream = String(args[0]);
+    const group = String(args[1]);
+    const consumer = String(args[2]);
+    const countIndex = args.indexOf('COUNT');
+    const count = countIndex === -1 ? 10 : Number(args[countIndex + 1]);
+    const state = this.group(stream, group);
+    const entries = Array.from(state.pending.values()).slice(0, count);
+    for (const entry of entries) {
+      state.pending.set(entry[0], entry);
+    }
+    void consumer;
+    return ['0-0', entries];
+  }
+
+  async set(key: string, _value: string, mode: 'NX', _expireMode: 'EX', _ttlSeconds: number): Promise<'OK' | null> {
+    if (mode !== 'NX') {
+      throw new Error('FakeRedis only supports SET NX');
+    }
+    if (this.locks.has(key)) {
+      return null;
+    }
+    this.locks.add(key);
+    return 'OK';
+  }
+
+  async del(...keys: string[]): Promise<number> {
+    let deleted = 0;
+    for (const key of keys) {
+      if (this.locks.delete(key)) {
+        deleted += 1;
+      }
+    }
+    return deleted;
+  }
+
+  pendingSize(stream = CDR_STREAM, group = CDR_CONSUMER_GROUP): number {
+    return this.group(stream, group).pending.size;
+  }
+
+  private group(stream: string, group: string): { delivered: number; pending: Map<string, RedisStreamEntry> } {
+    const state = this.groups.get(this.groupKey(stream, group));
+    if (!state) {
+      throw new Error('NOGROUP No such key or consumer group');
+    }
+    return state;
+  }
+
+  private groupKey(stream: string, group: string): string {
+    return `${stream}:${group}`;
+  }
+}
+
+function sampleEvent(overrides: Partial<CdrStreamPublishInput> = {}): CdrStreamPublishInput {
+  return {
+    eventId: 'evt-001',
+    callId: 'call-001',
+    nodeId: 'a1',
+    opensipsInstance: 'opensips-a1',
+    ingressAIp: '100.90.90.90',
+    rtpengineNode: 'a1',
+    sourceIp: '100.93.185.30',
+    caller: 's21-ip-1001',
+    callee: '13800138000',
+    sipCode: 503,
+    hangupReason: 'CONFIG_MISSING',
+    configVersion: '0',
+    createdAt: '2026-06-21T07:30:00.000Z',
+    ...overrides
+  };
+}
+
+describe('CDR Redis Stream contract', () => {
+  it('publishes multi-A-aware CDR fields and parses typed values', async () => {
+    const redis = new FakeRedis();
+    const redisId = await publishCdrEvent(redis, sampleEvent());
+    const entry = redis.streams.get(CDR_STREAM)?.find(([id]) => id === redisId);
+
+    expect(entry).toBeDefined();
+    const parsed = parseCdrStreamEvent(entry?.[1] ?? []);
+    expect(parsed.event_id).toBe('evt-001');
+    expect(parsed.node_id).toBe('a1');
+    expect(parsed.opensips_instance).toBe('opensips-a1');
+    expect(parsed.rtpengine_node).toBe('a1');
+    expect(parsed.sipCode).toBe(503);
+  });
+
+  it('creates the consumer group idempotently', async () => {
+    const redis = new FakeRedis();
+
+    await ensureCdrConsumerGroup(redis);
+    await ensureCdrConsumerGroup(redis);
+
+    expect(redis.groups.size).toBe(1);
+  });
+
+  it('reads with XREADGROUP and ACKs processed entries', async () => {
+    const redis = new FakeRedis();
+    await ensureCdrConsumerGroup(redis);
+    await publishCdrEvent(redis, sampleEvent());
+
+    const summary = await processCdrBatch(redis, async () => 'processed', {
+      consumer: 'test-consumer',
+      blockMs: 1
+    });
+
+    expect(summary.processed).toBe(1);
+    expect(summary.ackedIds).toEqual(['1-0']);
+    expect(redis.pendingSize()).toBe(0);
+  });
+
+  it('ACKs duplicate event_id without invoking downstream processing again', async () => {
+    const redis = new FakeRedis();
+    await ensureCdrConsumerGroup(redis);
+    await publishCdrEvent(redis, sampleEvent({ callId: 'call-001' }));
+    await publishCdrEvent(redis, sampleEvent({ callId: 'call-duplicate' }));
+    let handled = 0;
+
+    const summary = await processCdrBatch(
+      redis,
+      async () => {
+        handled += 1;
+        return 'processed';
+      },
+      { consumer: 'test-consumer', count: 2, blockMs: 1 }
+    );
+
+    expect(handled).toBe(1);
+    expect(summary.processed).toBe(1);
+    expect(summary.duplicates).toBe(1);
+    expect(summary.ackedIds).toEqual(['1-0', '2-0']);
+  });
+
+  it('moves invalid payloads to the deadletter stream and ACKs them', async () => {
+    const redis = new FakeRedis();
+    await ensureCdrConsumerGroup(redis);
+    await redis.xadd(CDR_STREAM, '*', 'event_id', 'evt-bad');
+
+    const summary = await processCdrBatch(redis, async () => 'processed', {
+      consumer: 'test-consumer',
+      blockMs: 1
+    });
+
+    expect(summary.deadlettered).toBe(1);
+    expect(redis.pendingSize()).toBe(0);
+    expect(redis.streams.get(CDR_DEADLETTER_STREAM)?.[0]?.[1]).toContain('evt-bad');
+  });
+
+  it('leaves retryable handler failures pending and releases the idempotency lock', async () => {
+    const redis = new FakeRedis();
+    await ensureCdrConsumerGroup(redis);
+    await publishCdrEvent(redis, sampleEvent());
+
+    const summary = await processCdrBatch(
+      redis,
+      async () => {
+        throw new CdrRetryableError('database is temporarily unavailable');
+      },
+      { consumer: 'test-consumer', blockMs: 1 }
+    );
+
+    expect(summary).toMatchObject({ processed: 0, duplicates: 0, deadlettered: 0, pendingLeft: 1 });
+    expect(summary.ackedIds).toEqual([]);
+    expect(redis.pendingSize()).toBe(1);
+    expect(redis.streams.get(CDR_DEADLETTER_STREAM)).toBeUndefined();
+
+    const retry = await processPendingCdrBatch(redis, async () => 'processed', {
+      consumer: 'retry-consumer',
+      minIdleMs: 1
+    });
+
+    expect(retry.processed).toBe(1);
+    expect(retry.ackedIds).toEqual(['1-0']);
+    expect(redis.pendingSize()).toBe(0);
+  });
+
+  it('reclaims pending entries with XAUTOCLAIM and ACKs after retry', async () => {
+    const redis = new FakeRedis();
+    await ensureCdrConsumerGroup(redis);
+    await publishCdrEvent(redis, sampleEvent());
+    await redis.xreadgroup('GROUP', CDR_CONSUMER_GROUP, 'stalled-consumer', 'COUNT', 1, 'STREAMS', CDR_STREAM, '>');
+
+    expect(redis.pendingSize()).toBe(1);
+    const summary = await processPendingCdrBatch(redis, async () => 'processed', {
+      consumer: 'retry-consumer',
+      minIdleMs: 1
+    });
+
+    expect(summary.processed).toBe(1);
+    expect(summary.ackedIds).toEqual(['1-0']);
+    expect(redis.pendingSize()).toBe(0);
+  });
+});
diff --git a/packages/redis/src/cdr-stream.ts b/packages/redis/src/cdr-stream.ts
new file mode 100644
index 0000000..09b9f64
--- /dev/null
+++ b/packages/redis/src/cdr-stream.ts
@@ -0,0 +1,408 @@
+import { randomUUID } from 'node:crypto';
+
+import { CDR_CONSUMER_GROUP, CDR_DEADLETTER_STREAM, CDR_STREAM } from './index.js';
+
+export const CDR_EVENT_SCHEMA_VERSION = '1';
+export const CDR_IDEMPOTENCY_KEY_PREFIX = 'lock:cdr:';
+
+export type CdrStreamFieldMap = Record<string, string>;
+
+export interface CdrRedisCommands {
+  xadd(stream: string, id: string, ...fieldValues: string[]): Promise<string>;
+  xack(stream: string, group: string, ...ids: string[]): Promise<number>;
+  xgroup(...args: string[]): Promise<string>;
+  xreadgroup(...args: Array<string | number>): Promise<RedisStreamReadResponse | null>;
+  xautoclaim(...args: Array<string | number>): Promise<RedisAutoClaimResponse>;
+  set(key: string, value: string, mode: 'NX', expireMode: 'EX', ttlSeconds: number): Promise<'OK' | null>;
+  del(...keys: string[]): Promise<number>;
+}
+
+export type RedisStreamEntry = [id: string, fields: string[]];
+export type RedisStreamReadResponse = Array<[stream: string, entries: RedisStreamEntry[]]>;
+export type RedisAutoClaimResponse = [nextStartId: string, entries: RedisStreamEntry[], deletedIds?: string[]];
+
+export interface CdrStreamEvent {
+  schema_version: string;
+  event_id: string;
+  idempotency_key: string;
+  call_id: string;
+  node_id: string;
+  opensips_instance: string;
+  ingress_a_ip: string;
+  rtpengine_node: string;
+  customer_id: string;
+  customer_gateway_id: string;
+  customer_gateway_policy_id: string;
+  source_ip: string;
+  caller: string;
+  callee: string;
+  vendor_id: string;
+  vendor_gateway_id: string;
+  line_group_id: string;
+  started_at: string;
+  answered_at: string;
+  ended_at: string;
+  duration_sec: string;
+  sip_code: string;
+  hangup_reason: string;
+  recording_key: string;
+  config_version: string;
+  created_at: string;
+}
+
+export interface ParsedCdrStreamEvent extends CdrStreamEvent {
+  durationSeconds: number;
+  sipCode: number;
+}
+
+export interface CdrStreamPublishInput {
+  eventId?: string;
+  idempotencyKey?: string;
+  callId: string;
+  nodeId?: string;
+  opensipsInstance?: string;
+  ingressAIp?: string;
+  rtpengineNode?: string;
+  customerId?: string;
+  customerGatewayId?: string;
+  customerGatewayPolicyId?: string;
+  sourceIp: string;
+  caller?: string;
+  callee?: string;
+  vendorId?: string;
+  vendorGatewayId?: string;
+  lineGroupId?: string;
+  startedAt?: string;
+  answeredAt?: string;
+  endedAt?: string;
+  durationSec?: number;
+  sipCode: number;
+  hangupReason: string;
+  recordingKey?: string;
+  configVersion?: string;
+  createdAt?: string;
+}
+
+export type CdrHandlerResult = 'processed' | 'duplicate';
+export type CdrStreamHandler = (event: ParsedCdrStreamEvent, redisId: string) => Promise<CdrHandlerResult>;
+
+export class CdrRetryableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'CdrRetryableError';
+  }
+}
+
+export interface ProcessCdrBatchOptions {
+  stream?: string;
+  group?: string;
+  consumer: string;
+  count?: number;
+  blockMs?: number;
+  idempotencyTtlSeconds?: number;
+}
+
+export interface ProcessPendingOptions {
+  stream?: string;
+  group?: string;
+  consumer: string;
+  minIdleMs?: number;
+  startId?: string;
+  count?: number;
+  idempotencyTtlSeconds?: number;
+}
+
+export interface CdrProcessSummary {
+  processed: number;
+  duplicates: number;
+  deadlettered: number;
+  pendingLeft: number;
+  ackedIds: string[];
+}
+
+const requiredFields = [
+  'schema_version',
+  'event_id',
+  'idempotency_key',
+  'call_id',
+  'node_id',
+  'opensips_instance',
+  'ingress_a_ip',
+  'rtpengine_node',
+  'source_ip',
+  'sip_code',
+  'hangup_reason',
+  'created_at'
+] as const;
+
+export function buildCdrStreamEvent(input: CdrStreamPublishInput): CdrStreamEvent {
+  const eventId = input.eventId ?? randomUUID();
+  const endedAt = input.endedAt ?? '';
+
+  return {
+    schema_version: CDR_EVENT_SCHEMA_VERSION,
+    event_id: eventId,
+    idempotency_key: input.idempotencyKey ?? `${input.callId}:${endedAt || eventId}`,
+    call_id: input.callId,
+    node_id: input.nodeId ?? 'a1',
+    opensips_instance: input.opensipsInstance ?? 'opensips-a1',
+    ingress_a_ip: input.ingressAIp ?? '',
+    rtpengine_node: input.rtpengineNode ?? input.nodeId ?? 'a1',
+    customer_id: input.customerId ?? '',
+    customer_gateway_id: input.customerGatewayId ?? '',
+    customer_gateway_policy_id: input.customerGatewayPolicyId ?? '',
+    source_ip: input.sourceIp,
+    caller: input.caller ?? '',
+    callee: input.callee ?? '',
+    vendor_id: input.vendorId ?? '',
+    vendor_gateway_id: input.vendorGatewayId ?? '',
+    line_group_id: input.lineGroupId ?? '',
+    started_at: input.startedAt ?? '',
+    answered_at: input.answeredAt ?? '',
+    ended_at: endedAt,
+    duration_sec: String(input.durationSec ?? 0),
+    sip_code: String(input.sipCode),
+    hangup_reason: input.hangupReason,
+    recording_key: input.recordingKey ?? '',
+    config_version: input.configVersion ?? '',
+    created_at: input.createdAt ?? new Date().toISOString()
+  };
+}
+
+export function serializeCdrEvent(event: CdrStreamEvent): string[] {
+  return Object.entries(event).flatMap(([field, value]) => [field, value]);
+}
+
+export function parseStreamFields(fields: string[]): CdrStreamFieldMap {
+  const parsed: CdrStreamFieldMap = {};
+  for (let index = 0; index < fields.length; index += 2) {
+    const key = fields[index];
+    const value = fields[index + 1];
+    if (key !== undefined && value !== undefined) {
+      parsed[key] = value;
+    }
+  }
+  return parsed;
+}
+
+export function parseCdrStreamEvent(fields: string[]): ParsedCdrStreamEvent {
+  const parsed = parseStreamFields(fields);
+  for (const field of requiredFields) {
+    if (!parsed[field]) {
+      throw new Error(`CDR stream event missing required field: ${field}`);
+    }
+  }
+  if (parsed.schema_version !== CDR_EVENT_SCHEMA_VERSION) {
+    throw new Error(`Unsupported CDR schema version: ${parsed.schema_version}`);
+  }
+
+  const durationSeconds = Number.parseInt(parsed.duration_sec ?? '0', 10);
+  const sipCode = Number.parseInt(parsed.sip_code, 10);
+  if (!Number.isInteger(durationSeconds) || durationSeconds < 0) {
+    throw new Error(`Invalid CDR duration_sec: ${parsed.duration_sec}`);
+  }
+  if (!Number.isInteger(sipCode) || sipCode < 100 || sipCode > 699) {
+    throw new Error(`Invalid CDR sip_code: ${parsed.sip_code}`);
+  }
+
+  return {
+    schema_version: parsed.schema_version,
+    event_id: parsed.event_id,
+    idempotency_key: parsed.idempotency_key,
+    call_id: parsed.call_id,
+    node_id: parsed.node_id,
+    opensips_instance: parsed.opensips_instance,
+    ingress_a_ip: parsed.ingress_a_ip,
+    rtpengine_node: parsed.rtpengine_node,
+    customer_id: parsed.customer_id ?? '',
+    customer_gateway_id: parsed.customer_gateway_id ?? '',
+    customer_gateway_policy_id: parsed.customer_gateway_policy_id ?? '',
+    source_ip: parsed.source_ip,
+    caller: parsed.caller ?? '',
+    callee: parsed.callee ?? '',
+    vendor_id: parsed.vendor_id ?? '',
+    vendor_gateway_id: parsed.vendor_gateway_id ?? '',
+    line_group_id: parsed.line_group_id ?? '',
+    started_at: parsed.started_at ?? '',
+    answered_at: parsed.answered_at ?? '',
+    ended_at: parsed.ended_at ?? '',
+    duration_sec: parsed.duration_sec ?? '0',
+    sip_code: parsed.sip_code,
+    hangup_reason: parsed.hangup_reason,
+    recording_key: parsed.recording_key ?? '',
+    config_version: parsed.config_version ?? '',
+    created_at: parsed.created_at,
+    durationSeconds,
+    sipCode
+  };
+}
+
+export async function ensureCdrConsumerGroup(
+  redis: CdrRedisCommands,
+  stream = CDR_STREAM,
+  group = CDR_CONSUMER_GROUP
+): Promise<void> {
+  try {
+    await redis.xgroup('CREATE', stream, group, '0', 'MKSTREAM');
+  } catch (error) {
+    if (!(error instanceof Error) || !error.message.includes('BUSYGROUP')) {
+      throw error;
+    }
+  }
+}
+
+export async function publishCdrEvent(
+  redis: CdrRedisCommands,
+  input: CdrStreamPublishInput,
+  stream = CDR_STREAM
+): Promise<string> {
+  const event = buildCdrStreamEvent(input);
+  return redis.xadd(stream, '*', ...serializeCdrEvent(event));
+}
+
+export async function processCdrBatch(
+  redis: CdrRedisCommands,
+  handler: CdrStreamHandler,
+  options: ProcessCdrBatchOptions
+): Promise<CdrProcessSummary> {
+  const stream = options.stream ?? CDR_STREAM;
+  const group = options.group ?? CDR_CONSUMER_GROUP;
+  const count = options.count ?? 10;
+  const blockMs = options.blockMs ?? 1000;
+  const response = await redis.xreadgroup(
+    'GROUP',
+    group,
+    options.consumer,
+    'COUNT',
+    count,
+    'BLOCK',
+    blockMs,
+    'STREAMS',
+    stream,
+    '>'
+  );
+  return processReadResponse(redis, handler, response, {
+    stream,
+    group,
+    idempotencyTtlSeconds: options.idempotencyTtlSeconds ?? 86400
+  });
+}
+
+export async function processPendingCdrBatch(
+  redis: CdrRedisCommands,
+  handler: CdrStreamHandler,
+  options: ProcessPendingOptions
+): Promise<CdrProcessSummary> {
+  const stream = options.stream ?? CDR_STREAM;
+  const group = options.group ?? CDR_CONSUMER_GROUP;
+  const response = await redis.xautoclaim(
+    stream,
+    group,
+    options.consumer,
+    options.minIdleMs ?? 60000,
+    options.startId ?? '0-0',
+    'COUNT',
+    options.count ?? 10
+  );
+  return processEntries(redis, handler, response[1], {
+    stream,
+    group,
+    idempotencyTtlSeconds: options.idempotencyTtlSeconds ?? 86400
+  });
+}
+
+async function processReadResponse(
+  redis: CdrRedisCommands,
+  handler: CdrStreamHandler,
+  response: RedisStreamReadResponse | null,
+  options: { stream: string; group: string; idempotencyTtlSeconds: number }
+): Promise<CdrProcessSummary> {
+  const entries = response?.flatMap(([, streamEntries]) => streamEntries) ?? [];
+  return processEntries(redis, handler, entries, options);
+}
+
+async function processEntries(
+  redis: CdrRedisCommands,
+  handler: CdrStreamHandler,
+  entries: RedisStreamEntry[],
+  options: { stream: string; group: string; idempotencyTtlSeconds: number }
+): Promise<CdrProcessSummary> {
+  const summary: CdrProcessSummary = {
+    processed: 0,
+    duplicates: 0,
+    deadlettered: 0,
+    pendingLeft: 0,
+    ackedIds: []
+  };
+
+  for (const [redisId, fields] of entries) {
+    try {
+      const event = parseCdrStreamEvent(fields);
+      const lock = await redis.set(
+        `${CDR_IDEMPOTENCY_KEY_PREFIX}${event.event_id}`,
+        redisId,
+        'NX',
+        'EX',
+        options.idempotencyTtlSeconds
+      );
+      if (lock === null) {
+        await ack(redis, options.stream, options.group, redisId, summary);
+        summary.duplicates += 1;
+        continue;
+      }
+
+      const result = await handler(event, redisId);
+      await ack(redis, options.stream, options.group, redisId, summary);
+      if (result === 'duplicate') {
+        summary.duplicates += 1;
+      } else {
+        summary.processed += 1;
+      }
+    } catch (error) {
+      if (error instanceof CdrRetryableError) {
+        const fieldMap = parseStreamFields(fields);
+        if (fieldMap.event_id) {
+          await redis.del(`${CDR_IDEMPOTENCY_KEY_PREFIX}${fieldMap.event_id}`);
+        }
+        summary.pendingLeft += 1;
+        continue;
+      }
+      await moveToDeadletter(redis, redisId, fields, error);
+      await ack(redis, options.stream, options.group, redisId, summary);
+      summary.deadlettered += 1;
+    }
+  }
+
+  return summary;
+}
+
+async function ack(
+  redis: CdrRedisCommands,
+  stream: string,
+  group: string,
+  redisId: string,
+  summary: CdrProcessSummary
+): Promise<void> {
+  await redis.xack(stream, group, redisId);
+  summary.ackedIds.push(redisId);
+}
+
+async function moveToDeadletter(redis: CdrRedisCommands, redisId: string, fields: string[], error: unknown): Promise<void> {
+  const fieldMap = parseStreamFields(fields);
+  await redis.xadd(
+    CDR_DEADLETTER_STREAM,
+    '*',
+    'original_redis_id',
+    redisId,
+    'event_id',
+    fieldMap.event_id ?? '',
+    'call_id',
+    fieldMap.call_id ?? '',
+    'error',
+    error instanceof Error ? error.message : 'Unknown CDR processing error',
+    'payload',
+    JSON.stringify(fieldMap),
+    'deadlettered_at',
+    new Date().toISOString()
+  );
+}
diff --git a/packages/redis/src/index.ts b/packages/redis/src/index.ts
new file mode 100644
index 0000000..0ec48d3
--- /dev/null
+++ b/packages/redis/src/index.ts
@@ -0,0 +1,27 @@
+import { Redis } from 'ioredis';
+
+export const CDR_STREAM = 'stream:cdr_payload';
+export const CDR_DEADLETTER_STREAM = 'stream:cdr_deadletter';
+export const CDR_CONSUMER_GROUP = 'billing-workers';
+export const CONFIG_ACTIVE_VERSION_KEY = 'cfg:active_version';
+export const CONFIG_PREVIOUS_VERSION_KEY = 'cfg:previous_version';
+
+export type RedisClient = Redis;
+
+export function configVersionPrefix(version: string): string {
+  return `cfg:v:${version}`;
+}
+
+export function configVersionManifestKey(version: string): string {
+  return `${configVersionPrefix(version)}:manifest`;
+}
+
+export function createRedisClient(redisUrl: string): Redis {
+  return new Redis(redisUrl, {
+    lazyConnect: true,
+    maxRetriesPerRequest: 3,
+    enableReadyCheck: true
+  });
+}
+
+export * from './cdr-stream.js';
diff --git a/packages/redis/tsconfig.json b/packages/redis/tsconfig.json
new file mode 100644
index 0000000..94b3d86
--- /dev/null
+++ b/packages/redis/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "tsBuildInfoFile": "dist/tsconfig.tsbuildinfo"
+  },
+  "include": ["src/**/*.ts"]
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
new file mode 100644
index 0000000..ec86335
--- /dev/null
+++ b/pnpm-lock.yaml
@@ -0,0 +1,4711 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    devDependencies:
+      '@eslint/js':
+        specifier: 9.39.1
+        version: 9.39.1
+      '@nestjs/testing':
+        specifier: 11.1.9
+        version: 11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2))
+      '@prisma/client':
+        specifier: 6.19.0
+        version: 6.19.0(prisma@6.19.0(typescript@5.9.3))(typescript@5.9.3)
+      '@types/node':
+        specifier: 22.19.0
+        version: 22.19.0
+      '@types/supertest':
+        specifier: 6.0.3
+        version: 6.0.3
+      '@typescript-eslint/eslint-plugin':
+        specifier: 8.48.0
+        version: 8.48.0(@typescript-eslint/parser@8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3))(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/parser':
+        specifier: 8.48.0
+        version: 8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)
+      cross-env:
+        specifier: 10.1.0
+        version: 10.1.0
+      eslint:
+        specifier: 9.39.1
+        version: 9.39.1(jiti@2.7.0)
+      eslint-config-prettier:
+        specifier: 10.1.8
+        version: 10.1.8(eslint@9.39.1(jiti@2.7.0))
+      globals:
+        specifier: 16.5.0
+        version: 16.5.0
+      prisma:
+        specifier: 6.19.0
+        version: 6.19.0(typescript@5.9.3)
+      supertest:
+        specifier: 7.1.4
+        version: 7.1.4
+      tsx:
+        specifier: 4.20.6
+        version: 4.20.6
+      typescript:
+        specifier: 5.9.3
+        version: 5.9.3
+      typescript-eslint:
+        specifier: 8.48.0
+        version: 8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)
+      vitest:
+        specifier: 4.0.14
+        version: 4.0.14(@types/node@22.19.0)(jiti@2.7.0)(tsx@4.20.6)
+
+  apps/api:
+    dependencies:
+      '@fastify/helmet':
+        specifier: 13.0.2
+        version: 13.0.2
+      '@fastify/static':
+        specifier: 8.3.0
+        version: 8.3.0
+      '@lisglosips/auth':
+        specifier: workspace:*
+        version: link:../../packages/auth
+      '@lisglosips/contracts':
+        specifier: workspace:*
+        version: link:../../packages/contracts
+      '@lisglosips/database':
+        specifier: workspace:*
+        version: link:../../packages/database
+      '@lisglosips/observability':
+        specifier: workspace:*
+        version: link:../../packages/observability
+      '@nestjs/common':
+        specifier: 11.1.9
+        version: 11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/config':
+        specifier: 4.0.2
+        version: 4.0.2(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(rxjs@7.8.2)
+      '@nestjs/core':
+        specifier: 11.1.9
+        version: 11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/platform-fastify':
+        specifier: 11.1.9
+        version: 11.1.9(@fastify/static@8.3.0)(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2))
+      '@nestjs/swagger':
+        specifier: 11.2.3
+        version: 11.2.3(@fastify/static@8.3.0)(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)
+      fastify:
+        specifier: 5.6.2
+        version: 5.6.2
+      joi:
+        specifier: 18.0.2
+        version: 18.0.2
+      nestjs-pino:
+        specifier: 4.5.0
+        version: 4.5.0(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(pino-http@11.0.0)(pino@10.3.1)(rxjs@7.8.2)
+      reflect-metadata:
+        specifier: 0.2.2
+        version: 0.2.2
+      rxjs:
+        specifier: 7.8.2
+        version: 7.8.2
+
+  apps/web:
+    dependencies:
+      react:
+        specifier: 18.2.0
+        version: 18.2.0
+      react-dom:
+        specifier: 18.2.0
+        version: 18.2.0(react@18.2.0)
+    devDependencies:
+      '@vitejs/plugin-react':
+        specifier: 4.7.0
+        version: 4.7.0(vite@5.4.21(@types/node@22.19.0))
+      vite:
+        specifier: 5.4.21
+        version: 5.4.21(@types/node@22.19.0)
+
+  apps/worker-cdr:
+    dependencies:
+      '@lisglosips/database':
+        specifier: workspace:*
+        version: link:../../packages/database
+      '@lisglosips/observability':
+        specifier: workspace:*
+        version: link:../../packages/observability
+      '@lisglosips/redis':
+        specifier: workspace:*
+        version: link:../../packages/redis
+    devDependencies:
+      cross-env:
+        specifier: 10.1.0
+        version: 10.1.0
+
+  apps/worker-config-publisher:
+    dependencies:
+      '@lisglosips/observability':
+        specifier: workspace:*
+        version: link:../../packages/observability
+      '@lisglosips/redis':
+        specifier: workspace:*
+        version: link:../../packages/redis
+      '@prisma/client':
+        specifier: 6.19.0
+        version: 6.19.0(prisma@6.19.0(typescript@5.9.3))(typescript@5.9.3)
+    devDependencies:
+      cross-env:
+        specifier: 10.1.0
+        version: 10.1.0
+
+  apps/worker-recording:
+    dependencies:
+      '@lisglosips/database':
+        specifier: workspace:*
+        version: link:../../packages/database
+      '@lisglosips/observability':
+        specifier: workspace:*
+        version: link:../../packages/observability
+    devDependencies:
+      cross-env:
+        specifier: 10.1.0
+        version: 10.1.0
+
+  packages/auth: {}
+
+  packages/contracts: {}
+
+  packages/database:
+    dependencies:
+      '@prisma/client':
+        specifier: 6.19.0
+        version: 6.19.0(prisma@6.19.0(typescript@5.9.3))(typescript@5.9.3)
+
+  packages/domain: {}
+
+  packages/observability:
+    dependencies:
+      pino:
+        specifier: 9.14.0
+        version: 9.14.0
+
+  packages/redis:
+    dependencies:
+      ioredis:
+        specifier: 5.8.2
+        version: 5.8.2
+
+packages:
+
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/compat-data@7.29.7':
+    resolution: {integrity: sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.29.7':
+    resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.29.7':
+    resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-compilation-targets@7.29.7':
+    resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-globals@7.29.7':
+    resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.29.7':
+    resolution: {integrity: sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-transforms@7.29.7':
+    resolution: {integrity: sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-plugin-utils@7.29.7':
+    resolution: {integrity: sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-string-parser@7.29.7':
+    resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-option@7.29.7':
+    resolution: {integrity: sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helpers@7.29.7':
+    resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.29.7':
+    resolution: {integrity: sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/plugin-transform-react-jsx-self@7.29.7':
+    resolution: {integrity: sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-jsx-source@7.29.7':
+    resolution: {integrity: sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/template@7.29.7':
+    resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.29.7':
+    resolution: {integrity: sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.29.7':
+    resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
+    engines: {node: '>=6.9.0'}
+
+  '@borewit/text-codec@0.2.2':
+    resolution: {integrity: sha512-DDaRehssg1aNrH4+2hnj1B7vnUGEjU6OIlyRdkMd0aUdIUvKXrJfXsy8LVtXAy7DRvYVluWbMspsRhz2lcW0mQ==}
+
+  '@epic-web/invariant@1.0.0':
+    resolution: {integrity: sha512-lrTPqgvfFQtR/eY/qkIzp98OGdNJu0m5ji3q/nJI8v3SXkRKEnWiOxMmbvcSoAIzv/cGiuvRy57k4suKQSAdwA==}
+
+  '@esbuild/aix-ppc64@0.21.5':
+    resolution: {integrity: sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==}
+    engines: {node: '>=12'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/aix-ppc64@0.25.12':
+    resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/aix-ppc64@0.27.7':
+    resolution: {integrity: sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.21.5':
+    resolution: {integrity: sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm64@0.25.12':
+    resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm64@0.27.7':
+    resolution: {integrity: sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.21.5':
+    resolution: {integrity: sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==}
+    engines: {node: '>=12'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-arm@0.25.12':
+    resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-arm@0.27.7':
+    resolution: {integrity: sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.21.5':
+    resolution: {integrity: sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/android-x64@0.25.12':
+    resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/android-x64@0.27.7':
+    resolution: {integrity: sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.21.5':
+    resolution: {integrity: sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-arm64@0.25.12':
+    resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-arm64@0.27.7':
+    resolution: {integrity: sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.21.5':
+    resolution: {integrity: sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.25.12':
+    resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.27.7':
+    resolution: {integrity: sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.21.5':
+    resolution: {integrity: sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-arm64@0.27.7':
+    resolution: {integrity: sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.21.5':
+    resolution: {integrity: sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.25.12':
+    resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.27.7':
+    resolution: {integrity: sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.21.5':
+    resolution: {integrity: sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm64@0.25.12':
+    resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm64@0.27.7':
+    resolution: {integrity: sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.21.5':
+    resolution: {integrity: sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==}
+    engines: {node: '>=12'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.25.12':
+    resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.27.7':
+    resolution: {integrity: sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.21.5':
+    resolution: {integrity: sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==}
+    engines: {node: '>=12'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.25.12':
+    resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.27.7':
+    resolution: {integrity: sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.21.5':
+    resolution: {integrity: sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==}
+    engines: {node: '>=12'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.25.12':
+    resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.27.7':
+    resolution: {integrity: sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.21.5':
+    resolution: {integrity: sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==}
+    engines: {node: '>=12'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.25.12':
+    resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.27.7':
+    resolution: {integrity: sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.21.5':
+    resolution: {integrity: sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==}
+    engines: {node: '>=12'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.25.12':
+    resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.27.7':
+    resolution: {integrity: sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.21.5':
+    resolution: {integrity: sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==}
+    engines: {node: '>=12'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.25.12':
+    resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.27.7':
+    resolution: {integrity: sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.21.5':
+    resolution: {integrity: sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==}
+    engines: {node: '>=12'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.25.12':
+    resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.27.7':
+    resolution: {integrity: sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.21.5':
+    resolution: {integrity: sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.25.12':
+    resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.27.7':
+    resolution: {integrity: sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-arm64@0.27.7':
+    resolution: {integrity: sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.21.5':
+    resolution: {integrity: sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.25.12':
+    resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.27.7':
+    resolution: {integrity: sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-arm64@0.27.7':
+    resolution: {integrity: sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.21.5':
+    resolution: {integrity: sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.25.12':
+    resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.27.7':
+    resolution: {integrity: sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/openharmony-arm64@0.27.7':
+    resolution: {integrity: sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.21.5':
+    resolution: {integrity: sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/sunos-x64@0.25.12':
+    resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/sunos-x64@0.27.7':
+    resolution: {integrity: sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.21.5':
+    resolution: {integrity: sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-arm64@0.25.12':
+    resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-arm64@0.27.7':
+    resolution: {integrity: sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.21.5':
+    resolution: {integrity: sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==}
+    engines: {node: '>=12'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.25.12':
+    resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.27.7':
+    resolution: {integrity: sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.21.5':
+    resolution: {integrity: sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.25.12':
+    resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.27.7':
+    resolution: {integrity: sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@eslint-community/eslint-utils@4.9.1':
+    resolution: {integrity: sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    peerDependencies:
+      eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
+
+  '@eslint-community/regexpp@4.12.2':
+    resolution: {integrity: sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==}
+    engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
+
+  '@eslint/config-array@0.21.2':
+    resolution: {integrity: sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/config-helpers@0.4.2':
+    resolution: {integrity: sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/core@0.17.0':
+    resolution: {integrity: sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/eslintrc@3.3.5':
+    resolution: {integrity: sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/js@9.39.1':
+    resolution: {integrity: sha512-S26Stp4zCy88tH94QbBv3XCuzRQiZ9yXofEILmglYTh/Ug/a9/umqvgFtYBAo3Lp0nsI/5/qH1CCrbdK3AP1Tw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/object-schema@2.1.7':
+    resolution: {integrity: sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/plugin-kit@0.4.1':
+    resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@fastify/accept-negotiator@2.0.1':
+    resolution: {integrity: sha512-/c/TW2bO/v9JeEgoD/g1G5GxGeCF1Hafdf79WPmUlgYiBXummY0oX3VVq4yFkKKVBKDNlaDUYoab7g38RpPqCQ==}
+
+  '@fastify/ajv-compiler@4.0.5':
+    resolution: {integrity: sha512-KoWKW+MhvfTRWL4qrhUwAAZoaChluo0m0vbiJlGMt2GXvL4LVPQEjt8kSpHI3IBq5Rez8fg+XeH3cneztq+C7A==}
+
+  '@fastify/cors@11.1.0':
+    resolution: {integrity: sha512-sUw8ed8wP2SouWZTIbA7V2OQtMNpLj2W6qJOYhNdcmINTu6gsxVYXjQiM9mdi8UUDlcoDDJ/W2syPo1WB2QjYA==}
+
+  '@fastify/error@4.2.0':
+    resolution: {integrity: sha512-RSo3sVDXfHskiBZKBPRgnQTtIqpi/7zhJOEmAxCiBcM7d0uwdGdxLlsCaLzGs8v8NnxIRlfG0N51p5yFaOentQ==}
+
+  '@fastify/fast-json-stringify-compiler@5.0.3':
+    resolution: {integrity: sha512-uik7yYHkLr6fxd8hJSZ8c+xF4WafPK+XzneQDPU+D10r5X19GW8lJcom2YijX2+qtFF1ENJlHXKFM9ouXNJYgQ==}
+
+  '@fastify/formbody@8.0.2':
+    resolution: {integrity: sha512-84v5J2KrkXzjgBpYnaNRPqwgMsmY7ZDjuj0YVuMR3NXCJRCgKEZy/taSP1wUYGn0onfxJpLyRGDLa+NMaDJtnA==}
+
+  '@fastify/forwarded@3.0.1':
+    resolution: {integrity: sha512-JqDochHFqXs3C3Ml3gOY58zM7OqO9ENqPo0UqAjAjH8L01fRZqwX9iLeX34//kiJubF7r2ZQHtBRU36vONbLlw==}
+
+  '@fastify/helmet@13.0.2':
+    resolution: {integrity: sha512-tO1QMkOfNeCt9l4sG/FiWErH4QMm+RjHzbMTrgew1DYOQ2vb/6M1G2iNABBrD7Xq6dUk+HLzWW8u+rmmhQHifA==}
+
+  '@fastify/merge-json-schemas@0.2.1':
+    resolution: {integrity: sha512-OA3KGBCy6KtIvLf8DINC5880o5iBlDX4SxzLQS8HorJAbqluzLRn80UXU0bxZn7UOFhFgpRJDasfwn9nG4FG4A==}
+
+  '@fastify/middie@9.0.3':
+    resolution: {integrity: sha512-7OYovKXp9UKYeVMcjcFLMcSpoMkmcZmfnG+eAvtdiatN35W7c+r9y1dRfpA+pfFVNuHGGqI3W+vDTmjvcfLcMA==}
+
+  '@fastify/proxy-addr@5.1.0':
+    resolution: {integrity: sha512-INS+6gh91cLUjB+PVHfu1UqcB76Sqtpyp7bnL+FYojhjygvOPA9ctiD/JDKsyD9Xgu4hUhCSJBPig/w7duNajw==}
+
+  '@fastify/send@4.1.0':
+    resolution: {integrity: sha512-TMYeQLCBSy2TOFmV95hQWkiTYgC/SEx7vMdV+wnZVX4tt8VBLKzmH8vV9OzJehV0+XBfg+WxPMt5wp+JBUKsVw==}
+
+  '@fastify/static@8.3.0':
+    resolution: {integrity: sha512-yKxviR5PH1OKNnisIzZKmgZSus0r2OZb8qCSbqmw34aolT4g3UlzYfeBRym+HJ1J471CR8e2ldNub4PubD1coA==}
+
+  '@hapi/address@5.1.1':
+    resolution: {integrity: sha512-A+po2d/dVoY7cYajycYI43ZbYMXukuopIsqCjh5QzsBCipDtdofHntljDlpccMjIfTy6UOkg+5KPriwYch2bXA==}
+    engines: {node: '>=14.0.0'}
+
+  '@hapi/formula@3.0.2':
+    resolution: {integrity: sha512-hY5YPNXzw1He7s0iqkRQi+uMGh383CGdyyIGYtB+W5N3KHPXoqychklvHhKCC9M3Xtv0OCs/IHw+r4dcHtBYWw==}
+
+  '@hapi/hoek@11.0.7':
+    resolution: {integrity: sha512-HV5undWkKzcB4RZUusqOpcgxOaq6VOAH7zhhIr2g3G8NF/MlFO75SjOr2NfuSx0Mh40+1FqCkagKLJRykUWoFQ==}
+
+  '@hapi/pinpoint@2.0.1':
+    resolution: {integrity: sha512-EKQmr16tM8s16vTT3cA5L0kZZcTMU5DUOZTuvpnY738m+jyP3JIUj+Mm1xc1rsLkGBQ/gVnfKYPwOmPg1tUR4Q==}
+
+  '@hapi/tlds@1.1.7':
+    resolution: {integrity: sha512-MgNjRwy9Ti92yVAixLmDc8dd1bJIKwO9qlWCfFQRwRmUEDPQHYn4G6hwPFvFGUTzAa0FsS+inMjLin7GnyBRhA==}
+    engines: {node: '>=14.0.0'}
+
+  '@hapi/topo@6.0.2':
+    resolution: {integrity: sha512-KR3rD5inZbGMrHmgPxsJ9dbi6zEK+C3ZwUwTa+eMwWLz7oijWUTWD2pMSNNYJAU6Qq+65NkxXjqHr/7LM2Xkqg==}
+
+  '@humanfs/core@0.19.2':
+    resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanfs/node@0.16.8':
+    resolution: {integrity: sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanfs/types@0.15.0':
+    resolution: {integrity: sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanwhocodes/module-importer@1.0.1':
+    resolution: {integrity: sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==}
+    engines: {node: '>=12.22'}
+
+  '@humanwhocodes/retry@0.4.3':
+    resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
+    engines: {node: '>=18.18'}
+
+  '@ioredis/commands@1.4.0':
+    resolution: {integrity: sha512-aFT2yemJJo+TZCmieA7qnYGQooOS7QfNmYrzGtsYd3g9j5iDP8AimYYAesf79ohjbLG12XxC4nG5DyEnC88AsQ==}
+
+  '@isaacs/cliui@9.0.0':
+    resolution: {integrity: sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg==}
+    engines: {node: '>=18'}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
+  '@jridgewell/remapping@2.3.5':
+    resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
+
+  '@jridgewell/resolve-uri@3.1.2':
+    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/sourcemap-codec@1.5.5':
+    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+
+  '@lukeed/csprng@1.1.0':
+    resolution: {integrity: sha512-Z7C/xXCiGWsg0KuKsHTKJxbWhpI3Vs5GwLfOean7MGyVFGqdRgBbAjOCh6u4bbjPc/8MJ2pZmK/0DLdCbivLDA==}
+    engines: {node: '>=8'}
+
+  '@lukeed/ms@2.0.2':
+    resolution: {integrity: sha512-9I2Zn6+NJLfaGoz9jN3lpwDgAYvfGeNYdbAIjJOqzs4Tpc+VU3Jqq4IofSUBKajiDS8k9fZIg18/z13mpk1bsA==}
+    engines: {node: '>=8'}
+
+  '@microsoft/tsdoc@0.16.0':
+    resolution: {integrity: sha512-xgAyonlVVS+q7Vc7qLW0UrJU7rSFcETRWsqdXZtjzRU8dF+6CkozTK4V4y1LwOX7j8r/vHphjDeMeGI4tNGeGA==}
+
+  '@nestjs/common@11.1.9':
+    resolution: {integrity: sha512-zDntUTReRbAThIfSp3dQZ9kKqI+LjgLp5YZN5c1bgNRDuoeLySAoZg46Bg1a+uV8TMgIRziHocglKGNzr6l+bQ==}
+    peerDependencies:
+      class-transformer: '>=0.4.1'
+      class-validator: '>=0.13.2'
+      reflect-metadata: ^0.1.12 || ^0.2.0
+      rxjs: ^7.1.0
+    peerDependenciesMeta:
+      class-transformer:
+        optional: true
+      class-validator:
+        optional: true
+
+  '@nestjs/config@4.0.2':
+    resolution: {integrity: sha512-McMW6EXtpc8+CwTUwFdg6h7dYcBUpH5iUILCclAsa+MbCEvC9ZKu4dCHRlJqALuhjLw97pbQu62l4+wRwGeZqA==}
+    peerDependencies:
+      '@nestjs/common': ^10.0.0 || ^11.0.0
+      rxjs: ^7.1.0
+
+  '@nestjs/core@11.1.9':
+    resolution: {integrity: sha512-a00B0BM4X+9z+t3UxJqIZlemIwCQdYoPKrMcM+ky4z3pkqqG1eTWexjs+YXpGObnLnjtMPVKWlcZHp3adDYvUw==}
+    engines: {node: '>= 20'}
+    peerDependencies:
+      '@nestjs/common': ^11.0.0
+      '@nestjs/microservices': ^11.0.0
+      '@nestjs/platform-express': ^11.0.0
+      '@nestjs/websockets': ^11.0.0
+      reflect-metadata: ^0.1.12 || ^0.2.0
+      rxjs: ^7.1.0
+    peerDependenciesMeta:
+      '@nestjs/microservices':
+        optional: true
+      '@nestjs/platform-express':
+        optional: true
+      '@nestjs/websockets':
+        optional: true
+
+  '@nestjs/mapped-types@2.1.0':
+    resolution: {integrity: sha512-W+n+rM69XsFdwORF11UqJahn4J3xi4g/ZEOlJNL6KoW5ygWSmBB2p0S2BZ4FQeS/NDH72e6xIcu35SfJnE8bXw==}
+    peerDependencies:
+      '@nestjs/common': ^10.0.0 || ^11.0.0
+      class-transformer: ^0.4.0 || ^0.5.0
+      class-validator: ^0.13.0 || ^0.14.0
+      reflect-metadata: ^0.1.12 || ^0.2.0
+    peerDependenciesMeta:
+      class-transformer:
+        optional: true
+      class-validator:
+        optional: true
+
+  '@nestjs/platform-fastify@11.1.9':
+    resolution: {integrity: sha512-OOCyg36CP+WrJn7KIk1E/XdCPegcIdH5zi2txwqUtQNshl6c0VWv+8qotyOncPwEFuiOgnn3fuGveQj7DPNKgA==}
+    peerDependencies:
+      '@fastify/static': ^8.0.0
+      '@fastify/view': ^10.0.0 || ^11.0.0
+      '@nestjs/common': ^11.0.0
+      '@nestjs/core': ^11.0.0
+    peerDependenciesMeta:
+      '@fastify/static':
+        optional: true
+      '@fastify/view':
+        optional: true
+
+  '@nestjs/swagger@11.2.3':
+    resolution: {integrity: sha512-a0xFfjeqk69uHIUpP8u0ryn4cKuHdra2Ug96L858i0N200Hxho+n3j+TlQXyOF4EstLSGjTfxI1Xb2E1lUxeNg==}
+    peerDependencies:
+      '@fastify/static': ^8.0.0
+      '@nestjs/common': ^11.0.1
+      '@nestjs/core': ^11.0.1
+      class-transformer: '*'
+      class-validator: '*'
+      reflect-metadata: ^0.1.12 || ^0.2.0
+    peerDependenciesMeta:
+      '@fastify/static':
+        optional: true
+      class-transformer:
+        optional: true
+      class-validator:
+        optional: true
+
+  '@nestjs/testing@11.1.9':
+    resolution: {integrity: sha512-UFxerBDdb0RUNxQNj25pvkvNE7/vxKhXYWBt3QuwBFnYISzRIzhVlyIqLfoV5YI3zV0m0Nn4QAn1KM0zzwfEng==}
+    peerDependencies:
+      '@nestjs/common': ^11.0.0
+      '@nestjs/core': ^11.0.0
+      '@nestjs/microservices': ^11.0.0
+      '@nestjs/platform-express': ^11.0.0
+    peerDependenciesMeta:
+      '@nestjs/microservices':
+        optional: true
+      '@nestjs/platform-express':
+        optional: true
+
+  '@noble/hashes@1.8.0':
+    resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
+    engines: {node: ^14.21.3 || >=16}
+
+  '@nuxt/opencollective@0.4.1':
+    resolution: {integrity: sha512-GXD3wy50qYbxCJ652bDrDzgMr3NFEkIS374+IgFQKkCvk9yiYcLvX2XDYr7UyQxf4wK0e+yqDYRubZ0DtOxnmQ==}
+    engines: {node: ^14.18.0 || >=16.10.0, npm: '>=5.10.0'}
+    hasBin: true
+
+  '@paralleldrive/cuid2@2.3.1':
+    resolution: {integrity: sha512-XO7cAxhnTZl0Yggq6jOgjiOHhbgcO4NqFqwSmQpjK3b6TEE6Uj/jfSk6wzYyemh3+I0sHirKSetjQwn5cZktFw==}
+
+  '@pinojs/redact@0.4.0':
+    resolution: {integrity: sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==}
+
+  '@prisma/client@6.19.0':
+    resolution: {integrity: sha512-QXFT+N/bva/QI2qoXmjBzL7D6aliPffIwP+81AdTGq0FXDoLxLkWivGMawG8iM5B9BKfxLIXxfWWAF6wbuJU6g==}
+    engines: {node: '>=18.18'}
+    peerDependencies:
+      prisma: '*'
+      typescript: '>=5.1.0'
+    peerDependenciesMeta:
+      prisma:
+        optional: true
+      typescript:
+        optional: true
+
+  '@prisma/config@6.19.0':
+    resolution: {integrity: sha512-zwCayme+NzI/WfrvFEtkFhhOaZb/hI+X8TTjzjJ252VbPxAl2hWHK5NMczmnG9sXck2lsXrxIZuK524E25UNmg==}
+
+  '@prisma/debug@6.19.0':
+    resolution: {integrity: sha512-8hAdGG7JmxrzFcTzXZajlQCidX0XNkMJkpqtfbLV54wC6LSSX6Vni25W/G+nAANwLnZ2TmwkfIuWetA7jJxJFA==}
+
+  '@prisma/engines-version@6.19.0-26.2ba551f319ab1df4bc874a89965d8b3641056773':
+    resolution: {integrity: sha512-gV7uOBQfAFlWDvPJdQxMT1aSRur3a0EkU/6cfbAC5isV67tKDWUrPauyaHNpB+wN1ebM4A9jn/f4gH+3iHSYSQ==}
+
+  '@prisma/engines@6.19.0':
+    resolution: {integrity: sha512-pMRJ+1S6NVdXoB8QJAPIGpKZevFjxhKt0paCkRDTZiczKb7F4yTgRP8M4JdVkpQwmaD4EoJf6qA+p61godDokw==}
+
+  '@prisma/fetch-engine@6.19.0':
+    resolution: {integrity: sha512-OOx2Lda0DGrZ1rodADT06ZGqHzr7HY7LNMaFE2Vp8dp146uJld58sRuasdX0OiwpHgl8SqDTUKHNUyzEq7pDdQ==}
+
+  '@prisma/get-platform@6.19.0':
+    resolution: {integrity: sha512-ym85WDO2yDhC3fIXHWYpG3kVMBA49cL1XD2GCsCF8xbwoy2OkDQY44gEbAt2X46IQ4Apq9H6g0Ex1iFfPqEkHA==}
+
+  '@rolldown/pluginutils@1.0.0-beta.27':
+    resolution: {integrity: sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==}
+
+  '@rollup/rollup-android-arm-eabi@4.62.2':
+    resolution: {integrity: sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg==}
+    cpu: [arm]
+    os: [android]
+
+  '@rollup/rollup-android-arm64@4.62.2':
+    resolution: {integrity: sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw==}
+    cpu: [arm64]
+    os: [android]
+
+  '@rollup/rollup-darwin-arm64@4.62.2':
+    resolution: {integrity: sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rollup/rollup-darwin-x64@4.62.2':
+    resolution: {integrity: sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rollup/rollup-freebsd-arm64@4.62.2':
+    resolution: {integrity: sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@rollup/rollup-freebsd-x64@4.62.2':
+    resolution: {integrity: sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.2':
+    resolution: {integrity: sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-arm-musleabihf@4.62.2':
+    resolution: {integrity: sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA==}
+    cpu: [arm]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-arm64-gnu@4.62.2':
+    resolution: {integrity: sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-arm64-musl@4.62.2':
+    resolution: {integrity: sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-loong64-gnu@4.62.2':
+    resolution: {integrity: sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-loong64-musl@4.62.2':
+    resolution: {integrity: sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-ppc64-gnu@4.62.2':
+    resolution: {integrity: sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-ppc64-musl@4.62.2':
+    resolution: {integrity: sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-riscv64-gnu@4.62.2':
+    resolution: {integrity: sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-riscv64-musl@4.62.2':
+    resolution: {integrity: sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-s390x-gnu@4.62.2':
+    resolution: {integrity: sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-x64-gnu@4.62.2':
+    resolution: {integrity: sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-x64-musl@4.62.2':
+    resolution: {integrity: sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-openbsd-x64@4.62.2':
+    resolution: {integrity: sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg==}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@rollup/rollup-openharmony-arm64@4.62.2':
+    resolution: {integrity: sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rollup/rollup-win32-arm64-msvc@4.62.2':
+    resolution: {integrity: sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rollup/rollup-win32-ia32-msvc@4.62.2':
+    resolution: {integrity: sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-gnu@4.62.2':
+    resolution: {integrity: sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg==}
+    cpu: [x64]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-msvc@4.62.2':
+    resolution: {integrity: sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA==}
+    cpu: [x64]
+    os: [win32]
+
+  '@scarf/scarf@1.4.0':
+    resolution: {integrity: sha512-xxeapPiUXdZAE3che6f3xogoJPeZgig6omHEy1rIY5WVsB3H2BHNnZH+gHG6x91SCWyQCzWGsuL2Hh3ClO5/qQ==}
+
+  '@standard-schema/spec@1.1.0':
+    resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
+
+  '@tokenizer/inflate@0.3.1':
+    resolution: {integrity: sha512-4oeoZEBQdLdt5WmP/hx1KZ6D3/Oid/0cUb2nk4F0pTDAWy+KCH3/EnAkZF/bvckWo8I33EqBm01lIPgmgc8rCA==}
+    engines: {node: '>=18'}
+
+  '@tokenizer/token@0.3.0':
+    resolution: {integrity: sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A==}
+
+  '@types/babel__core@7.20.5':
+    resolution: {integrity: sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==}
+
+  '@types/babel__generator@7.27.0':
+    resolution: {integrity: sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==}
+
+  '@types/babel__template@7.4.4':
+    resolution: {integrity: sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==}
+
+  '@types/babel__traverse@7.28.0':
+    resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
+
+  '@types/chai@5.2.3':
+    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
+
+  '@types/cookiejar@2.1.5':
+    resolution: {integrity: sha512-he+DHOWReW0nghN24E1WUqM0efK4kI9oTqDm6XmK8ZPe2djZ90BSNdGnIyCLzCPw7/pogPlGbzI2wHGGmi4O/Q==}
+
+  '@types/deep-eql@4.0.2':
+    resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+
+  '@types/estree@1.0.9':
+    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
+
+  '@types/json-schema@7.0.15':
+    resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
+
+  '@types/methods@1.1.4':
+    resolution: {integrity: sha512-ymXWVrDiCxTBE3+RIrrP533E70eA+9qu7zdWoHuOmGujkYtzf4HQF96b8nwHLqhuf4ykX61IGRIB38CC6/sImQ==}
+
+  '@types/node@22.19.0':
+    resolution: {integrity: sha512-xpr/lmLPQEj+TUnHmR+Ab91/glhJvsqcjB+yY0Ix9GO70H6Lb4FHH5GeqdOE5btAx7eIMwuHkp4H2MSkLcqWbA==}
+
+  '@types/superagent@8.1.10':
+    resolution: {integrity: sha512-nbt4IWXABhW0jGmmpRzCFNlbmwCTzZ2gTUsNIr+X+ItdqPms+PAJZbWsNzpS2USqXjcoNLQcO6nXo60zcPQiIg==}
+
+  '@types/supertest@6.0.3':
+    resolution: {integrity: sha512-8WzXq62EXFhJ7QsH3Ocb/iKQ/Ty9ZVWnVzoTKc9tyyFRRF3a74Tk2+TLFgaFFw364Ere+npzHKEJ6ga2LzIL7w==}
+
+  '@typescript-eslint/eslint-plugin@8.48.0':
+    resolution: {integrity: sha512-XxXP5tL1txl13YFtrECECQYeZjBZad4fyd3cFV4a19LkAY/bIp9fev3US4S5fDVV2JaYFiKAZ/GRTOLer+mbyQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      '@typescript-eslint/parser': ^8.48.0
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/parser@8.48.0':
+    resolution: {integrity: sha512-jCzKdm/QK0Kg4V4IK/oMlRZlY+QOcdjv89U2NgKHZk1CYTj82/RVSx1mV/0gqCVMJ/DA+Zf/S4NBWNF8GQ+eqQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/project-service@8.48.0':
+    resolution: {integrity: sha512-Ne4CTZyRh1BecBf84siv42wv5vQvVmgtk8AuiEffKTUo3DrBaGYZueJSxxBZ8fjk/N3DrgChH4TOdIOwOwiqqw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/scope-manager@8.48.0':
+    resolution: {integrity: sha512-uGSSsbrtJrLduti0Q1Q9+BF1/iFKaxGoQwjWOIVNJv0o6omrdyR8ct37m4xIl5Zzpkp69Kkmvom7QFTtue89YQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/tsconfig-utils@8.48.0':
+    resolution: {integrity: sha512-WNebjBdFdyu10sR1M4OXTt2OkMd5KWIL+LLfeH9KhgP+jzfDV/LI3eXzwJ1s9+Yc0Kzo2fQCdY/OpdusCMmh6w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/type-utils@8.48.0':
+    resolution: {integrity: sha512-zbeVaVqeXhhab6QNEKfK96Xyc7UQuoFWERhEnj3mLVnUWrQnv15cJNseUni7f3g557gm0e46LZ6IJ4NJVOgOpw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/types@8.48.0':
+    resolution: {integrity: sha512-cQMcGQQH7kwKoVswD1xdOytxQR60MWKM1di26xSUtxehaDs/32Zpqsu5WJlXTtTTqyAVK8R7hvsUnIXRS+bjvA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/typescript-estree@8.48.0':
+    resolution: {integrity: sha512-ljHab1CSO4rGrQIAyizUS6UGHHCiAYhbfcIZ1zVJr5nMryxlXMVWS3duFPSKvSUbFPwkXMFk1k0EMIjub4sRRQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/utils@8.48.0':
+    resolution: {integrity: sha512-yTJO1XuGxCsSfIVt1+1UrLHtue8xz16V8apzPYI06W0HbEbEWHxHXgZaAgavIkoh+GeV6hKKd5jm0sS6OYxWXQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/visitor-keys@8.48.0':
+    resolution: {integrity: sha512-T0XJMaRPOH3+LBbAfzR2jalckP1MSG/L9eUtY0DEzUyVaXJ/t6zN0nR7co5kz0Jko/nkSYCBRkz1djvjajVTTg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@vitejs/plugin-react@4.7.0':
+    resolution: {integrity: sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==}
+    engines: {node: ^14.18.0 || >=16.0.0}
+    peerDependencies:
+      vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
+
+  '@vitest/expect@4.0.14':
+    resolution: {integrity: sha512-RHk63V3zvRiYOWAV0rGEBRO820ce17hz7cI2kDmEdfQsBjT2luEKB5tCOc91u1oSQoUOZkSv3ZyzkdkSLD7lKw==}
+
+  '@vitest/mocker@4.0.14':
+    resolution: {integrity: sha512-RzS5NujlCzeRPF1MK7MXLiEFpkIXeMdQ+rN3Kk3tDI9j0mtbr7Nmuq67tpkOJQpgyClbOltCXMjLZicJHsH5Cg==}
+    peerDependencies:
+      msw: ^2.4.9
+      vite: ^6.0.0 || ^7.0.0-0
+    peerDependenciesMeta:
+      msw:
+        optional: true
+      vite:
+        optional: true
+
+  '@vitest/pretty-format@4.0.14':
+    resolution: {integrity: sha512-SOYPgujB6TITcJxgd3wmsLl+wZv+fy3av2PpiPpsWPZ6J1ySUYfScfpIt2Yv56ShJXR2MOA6q2KjKHN4EpdyRQ==}
+
+  '@vitest/runner@4.0.14':
+    resolution: {integrity: sha512-BsAIk3FAqxICqREbX8SetIteT8PiaUL/tgJjmhxJhCsigmzzH8xeadtp7LRnTpCVzvf0ib9BgAfKJHuhNllKLw==}
+
+  '@vitest/snapshot@4.0.14':
+    resolution: {integrity: sha512-aQVBfT1PMzDSA16Y3Fp45a0q8nKexx6N5Amw3MX55BeTeZpoC08fGqEZqVmPcqN0ueZsuUQ9rriPMhZ3Mu19Ag==}
+
+  '@vitest/spy@4.0.14':
+    resolution: {integrity: sha512-JmAZT1UtZooO0tpY3GRyiC/8W7dCs05UOq9rfsUUgEZEdq+DuHLmWhPsrTt0TiW7WYeL/hXpaE07AZ2RCk44hg==}
+
+  '@vitest/utils@4.0.14':
+    resolution: {integrity: sha512-hLqXZKAWNg8pI+SQXyXxWCTOpA3MvsqcbVeNgSi8x/CSN2wi26dSzn1wrOhmCmFjEvN9p8/kLFRHa6PI8jHazw==}
+
+  abstract-logging@2.0.1:
+    resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
+
+  acorn-jsx@5.3.2:
+    resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
+    peerDependencies:
+      acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
+
+  acorn@8.17.0:
+    resolution: {integrity: sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
+  ajv-formats@3.0.1:
+    resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==}
+    peerDependencies:
+      ajv: ^8.0.0
+    peerDependenciesMeta:
+      ajv:
+        optional: true
+
+  ajv@6.15.0:
+    resolution: {integrity: sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==}
+
+  ajv@8.20.0:
+    resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
+
+  ansi-styles@4.3.0:
+    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
+    engines: {node: '>=8'}
+
+  argparse@2.0.1:
+    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
+
+  asap@2.0.6:
+    resolution: {integrity: sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==}
+
+  assertion-error@2.0.1:
+    resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
+    engines: {node: '>=12'}
+
+  asynckit@0.4.0:
+    resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
+  atomic-sleep@1.0.0:
+    resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
+    engines: {node: '>=8.0.0'}
+
+  avvio@9.2.0:
+    resolution: {integrity: sha512-2t/sy01ArdHHE0vRH5Hsay+RtCZt3dLPji7W7/MMOCEgze5b7SNDC4j5H6FnVgPkI1MTNFGzHdHrVXDDl7QSSQ==}
+
+  balanced-match@1.0.2:
+    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
+
+  balanced-match@4.0.4:
+    resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
+    engines: {node: 18 || 20 || >=22}
+
+  baseline-browser-mapping@2.10.38:
+    resolution: {integrity: sha512-31/02mVB4yuQU6adKk5SlY6m+mxDwUq5KZkyYgnLrrKl7TEm1+3PyDtDBz2kOv/wxZz41GHsvV1A/u6RmiyBvw==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  brace-expansion@1.1.15:
+    resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==}
+
+  brace-expansion@2.1.1:
+    resolution: {integrity: sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==}
+
+  brace-expansion@5.0.6:
+    resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==}
+    engines: {node: 18 || 20 || >=22}
+
+  browserslist@4.28.2:
+    resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  c12@3.1.0:
+    resolution: {integrity: sha512-uWoS8OU1MEIsOv8p/5a82c3H31LsWVR5qiyXVfBNOzfffjUWtPnhAb4BYI2uG2HfGmZmFjCtui5XNWaps+iFuw==}
+    peerDependencies:
+      magicast: ^0.3.5
+    peerDependenciesMeta:
+      magicast:
+        optional: true
+
+  call-bind-apply-helpers@1.0.2:
+    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bound@1.0.4:
+    resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
+    engines: {node: '>= 0.4'}
+
+  callsites@3.1.0:
+    resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
+    engines: {node: '>=6'}
+
+  caniuse-lite@1.0.30001799:
+    resolution: {integrity: sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==}
+
+  chai@6.2.2:
+    resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==}
+    engines: {node: '>=18'}
+
+  chalk@4.1.2:
+    resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
+    engines: {node: '>=10'}
+
+  chokidar@4.0.3:
+    resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
+    engines: {node: '>= 14.16.0'}
+
+  citty@0.1.6:
+    resolution: {integrity: sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ==}
+
+  citty@0.2.2:
+    resolution: {integrity: sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==}
+
+  cluster-key-slot@1.1.2:
+    resolution: {integrity: sha512-RMr0FhtfXemyinomL4hrWcYJxmX6deFdCxpJzhDttxgO1+bcCnkk+9drydLVDmAMG7NE6aN/fl4F7ucU/90gAA==}
+    engines: {node: '>=0.10.0'}
+
+  color-convert@2.0.1:
+    resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
+    engines: {node: '>=7.0.0'}
+
+  color-name@1.1.4:
+    resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
+
+  combined-stream@1.0.8:
+    resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
+    engines: {node: '>= 0.8'}
+
+  component-emitter@1.3.1:
+    resolution: {integrity: sha512-T0+barUSQRTUQASh8bx02dl+DhF54GtIDY13Y3m9oWTklKbb3Wv974meRpeZ3lp1JpLVECWWNHC4vaG2XHXouQ==}
+
+  concat-map@0.0.1:
+    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
+
+  confbox@0.2.4:
+    resolution: {integrity: sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==}
+
+  consola@3.4.2:
+    resolution: {integrity: sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA==}
+    engines: {node: ^14.18.0 || >=16.10.0}
+
+  content-disposition@0.5.4:
+    resolution: {integrity: sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==}
+    engines: {node: '>= 0.6'}
+
+  convert-source-map@2.0.0:
+    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
+
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
+  cookiejar@2.1.4:
+    resolution: {integrity: sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw==}
+
+  cross-env@10.1.0:
+    resolution: {integrity: sha512-GsYosgnACZTADcmEyJctkJIoqAhHjttw7RsFrVoJNXbsWWqaq6Ym+7kZjq6mS45O0jij6vtiReppKQEtqWy6Dw==}
+    engines: {node: '>=20'}
+    hasBin: true
+
+  cross-spawn@7.0.6:
+    resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
+    engines: {node: '>= 8'}
+
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  deep-is@0.1.4:
+    resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
+
+  deepmerge-ts@7.1.5:
+    resolution: {integrity: sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==}
+    engines: {node: '>=16.0.0'}
+
+  defu@6.1.7:
+    resolution: {integrity: sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==}
+
+  delayed-stream@1.0.0:
+    resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
+    engines: {node: '>=0.4.0'}
+
+  denque@2.1.0:
+    resolution: {integrity: sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw==}
+    engines: {node: '>=0.10'}
+
+  depd@2.0.0:
+    resolution: {integrity: sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==}
+    engines: {node: '>= 0.8'}
+
+  dequal@2.0.3:
+    resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
+    engines: {node: '>=6'}
+
+  destr@2.0.5:
+    resolution: {integrity: sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==}
+
+  dezalgo@1.0.4:
+    resolution: {integrity: sha512-rXSP0bf+5n0Qonsb+SVVfNfIsimO4HEtmnIpPHY8Q1UCzKlQrDMfdobr8nJOOsRgWCyMRqeSBQzmWUMq7zvVig==}
+
+  dotenv-expand@12.0.1:
+    resolution: {integrity: sha512-LaKRbou8gt0RNID/9RoI+J2rvXsBRPMV7p+ElHlPhcSARbCPDYcYG2s1TIzAfWv4YSgyY5taidWzzs31lNV3yQ==}
+    engines: {node: '>=12'}
+
+  dotenv@16.4.7:
+    resolution: {integrity: sha512-47qPchRCykZC03FhkYAhrvwU4xDBFIj1QPqaarj6mdM/hgUzfPHcpkHJOn3mJAufFeeAxAzeGsr5X0M4k6fLZQ==}
+    engines: {node: '>=12'}
+
+  dotenv@16.6.1:
+    resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
+    engines: {node: '>=12'}
+
+  dunder-proto@1.0.1:
+    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
+    engines: {node: '>= 0.4'}
+
+  effect@3.18.4:
+    resolution: {integrity: sha512-b1LXQJLe9D11wfnOKAk3PKxuqYshQ0Heez+y5pnkd3jLj1yx9QhM72zZ9uUrOQyNvrs2GZZd/3maL0ZV18YuDA==}
+
+  electron-to-chromium@1.5.376:
+    resolution: {integrity: sha512-cUVA7/RvbFTEuw/i3obUwDTRIXojaxkResf+ibByPFxjc6XK3VNtcQXV0NSbAlJ0FMjcJGgftVVB4Qo184EXvA==}
+
+  empathic@2.0.0:
+    resolution: {integrity: sha512-i6UzDscO/XfAcNYD75CfICkmfLedpyPDdozrLMmQc5ORaQcdMoc21OnlEylMIqI7U8eniKrPMxxtj8k0vhmJhA==}
+    engines: {node: '>=14'}
+
+  es-define-property@1.0.1:
+    resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
+    engines: {node: '>= 0.4'}
+
+  es-errors@1.3.0:
+    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+    engines: {node: '>= 0.4'}
+
+  es-module-lexer@1.7.0:
+    resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
+
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
+    engines: {node: '>= 0.4'}
+
+  es-set-tostringtag@2.1.0:
+    resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
+    engines: {node: '>= 0.4'}
+
+  esbuild@0.21.5:
+    resolution: {integrity: sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==}
+    engines: {node: '>=12'}
+    hasBin: true
+
+  esbuild@0.25.12:
+    resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  esbuild@0.27.7:
+    resolution: {integrity: sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  escalade@3.2.0:
+    resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
+    engines: {node: '>=6'}
+
+  escape-html@1.0.3:
+    resolution: {integrity: sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==}
+
+  escape-string-regexp@4.0.0:
+    resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
+    engines: {node: '>=10'}
+
+  eslint-config-prettier@10.1.8:
+    resolution: {integrity: sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==}
+    hasBin: true
+    peerDependencies:
+      eslint: '>=7.0.0'
+
+  eslint-scope@8.4.0:
+    resolution: {integrity: sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@3.4.3:
+    resolution: {integrity: sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
+  eslint-visitor-keys@4.2.1:
+    resolution: {integrity: sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint@9.39.1:
+    resolution: {integrity: sha512-BhHmn2yNOFA9H9JmmIVKJmd288g9hrVRDkdoIgRCRuSySRUHH7r/DI6aAXW9T1WwUuY3DFgrcaqB+deURBLR5g==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    hasBin: true
+    peerDependencies:
+      jiti: '*'
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+
+  espree@10.4.0:
+    resolution: {integrity: sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  esquery@1.7.0:
+    resolution: {integrity: sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==}
+    engines: {node: '>=0.10'}
+
+  esrecurse@4.3.0:
+    resolution: {integrity: sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==}
+    engines: {node: '>=4.0'}
+
+  estraverse@5.3.0:
+    resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
+    engines: {node: '>=4.0'}
+
+  estree-walker@3.0.3:
+    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
+
+  esutils@2.0.3:
+    resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
+    engines: {node: '>=0.10.0'}
+
+  expect-type@1.3.0:
+    resolution: {integrity: sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==}
+    engines: {node: '>=12.0.0'}
+
+  exsolve@1.0.8:
+    resolution: {integrity: sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==}
+
+  fast-check@3.23.2:
+    resolution: {integrity: sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==}
+    engines: {node: '>=8.0.0'}
+
+  fast-decode-uri-component@1.0.1:
+    resolution: {integrity: sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==}
+
+  fast-deep-equal@3.1.3:
+    resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
+
+  fast-json-stable-stringify@2.1.0:
+    resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
+
+  fast-json-stringify@6.4.0:
+    resolution: {integrity: sha512-ibRCQ0GZKJIQ+P3Et1h0LhPgp3PMTYk0MH8O+kW3lNYsvmaQww5Nn3f1jf73Q0jR1Yz3a1CDP4/NZD3vOajWJQ==}
+
+  fast-levenshtein@2.0.6:
+    resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
+
+  fast-querystring@1.1.2:
+    resolution: {integrity: sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==}
+
+  fast-safe-stringify@2.1.1:
+    resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==}
+
+  fast-uri@3.1.2:
+    resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==}
+
+  fastify-plugin@5.1.0:
+    resolution: {integrity: sha512-FAIDA8eovSt5qcDgcBvDuX/v0Cjz0ohGhENZ/wpc3y+oZCY2afZ9Baqql3g/lC+OHRnciQol4ww7tuthOb9idw==}
+
+  fastify@5.6.2:
+    resolution: {integrity: sha512-dPugdGnsvYkBlENLhCgX8yhyGCsCPrpA8lFWbTNU428l+YOnLgYHR69hzV8HWPC79n536EqzqQtvhtdaCE0dKg==}
+
+  fastq@1.20.1:
+    resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  fflate@0.8.3:
+    resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==}
+
+  file-entry-cache@8.0.0:
+    resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
+    engines: {node: '>=16.0.0'}
+
+  file-type@21.1.0:
+    resolution: {integrity: sha512-boU4EHmP3JXkwDo4uhyBhTt5pPstxB6eEXKJBu2yu2l7aAMMm7QQYQEzssJmKReZYrFdFOJS8koVo6bXIBGDqA==}
+    engines: {node: '>=20'}
+
+  find-my-way@9.6.0:
+    resolution: {integrity: sha512-Zf4Xve4RymLl7NgaavNebZ01joJ8MfVerOG43wy7SHLO+r+K0C6d/SE0BiR7AV5V1VOCFlOP7ecdo+I4qmiHrQ==}
+    engines: {node: '>=20'}
+
+  find-up@5.0.0:
+    resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
+    engines: {node: '>=10'}
+
+  flat-cache@4.0.1:
+    resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
+    engines: {node: '>=16'}
+
+  flatted@3.4.2:
+    resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
+
+  foreground-child@3.3.1:
+    resolution: {integrity: sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==}
+    engines: {node: '>=14'}
+
+  form-data@4.0.6:
+    resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
+    engines: {node: '>= 6'}
+
+  formidable@3.5.4:
+    resolution: {integrity: sha512-YikH+7CUTOtP44ZTnUhR7Ic2UASBPOqmaRkRKxRbywPTe5VxF7RRCck4af9wutiZ/QKM5nME9Bie2fFaPz5Gug==}
+    engines: {node: '>=14.0.0'}
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+  gensync@1.0.0-beta.2:
+    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
+    engines: {node: '>=6.9.0'}
+
+  get-caller-file@2.0.5:
+    resolution: {integrity: sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==}
+    engines: {node: 6.* || 8.* || >= 10.*}
+
+  get-intrinsic@1.3.0:
+    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
+    engines: {node: '>= 0.4'}
+
+  get-proto@1.0.1:
+    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+    engines: {node: '>= 0.4'}
+
+  get-tsconfig@4.14.0:
+    resolution: {integrity: sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==}
+
+  giget@2.0.0:
+    resolution: {integrity: sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA==}
+    hasBin: true
+
+  glob-parent@6.0.2:
+    resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
+    engines: {node: '>=10.13.0'}
+
+  glob@11.1.0:
+    resolution: {integrity: sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw==}
+    engines: {node: 20 || >=22}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+    hasBin: true
+
+  globals@14.0.0:
+    resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
+    engines: {node: '>=18'}
+
+  globals@16.5.0:
+    resolution: {integrity: sha512-c/c15i26VrJ4IRt5Z89DnIzCGDn9EcebibhAOjw5ibqEHsE1wLUgkPn9RDmNcUKyU87GeaL633nyJ+pplFR2ZQ==}
+    engines: {node: '>=18'}
+
+  gopd@1.2.0:
+    resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
+    engines: {node: '>= 0.4'}
+
+  graphemer@1.4.0:
+    resolution: {integrity: sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==}
+
+  has-flag@4.0.0:
+    resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
+    engines: {node: '>=8'}
+
+  has-symbols@1.1.0:
+    resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
+    engines: {node: '>= 0.4'}
+
+  has-tostringtag@1.0.2:
+    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
+    engines: {node: '>= 0.4'}
+
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
+  helmet@8.2.0:
+    resolution: {integrity: sha512-DRgTIUgnWcJ62KyarxxziuqYxKGnR6Rgg19BlbucN/dpmJbl1XOit6qvoOX0ZT+HhWe5OUVhU/a1zpGyc1xA0Q==}
+    engines: {node: '>=18.0.0'}
+
+  http-errors@2.0.1:
+    resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
+    engines: {node: '>= 0.8'}
+
+  ieee754@1.2.1:
+    resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
+
+  ignore@5.3.2:
+    resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
+    engines: {node: '>= 4'}
+
+  ignore@7.0.5:
+    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
+    engines: {node: '>= 4'}
+
+  import-fresh@3.3.1:
+    resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
+    engines: {node: '>=6'}
+
+  imurmurhash@0.1.4:
+    resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
+    engines: {node: '>=0.8.19'}
+
+  inherits@2.0.4:
+    resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
+
+  ioredis@5.8.2:
+    resolution: {integrity: sha512-C6uC+kleiIMmjViJINWk80sOQw5lEzse1ZmvD+S/s8p8CWapftSaC+kocGTx6xrbrJ4WmYQGC08ffHLr6ToR6Q==}
+    engines: {node: '>=12.22.0'}
+
+  ipaddr.js@2.4.0:
+    resolution: {integrity: sha512-9VGk3HGanVE6JoZXHiCpnGy5X0jYDnN4EA4lntFPj+1vIWlFhIylq2CrrCOJH9EAhc5CYhq18F2Av2tgoAPsYQ==}
+    engines: {node: '>= 10'}
+
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
+  isexe@2.0.0:
+    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
+
+  iterare@1.2.1:
+    resolution: {integrity: sha512-RKYVTCjAnRthyJes037NX/IiqeidgN1xc3j1RjFfECFp28A1GVwK9nA+i0rJPaHqSZwygLzRnFlzUuHFoWWy+Q==}
+    engines: {node: '>=6'}
+
+  jackspeak@4.2.3:
+    resolution: {integrity: sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg==}
+    engines: {node: 20 || >=22}
+
+  jiti@2.7.0:
+    resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
+    hasBin: true
+
+  joi@18.0.2:
+    resolution: {integrity: sha512-RuCOQMIt78LWnktPoeBL0GErkNaJPTBGcYuyaBvUOQSpcpcLfWrHPPihYdOGbV5pam9VTWbeoF7TsGiHugcjGA==}
+    engines: {node: '>= 20'}
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  js-yaml@4.1.1:
+    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+    hasBin: true
+
+  js-yaml@4.2.0:
+    resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
+    hasBin: true
+
+  jsesc@3.1.0:
+    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  json-buffer@3.0.1:
+    resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
+
+  json-schema-ref-resolver@3.0.0:
+    resolution: {integrity: sha512-hOrZIVL5jyYFjzk7+y7n5JDzGlU8rfWDuYyHwGa2WA8/pcmMHezp2xsVwxrebD/Q9t8Nc5DboieySDpCp4WG4A==}
+
+  json-schema-traverse@0.4.1:
+    resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
+
+  json-schema-traverse@1.0.0:
+    resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
+
+  json-stable-stringify-without-jsonify@1.0.1:
+    resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  keyv@4.5.4:
+    resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
+
+  levn@0.4.1:
+    resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
+    engines: {node: '>= 0.8.0'}
+
+  light-my-request@6.6.0:
+    resolution: {integrity: sha512-CHYbu8RtboSIoVsHZ6Ye4cj4Aw/yg2oAFimlF7mNvfDV192LR7nDiKtSIfCuLT7KokPSTn/9kfVLm5OGN0A28A==}
+
+  load-esm@1.0.3:
+    resolution: {integrity: sha512-v5xlu8eHD1+6r8EHTg6hfmO97LN8ugKtiXcy5e6oN72iD2r6u0RPfLl6fxM+7Wnh2ZRq15o0russMst44WauPA==}
+    engines: {node: '>=13.2.0'}
+
+  locate-path@6.0.0:
+    resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
+    engines: {node: '>=10'}
+
+  lodash.defaults@4.2.0:
+    resolution: {integrity: sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ==}
+
+  lodash.isarguments@3.1.0:
+    resolution: {integrity: sha512-chi4NHZlZqZD18a0imDHnZPrDeBbTtVN7GXMwuGdRH9qotxAjYs3aVLKc7zNOG9eddR5Ksd8rvFEBc9SsggPpg==}
+
+  lodash.merge@4.6.2:
+    resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
+
+  lodash@4.17.21:
+    resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==}
+
+  loose-envify@1.4.0:
+    resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
+    hasBin: true
+
+  lru-cache@11.5.1:
+    resolution: {integrity: sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==}
+    engines: {node: 20 || >=22}
+
+  lru-cache@5.1.1:
+    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
+
+  magic-string@0.30.21:
+    resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
+
+  math-intrinsics@1.1.0:
+    resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
+    engines: {node: '>= 0.4'}
+
+  methods@1.1.2:
+    resolution: {integrity: sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==}
+    engines: {node: '>= 0.6'}
+
+  mime-db@1.52.0:
+    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
+    engines: {node: '>= 0.6'}
+
+  mime-types@2.1.35:
+    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
+    engines: {node: '>= 0.6'}
+
+  mime@2.6.0:
+    resolution: {integrity: sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==}
+    engines: {node: '>=4.0.0'}
+    hasBin: true
+
+  mime@3.0.0:
+    resolution: {integrity: sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A==}
+    engines: {node: '>=10.0.0'}
+    hasBin: true
+
+  minimatch@10.2.5:
+    resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
+    engines: {node: 18 || 20 || >=22}
+
+  minimatch@3.1.5:
+    resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
+
+  minimatch@9.0.9:
+    resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==}
+    engines: {node: '>=16 || 14 >=14.17'}
+
+  minipass@7.1.3:
+    resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==}
+    engines: {node: '>=16 || 14 >=14.17'}
+
+  ms@2.1.3:
+    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+  nanoid@3.3.14:
+    resolution: {integrity: sha512-U9kYi5bpVMEI31yC8iw4bJJp0avcHXA0W8/wNfLfnvJYzihQo2ZRPYPvpAAd570HAcCBjCTN7vnr+v4StKl1IQ==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  natural-compare@1.4.0:
+    resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
+
+  nestjs-pino@4.5.0:
+    resolution: {integrity: sha512-e54ChJMACSGF8gPYaHsuD07RW7l/OVoV6aI8Hqhpp0ZQ4WA8QY3eewL42JX7Z1U6rV7byNU7bGBV9l6d9V6PDQ==}
+    engines: {node: '>= 14'}
+    peerDependencies:
+      '@nestjs/common': ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0
+      pino: ^7.5.0 || ^8.0.0 || ^9.0.0 || ^10.0.0
+      pino-http: ^6.4.0 || ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0
+      rxjs: ^7.1.0
+
+  node-fetch-native@1.6.7:
+    resolution: {integrity: sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==}
+
+  node-releases@2.0.48:
+    resolution: {integrity: sha512-1uz8041X6LoI6ZSdZacM9lVY28vuzDlSKitnpbSNK0RfKoIJkX29NBPVEFXhnuSuEOA9Ww0xnPJ+ILWbGAv8DA==}
+    engines: {node: '>=18'}
+
+  nypm@0.6.7:
+    resolution: {integrity: sha512-s3ds97SD5pd1dULE+tHUk1DrV0cSHOnsfpcdGATJ8JpBo21DoKqN9exTH4/2nhPQNOLomBdTFMicN94S4DrZrQ==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  object-inspect@1.13.4:
+    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
+    engines: {node: '>= 0.4'}
+
+  obug@2.1.3:
+    resolution: {integrity: sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==}
+    engines: {node: '>=12.20.0'}
+
+  ohash@2.0.11:
+    resolution: {integrity: sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==}
+
+  on-exit-leak-free@2.1.2:
+    resolution: {integrity: sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==}
+    engines: {node: '>=14.0.0'}
+
+  once@1.4.0:
+    resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
+
+  optionator@0.9.4:
+    resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
+    engines: {node: '>= 0.8.0'}
+
+  p-limit@3.1.0:
+    resolution: {integrity: sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
+    engines: {node: '>=10'}
+
+  p-locate@5.0.0:
+    resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
+    engines: {node: '>=10'}
+
+  package-json-from-dist@1.0.1:
+    resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
+
+  parent-module@1.0.1:
+    resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
+    engines: {node: '>=6'}
+
+  path-exists@4.0.0:
+    resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
+    engines: {node: '>=8'}
+
+  path-key@3.1.1:
+    resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
+    engines: {node: '>=8'}
+
+  path-scurry@2.0.2:
+    resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==}
+    engines: {node: 18 || 20 || >=22}
+
+  path-to-regexp@8.3.0:
+    resolution: {integrity: sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==}
+
+  pathe@2.0.3:
+    resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
+
+  perfect-debounce@1.0.0:
+    resolution: {integrity: sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@4.0.4:
+    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
+    engines: {node: '>=12'}
+
+  pino-abstract-transport@2.0.0:
+    resolution: {integrity: sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==}
+
+  pino-abstract-transport@3.0.0:
+    resolution: {integrity: sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==}
+
+  pino-http@11.0.0:
+    resolution: {integrity: sha512-wqg5XIAGRRIWtTk8qPGxkbrfiwEWz1lgedVLvhLALudKXvg1/L2lTFgTGPJ4Z2e3qcRmxoFxDuSdMdMGNM6I1g==}
+
+  pino-std-serializers@7.1.0:
+    resolution: {integrity: sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==}
+
+  pino@10.3.1:
+    resolution: {integrity: sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==}
+    hasBin: true
+
+  pino@9.14.0:
+    resolution: {integrity: sha512-8OEwKp5juEvb/MjpIc4hjqfgCNysrS94RIOMXYvpYCdm/jglrKEiAYmiumbmGhCvs+IcInsphYDFwqrjr7398w==}
+    hasBin: true
+
+  pkg-types@2.3.1:
+    resolution: {integrity: sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==}
+
+  postcss@8.5.15:
+    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  prelude-ls@1.2.1:
+    resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
+    engines: {node: '>= 0.8.0'}
+
+  prisma@6.19.0:
+    resolution: {integrity: sha512-F3eX7K+tWpkbhl3l4+VkFtrwJlLXbAM+f9jolgoUZbFcm1DgHZ4cq9AgVEgUym2au5Ad/TDLN8lg83D+M10ycw==}
+    engines: {node: '>=18.18'}
+    hasBin: true
+    peerDependencies:
+      typescript: '>=5.1.0'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  process-warning@4.0.1:
+    resolution: {integrity: sha512-3c2LzQ3rY9d0hc1emcsHhfT9Jwz0cChib/QN89oME2R451w5fy3f0afAhERFZAwrbDU43wk12d0ORBpDVME50Q==}
+
+  process-warning@5.0.0:
+    resolution: {integrity: sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==}
+
+  punycode@2.3.1:
+    resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
+    engines: {node: '>=6'}
+
+  pure-rand@6.1.0:
+    resolution: {integrity: sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==}
+
+  qs@6.15.2:
+    resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==}
+    engines: {node: '>=0.6'}
+
+  quick-format-unescaped@4.0.4:
+    resolution: {integrity: sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==}
+
+  rc9@2.1.2:
+    resolution: {integrity: sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==}
+
+  react-dom@18.2.0:
+    resolution: {integrity: sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g==}
+    peerDependencies:
+      react: ^18.2.0
+
+  react-refresh@0.17.0:
+    resolution: {integrity: sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ==}
+    engines: {node: '>=0.10.0'}
+
+  react@18.2.0:
+    resolution: {integrity: sha512-/3IjMdb2L9QbBdWiW5e3P2/npwMBaU9mHCSCUzNln0ZCYbcfTsGbTJrU/kGemdH2IWmB2ioZ+zkxtmq6g09fGQ==}
+    engines: {node: '>=0.10.0'}
+
+  readdirp@4.1.2:
+    resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
+    engines: {node: '>= 14.18.0'}
+
+  real-require@0.2.0:
+    resolution: {integrity: sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==}
+    engines: {node: '>= 12.13.0'}
+
+  real-require@1.0.0:
+    resolution: {integrity: sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==}
+
+  redis-errors@1.2.0:
+    resolution: {integrity: sha512-1qny3OExCf0UvUV/5wpYKf2YwPcOqXzkwKKSmKHiE6ZMQs5heeE/c8eXK+PNllPvmjgAbfnsbpkGZWy8cBpn9w==}
+    engines: {node: '>=4'}
+
+  redis-parser@3.0.0:
+    resolution: {integrity: sha512-DJnGAeenTdpMEH6uAJRK/uiyEIH9WVsUmoLwzudwGJUwZPp80PDBWPHXSAGNPwNvIXAbe7MSUB1zQFugFml66A==}
+    engines: {node: '>=4'}
+
+  reflect-metadata@0.2.2:
+    resolution: {integrity: sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==}
+
+  require-from-string@2.0.2:
+    resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
+    engines: {node: '>=0.10.0'}
+
+  resolve-from@4.0.0:
+    resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
+    engines: {node: '>=4'}
+
+  resolve-pkg-maps@1.0.0:
+    resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
+
+  ret@0.5.0:
+    resolution: {integrity: sha512-I1XxrZSQ+oErkRR4jYbAyEEu2I0avBvvMM5JN+6EBprOGRCs63ENqZ3vjavq8fBw2+62G5LF5XelKwuJpcvcxw==}
+    engines: {node: '>=10'}
+
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  rfdc@1.4.1:
+    resolution: {integrity: sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==}
+
+  rollup@4.62.2:
+    resolution: {integrity: sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
+  rxjs@7.8.2:
+    resolution: {integrity: sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==}
+
+  safe-buffer@5.2.1:
+    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+
+  safe-regex2@5.1.1:
+    resolution: {integrity: sha512-mOSBvHGDZMuIEZMdOz/aCEYDCv0E7nfcNsIhUF+/P+xC7Hyf3FkvymqgPbg9D1EdSGu+uKbJgy09K/RKKc7kJA==}
+    hasBin: true
+
+  safe-stable-stringify@2.5.0:
+    resolution: {integrity: sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==}
+    engines: {node: '>=10'}
+
+  scheduler@0.23.2:
+    resolution: {integrity: sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==}
+
+  secure-json-parse@4.1.0:
+    resolution: {integrity: sha512-l4KnYfEyqYJxDwlNVyRfO2E4NTHfMKAWdUuA8J0yve2Dz/E/PdBepY03RvyJpssIpRFwJoCD55wA+mEDs6ByWA==}
+
+  semver@6.3.1:
+    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
+    hasBin: true
+
+  semver@7.8.5:
+    resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  set-cookie-parser@2.7.2:
+    resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
+
+  setprototypeof@1.2.0:
+    resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==}
+
+  shebang-command@2.0.0:
+    resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
+    engines: {node: '>=8'}
+
+  shebang-regex@3.0.0:
+    resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
+    engines: {node: '>=8'}
+
+  side-channel-list@1.0.1:
+    resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-map@1.0.1:
+    resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-weakmap@1.0.2:
+    resolution: {integrity: sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
+    engines: {node: '>= 0.4'}
+
+  side-channel@1.1.1:
+    resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
+    engines: {node: '>= 0.4'}
+
+  siginfo@2.0.0:
+    resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
+
+  signal-exit@4.1.0:
+    resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
+    engines: {node: '>=14'}
+
+  sonic-boom@4.2.1:
+    resolution: {integrity: sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==}
+
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
+  split2@4.2.0:
+    resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==}
+    engines: {node: '>= 10.x'}
+
+  stackback@0.0.2:
+    resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
+
+  standard-as-callback@2.1.0:
+    resolution: {integrity: sha512-qoRRSyROncaz1z0mvYqIE4lCd9p2R90i6GxW3uZv5ucSu8tU7B5HXUP1gG8pVZsYNVaXjk8ClXHPttLyxAL48A==}
+
+  statuses@2.0.2:
+    resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
+    engines: {node: '>= 0.8'}
+
+  std-env@3.10.0:
+    resolution: {integrity: sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==}
+
+  strip-json-comments@3.1.1:
+    resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
+    engines: {node: '>=8'}
+
+  strtok3@10.3.5:
+    resolution: {integrity: sha512-ki4hZQfh5rX0QDLLkOCj+h+CVNkqmp/CMf8v8kZpkNVK6jGQooMytqzLZYUVYIZcFZ6yDB70EfD8POcFXiF5oA==}
+    engines: {node: '>=18'}
+
+  superagent@10.3.0:
+    resolution: {integrity: sha512-B+4Ik7ROgVKrQsXTV0Jwp2u+PXYLSlqtDAhYnkkD+zn3yg8s/zjA2MeGayPoY/KICrbitwneDHrjSotxKL+0XQ==}
+    engines: {node: '>=14.18.0'}
+
+  supertest@7.1.4:
+    resolution: {integrity: sha512-tjLPs7dVyqgItVFirHYqe2T+MfWc2VOBQ8QFKKbWTA3PU7liZR8zoSpAi/C1k1ilm9RsXIKYf197oap9wXGVYg==}
+    engines: {node: '>=14.18.0'}
+
+  supports-color@7.2.0:
+    resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
+    engines: {node: '>=8'}
+
+  swagger-ui-dist@5.30.2:
+    resolution: {integrity: sha512-HWCg1DTNE/Nmapt+0m2EPXFwNKNeKK4PwMjkwveN/zn1cV2Kxi9SURd+m0SpdcSgWEK/O64sf8bzXdtUhigtHA==}
+
+  thread-stream@3.2.0:
+    resolution: {integrity: sha512-zLBvqpwr4Esa0kRjcrzGU6zL25lePWaCLMx0RQFrmteozIfeNdaMLpG5U7PeHzvlFkAWaRKA9/KVW4F60iB+qw==}
+
+  thread-stream@4.2.0:
+    resolution: {integrity: sha512-e2zZ96wSChazBsbENf/Pcm/4swHt2cEKQ92rhUjkL9GCKiTDJIaTBenjE/m9DXi0QBmTMDkFDdOomUy20A1tDQ==}
+    engines: {node: '>=20'}
+
+  tinybench@2.9.0:
+    resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
+
+  tinyexec@0.3.2:
+    resolution: {integrity: sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==}
+
+  tinyexec@1.2.4:
+    resolution: {integrity: sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==}
+    engines: {node: '>=18'}
+
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
+  tinyrainbow@3.1.0:
+    resolution: {integrity: sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==}
+    engines: {node: '>=14.0.0'}
+
+  toad-cache@3.7.1:
+    resolution: {integrity: sha512-5DXWzE4Vz7xNHsv+xQ+MGfJYyC78Aok3tEr0MNwHoRf7vZnga1mQXZ4/Nsodld4VR6Wd+VhfmqnNrsRJyYPfrQ==}
+    engines: {node: '>=20'}
+
+  toidentifier@1.0.1:
+    resolution: {integrity: sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==}
+    engines: {node: '>=0.6'}
+
+  token-types@6.1.2:
+    resolution: {integrity: sha512-dRXchy+C0IgK8WPC6xvCHFRIWYUbqqdEIKPaKo/AcTUNzwLTK6AH7RjdLWsEZcAN/TBdtfUw3PYEgPr5VPr6ww==}
+    engines: {node: '>=14.16'}
+
+  ts-api-utils@2.5.0:
+    resolution: {integrity: sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==}
+    engines: {node: '>=18.12'}
+    peerDependencies:
+      typescript: '>=4.8.4'
+
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+  tsx@4.20.6:
+    resolution: {integrity: sha512-ytQKuwgmrrkDTFP4LjR0ToE2nqgy886GpvRSpU0JAnrdBYppuY5rLkRUYPU1yCryb24SsKBTL/hlDQAEFVwtZg==}
+    engines: {node: '>=18.0.0'}
+    hasBin: true
+
+  type-check@0.4.0:
+    resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
+    engines: {node: '>= 0.8.0'}
+
+  typescript-eslint@8.48.0:
+    resolution: {integrity: sha512-fcKOvQD9GUn3Xw63EgiDqhvWJ5jsyZUaekl3KVpGsDJnN46WJTe3jWxtQP9lMZm1LJNkFLlTaWAxK2vUQR+cqw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <6.0.0'
+
+  typescript@5.9.3:
+    resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  uid@2.0.2:
+    resolution: {integrity: sha512-u3xV3X7uzvi5b1MncmZo3i2Aw222Zk1keqLA1YkHldREkAhAqi65wuPfe7lHx8H/Wzy+8CE7S7uS3jekIM5s8g==}
+    engines: {node: '>=8'}
+
+  uint8array-extras@1.5.0:
+    resolution: {integrity: sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==}
+    engines: {node: '>=18'}
+
+  undici-types@6.21.0:
+    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
+
+  update-browserslist-db@1.2.3:
+    resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  uri-js@4.4.1:
+    resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
+
+  vite@5.4.21:
+    resolution: {integrity: sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==}
+    engines: {node: ^18.0.0 || >=20.0.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^18.0.0 || >=20.0.0
+      less: '*'
+      lightningcss: ^1.21.0
+      sass: '*'
+      sass-embedded: '*'
+      stylus: '*'
+      sugarss: '*'
+      terser: ^5.4.0
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+
+  vite@7.3.5:
+    resolution: {integrity: sha512-KuOaNhcnGFN2zIPGA7wRmzF+lJA1sea7rHq17aiJ++9lzY1WWG6Jpwqwe1KNbRVPIqHmr8GLYx7jbrQcN/7/ww==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^20.19.0 || >=22.12.0
+      jiti: '>=1.21.0'
+      less: ^4.0.0
+      lightningcss: ^1.21.0
+      sass: ^1.70.0
+      sass-embedded: ^1.70.0
+      stylus: '>=0.54.8'
+      sugarss: ^5.0.0
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  vitest@4.0.14:
+    resolution: {integrity: sha512-d9B2J9Cm9dN9+6nxMnnNJKJCtcyKfnHj15N6YNJfaFHRLua/d3sRKU9RuKmO9mB0XdFtUizlxfz/VPbd3OxGhw==}
+    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
+    hasBin: true
+    peerDependencies:
+      '@edge-runtime/vm': '*'
+      '@opentelemetry/api': ^1.9.0
+      '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
+      '@vitest/browser-playwright': 4.0.14
+      '@vitest/browser-preview': 4.0.14
+      '@vitest/browser-webdriverio': 4.0.14
+      '@vitest/ui': 4.0.14
+      happy-dom: '*'
+      jsdom: '*'
+    peerDependenciesMeta:
+      '@edge-runtime/vm':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+      '@types/node':
+        optional: true
+      '@vitest/browser-playwright':
+        optional: true
+      '@vitest/browser-preview':
+        optional: true
+      '@vitest/browser-webdriverio':
+        optional: true
+      '@vitest/ui':
+        optional: true
+      happy-dom:
+        optional: true
+      jsdom:
+        optional: true
+
+  which@2.0.2:
+    resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
+    engines: {node: '>= 8'}
+    hasBin: true
+
+  why-is-node-running@2.3.0:
+    resolution: {integrity: sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==}
+    engines: {node: '>=8'}
+    hasBin: true
+
+  word-wrap@1.2.5:
+    resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
+    engines: {node: '>=0.10.0'}
+
+  wrappy@1.0.2:
+    resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
+
+  yallist@3.1.1:
+    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
+
+  yocto-queue@0.1.0:
+    resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
+    engines: {node: '>=10'}
+
+snapshots:
+
+  '@babel/code-frame@7.29.7':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.29.7
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.29.7': {}
+
+  '@babel/core@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/helper-compilation-targets': 7.29.7
+      '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
+      '@babel/helpers': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/template': 7.29.7
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/generator@7.29.7':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
+  '@babel/helper-compilation-targets@7.29.7':
+    dependencies:
+      '@babel/compat-data': 7.29.7
+      '@babel/helper-validator-option': 7.29.7
+      browserslist: 4.28.2
+      lru-cache: 5.1.1
+      semver: 6.3.1
+
+  '@babel/helper-globals@7.29.7': {}
+
+  '@babel/helper-module-imports@7.29.7':
+    dependencies:
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-module-imports': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+      '@babel/traverse': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-plugin-utils@7.29.7': {}
+
+  '@babel/helper-string-parser@7.29.7': {}
+
+  '@babel/helper-validator-identifier@7.29.7': {}
+
+  '@babel/helper-validator-option@7.29.7': {}
+
+  '@babel/helpers@7.29.7':
+    dependencies:
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@babel/parser@7.29.7':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@babel/plugin-transform-react-jsx-self@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/plugin-transform-react-jsx-source@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/template@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@babel/traverse@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/helper-globals': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.7
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/types@7.29.7':
+    dependencies:
+      '@babel/helper-string-parser': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+
+  '@borewit/text-codec@0.2.2': {}
+
+  '@epic-web/invariant@1.0.0': {}
+
+  '@esbuild/aix-ppc64@0.21.5':
+    optional: true
+
+  '@esbuild/aix-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/aix-ppc64@0.27.7':
+    optional: true
+
+  '@esbuild/android-arm64@0.21.5':
+    optional: true
+
+  '@esbuild/android-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/android-arm@0.21.5':
+    optional: true
+
+  '@esbuild/android-arm@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm@0.27.7':
+    optional: true
+
+  '@esbuild/android-x64@0.21.5':
+    optional: true
+
+  '@esbuild/android-x64@0.25.12':
+    optional: true
+
+  '@esbuild/android-x64@0.27.7':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.21.5':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/darwin-x64@0.21.5':
+    optional: true
+
+  '@esbuild/darwin-x64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-x64@0.27.7':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.21.5':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.21.5':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.27.7':
+    optional: true
+
+  '@esbuild/linux-arm64@0.21.5':
+    optional: true
+
+  '@esbuild/linux-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/linux-arm@0.21.5':
+    optional: true
+
+  '@esbuild/linux-arm@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm@0.27.7':
+    optional: true
+
+  '@esbuild/linux-ia32@0.21.5':
+    optional: true
+
+  '@esbuild/linux-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ia32@0.27.7':
+    optional: true
+
+  '@esbuild/linux-loong64@0.21.5':
+    optional: true
+
+  '@esbuild/linux-loong64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-loong64@0.27.7':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.21.5':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.25.12':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.27.7':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.21.5':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.27.7':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.21.5':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.27.7':
+    optional: true
+
+  '@esbuild/linux-s390x@0.21.5':
+    optional: true
+
+  '@esbuild/linux-s390x@0.25.12':
+    optional: true
+
+  '@esbuild/linux-s390x@0.27.7':
+    optional: true
+
+  '@esbuild/linux-x64@0.21.5':
+    optional: true
+
+  '@esbuild/linux-x64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-x64@0.27.7':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.21.5':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.27.7':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.21.5':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.27.7':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/sunos-x64@0.21.5':
+    optional: true
+
+  '@esbuild/sunos-x64@0.25.12':
+    optional: true
+
+  '@esbuild/sunos-x64@0.27.7':
+    optional: true
+
+  '@esbuild/win32-arm64@0.21.5':
+    optional: true
+
+  '@esbuild/win32-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-arm64@0.27.7':
+    optional: true
+
+  '@esbuild/win32-ia32@0.21.5':
+    optional: true
+
+  '@esbuild/win32-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/win32-ia32@0.27.7':
+    optional: true
+
+  '@esbuild/win32-x64@0.21.5':
+    optional: true
+
+  '@esbuild/win32-x64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-x64@0.27.7':
+    optional: true
+
+  '@eslint-community/eslint-utils@4.9.1(eslint@9.39.1(jiti@2.7.0))':
+    dependencies:
+      eslint: 9.39.1(jiti@2.7.0)
+      eslint-visitor-keys: 3.4.3
+
+  '@eslint-community/regexpp@4.12.2': {}
+
+  '@eslint/config-array@0.21.2':
+    dependencies:
+      '@eslint/object-schema': 2.1.7
+      debug: 4.4.3
+      minimatch: 3.1.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/config-helpers@0.4.2':
+    dependencies:
+      '@eslint/core': 0.17.0
+
+  '@eslint/core@0.17.0':
+    dependencies:
+      '@types/json-schema': 7.0.15
+
+  '@eslint/eslintrc@3.3.5':
+    dependencies:
+      ajv: 6.15.0
+      debug: 4.4.3
+      espree: 10.4.0
+      globals: 14.0.0
+      ignore: 5.3.2
+      import-fresh: 3.3.1
+      js-yaml: 4.2.0
+      minimatch: 3.1.5
+      strip-json-comments: 3.1.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/js@9.39.1': {}
+
+  '@eslint/object-schema@2.1.7': {}
+
+  '@eslint/plugin-kit@0.4.1':
+    dependencies:
+      '@eslint/core': 0.17.0
+      levn: 0.4.1
+
+  '@fastify/accept-negotiator@2.0.1': {}
+
+  '@fastify/ajv-compiler@4.0.5':
+    dependencies:
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      fast-uri: 3.1.2
+
+  '@fastify/cors@11.1.0':
+    dependencies:
+      fastify-plugin: 5.1.0
+      toad-cache: 3.7.1
+
+  '@fastify/error@4.2.0': {}
+
+  '@fastify/fast-json-stringify-compiler@5.0.3':
+    dependencies:
+      fast-json-stringify: 6.4.0
+
+  '@fastify/formbody@8.0.2':
+    dependencies:
+      fast-querystring: 1.1.2
+      fastify-plugin: 5.1.0
+
+  '@fastify/forwarded@3.0.1': {}
+
+  '@fastify/helmet@13.0.2':
+    dependencies:
+      fastify-plugin: 5.1.0
+      helmet: 8.2.0
+
+  '@fastify/merge-json-schemas@0.2.1':
+    dependencies:
+      dequal: 2.0.3
+
+  '@fastify/middie@9.0.3':
+    dependencies:
+      '@fastify/error': 4.2.0
+      fastify-plugin: 5.1.0
+      path-to-regexp: 8.3.0
+      reusify: 1.1.0
+
+  '@fastify/proxy-addr@5.1.0':
+    dependencies:
+      '@fastify/forwarded': 3.0.1
+      ipaddr.js: 2.4.0
+
+  '@fastify/send@4.1.0':
+    dependencies:
+      '@lukeed/ms': 2.0.2
+      escape-html: 1.0.3
+      fast-decode-uri-component: 1.0.1
+      http-errors: 2.0.1
+      mime: 3.0.0
+
+  '@fastify/static@8.3.0':
+    dependencies:
+      '@fastify/accept-negotiator': 2.0.1
+      '@fastify/send': 4.1.0
+      content-disposition: 0.5.4
+      fastify-plugin: 5.1.0
+      fastq: 1.20.1
+      glob: 11.1.0
+
+  '@hapi/address@5.1.1':
+    dependencies:
+      '@hapi/hoek': 11.0.7
+
+  '@hapi/formula@3.0.2': {}
+
+  '@hapi/hoek@11.0.7': {}
+
+  '@hapi/pinpoint@2.0.1': {}
+
+  '@hapi/tlds@1.1.7': {}
+
+  '@hapi/topo@6.0.2':
+    dependencies:
+      '@hapi/hoek': 11.0.7
+
+  '@humanfs/core@0.19.2':
+    dependencies:
+      '@humanfs/types': 0.15.0
+
+  '@humanfs/node@0.16.8':
+    dependencies:
+      '@humanfs/core': 0.19.2
+      '@humanfs/types': 0.15.0
+      '@humanwhocodes/retry': 0.4.3
+
+  '@humanfs/types@0.15.0': {}
+
+  '@humanwhocodes/module-importer@1.0.1': {}
+
+  '@humanwhocodes/retry@0.4.3': {}
+
+  '@ioredis/commands@1.4.0': {}
+
+  '@isaacs/cliui@9.0.0': {}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/remapping@2.3.5':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/resolve-uri@3.1.2': {}
+
+  '@jridgewell/sourcemap-codec@1.5.5': {}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@lukeed/csprng@1.1.0': {}
+
+  '@lukeed/ms@2.0.2': {}
+
+  '@microsoft/tsdoc@0.16.0': {}
+
+  '@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2)':
+    dependencies:
+      file-type: 21.1.0
+      iterare: 1.2.1
+      load-esm: 1.0.3
+      reflect-metadata: 0.2.2
+      rxjs: 7.8.2
+      tslib: 2.8.1
+      uid: 2.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@nestjs/config@4.0.2(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(rxjs@7.8.2)':
+    dependencies:
+      '@nestjs/common': 11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      dotenv: 16.4.7
+      dotenv-expand: 12.0.1
+      lodash: 4.17.21
+      rxjs: 7.8.2
+
+  '@nestjs/core@11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2)':
+    dependencies:
+      '@nestjs/common': 11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nuxt/opencollective': 0.4.1
+      fast-safe-stringify: 2.1.1
+      iterare: 1.2.1
+      path-to-regexp: 8.3.0
+      reflect-metadata: 0.2.2
+      rxjs: 7.8.2
+      tslib: 2.8.1
+      uid: 2.0.2
+
+  '@nestjs/mapped-types@2.1.0(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)':
+    dependencies:
+      '@nestjs/common': 11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      reflect-metadata: 0.2.2
+
+  '@nestjs/platform-fastify@11.1.9(@fastify/static@8.3.0)(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2))':
+    dependencies:
+      '@fastify/cors': 11.1.0
+      '@fastify/formbody': 8.0.2
+      '@fastify/middie': 9.0.3
+      '@nestjs/common': 11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/core': 11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      fast-querystring: 1.1.2
+      fastify: 5.6.2
+      light-my-request: 6.6.0
+      path-to-regexp: 8.3.0
+      tslib: 2.8.1
+    optionalDependencies:
+      '@fastify/static': 8.3.0
+
+  '@nestjs/swagger@11.2.3(@fastify/static@8.3.0)(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)':
+    dependencies:
+      '@microsoft/tsdoc': 0.16.0
+      '@nestjs/common': 11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/core': 11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/mapped-types': 2.1.0(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)
+      js-yaml: 4.1.1
+      lodash: 4.17.21
+      path-to-regexp: 8.3.0
+      reflect-metadata: 0.2.2
+      swagger-ui-dist: 5.30.2
+    optionalDependencies:
+      '@fastify/static': 8.3.0
+
+  '@nestjs/testing@11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2))':
+    dependencies:
+      '@nestjs/common': 11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/core': 11.1.9(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      tslib: 2.8.1
+
+  '@noble/hashes@1.8.0': {}
+
+  '@nuxt/opencollective@0.4.1':
+    dependencies:
+      consola: 3.4.2
+
+  '@paralleldrive/cuid2@2.3.1':
+    dependencies:
+      '@noble/hashes': 1.8.0
+
+  '@pinojs/redact@0.4.0': {}
+
+  '@prisma/client@6.19.0(prisma@6.19.0(typescript@5.9.3))(typescript@5.9.3)':
+    optionalDependencies:
+      prisma: 6.19.0(typescript@5.9.3)
+      typescript: 5.9.3
+
+  '@prisma/config@6.19.0':
+    dependencies:
+      c12: 3.1.0
+      deepmerge-ts: 7.1.5
+      effect: 3.18.4
+      empathic: 2.0.0
+    transitivePeerDependencies:
+      - magicast
+
+  '@prisma/debug@6.19.0': {}
+
+  '@prisma/engines-version@6.19.0-26.2ba551f319ab1df4bc874a89965d8b3641056773': {}
+
+  '@prisma/engines@6.19.0':
+    dependencies:
+      '@prisma/debug': 6.19.0
+      '@prisma/engines-version': 6.19.0-26.2ba551f319ab1df4bc874a89965d8b3641056773
+      '@prisma/fetch-engine': 6.19.0
+      '@prisma/get-platform': 6.19.0
+
+  '@prisma/fetch-engine@6.19.0':
+    dependencies:
+      '@prisma/debug': 6.19.0
+      '@prisma/engines-version': 6.19.0-26.2ba551f319ab1df4bc874a89965d8b3641056773
+      '@prisma/get-platform': 6.19.0
+
+  '@prisma/get-platform@6.19.0':
+    dependencies:
+      '@prisma/debug': 6.19.0
+
+  '@rolldown/pluginutils@1.0.0-beta.27': {}
+
+  '@rollup/rollup-android-arm-eabi@4.62.2':
+    optional: true
+
+  '@rollup/rollup-android-arm64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-darwin-arm64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-darwin-x64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-freebsd-arm64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-freebsd-x64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-arm-musleabihf@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-musl@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-musl@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-musl@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-musl@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-s390x-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-x64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-x64-musl@4.62.2':
+    optional: true
+
+  '@rollup/rollup-openbsd-x64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-openharmony-arm64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-win32-arm64-msvc@4.62.2':
+    optional: true
+
+  '@rollup/rollup-win32-ia32-msvc@4.62.2':
+    optional: true
+
+  '@rollup/rollup-win32-x64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-win32-x64-msvc@4.62.2':
+    optional: true
+
+  '@scarf/scarf@1.4.0': {}
+
+  '@standard-schema/spec@1.1.0': {}
+
+  '@tokenizer/inflate@0.3.1':
+    dependencies:
+      debug: 4.4.3
+      fflate: 0.8.3
+      token-types: 6.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@tokenizer/token@0.3.0': {}
+
+  '@types/babel__core@7.20.5':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+      '@types/babel__generator': 7.27.0
+      '@types/babel__template': 7.4.4
+      '@types/babel__traverse': 7.28.0
+
+  '@types/babel__generator@7.27.0':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@types/babel__template@7.4.4':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@types/babel__traverse@7.28.0':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@types/chai@5.2.3':
+    dependencies:
+      '@types/deep-eql': 4.0.2
+      assertion-error: 2.0.1
+
+  '@types/cookiejar@2.1.5': {}
+
+  '@types/deep-eql@4.0.2': {}
+
+  '@types/estree@1.0.9': {}
+
+  '@types/json-schema@7.0.15': {}
+
+  '@types/methods@1.1.4': {}
+
+  '@types/node@22.19.0':
+    dependencies:
+      undici-types: 6.21.0
+
+  '@types/superagent@8.1.10':
+    dependencies:
+      '@types/cookiejar': 2.1.5
+      '@types/methods': 1.1.4
+      '@types/node': 22.19.0
+      form-data: 4.0.6
+
+  '@types/supertest@6.0.3':
+    dependencies:
+      '@types/methods': 1.1.4
+      '@types/superagent': 8.1.10
+
+  '@typescript-eslint/eslint-plugin@8.48.0(@typescript-eslint/parser@8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3))(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/regexpp': 4.12.2
+      '@typescript-eslint/parser': 8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/scope-manager': 8.48.0
+      '@typescript-eslint/type-utils': 8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.48.0
+      eslint: 9.39.1(jiti@2.7.0)
+      graphemer: 1.4.0
+      ignore: 7.0.5
+      natural-compare: 1.4.0
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/parser@8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/scope-manager': 8.48.0
+      '@typescript-eslint/types': 8.48.0
+      '@typescript-eslint/typescript-estree': 8.48.0(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.48.0
+      debug: 4.4.3
+      eslint: 9.39.1(jiti@2.7.0)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.48.0(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.48.0(typescript@5.9.3)
+      '@typescript-eslint/types': 8.48.0
+      debug: 4.4.3
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/scope-manager@8.48.0':
+    dependencies:
+      '@typescript-eslint/types': 8.48.0
+      '@typescript-eslint/visitor-keys': 8.48.0
+
+  '@typescript-eslint/tsconfig-utils@8.48.0(typescript@5.9.3)':
+    dependencies:
+      typescript: 5.9.3
+
+  '@typescript-eslint/type-utils@8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/types': 8.48.0
+      '@typescript-eslint/typescript-estree': 8.48.0(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)
+      debug: 4.4.3
+      eslint: 9.39.1(jiti@2.7.0)
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/types@8.48.0': {}
+
+  '@typescript-eslint/typescript-estree@8.48.0(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.48.0(typescript@5.9.3)
+      '@typescript-eslint/tsconfig-utils': 8.48.0(typescript@5.9.3)
+      '@typescript-eslint/types': 8.48.0
+      '@typescript-eslint/visitor-keys': 8.48.0
+      debug: 4.4.3
+      minimatch: 9.0.9
+      semver: 7.8.5
+      tinyglobby: 0.2.17
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.1(jiti@2.7.0))
+      '@typescript-eslint/scope-manager': 8.48.0
+      '@typescript-eslint/types': 8.48.0
+      '@typescript-eslint/typescript-estree': 8.48.0(typescript@5.9.3)
+      eslint: 9.39.1(jiti@2.7.0)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/visitor-keys@8.48.0':
+    dependencies:
+      '@typescript-eslint/types': 8.48.0
+      eslint-visitor-keys: 4.2.1
+
+  '@vitejs/plugin-react@4.7.0(vite@5.4.21(@types/node@22.19.0))':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/plugin-transform-react-jsx-self': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-react-jsx-source': 7.29.7(@babel/core@7.29.7)
+      '@rolldown/pluginutils': 1.0.0-beta.27
+      '@types/babel__core': 7.20.5
+      react-refresh: 0.17.0
+      vite: 5.4.21(@types/node@22.19.0)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@vitest/expect@4.0.14':
+    dependencies:
+      '@standard-schema/spec': 1.1.0
+      '@types/chai': 5.2.3
+      '@vitest/spy': 4.0.14
+      '@vitest/utils': 4.0.14
+      chai: 6.2.2
+      tinyrainbow: 3.1.0
+
+  '@vitest/mocker@4.0.14(vite@7.3.5(@types/node@22.19.0)(jiti@2.7.0)(tsx@4.20.6))':
+    dependencies:
+      '@vitest/spy': 4.0.14
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+    optionalDependencies:
+      vite: 7.3.5(@types/node@22.19.0)(jiti@2.7.0)(tsx@4.20.6)
+
+  '@vitest/pretty-format@4.0.14':
+    dependencies:
+      tinyrainbow: 3.1.0
+
+  '@vitest/runner@4.0.14':
+    dependencies:
+      '@vitest/utils': 4.0.14
+      pathe: 2.0.3
+
+  '@vitest/snapshot@4.0.14':
+    dependencies:
+      '@vitest/pretty-format': 4.0.14
+      magic-string: 0.30.21
+      pathe: 2.0.3
+
+  '@vitest/spy@4.0.14': {}
+
+  '@vitest/utils@4.0.14':
+    dependencies:
+      '@vitest/pretty-format': 4.0.14
+      tinyrainbow: 3.1.0
+
+  abstract-logging@2.0.1: {}
+
+  acorn-jsx@5.3.2(acorn@8.17.0):
+    dependencies:
+      acorn: 8.17.0
+
+  acorn@8.17.0: {}
+
+  ajv-formats@3.0.1(ajv@8.20.0):
+    optionalDependencies:
+      ajv: 8.20.0
+
+  ajv@6.15.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-json-stable-stringify: 2.1.0
+      json-schema-traverse: 0.4.1
+      uri-js: 4.4.1
+
+  ajv@8.20.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-uri: 3.1.2
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+
+  ansi-styles@4.3.0:
+    dependencies:
+      color-convert: 2.0.1
+
+  argparse@2.0.1: {}
+
+  asap@2.0.6: {}
+
+  assertion-error@2.0.1: {}
+
+  asynckit@0.4.0: {}
+
+  atomic-sleep@1.0.0: {}
+
+  avvio@9.2.0:
+    dependencies:
+      '@fastify/error': 4.2.0
+      fastq: 1.20.1
+
+  balanced-match@1.0.2: {}
+
+  balanced-match@4.0.4: {}
+
+  baseline-browser-mapping@2.10.38: {}
+
+  brace-expansion@1.1.15:
+    dependencies:
+      balanced-match: 1.0.2
+      concat-map: 0.0.1
+
+  brace-expansion@2.1.1:
+    dependencies:
+      balanced-match: 1.0.2
+
+  brace-expansion@5.0.6:
+    dependencies:
+      balanced-match: 4.0.4
+
+  browserslist@4.28.2:
+    dependencies:
+      baseline-browser-mapping: 2.10.38
+      caniuse-lite: 1.0.30001799
+      electron-to-chromium: 1.5.376
+      node-releases: 2.0.48
+      update-browserslist-db: 1.2.3(browserslist@4.28.2)
+
+  c12@3.1.0:
+    dependencies:
+      chokidar: 4.0.3
+      confbox: 0.2.4
+      defu: 6.1.7
+      dotenv: 16.6.1
+      exsolve: 1.0.8
+      giget: 2.0.0
+      jiti: 2.7.0
+      ohash: 2.0.11
+      pathe: 2.0.3
+      perfect-debounce: 1.0.0
+      pkg-types: 2.3.1
+      rc9: 2.1.2
+
+  call-bind-apply-helpers@1.0.2:
+    dependencies:
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+
+  call-bound@1.0.4:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      get-intrinsic: 1.3.0
+
+  callsites@3.1.0: {}
+
+  caniuse-lite@1.0.30001799: {}
+
+  chai@6.2.2: {}
+
+  chalk@4.1.2:
+    dependencies:
+      ansi-styles: 4.3.0
+      supports-color: 7.2.0
+
+  chokidar@4.0.3:
+    dependencies:
+      readdirp: 4.1.2
+
+  citty@0.1.6:
+    dependencies:
+      consola: 3.4.2
+
+  citty@0.2.2: {}
+
+  cluster-key-slot@1.1.2: {}
+
+  color-convert@2.0.1:
+    dependencies:
+      color-name: 1.1.4
+
+  color-name@1.1.4: {}
+
+  combined-stream@1.0.8:
+    dependencies:
+      delayed-stream: 1.0.0
+
+  component-emitter@1.3.1: {}
+
+  concat-map@0.0.1: {}
+
+  confbox@0.2.4: {}
+
+  consola@3.4.2: {}
+
+  content-disposition@0.5.4:
+    dependencies:
+      safe-buffer: 5.2.1
+
+  convert-source-map@2.0.0: {}
+
+  cookie@1.1.1: {}
+
+  cookiejar@2.1.4: {}
+
+  cross-env@10.1.0:
+    dependencies:
+      '@epic-web/invariant': 1.0.0
+      cross-spawn: 7.0.6
+
+  cross-spawn@7.0.6:
+    dependencies:
+      path-key: 3.1.1
+      shebang-command: 2.0.0
+      which: 2.0.2
+
+  debug@4.4.3:
+    dependencies:
+      ms: 2.1.3
+
+  deep-is@0.1.4: {}
+
+  deepmerge-ts@7.1.5: {}
+
+  defu@6.1.7: {}
+
+  delayed-stream@1.0.0: {}
+
+  denque@2.1.0: {}
+
+  depd@2.0.0: {}
+
+  dequal@2.0.3: {}
+
+  destr@2.0.5: {}
+
+  dezalgo@1.0.4:
+    dependencies:
+      asap: 2.0.6
+      wrappy: 1.0.2
+
+  dotenv-expand@12.0.1:
+    dependencies:
+      dotenv: 16.4.7
+
+  dotenv@16.4.7: {}
+
+  dotenv@16.6.1: {}
+
+  dunder-proto@1.0.1:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  effect@3.18.4:
+    dependencies:
+      '@standard-schema/spec': 1.1.0
+      fast-check: 3.23.2
+
+  electron-to-chromium@1.5.376: {}
+
+  empathic@2.0.0: {}
+
+  es-define-property@1.0.1: {}
+
+  es-errors@1.3.0: {}
+
+  es-module-lexer@1.7.0: {}
+
+  es-object-atoms@1.1.2:
+    dependencies:
+      es-errors: 1.3.0
+
+  es-set-tostringtag@2.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.4
+
+  esbuild@0.21.5:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.21.5
+      '@esbuild/android-arm': 0.21.5
+      '@esbuild/android-arm64': 0.21.5
+      '@esbuild/android-x64': 0.21.5
+      '@esbuild/darwin-arm64': 0.21.5
+      '@esbuild/darwin-x64': 0.21.5
+      '@esbuild/freebsd-arm64': 0.21.5
+      '@esbuild/freebsd-x64': 0.21.5
+      '@esbuild/linux-arm': 0.21.5
+      '@esbuild/linux-arm64': 0.21.5
+      '@esbuild/linux-ia32': 0.21.5
+      '@esbuild/linux-loong64': 0.21.5
+      '@esbuild/linux-mips64el': 0.21.5
+      '@esbuild/linux-ppc64': 0.21.5
+      '@esbuild/linux-riscv64': 0.21.5
+      '@esbuild/linux-s390x': 0.21.5
+      '@esbuild/linux-x64': 0.21.5
+      '@esbuild/netbsd-x64': 0.21.5
+      '@esbuild/openbsd-x64': 0.21.5
+      '@esbuild/sunos-x64': 0.21.5
+      '@esbuild/win32-arm64': 0.21.5
+      '@esbuild/win32-ia32': 0.21.5
+      '@esbuild/win32-x64': 0.21.5
+
+  esbuild@0.25.12:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.25.12
+      '@esbuild/android-arm': 0.25.12
+      '@esbuild/android-arm64': 0.25.12
+      '@esbuild/android-x64': 0.25.12
+      '@esbuild/darwin-arm64': 0.25.12
+      '@esbuild/darwin-x64': 0.25.12
+      '@esbuild/freebsd-arm64': 0.25.12
+      '@esbuild/freebsd-x64': 0.25.12
+      '@esbuild/linux-arm': 0.25.12
+      '@esbuild/linux-arm64': 0.25.12
+      '@esbuild/linux-ia32': 0.25.12
+      '@esbuild/linux-loong64': 0.25.12
+      '@esbuild/linux-mips64el': 0.25.12
+      '@esbuild/linux-ppc64': 0.25.12
+      '@esbuild/linux-riscv64': 0.25.12
+      '@esbuild/linux-s390x': 0.25.12
+      '@esbuild/linux-x64': 0.25.12
+      '@esbuild/netbsd-arm64': 0.25.12
+      '@esbuild/netbsd-x64': 0.25.12
+      '@esbuild/openbsd-arm64': 0.25.12
+      '@esbuild/openbsd-x64': 0.25.12
+      '@esbuild/openharmony-arm64': 0.25.12
+      '@esbuild/sunos-x64': 0.25.12
+      '@esbuild/win32-arm64': 0.25.12
+      '@esbuild/win32-ia32': 0.25.12
+      '@esbuild/win32-x64': 0.25.12
+
+  esbuild@0.27.7:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.27.7
+      '@esbuild/android-arm': 0.27.7
+      '@esbuild/android-arm64': 0.27.7
+      '@esbuild/android-x64': 0.27.7
+      '@esbuild/darwin-arm64': 0.27.7
+      '@esbuild/darwin-x64': 0.27.7
+      '@esbuild/freebsd-arm64': 0.27.7
+      '@esbuild/freebsd-x64': 0.27.7
+      '@esbuild/linux-arm': 0.27.7
+      '@esbuild/linux-arm64': 0.27.7
+      '@esbuild/linux-ia32': 0.27.7
+      '@esbuild/linux-loong64': 0.27.7
+      '@esbuild/linux-mips64el': 0.27.7
+      '@esbuild/linux-ppc64': 0.27.7
+      '@esbuild/linux-riscv64': 0.27.7
+      '@esbuild/linux-s390x': 0.27.7
+      '@esbuild/linux-x64': 0.27.7
+      '@esbuild/netbsd-arm64': 0.27.7
+      '@esbuild/netbsd-x64': 0.27.7
+      '@esbuild/openbsd-arm64': 0.27.7
+      '@esbuild/openbsd-x64': 0.27.7
+      '@esbuild/openharmony-arm64': 0.27.7
+      '@esbuild/sunos-x64': 0.27.7
+      '@esbuild/win32-arm64': 0.27.7
+      '@esbuild/win32-ia32': 0.27.7
+      '@esbuild/win32-x64': 0.27.7
+
+  escalade@3.2.0: {}
+
+  escape-html@1.0.3: {}
+
+  escape-string-regexp@4.0.0: {}
+
+  eslint-config-prettier@10.1.8(eslint@9.39.1(jiti@2.7.0)):
+    dependencies:
+      eslint: 9.39.1(jiti@2.7.0)
+
+  eslint-scope@8.4.0:
+    dependencies:
+      esrecurse: 4.3.0
+      estraverse: 5.3.0
+
+  eslint-visitor-keys@3.4.3: {}
+
+  eslint-visitor-keys@4.2.1: {}
+
+  eslint@9.39.1(jiti@2.7.0):
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.1(jiti@2.7.0))
+      '@eslint-community/regexpp': 4.12.2
+      '@eslint/config-array': 0.21.2
+      '@eslint/config-helpers': 0.4.2
+      '@eslint/core': 0.17.0
+      '@eslint/eslintrc': 3.3.5
+      '@eslint/js': 9.39.1
+      '@eslint/plugin-kit': 0.4.1
+      '@humanfs/node': 0.16.8
+      '@humanwhocodes/module-importer': 1.0.1
+      '@humanwhocodes/retry': 0.4.3
+      '@types/estree': 1.0.9
+      ajv: 6.15.0
+      chalk: 4.1.2
+      cross-spawn: 7.0.6
+      debug: 4.4.3
+      escape-string-regexp: 4.0.0
+      eslint-scope: 8.4.0
+      eslint-visitor-keys: 4.2.1
+      espree: 10.4.0
+      esquery: 1.7.0
+      esutils: 2.0.3
+      fast-deep-equal: 3.1.3
+      file-entry-cache: 8.0.0
+      find-up: 5.0.0
+      glob-parent: 6.0.2
+      ignore: 5.3.2
+      imurmurhash: 0.1.4
+      is-glob: 4.0.3
+      json-stable-stringify-without-jsonify: 1.0.1
+      lodash.merge: 4.6.2
+      minimatch: 3.1.5
+      natural-compare: 1.4.0
+      optionator: 0.9.4
+    optionalDependencies:
+      jiti: 2.7.0
+    transitivePeerDependencies:
+      - supports-color
+
+  espree@10.4.0:
+    dependencies:
+      acorn: 8.17.0
+      acorn-jsx: 5.3.2(acorn@8.17.0)
+      eslint-visitor-keys: 4.2.1
+
+  esquery@1.7.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  esrecurse@4.3.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  estraverse@5.3.0: {}
+
+  estree-walker@3.0.3:
+    dependencies:
+      '@types/estree': 1.0.9
+
+  esutils@2.0.3: {}
+
+  expect-type@1.3.0: {}
+
+  exsolve@1.0.8: {}
+
+  fast-check@3.23.2:
+    dependencies:
+      pure-rand: 6.1.0
+
+  fast-decode-uri-component@1.0.1: {}
+
+  fast-deep-equal@3.1.3: {}
+
+  fast-json-stable-stringify@2.1.0: {}
+
+  fast-json-stringify@6.4.0:
+    dependencies:
+      '@fastify/merge-json-schemas': 0.2.1
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      fast-uri: 3.1.2
+      json-schema-ref-resolver: 3.0.0
+      rfdc: 1.4.1
+
+  fast-levenshtein@2.0.6: {}
+
+  fast-querystring@1.1.2:
+    dependencies:
+      fast-decode-uri-component: 1.0.1
+
+  fast-safe-stringify@2.1.1: {}
+
+  fast-uri@3.1.2: {}
+
+  fastify-plugin@5.1.0: {}
+
+  fastify@5.6.2:
+    dependencies:
+      '@fastify/ajv-compiler': 4.0.5
+      '@fastify/error': 4.2.0
+      '@fastify/fast-json-stringify-compiler': 5.0.3
+      '@fastify/proxy-addr': 5.1.0
+      abstract-logging: 2.0.1
+      avvio: 9.2.0
+      fast-json-stringify: 6.4.0
+      find-my-way: 9.6.0
+      light-my-request: 6.6.0
+      pino: 10.3.1
+      process-warning: 5.0.0
+      rfdc: 1.4.1
+      secure-json-parse: 4.1.0
+      semver: 7.8.5
+      toad-cache: 3.7.1
+
+  fastq@1.20.1:
+    dependencies:
+      reusify: 1.1.0
+
+  fdir@6.5.0(picomatch@4.0.4):
+    optionalDependencies:
+      picomatch: 4.0.4
+
+  fflate@0.8.3: {}
+
+  file-entry-cache@8.0.0:
+    dependencies:
+      flat-cache: 4.0.1
+
+  file-type@21.1.0:
+    dependencies:
+      '@tokenizer/inflate': 0.3.1
+      strtok3: 10.3.5
+      token-types: 6.1.2
+      uint8array-extras: 1.5.0
+    transitivePeerDependencies:
+      - supports-color
+
+  find-my-way@9.6.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-querystring: 1.1.2
+      safe-regex2: 5.1.1
+
+  find-up@5.0.0:
+    dependencies:
+      locate-path: 6.0.0
+      path-exists: 4.0.0
+
+  flat-cache@4.0.1:
+    dependencies:
+      flatted: 3.4.2
+      keyv: 4.5.4
+
+  flatted@3.4.2: {}
+
+  foreground-child@3.3.1:
+    dependencies:
+      cross-spawn: 7.0.6
+      signal-exit: 4.1.0
+
+  form-data@4.0.6:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.4
+      mime-types: 2.1.35
+
+  formidable@3.5.4:
+    dependencies:
+      '@paralleldrive/cuid2': 2.3.1
+      dezalgo: 1.0.4
+      once: 1.4.0
+
+  fsevents@2.3.3:
+    optional: true
+
+  function-bind@1.1.2: {}
+
+  gensync@1.0.0-beta.2: {}
+
+  get-caller-file@2.0.5: {}
+
+  get-intrinsic@1.3.0:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      function-bind: 1.1.2
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.4
+      math-intrinsics: 1.1.0
+
+  get-proto@1.0.1:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-object-atoms: 1.1.2
+
+  get-tsconfig@4.14.0:
+    dependencies:
+      resolve-pkg-maps: 1.0.0
+
+  giget@2.0.0:
+    dependencies:
+      citty: 0.1.6
+      consola: 3.4.2
+      defu: 6.1.7
+      node-fetch-native: 1.6.7
+      nypm: 0.6.7
+      pathe: 2.0.3
+
+  glob-parent@6.0.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob@11.1.0:
+    dependencies:
+      foreground-child: 3.3.1
+      jackspeak: 4.2.3
+      minimatch: 10.2.5
+      minipass: 7.1.3
+      package-json-from-dist: 1.0.1
+      path-scurry: 2.0.2
+
+  globals@14.0.0: {}
+
+  globals@16.5.0: {}
+
+  gopd@1.2.0: {}
+
+  graphemer@1.4.0: {}
+
+  has-flag@4.0.0: {}
+
+  has-symbols@1.1.0: {}
+
+  has-tostringtag@1.0.2:
+    dependencies:
+      has-symbols: 1.1.0
+
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
+  helmet@8.2.0: {}
+
+  http-errors@2.0.1:
+    dependencies:
+      depd: 2.0.0
+      inherits: 2.0.4
+      setprototypeof: 1.2.0
+      statuses: 2.0.2
+      toidentifier: 1.0.1
+
+  ieee754@1.2.1: {}
+
+  ignore@5.3.2: {}
+
+  ignore@7.0.5: {}
+
+  import-fresh@3.3.1:
+    dependencies:
+      parent-module: 1.0.1
+      resolve-from: 4.0.0
+
+  imurmurhash@0.1.4: {}
+
+  inherits@2.0.4: {}
+
+  ioredis@5.8.2:
+    dependencies:
+      '@ioredis/commands': 1.4.0
+      cluster-key-slot: 1.1.2
+      debug: 4.4.3
+      denque: 2.1.0
+      lodash.defaults: 4.2.0
+      lodash.isarguments: 3.1.0
+      redis-errors: 1.2.0
+      redis-parser: 3.0.0
+      standard-as-callback: 2.1.0
+    transitivePeerDependencies:
+      - supports-color
+
+  ipaddr.js@2.4.0: {}
+
+  is-extglob@2.1.1: {}
+
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
+  isexe@2.0.0: {}
+
+  iterare@1.2.1: {}
+
+  jackspeak@4.2.3:
+    dependencies:
+      '@isaacs/cliui': 9.0.0
+
+  jiti@2.7.0: {}
+
+  joi@18.0.2:
+    dependencies:
+      '@hapi/address': 5.1.1
+      '@hapi/formula': 3.0.2
+      '@hapi/hoek': 11.0.7
+      '@hapi/pinpoint': 2.0.1
+      '@hapi/tlds': 1.1.7
+      '@hapi/topo': 6.0.2
+      '@standard-schema/spec': 1.1.0
+
+  js-tokens@4.0.0: {}
+
+  js-yaml@4.1.1:
+    dependencies:
+      argparse: 2.0.1
+
+  js-yaml@4.2.0:
+    dependencies:
+      argparse: 2.0.1
+
+  jsesc@3.1.0: {}
+
+  json-buffer@3.0.1: {}
+
+  json-schema-ref-resolver@3.0.0:
+    dependencies:
+      dequal: 2.0.3
+
+  json-schema-traverse@0.4.1: {}
+
+  json-schema-traverse@1.0.0: {}
+
+  json-stable-stringify-without-jsonify@1.0.1: {}
+
+  json5@2.2.3: {}
+
+  keyv@4.5.4:
+    dependencies:
+      json-buffer: 3.0.1
+
+  levn@0.4.1:
+    dependencies:
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+
+  light-my-request@6.6.0:
+    dependencies:
+      cookie: 1.1.1
+      process-warning: 4.0.1
+      set-cookie-parser: 2.7.2
+
+  load-esm@1.0.3: {}
+
+  locate-path@6.0.0:
+    dependencies:
+      p-locate: 5.0.0
+
+  lodash.defaults@4.2.0: {}
+
+  lodash.isarguments@3.1.0: {}
+
+  lodash.merge@4.6.2: {}
+
+  lodash@4.17.21: {}
+
+  loose-envify@1.4.0:
+    dependencies:
+      js-tokens: 4.0.0
+
+  lru-cache@11.5.1: {}
+
+  lru-cache@5.1.1:
+    dependencies:
+      yallist: 3.1.1
+
+  magic-string@0.30.21:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  math-intrinsics@1.1.0: {}
+
+  methods@1.1.2: {}
+
+  mime-db@1.52.0: {}
+
+  mime-types@2.1.35:
+    dependencies:
+      mime-db: 1.52.0
+
+  mime@2.6.0: {}
+
+  mime@3.0.0: {}
+
+  minimatch@10.2.5:
+    dependencies:
+      brace-expansion: 5.0.6
+
+  minimatch@3.1.5:
+    dependencies:
+      brace-expansion: 1.1.15
+
+  minimatch@9.0.9:
+    dependencies:
+      brace-expansion: 2.1.1
+
+  minipass@7.1.3: {}
+
+  ms@2.1.3: {}
+
+  nanoid@3.3.14: {}
+
+  natural-compare@1.4.0: {}
+
+  nestjs-pino@4.5.0(@nestjs/common@11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2))(pino-http@11.0.0)(pino@10.3.1)(rxjs@7.8.2):
+    dependencies:
+      '@nestjs/common': 11.1.9(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      pino: 10.3.1
+      pino-http: 11.0.0
+      rxjs: 7.8.2
+
+  node-fetch-native@1.6.7: {}
+
+  node-releases@2.0.48: {}
+
+  nypm@0.6.7:
+    dependencies:
+      citty: 0.2.2
+      pathe: 2.0.3
+      tinyexec: 1.2.4
+
+  object-inspect@1.13.4: {}
+
+  obug@2.1.3: {}
+
+  ohash@2.0.11: {}
+
+  on-exit-leak-free@2.1.2: {}
+
+  once@1.4.0:
+    dependencies:
+      wrappy: 1.0.2
+
+  optionator@0.9.4:
+    dependencies:
+      deep-is: 0.1.4
+      fast-levenshtein: 2.0.6
+      levn: 0.4.1
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+      word-wrap: 1.2.5
+
+  p-limit@3.1.0:
+    dependencies:
+      yocto-queue: 0.1.0
+
+  p-locate@5.0.0:
+    dependencies:
+      p-limit: 3.1.0
+
+  package-json-from-dist@1.0.1: {}
+
+  parent-module@1.0.1:
+    dependencies:
+      callsites: 3.1.0
+
+  path-exists@4.0.0: {}
+
+  path-key@3.1.1: {}
+
+  path-scurry@2.0.2:
+    dependencies:
+      lru-cache: 11.5.1
+      minipass: 7.1.3
+
+  path-to-regexp@8.3.0: {}
+
+  pathe@2.0.3: {}
+
+  perfect-debounce@1.0.0: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@4.0.4: {}
+
+  pino-abstract-transport@2.0.0:
+    dependencies:
+      split2: 4.2.0
+
+  pino-abstract-transport@3.0.0:
+    dependencies:
+      split2: 4.2.0
+
+  pino-http@11.0.0:
+    dependencies:
+      get-caller-file: 2.0.5
+      pino: 10.3.1
+      pino-std-serializers: 7.1.0
+      process-warning: 5.0.0
+
+  pino-std-serializers@7.1.0: {}
+
+  pino@10.3.1:
+    dependencies:
+      '@pinojs/redact': 0.4.0
+      atomic-sleep: 1.0.0
+      on-exit-leak-free: 2.1.2
+      pino-abstract-transport: 3.0.0
+      pino-std-serializers: 7.1.0
+      process-warning: 5.0.0
+      quick-format-unescaped: 4.0.4
+      real-require: 0.2.0
+      safe-stable-stringify: 2.5.0
+      sonic-boom: 4.2.1
+      thread-stream: 4.2.0
+
+  pino@9.14.0:
+    dependencies:
+      '@pinojs/redact': 0.4.0
+      atomic-sleep: 1.0.0
+      on-exit-leak-free: 2.1.2
+      pino-abstract-transport: 2.0.0
+      pino-std-serializers: 7.1.0
+      process-warning: 5.0.0
+      quick-format-unescaped: 4.0.4
+      real-require: 0.2.0
+      safe-stable-stringify: 2.5.0
+      sonic-boom: 4.2.1
+      thread-stream: 3.2.0
+
+  pkg-types@2.3.1:
+    dependencies:
+      confbox: 0.2.4
+      exsolve: 1.0.8
+      pathe: 2.0.3
+
+  postcss@8.5.15:
+    dependencies:
+      nanoid: 3.3.14
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  prelude-ls@1.2.1: {}
+
+  prisma@6.19.0(typescript@5.9.3):
+    dependencies:
+      '@prisma/config': 6.19.0
+      '@prisma/engines': 6.19.0
+    optionalDependencies:
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - magicast
+
+  process-warning@4.0.1: {}
+
+  process-warning@5.0.0: {}
+
+  punycode@2.3.1: {}
+
+  pure-rand@6.1.0: {}
+
+  qs@6.15.2:
+    dependencies:
+      side-channel: 1.1.1
+
+  quick-format-unescaped@4.0.4: {}
+
+  rc9@2.1.2:
+    dependencies:
+      defu: 6.1.7
+      destr: 2.0.5
+
+  react-dom@18.2.0(react@18.2.0):
+    dependencies:
+      loose-envify: 1.4.0
+      react: 18.2.0
+      scheduler: 0.23.2
+
+  react-refresh@0.17.0: {}
+
+  react@18.2.0:
+    dependencies:
+      loose-envify: 1.4.0
+
+  readdirp@4.1.2: {}
+
+  real-require@0.2.0: {}
+
+  real-require@1.0.0: {}
+
+  redis-errors@1.2.0: {}
+
+  redis-parser@3.0.0:
+    dependencies:
+      redis-errors: 1.2.0
+
+  reflect-metadata@0.2.2: {}
+
+  require-from-string@2.0.2: {}
+
+  resolve-from@4.0.0: {}
+
+  resolve-pkg-maps@1.0.0: {}
+
+  ret@0.5.0: {}
+
+  reusify@1.1.0: {}
+
+  rfdc@1.4.1: {}
+
+  rollup@4.62.2:
+    dependencies:
+      '@types/estree': 1.0.9
+    optionalDependencies:
+      '@rollup/rollup-android-arm-eabi': 4.62.2
+      '@rollup/rollup-android-arm64': 4.62.2
+      '@rollup/rollup-darwin-arm64': 4.62.2
+      '@rollup/rollup-darwin-x64': 4.62.2
+      '@rollup/rollup-freebsd-arm64': 4.62.2
+      '@rollup/rollup-freebsd-x64': 4.62.2
+      '@rollup/rollup-linux-arm-gnueabihf': 4.62.2
+      '@rollup/rollup-linux-arm-musleabihf': 4.62.2
+      '@rollup/rollup-linux-arm64-gnu': 4.62.2
+      '@rollup/rollup-linux-arm64-musl': 4.62.2
+      '@rollup/rollup-linux-loong64-gnu': 4.62.2
+      '@rollup/rollup-linux-loong64-musl': 4.62.2
+      '@rollup/rollup-linux-ppc64-gnu': 4.62.2
+      '@rollup/rollup-linux-ppc64-musl': 4.62.2
+      '@rollup/rollup-linux-riscv64-gnu': 4.62.2
+      '@rollup/rollup-linux-riscv64-musl': 4.62.2
+      '@rollup/rollup-linux-s390x-gnu': 4.62.2
+      '@rollup/rollup-linux-x64-gnu': 4.62.2
+      '@rollup/rollup-linux-x64-musl': 4.62.2
+      '@rollup/rollup-openbsd-x64': 4.62.2
+      '@rollup/rollup-openharmony-arm64': 4.62.2
+      '@rollup/rollup-win32-arm64-msvc': 4.62.2
+      '@rollup/rollup-win32-ia32-msvc': 4.62.2
+      '@rollup/rollup-win32-x64-gnu': 4.62.2
+      '@rollup/rollup-win32-x64-msvc': 4.62.2
+      fsevents: 2.3.3
+
+  rxjs@7.8.2:
+    dependencies:
+      tslib: 2.8.1
+
+  safe-buffer@5.2.1: {}
+
+  safe-regex2@5.1.1:
+    dependencies:
+      ret: 0.5.0
+
+  safe-stable-stringify@2.5.0: {}
+
+  scheduler@0.23.2:
+    dependencies:
+      loose-envify: 1.4.0
+
+  secure-json-parse@4.1.0: {}
+
+  semver@6.3.1: {}
+
+  semver@7.8.5: {}
+
+  set-cookie-parser@2.7.2: {}
+
+  setprototypeof@1.2.0: {}
+
+  shebang-command@2.0.0:
+    dependencies:
+      shebang-regex: 3.0.0
+
+  shebang-regex@3.0.0: {}
+
+  side-channel-list@1.0.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-map@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-weakmap@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-map: 1.0.1
+
+  side-channel@1.1.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-list: 1.0.1
+      side-channel-map: 1.0.1
+      side-channel-weakmap: 1.0.2
+
+  siginfo@2.0.0: {}
+
+  signal-exit@4.1.0: {}
+
+  sonic-boom@4.2.1:
+    dependencies:
+      atomic-sleep: 1.0.0
+
+  source-map-js@1.2.1: {}
+
+  split2@4.2.0: {}
+
+  stackback@0.0.2: {}
+
+  standard-as-callback@2.1.0: {}
+
+  statuses@2.0.2: {}
+
+  std-env@3.10.0: {}
+
+  strip-json-comments@3.1.1: {}
+
+  strtok3@10.3.5:
+    dependencies:
+      '@tokenizer/token': 0.3.0
+
+  superagent@10.3.0:
+    dependencies:
+      component-emitter: 1.3.1
+      cookiejar: 2.1.4
+      debug: 4.4.3
+      fast-safe-stringify: 2.1.1
+      form-data: 4.0.6
+      formidable: 3.5.4
+      methods: 1.1.2
+      mime: 2.6.0
+      qs: 6.15.2
+    transitivePeerDependencies:
+      - supports-color
+
+  supertest@7.1.4:
+    dependencies:
+      methods: 1.1.2
+      superagent: 10.3.0
+    transitivePeerDependencies:
+      - supports-color
+
+  supports-color@7.2.0:
+    dependencies:
+      has-flag: 4.0.0
+
+  swagger-ui-dist@5.30.2:
+    dependencies:
+      '@scarf/scarf': 1.4.0
+
+  thread-stream@3.2.0:
+    dependencies:
+      real-require: 0.2.0
+
+  thread-stream@4.2.0:
+    dependencies:
+      real-require: 1.0.0
+
+  tinybench@2.9.0: {}
+
+  tinyexec@0.3.2: {}
+
+  tinyexec@1.2.4: {}
+
+  tinyglobby@0.2.17:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
+
+  tinyrainbow@3.1.0: {}
+
+  toad-cache@3.7.1: {}
+
+  toidentifier@1.0.1: {}
+
+  token-types@6.1.2:
+    dependencies:
+      '@borewit/text-codec': 0.2.2
+      '@tokenizer/token': 0.3.0
+      ieee754: 1.2.1
+
+  ts-api-utils@2.5.0(typescript@5.9.3):
+    dependencies:
+      typescript: 5.9.3
+
+  tslib@2.8.1: {}
+
+  tsx@4.20.6:
+    dependencies:
+      esbuild: 0.25.12
+      get-tsconfig: 4.14.0
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  type-check@0.4.0:
+    dependencies:
+      prelude-ls: 1.2.1
+
+  typescript-eslint@8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3):
+    dependencies:
+      '@typescript-eslint/eslint-plugin': 8.48.0(@typescript-eslint/parser@8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3))(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/typescript-estree': 8.48.0(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.48.0(eslint@9.39.1(jiti@2.7.0))(typescript@5.9.3)
+      eslint: 9.39.1(jiti@2.7.0)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  typescript@5.9.3: {}
+
+  uid@2.0.2:
+    dependencies:
+      '@lukeed/csprng': 1.1.0
+
+  uint8array-extras@1.5.0: {}
+
+  undici-types@6.21.0: {}
+
+  update-browserslist-db@1.2.3(browserslist@4.28.2):
+    dependencies:
+      browserslist: 4.28.2
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
+  uri-js@4.4.1:
+    dependencies:
+      punycode: 2.3.1
+
+  vite@5.4.21(@types/node@22.19.0):
+    dependencies:
+      esbuild: 0.21.5
+      postcss: 8.5.15
+      rollup: 4.62.2
+    optionalDependencies:
+      '@types/node': 22.19.0
+      fsevents: 2.3.3
+
+  vite@7.3.5(@types/node@22.19.0)(jiti@2.7.0)(tsx@4.20.6):
+    dependencies:
+      esbuild: 0.27.7
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
+      postcss: 8.5.15
+      rollup: 4.62.2
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      '@types/node': 22.19.0
+      fsevents: 2.3.3
+      jiti: 2.7.0
+      tsx: 4.20.6
+
+  vitest@4.0.14(@types/node@22.19.0)(jiti@2.7.0)(tsx@4.20.6):
+    dependencies:
+      '@vitest/expect': 4.0.14
+      '@vitest/mocker': 4.0.14(vite@7.3.5(@types/node@22.19.0)(jiti@2.7.0)(tsx@4.20.6))
+      '@vitest/pretty-format': 4.0.14
+      '@vitest/runner': 4.0.14
+      '@vitest/snapshot': 4.0.14
+      '@vitest/spy': 4.0.14
+      '@vitest/utils': 4.0.14
+      es-module-lexer: 1.7.0
+      expect-type: 1.3.0
+      magic-string: 0.30.21
+      obug: 2.1.3
+      pathe: 2.0.3
+      picomatch: 4.0.4
+      std-env: 3.10.0
+      tinybench: 2.9.0
+      tinyexec: 0.3.2
+      tinyglobby: 0.2.17
+      tinyrainbow: 3.1.0
+      vite: 7.3.5(@types/node@22.19.0)(jiti@2.7.0)(tsx@4.20.6)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@types/node': 22.19.0
+    transitivePeerDependencies:
+      - jiti
+      - less
+      - lightningcss
+      - msw
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - terser
+      - tsx
+      - yaml
+
+  which@2.0.2:
+    dependencies:
+      isexe: 2.0.0
+
+  why-is-node-running@2.3.0:
+    dependencies:
+      siginfo: 2.0.0
+      stackback: 0.0.2
+
+  word-wrap@1.2.5: {}
+
+  wrappy@1.0.2: {}
+
+  yallist@3.1.1: {}
+
+  yocto-queue@0.1.0: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000..3ff5faa
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,3 @@
+packages:
+  - "apps/*"
+  - "packages/*"
diff --git a/prisma.config.ts b/prisma.config.ts
new file mode 100644
index 0000000..6ee8c7f
--- /dev/null
+++ b/prisma.config.ts
@@ -0,0 +1,9 @@
+import { defineConfig } from 'prisma/config';
+
+export default defineConfig({
+  schema: 'prisma/schema.prisma',
+  migrations: {
+    path: 'prisma/migrations',
+    seed: 'tsx prisma/seed.ts'
+  }
+});
diff --git a/prisma/migrations/20260621090000_init_v2_schema/migration.sql b/prisma/migrations/20260621090000_init_v2_schema/migration.sql
new file mode 100644
index 0000000..b7d25e7
--- /dev/null
+++ b/prisma/migrations/20260621090000_init_v2_schema/migration.sql
@@ -0,0 +1,617 @@
+-- CreateTable
+CREATE TABLE `customers` (
+    `id` VARCHAR(32) NOT NULL,
+    `name` VARCHAR(120) NOT NULL,
+    `contact_name` VARCHAR(80) NULL,
+    `phone` VARCHAR(32) NULL,
+    `email` VARCHAR(160) NULL,
+    `domain` VARCHAR(160) NULL,
+    `status` ENUM('ENABLED', 'DISABLED') NOT NULL DEFAULT 'ENABLED',
+    `billing_mode` ENUM('PREPAID', 'POSTPAID') NOT NULL DEFAULT 'PREPAID',
+    `balance` DECIMAL(20, 6) NOT NULL DEFAULT 0,
+    `credit_limit` DECIMAL(20, 6) NOT NULL DEFAULT 0,
+    `min_balance` DECIMAL(20, 6) NOT NULL DEFAULT 0,
+    `notes` VARCHAR(500) NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+    `deleted_at` DATETIME(3) NULL,
+
+    UNIQUE INDEX `customers_name_key`(`name`),
+    UNIQUE INDEX `customers_domain_key`(`domain`),
+    INDEX `customers_status_idx`(`status`),
+    INDEX `customers_deleted_at_idx`(`deleted_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `customer_gateways` (
+    `id` VARCHAR(32) NOT NULL,
+    `customer_id` VARCHAR(32) NOT NULL,
+    `name` VARCHAR(120) NOT NULL,
+    `auth_mode` ENUM('IP', 'SIP_DIGEST', 'MIXED') NOT NULL,
+    `source_ip` VARCHAR(45) NULL,
+    `sip_username` VARCHAR(120) NULL,
+    `sip_domain` VARCHAR(160) NULL,
+    `sip_ha1` VARCHAR(128) NULL,
+    `status` ENUM('ENABLED', 'DISABLED') NOT NULL DEFAULT 'ENABLED',
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+    `deleted_at` DATETIME(3) NULL,
+
+    INDEX `customer_gateways_customer_id_status_idx`(`customer_id`, `status`),
+    INDEX `customer_gateways_source_ip_idx`(`source_ip`),
+    INDEX `customer_gateways_deleted_at_idx`(`deleted_at`),
+    UNIQUE INDEX `customer_gateways_customer_id_name_key`(`customer_id`, `name`),
+    UNIQUE INDEX `customer_gateways_sip_username_sip_domain_key`(`sip_username`, `sip_domain`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `customer_gateway_policies` (
+    `id` VARCHAR(32) NOT NULL,
+    `customer_id` VARCHAR(32) NOT NULL,
+    `gateway_id` VARCHAR(32) NOT NULL,
+    `line_group_id` VARCHAR(32) NOT NULL,
+    `name` VARCHAR(120) NOT NULL,
+    `priority` INTEGER NOT NULL,
+    `caller_mode` ENUM('ANY', 'EQUALS', 'PREFIX') NOT NULL DEFAULT 'ANY',
+    `caller_value` VARCHAR(64) NULL,
+    `callee_mode` ENUM('ANY', 'EQUALS', 'PREFIX') NOT NULL DEFAULT 'ANY',
+    `callee_value` VARCHAR(64) NULL,
+    `status` ENUM('ENABLED', 'DISABLED') NOT NULL DEFAULT 'ENABLED',
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+    `deleted_at` DATETIME(3) NULL,
+
+    INDEX `customer_gateway_policies_customer_id_status_idx`(`customer_id`, `status`),
+    INDEX `customer_gateway_policies_line_group_id_idx`(`line_group_id`),
+    INDEX `customer_gateway_policies_deleted_at_idx`(`deleted_at`),
+    UNIQUE INDEX `customer_gateway_policies_gateway_id_priority_key`(`gateway_id`, `priority`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `customer_recharges` (
+    `id` VARCHAR(40) NOT NULL,
+    `customer_id` VARCHAR(32) NOT NULL,
+    `amount` DECIMAL(20, 6) NOT NULL,
+    `before_balance` DECIMAL(20, 6) NOT NULL,
+    `after_balance` DECIMAL(20, 6) NOT NULL,
+    `idempotency_key` VARCHAR(128) NOT NULL,
+    `remark` VARCHAR(500) NULL,
+    `status` ENUM('SUCCEEDED', 'FAILED', 'REVERSED') NOT NULL DEFAULT 'SUCCEEDED',
+    `occurred_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `created_by` VARCHAR(32) NULL,
+
+    UNIQUE INDEX `customer_recharges_idempotency_key_key`(`idempotency_key`),
+    INDEX `customer_recharges_customer_id_occurred_at_idx`(`customer_id`, `occurred_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `vendors` (
+    `id` VARCHAR(32) NOT NULL,
+    `name` VARCHAR(120) NOT NULL,
+    `contact_name` VARCHAR(80) NULL,
+    `phone` VARCHAR(32) NULL,
+    `email` VARCHAR(160) NULL,
+    `status` ENUM('ENABLED', 'DISABLED') NOT NULL DEFAULT 'ENABLED',
+    `balance` DECIMAL(20, 6) NOT NULL DEFAULT 0,
+    `credit_limit` DECIMAL(20, 6) NOT NULL DEFAULT 0,
+    `settlement` VARCHAR(80) NULL,
+    `notes` VARCHAR(500) NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+    `deleted_at` DATETIME(3) NULL,
+
+    UNIQUE INDEX `vendors_name_key`(`name`),
+    INDEX `vendors_status_idx`(`status`),
+    INDEX `vendors_deleted_at_idx`(`deleted_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `vendor_recharges` (
+    `id` VARCHAR(40) NOT NULL,
+    `vendor_id` VARCHAR(32) NOT NULL,
+    `amount` DECIMAL(20, 6) NOT NULL,
+    `before_balance` DECIMAL(20, 6) NOT NULL,
+    `after_balance` DECIMAL(20, 6) NOT NULL,
+    `idempotency_key` VARCHAR(128) NOT NULL,
+    `remark` VARCHAR(500) NULL,
+    `status` ENUM('SUCCEEDED', 'FAILED', 'REVERSED') NOT NULL DEFAULT 'SUCCEEDED',
+    `occurred_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `created_by` VARCHAR(32) NULL,
+
+    UNIQUE INDEX `vendor_recharges_idempotency_key_key`(`idempotency_key`),
+    INDEX `vendor_recharges_vendor_id_occurred_at_idx`(`vendor_id`, `occurred_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `vendor_gateways` (
+    `id` VARCHAR(32) NOT NULL,
+    `vendor_id` VARCHAR(32) NOT NULL,
+    `name` VARCHAR(120) NOT NULL,
+    `auth_mode` ENUM('IP', 'SIP_DIGEST', 'MIXED') NOT NULL,
+    `host` VARCHAR(160) NOT NULL,
+    `port` INTEGER NOT NULL DEFAULT 5060,
+    `transport` VARCHAR(16) NOT NULL DEFAULT 'udp',
+    `sip_username` VARCHAR(120) NULL,
+    `sip_ha1` VARCHAR(128) NULL,
+    `cps_limit` INTEGER NOT NULL DEFAULT 0,
+    `concurrency_limit` INTEGER NOT NULL DEFAULT 0,
+    `billing_cycle_sec` INTEGER NOT NULL DEFAULT 60,
+    `cycle_rate` DECIMAL(20, 6) NOT NULL DEFAULT 0,
+    `status` ENUM('ENABLED', 'DISABLED') NOT NULL DEFAULT 'ENABLED',
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+    `deleted_at` DATETIME(3) NULL,
+
+    INDEX `vendor_gateways_vendor_id_status_idx`(`vendor_id`, `status`),
+    INDEX `vendor_gateways_host_idx`(`host`),
+    INDEX `vendor_gateways_deleted_at_idx`(`deleted_at`),
+    UNIQUE INDEX `vendor_gateways_vendor_id_name_key`(`vendor_id`, `name`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `vendor_gateway_forbidden_periods` (
+    `id` VARCHAR(32) NOT NULL,
+    `vendor_gateway_id` VARCHAR(32) NOT NULL,
+    `weekday_mask` INTEGER NOT NULL,
+    `start_time` VARCHAR(8) NOT NULL,
+    `end_time` VARCHAR(8) NOT NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+
+    INDEX `vendor_gateway_forbidden_periods_vendor_gateway_id_idx`(`vendor_gateway_id`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `vendor_gateway_codecs` (
+    `id` VARCHAR(32) NOT NULL,
+    `vendor_gateway_id` VARCHAR(32) NOT NULL,
+    `codec` VARCHAR(32) NOT NULL,
+    `priority` INTEGER NOT NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+
+    UNIQUE INDEX `vendor_gateway_codecs_vendor_gateway_id_codec_key`(`vendor_gateway_id`, `codec`),
+    UNIQUE INDEX `vendor_gateway_codecs_vendor_gateway_id_priority_key`(`vendor_gateway_id`, `priority`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `vendor_gateway_prefix_rules` (
+    `id` VARCHAR(32) NOT NULL,
+    `vendor_gateway_id` VARCHAR(32) NOT NULL,
+    `direction` ENUM('CALLER', 'CALLEE') NOT NULL,
+    `match_prefix` VARCHAR(32) NOT NULL,
+    `replace_prefix` VARCHAR(32) NOT NULL,
+    `priority` INTEGER NOT NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+
+    INDEX `vendor_gateway_prefix_rules_vendor_gateway_id_direction_idx`(`vendor_gateway_id`, `direction`),
+    UNIQUE INDEX `vendor_gateway_prefix_rules_vendor_gateway_id_direction_prio_key`(`vendor_gateway_id`, `direction`, `priority`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `landing_line_groups` (
+    `id` VARCHAR(32) NOT NULL,
+    `name` VARCHAR(120) NOT NULL,
+    `status` ENUM('ENABLED', 'DISABLED') NOT NULL DEFAULT 'ENABLED',
+    `notes` VARCHAR(500) NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+    `deleted_at` DATETIME(3) NULL,
+
+    UNIQUE INDEX `landing_line_groups_name_key`(`name`),
+    INDEX `landing_line_groups_status_idx`(`status`),
+    INDEX `landing_line_groups_deleted_at_idx`(`deleted_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `landing_line_group_items` (
+    `id` VARCHAR(32) NOT NULL,
+    `line_group_id` VARCHAR(32) NOT NULL,
+    `vendor_gateway_id` VARCHAR(32) NOT NULL,
+    `priority` INTEGER NOT NULL,
+    `weight` INTEGER NOT NULL DEFAULT 1,
+    `concurrency_cap` INTEGER NOT NULL DEFAULT 0,
+    `status` ENUM('ENABLED', 'DISABLED') NOT NULL DEFAULT 'ENABLED',
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+
+    INDEX `landing_line_group_items_vendor_gateway_id_idx`(`vendor_gateway_id`),
+    UNIQUE INDEX `landing_line_group_items_line_group_id_vendor_gateway_id_key`(`line_group_id`, `vendor_gateway_id`),
+    UNIQUE INDEX `landing_line_group_items_line_group_id_priority_key`(`line_group_id`, `priority`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `raw_cdrs` (
+    `id` VARCHAR(40) NOT NULL,
+    `event_id` VARCHAR(64) NOT NULL,
+    `call_id` VARCHAR(255) NOT NULL,
+    `customer_id` VARCHAR(32) NULL,
+    `customer_gateway_id` VARCHAR(32) NULL,
+    `customer_gateway_policy_id` VARCHAR(32) NULL,
+    `source_ip` VARCHAR(45) NULL,
+    `caller` VARCHAR(64) NOT NULL,
+    `callee` VARCHAR(64) NOT NULL,
+    `vendor_id` VARCHAR(32) NULL,
+    `vendor_gateway_id` VARCHAR(32) NULL,
+    `line_group_id` VARCHAR(32) NULL,
+    `started_at` DATETIME(3) NOT NULL,
+    `answered_at` DATETIME(3) NULL,
+    `ended_at` DATETIME(3) NOT NULL,
+    `duration_sec` INTEGER NOT NULL DEFAULT 0,
+    `sip_code` INTEGER NOT NULL,
+    `hangup_reason` VARCHAR(120) NULL,
+    `recording_key` VARCHAR(255) NULL,
+    `config_version` INTEGER NULL,
+    `rating_status` ENUM('UNRATED', 'RATED', 'SKIPPED', 'FAILED') NOT NULL DEFAULT 'UNRATED',
+    `payload` JSON NULL,
+    `received_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+
+    UNIQUE INDEX `raw_cdrs_event_id_key`(`event_id`),
+    INDEX `raw_cdrs_customer_id_started_at_idx`(`customer_id`, `started_at`),
+    INDEX `raw_cdrs_vendor_id_started_at_idx`(`vendor_id`, `started_at`),
+    INDEX `raw_cdrs_sip_code_idx`(`sip_code`),
+    INDEX `raw_cdrs_rating_status_idx`(`rating_status`),
+    UNIQUE INDEX `raw_cdrs_call_id_ended_at_key`(`call_id`, `ended_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `rated_cdrs` (
+    `id` VARCHAR(40) NOT NULL,
+    `raw_cdr_id` VARCHAR(40) NOT NULL,
+    `bill_sec` INTEGER NOT NULL,
+    `customer_fee` DECIMAL(20, 6) NOT NULL DEFAULT 0,
+    `vendor_cost` DECIMAL(20, 6) NOT NULL DEFAULT 0,
+    `gross_profit` DECIMAL(20, 6) NOT NULL DEFAULT 0,
+    `customer_rate` JSON NULL,
+    `vendor_rate` JSON NULL,
+    `rated_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+
+    UNIQUE INDEX `rated_cdrs_raw_cdr_id_key`(`raw_cdr_id`),
+    INDEX `rated_cdrs_rated_at_idx`(`rated_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `recordings` (
+    `id` VARCHAR(40) NOT NULL,
+    `raw_cdr_id` VARCHAR(40) NULL,
+    `storage_key` VARCHAR(255) NOT NULL,
+    `storage_path` VARCHAR(500) NOT NULL,
+    `sha256` CHAR(64) NULL,
+    `bytes` BIGINT NOT NULL DEFAULT 0,
+    `duration_sec` INTEGER NOT NULL DEFAULT 0,
+    `status` ENUM('PENDING', 'READY', 'FAILED', 'DELETED') NOT NULL DEFAULT 'PENDING',
+    `moved_at` DATETIME(3) NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+
+    UNIQUE INDEX `recordings_raw_cdr_id_key`(`raw_cdr_id`),
+    UNIQUE INDEX `recordings_storage_key_key`(`storage_key`),
+    INDEX `recordings_status_created_at_idx`(`status`, `created_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `quality_sampling_rules` (
+    `id` VARCHAR(32) NOT NULL,
+    `name` VARCHAR(120) NOT NULL,
+    `customer_id` VARCHAR(32) NULL,
+    `line_group_id` VARCHAR(32) NULL,
+    `ratio` DECIMAL(5, 2) NOT NULL,
+    `status` ENUM('ENABLED', 'DISABLED') NOT NULL DEFAULT 'ENABLED',
+    `effective_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `expires_at` DATETIME(3) NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+    `deleted_at` DATETIME(3) NULL,
+
+    INDEX `quality_sampling_rules_customer_id_status_idx`(`customer_id`, `status`),
+    INDEX `quality_sampling_rules_line_group_id_status_idx`(`line_group_id`, `status`),
+    INDEX `quality_sampling_rules_deleted_at_idx`(`deleted_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `quality_reviews` (
+    `id` VARCHAR(40) NOT NULL,
+    `recording_id` VARCHAR(40) NOT NULL,
+    `reviewer_id` VARCHAR(32) NOT NULL,
+    `score` INTEGER NULL,
+    `result` ENUM('PASS', 'ISSUE', 'ESCALATED') NOT NULL,
+    `issue_tags` JSON NULL,
+    `notes` VARCHAR(1000) NULL,
+    `reviewed_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+
+    INDEX `quality_reviews_recording_id_idx`(`recording_id`),
+    INDEX `quality_reviews_reviewer_id_reviewed_at_idx`(`reviewer_id`, `reviewed_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `users` (
+    `id` VARCHAR(32) NOT NULL,
+    `username` VARCHAR(80) NOT NULL,
+    `display_name` VARCHAR(80) NOT NULL,
+    `phone` VARCHAR(32) NULL,
+    `email` VARCHAR(160) NULL,
+    `password_hash` VARCHAR(255) NULL,
+    `password_algo` VARCHAR(32) NULL,
+    `status` ENUM('ENABLED', 'DISABLED') NOT NULL DEFAULT 'ENABLED',
+    `failed_login_count` INTEGER NOT NULL DEFAULT 0,
+    `locked_until` DATETIME(3) NULL,
+    `require_password_change` BOOLEAN NOT NULL DEFAULT false,
+    `last_login_at` DATETIME(3) NULL,
+    `last_login_ip` VARCHAR(45) NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+    `deleted_at` DATETIME(3) NULL,
+
+    UNIQUE INDEX `users_username_key`(`username`),
+    UNIQUE INDEX `users_email_key`(`email`),
+    INDEX `users_status_idx`(`status`),
+    INDEX `users_deleted_at_idx`(`deleted_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `roles` (
+    `id` VARCHAR(32) NOT NULL,
+    `name` VARCHAR(80) NOT NULL,
+    `description` VARCHAR(300) NULL,
+    `built_in` BOOLEAN NOT NULL DEFAULT false,
+    `status` ENUM('ENABLED', 'DISABLED') NOT NULL DEFAULT 'ENABLED',
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+    `created_by` VARCHAR(32) NULL,
+    `updated_by` VARCHAR(32) NULL,
+    `version` INTEGER NOT NULL DEFAULT 1,
+    `deleted_at` DATETIME(3) NULL,
+
+    UNIQUE INDEX `roles_name_key`(`name`),
+    INDEX `roles_status_idx`(`status`),
+    INDEX `roles_deleted_at_idx`(`deleted_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `permissions` (
+    `id` VARCHAR(80) NOT NULL,
+    `module` VARCHAR(80) NOT NULL,
+    `action` VARCHAR(80) NOT NULL,
+    `description` VARCHAR(300) NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+
+    UNIQUE INDEX `permissions_module_action_key`(`module`, `action`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `user_roles` (
+    `user_id` VARCHAR(32) NOT NULL,
+    `role_id` VARCHAR(32) NOT NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `created_by` VARCHAR(32) NULL,
+
+    INDEX `user_roles_role_id_idx`(`role_id`),
+    PRIMARY KEY (`user_id`, `role_id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `role_permissions` (
+    `role_id` VARCHAR(32) NOT NULL,
+    `permission_id` VARCHAR(80) NOT NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `created_by` VARCHAR(32) NULL,
+
+    INDEX `role_permissions_permission_id_idx`(`permission_id`),
+    PRIMARY KEY (`role_id`, `permission_id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `audit_logs` (
+    `id` VARCHAR(40) NOT NULL,
+    `request_id` VARCHAR(64) NOT NULL,
+    `user_id` VARCHAR(32) NULL,
+    `username` VARCHAR(80) NULL,
+    `role_names` VARCHAR(300) NULL,
+    `ip` VARCHAR(45) NULL,
+    `user_agent` VARCHAR(500) NULL,
+    `module` VARCHAR(80) NOT NULL,
+    `action` VARCHAR(80) NOT NULL,
+    `object_type` VARCHAR(80) NOT NULL,
+    `object_id` VARCHAR(80) NULL,
+    `before_summary` JSON NULL,
+    `after_summary` JSON NULL,
+    `result` ENUM('SUCCESS', 'FAILURE') NOT NULL,
+    `error_code` VARCHAR(80) NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+
+    INDEX `audit_logs_user_id_created_at_idx`(`user_id`, `created_at`),
+    INDEX `audit_logs_module_action_created_at_idx`(`module`, `action`, `created_at`),
+    INDEX `audit_logs_object_type_object_id_idx`(`object_type`, `object_id`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `outbox_events` (
+    `id` VARCHAR(40) NOT NULL,
+    `aggregate_type` VARCHAR(80) NOT NULL,
+    `aggregate_id` VARCHAR(80) NOT NULL,
+    `event_type` VARCHAR(120) NOT NULL,
+    `payload` JSON NOT NULL,
+    `status` ENUM('PENDING', 'PROCESSING', 'PUBLISHED', 'FAILED') NOT NULL DEFAULT 'PENDING',
+    `attempts` INTEGER NOT NULL DEFAULT 0,
+    `available_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `locked_at` DATETIME(3) NULL,
+    `processed_at` DATETIME(3) NULL,
+    `last_error` VARCHAR(1000) NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+
+    INDEX `outbox_events_status_available_at_idx`(`status`, `available_at`),
+    INDEX `outbox_events_aggregate_type_aggregate_id_idx`(`aggregate_type`, `aggregate_id`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateTable
+CREATE TABLE `idempotency_keys` (
+    `id` VARCHAR(40) NOT NULL,
+    `key` VARCHAR(128) NOT NULL,
+    `scope` VARCHAR(80) NOT NULL,
+    `request_hash` CHAR(64) NOT NULL,
+    `response_status` INTEGER NULL,
+    `response_body` JSON NULL,
+    `status` ENUM('IN_PROGRESS', 'SUCCEEDED', 'FAILED', 'EXPIRED') NOT NULL DEFAULT 'IN_PROGRESS',
+    `locked_until` DATETIME(3) NULL,
+    `expires_at` DATETIME(3) NOT NULL,
+    `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updated_at` DATETIME(3) NOT NULL,
+
+    UNIQUE INDEX `idempotency_keys_key_key`(`key`),
+    INDEX `idempotency_keys_scope_status_idx`(`scope`, `status`),
+    INDEX `idempotency_keys_expires_at_idx`(`expires_at`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- AddForeignKey
+ALTER TABLE `customer_gateways` ADD CONSTRAINT `customer_gateways_customer_id_fkey` FOREIGN KEY (`customer_id`) REFERENCES `customers`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `customer_gateway_policies` ADD CONSTRAINT `customer_gateway_policies_customer_id_fkey` FOREIGN KEY (`customer_id`) REFERENCES `customers`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `customer_gateway_policies` ADD CONSTRAINT `customer_gateway_policies_gateway_id_fkey` FOREIGN KEY (`gateway_id`) REFERENCES `customer_gateways`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `customer_gateway_policies` ADD CONSTRAINT `customer_gateway_policies_line_group_id_fkey` FOREIGN KEY (`line_group_id`) REFERENCES `landing_line_groups`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `customer_recharges` ADD CONSTRAINT `customer_recharges_customer_id_fkey` FOREIGN KEY (`customer_id`) REFERENCES `customers`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `vendor_recharges` ADD CONSTRAINT `vendor_recharges_vendor_id_fkey` FOREIGN KEY (`vendor_id`) REFERENCES `vendors`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `vendor_gateways` ADD CONSTRAINT `vendor_gateways_vendor_id_fkey` FOREIGN KEY (`vendor_id`) REFERENCES `vendors`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `vendor_gateway_forbidden_periods` ADD CONSTRAINT `vendor_gateway_forbidden_periods_vendor_gateway_id_fkey` FOREIGN KEY (`vendor_gateway_id`) REFERENCES `vendor_gateways`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `vendor_gateway_codecs` ADD CONSTRAINT `vendor_gateway_codecs_vendor_gateway_id_fkey` FOREIGN KEY (`vendor_gateway_id`) REFERENCES `vendor_gateways`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `vendor_gateway_prefix_rules` ADD CONSTRAINT `vendor_gateway_prefix_rules_vendor_gateway_id_fkey` FOREIGN KEY (`vendor_gateway_id`) REFERENCES `vendor_gateways`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `landing_line_group_items` ADD CONSTRAINT `landing_line_group_items_line_group_id_fkey` FOREIGN KEY (`line_group_id`) REFERENCES `landing_line_groups`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `landing_line_group_items` ADD CONSTRAINT `landing_line_group_items_vendor_gateway_id_fkey` FOREIGN KEY (`vendor_gateway_id`) REFERENCES `vendor_gateways`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `raw_cdrs` ADD CONSTRAINT `raw_cdrs_customer_id_fkey` FOREIGN KEY (`customer_id`) REFERENCES `customers`(`id`) ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `raw_cdrs` ADD CONSTRAINT `raw_cdrs_customer_gateway_id_fkey` FOREIGN KEY (`customer_gateway_id`) REFERENCES `customer_gateways`(`id`) ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `raw_cdrs` ADD CONSTRAINT `raw_cdrs_customer_gateway_policy_id_fkey` FOREIGN KEY (`customer_gateway_policy_id`) REFERENCES `customer_gateway_policies`(`id`) ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `raw_cdrs` ADD CONSTRAINT `raw_cdrs_vendor_id_fkey` FOREIGN KEY (`vendor_id`) REFERENCES `vendors`(`id`) ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `raw_cdrs` ADD CONSTRAINT `raw_cdrs_vendor_gateway_id_fkey` FOREIGN KEY (`vendor_gateway_id`) REFERENCES `vendor_gateways`(`id`) ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `raw_cdrs` ADD CONSTRAINT `raw_cdrs_line_group_id_fkey` FOREIGN KEY (`line_group_id`) REFERENCES `landing_line_groups`(`id`) ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `rated_cdrs` ADD CONSTRAINT `rated_cdrs_raw_cdr_id_fkey` FOREIGN KEY (`raw_cdr_id`) REFERENCES `raw_cdrs`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `recordings` ADD CONSTRAINT `recordings_raw_cdr_id_fkey` FOREIGN KEY (`raw_cdr_id`) REFERENCES `raw_cdrs`(`id`) ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `quality_sampling_rules` ADD CONSTRAINT `quality_sampling_rules_customer_id_fkey` FOREIGN KEY (`customer_id`) REFERENCES `customers`(`id`) ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `quality_sampling_rules` ADD CONSTRAINT `quality_sampling_rules_line_group_id_fkey` FOREIGN KEY (`line_group_id`) REFERENCES `landing_line_groups`(`id`) ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `quality_reviews` ADD CONSTRAINT `quality_reviews_recording_id_fkey` FOREIGN KEY (`recording_id`) REFERENCES `recordings`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `quality_reviews` ADD CONSTRAINT `quality_reviews_reviewer_id_fkey` FOREIGN KEY (`reviewer_id`) REFERENCES `users`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `user_roles` ADD CONSTRAINT `user_roles_user_id_fkey` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `user_roles` ADD CONSTRAINT `user_roles_role_id_fkey` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `role_permissions` ADD CONSTRAINT `role_permissions_role_id_fkey` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `role_permissions` ADD CONSTRAINT `role_permissions_permission_id_fkey` FOREIGN KEY (`permission_id`) REFERENCES `permissions`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
diff --git a/prisma/migrations/20260621093000_auth_sessions/migration.sql b/prisma/migrations/20260621093000_auth_sessions/migration.sql
new file mode 100644
index 0000000..c6eb3c9
--- /dev/null
+++ b/prisma/migrations/20260621093000_auth_sessions/migration.sql
@@ -0,0 +1,22 @@
+-- S09 login authentication session table.
+-- Forward-only additive migration: no existing table or column is modified.
+
+CREATE TABLE `user_sessions` (
+  `id` VARCHAR(40) NOT NULL,
+  `user_id` VARCHAR(32) NOT NULL,
+  `refresh_token_hash` CHAR(64) NOT NULL,
+  `user_agent` VARCHAR(500) NULL,
+  `ip` VARCHAR(45) NULL,
+  `expires_at` DATETIME(3) NOT NULL,
+  `revoked_at` DATETIME(3) NULL,
+  `rotated_from_id` VARCHAR(40) NULL,
+  `created_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  `updated_at` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+
+  PRIMARY KEY (`id`),
+  UNIQUE INDEX `user_sessions_refresh_token_hash_key` (`refresh_token_hash`),
+  INDEX `user_sessions_user_id_created_at_idx` (`user_id`, `created_at`),
+  INDEX `user_sessions_expires_at_idx` (`expires_at`),
+  INDEX `user_sessions_revoked_at_idx` (`revoked_at`),
+  CONSTRAINT `user_sessions_user_id_fkey` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
new file mode 100644
index 0000000..ea98e31
--- /dev/null
+++ b/prisma/schema.prisma
@@ -0,0 +1,699 @@
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "mysql"
+  url      = env("DATABASE_URL")
+}
+
+enum EntityStatus {
+  ENABLED
+  DISABLED
+
+  @@map("entity_status")
+}
+
+enum CustomerBillingMode {
+  PREPAID
+  POSTPAID
+
+  @@map("customer_billing_mode")
+}
+
+enum GatewayAuthMode {
+  IP
+  SIP_DIGEST
+  MIXED
+
+  @@map("gateway_auth_mode")
+}
+
+enum MatchMode {
+  ANY
+  EQUALS
+  PREFIX
+
+  @@map("match_mode")
+}
+
+enum RechargeStatus {
+  SUCCEEDED
+  FAILED
+  REVERSED
+
+  @@map("recharge_status")
+}
+
+enum PrefixRuleDirection {
+  CALLER
+  CALLEE
+
+  @@map("prefix_rule_direction")
+}
+
+enum CdrRatingStatus {
+  UNRATED
+  RATED
+  SKIPPED
+  FAILED
+
+  @@map("cdr_rating_status")
+}
+
+enum RecordingStatus {
+  PENDING
+  READY
+  FAILED
+  DELETED
+
+  @@map("recording_status")
+}
+
+enum QualityReviewResult {
+  PASS
+  ISSUE
+  ESCALATED
+
+  @@map("quality_review_result")
+}
+
+enum AuditResult {
+  SUCCESS
+  FAILURE
+
+  @@map("audit_result")
+}
+
+enum OutboxStatus {
+  PENDING
+  PROCESSING
+  PUBLISHED
+  FAILED
+
+  @@map("outbox_status")
+}
+
+enum IdempotencyStatus {
+  IN_PROGRESS
+  SUCCEEDED
+  FAILED
+  EXPIRED
+
+  @@map("idempotency_status")
+}
+
+model Customer {
+  id               String              @id @db.VarChar(32)
+  name             String              @unique @db.VarChar(120)
+  contactName      String?             @map("contact_name") @db.VarChar(80)
+  phone            String?             @db.VarChar(32)
+  email            String?             @db.VarChar(160)
+  domain           String?             @unique @db.VarChar(160)
+  status           EntityStatus        @default(ENABLED)
+  billingMode      CustomerBillingMode @default(PREPAID) @map("billing_mode")
+  balance          Decimal             @default(0) @db.Decimal(20, 6)
+  creditLimit      Decimal             @default(0) @map("credit_limit") @db.Decimal(20, 6)
+  minBalance       Decimal             @default(0) @map("min_balance") @db.Decimal(20, 6)
+  notes            String?             @db.VarChar(500)
+  createdAt        DateTime            @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt        DateTime            @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy        String?             @map("created_by") @db.VarChar(32)
+  updatedBy        String?             @map("updated_by") @db.VarChar(32)
+  version          Int                 @default(1)
+  deletedAt        DateTime?           @map("deleted_at") @db.DateTime(3)
+
+  gateways         CustomerGateway[]
+  policies         CustomerGatewayPolicy[]
+  recharges        CustomerRecharge[]
+  rawCdrs          RawCdr[]
+  samplingRules    QualitySamplingRule[]
+
+  @@index([status])
+  @@index([deletedAt])
+  @@map("customers")
+}
+
+model CustomerGateway {
+  id            String                  @id @db.VarChar(32)
+  customerId    String                  @map("customer_id") @db.VarChar(32)
+  name          String                  @db.VarChar(120)
+  authMode      GatewayAuthMode         @map("auth_mode")
+  sourceIp      String?                 @map("source_ip") @db.VarChar(45)
+  sipUsername   String?                 @map("sip_username") @db.VarChar(120)
+  sipDomain     String?                 @map("sip_domain") @db.VarChar(160)
+  sipHa1        String?                 @map("sip_ha1") @db.VarChar(128)
+  status        EntityStatus            @default(ENABLED)
+  createdAt     DateTime                @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt     DateTime                @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy     String?                 @map("created_by") @db.VarChar(32)
+  updatedBy     String?                 @map("updated_by") @db.VarChar(32)
+  version       Int                     @default(1)
+  deletedAt     DateTime?               @map("deleted_at") @db.DateTime(3)
+
+  customer      Customer                @relation(fields: [customerId], references: [id], onDelete: Restrict)
+  policies      CustomerGatewayPolicy[]
+  rawCdrs       RawCdr[]
+
+  @@unique([customerId, name])
+  @@unique([sipUsername, sipDomain])
+  @@index([customerId, status])
+  @@index([sourceIp])
+  @@index([deletedAt])
+  @@map("customer_gateways")
+}
+
+model CustomerGatewayPolicy {
+  id             String           @id @db.VarChar(32)
+  customerId     String           @map("customer_id") @db.VarChar(32)
+  gatewayId      String           @map("gateway_id") @db.VarChar(32)
+  lineGroupId    String           @map("line_group_id") @db.VarChar(32)
+  name           String           @db.VarChar(120)
+  priority       Int
+  callerMode     MatchMode        @default(ANY) @map("caller_mode")
+  callerValue    String?          @map("caller_value") @db.VarChar(64)
+  calleeMode     MatchMode        @default(ANY) @map("callee_mode")
+  calleeValue    String?          @map("callee_value") @db.VarChar(64)
+  status         EntityStatus     @default(ENABLED)
+  createdAt      DateTime         @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt      DateTime         @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy      String?          @map("created_by") @db.VarChar(32)
+  updatedBy      String?          @map("updated_by") @db.VarChar(32)
+  version        Int              @default(1)
+  deletedAt      DateTime?        @map("deleted_at") @db.DateTime(3)
+
+  customer       Customer         @relation(fields: [customerId], references: [id], onDelete: Restrict)
+  gateway        CustomerGateway  @relation(fields: [gatewayId], references: [id], onDelete: Restrict)
+  lineGroup      LandingLineGroup @relation(fields: [lineGroupId], references: [id], onDelete: Restrict)
+  rawCdrs        RawCdr[]
+
+  @@unique([gatewayId, priority])
+  @@index([customerId, status])
+  @@index([lineGroupId])
+  @@index([deletedAt])
+  @@map("customer_gateway_policies")
+}
+
+model CustomerRecharge {
+  id              String         @id @db.VarChar(40)
+  customerId      String         @map("customer_id") @db.VarChar(32)
+  amount          Decimal        @db.Decimal(20, 6)
+  beforeBalance   Decimal        @map("before_balance") @db.Decimal(20, 6)
+  afterBalance    Decimal        @map("after_balance") @db.Decimal(20, 6)
+  idempotencyKey  String         @unique @map("idempotency_key") @db.VarChar(128)
+  remark          String?        @db.VarChar(500)
+  status          RechargeStatus @default(SUCCEEDED)
+  occurredAt      DateTime       @default(now()) @map("occurred_at") @db.DateTime(3)
+  createdAt       DateTime       @default(now()) @map("created_at") @db.DateTime(3)
+  createdBy       String?        @map("created_by") @db.VarChar(32)
+
+  customer        Customer       @relation(fields: [customerId], references: [id], onDelete: Restrict)
+
+  @@index([customerId, occurredAt])
+  @@map("customer_recharges")
+}
+
+model Vendor {
+  id            String            @id @db.VarChar(32)
+  name          String            @unique @db.VarChar(120)
+  contactName   String?           @map("contact_name") @db.VarChar(80)
+  phone         String?           @db.VarChar(32)
+  email         String?           @db.VarChar(160)
+  status        EntityStatus      @default(ENABLED)
+  balance       Decimal           @default(0) @db.Decimal(20, 6)
+  creditLimit   Decimal           @default(0) @map("credit_limit") @db.Decimal(20, 6)
+  settlement    String?           @db.VarChar(80)
+  notes         String?           @db.VarChar(500)
+  createdAt     DateTime          @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt     DateTime          @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy     String?           @map("created_by") @db.VarChar(32)
+  updatedBy     String?           @map("updated_by") @db.VarChar(32)
+  version       Int               @default(1)
+  deletedAt     DateTime?         @map("deleted_at") @db.DateTime(3)
+
+  gateways      VendorGateway[]
+  recharges     VendorRecharge[]
+  rawCdrs       RawCdr[]
+
+  @@index([status])
+  @@index([deletedAt])
+  @@map("vendors")
+}
+
+model VendorRecharge {
+  id              String         @id @db.VarChar(40)
+  vendorId        String         @map("vendor_id") @db.VarChar(32)
+  amount          Decimal        @db.Decimal(20, 6)
+  beforeBalance   Decimal        @map("before_balance") @db.Decimal(20, 6)
+  afterBalance    Decimal        @map("after_balance") @db.Decimal(20, 6)
+  idempotencyKey  String         @unique @map("idempotency_key") @db.VarChar(128)
+  remark          String?        @db.VarChar(500)
+  status          RechargeStatus @default(SUCCEEDED)
+  occurredAt      DateTime       @default(now()) @map("occurred_at") @db.DateTime(3)
+  createdAt       DateTime       @default(now()) @map("created_at") @db.DateTime(3)
+  createdBy       String?        @map("created_by") @db.VarChar(32)
+
+  vendor          Vendor         @relation(fields: [vendorId], references: [id], onDelete: Restrict)
+
+  @@index([vendorId, occurredAt])
+  @@map("vendor_recharges")
+}
+
+model VendorGateway {
+  id                 String                         @id @db.VarChar(32)
+  vendorId           String                         @map("vendor_id") @db.VarChar(32)
+  name               String                         @db.VarChar(120)
+  authMode           GatewayAuthMode                @map("auth_mode")
+  host               String                         @db.VarChar(160)
+  port               Int                            @default(5060)
+  transport          String                         @default("udp") @db.VarChar(16)
+  sipUsername        String?                        @map("sip_username") @db.VarChar(120)
+  sipHa1             String?                        @map("sip_ha1") @db.VarChar(128)
+  cpsLimit           Int                            @default(0) @map("cps_limit")
+  concurrencyLimit   Int                            @default(0) @map("concurrency_limit")
+  billingCycleSec    Int                            @default(60) @map("billing_cycle_sec")
+  cycleRate          Decimal                        @default(0) @map("cycle_rate") @db.Decimal(20, 6)
+  status             EntityStatus                   @default(ENABLED)
+  createdAt          DateTime                       @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt          DateTime                       @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy          String?                        @map("created_by") @db.VarChar(32)
+  updatedBy          String?                        @map("updated_by") @db.VarChar(32)
+  version            Int                            @default(1)
+  deletedAt          DateTime?                      @map("deleted_at") @db.DateTime(3)
+
+  vendor             Vendor                         @relation(fields: [vendorId], references: [id], onDelete: Restrict)
+  forbiddenPeriods   VendorGatewayForbiddenPeriod[]
+  codecs             VendorGatewayCodec[]
+  prefixRules        VendorGatewayPrefixRule[]
+  lineGroupItems     LandingLineGroupItem[]
+  rawCdrs            RawCdr[]
+
+  @@unique([vendorId, name])
+  @@index([vendorId, status])
+  @@index([host])
+  @@index([deletedAt])
+  @@map("vendor_gateways")
+}
+
+model VendorGatewayForbiddenPeriod {
+  id              String        @id @db.VarChar(32)
+  vendorGatewayId String        @map("vendor_gateway_id") @db.VarChar(32)
+  weekdayMask     Int           @map("weekday_mask")
+  startTime       String        @map("start_time") @db.VarChar(8)
+  endTime         String        @map("end_time") @db.VarChar(8)
+  createdAt       DateTime      @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt       DateTime      @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy       String?       @map("created_by") @db.VarChar(32)
+  updatedBy       String?       @map("updated_by") @db.VarChar(32)
+  version         Int           @default(1)
+
+  vendorGateway   VendorGateway @relation(fields: [vendorGatewayId], references: [id], onDelete: Cascade)
+
+  @@index([vendorGatewayId])
+  @@map("vendor_gateway_forbidden_periods")
+}
+
+model VendorGatewayCodec {
+  id              String        @id @db.VarChar(32)
+  vendorGatewayId String        @map("vendor_gateway_id") @db.VarChar(32)
+  codec           String        @db.VarChar(32)
+  priority        Int
+  createdAt       DateTime      @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt       DateTime      @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy       String?       @map("created_by") @db.VarChar(32)
+  updatedBy       String?       @map("updated_by") @db.VarChar(32)
+  version         Int           @default(1)
+
+  vendorGateway   VendorGateway @relation(fields: [vendorGatewayId], references: [id], onDelete: Cascade)
+
+  @@unique([vendorGatewayId, codec])
+  @@unique([vendorGatewayId, priority])
+  @@map("vendor_gateway_codecs")
+}
+
+model VendorGatewayPrefixRule {
+  id              String              @id @db.VarChar(32)
+  vendorGatewayId String              @map("vendor_gateway_id") @db.VarChar(32)
+  direction       PrefixRuleDirection
+  matchPrefix     String              @map("match_prefix") @db.VarChar(32)
+  replacePrefix   String              @map("replace_prefix") @db.VarChar(32)
+  priority        Int
+  createdAt       DateTime            @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt       DateTime            @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy       String?             @map("created_by") @db.VarChar(32)
+  updatedBy       String?             @map("updated_by") @db.VarChar(32)
+  version         Int                 @default(1)
+
+  vendorGateway   VendorGateway       @relation(fields: [vendorGatewayId], references: [id], onDelete: Cascade)
+
+  @@unique([vendorGatewayId, direction, priority])
+  @@index([vendorGatewayId, direction])
+  @@map("vendor_gateway_prefix_rules")
+}
+
+model LandingLineGroup {
+  id          String                  @id @db.VarChar(32)
+  name        String                  @unique @db.VarChar(120)
+  status      EntityStatus            @default(ENABLED)
+  notes       String?                 @db.VarChar(500)
+  createdAt   DateTime                @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt   DateTime                @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy   String?                 @map("created_by") @db.VarChar(32)
+  updatedBy   String?                 @map("updated_by") @db.VarChar(32)
+  version     Int                     @default(1)
+  deletedAt   DateTime?               @map("deleted_at") @db.DateTime(3)
+
+  items       LandingLineGroupItem[]
+  policies    CustomerGatewayPolicy[]
+  rawCdrs     RawCdr[]
+  rules       QualitySamplingRule[]
+
+  @@index([status])
+  @@index([deletedAt])
+  @@map("landing_line_groups")
+}
+
+model LandingLineGroupItem {
+  id              String           @id @db.VarChar(32)
+  lineGroupId     String           @map("line_group_id") @db.VarChar(32)
+  vendorGatewayId String           @map("vendor_gateway_id") @db.VarChar(32)
+  priority        Int
+  weight          Int              @default(1)
+  concurrencyCap  Int              @default(0) @map("concurrency_cap")
+  status          EntityStatus     @default(ENABLED)
+  createdAt       DateTime         @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt       DateTime         @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy       String?          @map("created_by") @db.VarChar(32)
+  updatedBy       String?          @map("updated_by") @db.VarChar(32)
+  version         Int              @default(1)
+
+  lineGroup       LandingLineGroup @relation(fields: [lineGroupId], references: [id], onDelete: Cascade)
+  vendorGateway   VendorGateway    @relation(fields: [vendorGatewayId], references: [id], onDelete: Restrict)
+
+  @@unique([lineGroupId, vendorGatewayId])
+  @@unique([lineGroupId, priority])
+  @@index([vendorGatewayId])
+  @@map("landing_line_group_items")
+}
+
+model RawCdr {
+  id                      String                 @id @db.VarChar(40)
+  eventId                 String                 @unique @map("event_id") @db.VarChar(64)
+  callId                  String                 @map("call_id") @db.VarChar(255)
+  customerId              String?                @map("customer_id") @db.VarChar(32)
+  customerGatewayId       String?                @map("customer_gateway_id") @db.VarChar(32)
+  customerGatewayPolicyId String?                @map("customer_gateway_policy_id") @db.VarChar(32)
+  sourceIp                String?                @map("source_ip") @db.VarChar(45)
+  caller                  String                 @db.VarChar(64)
+  callee                  String                 @db.VarChar(64)
+  vendorId                String?                @map("vendor_id") @db.VarChar(32)
+  vendorGatewayId         String?                @map("vendor_gateway_id") @db.VarChar(32)
+  lineGroupId             String?                @map("line_group_id") @db.VarChar(32)
+  startedAt               DateTime               @map("started_at") @db.DateTime(3)
+  answeredAt              DateTime?              @map("answered_at") @db.DateTime(3)
+  endedAt                 DateTime               @map("ended_at") @db.DateTime(3)
+  durationSec             Int                    @default(0) @map("duration_sec")
+  sipCode                 Int                    @map("sip_code")
+  hangupReason            String?                @map("hangup_reason") @db.VarChar(120)
+  recordingKey            String?                @map("recording_key") @db.VarChar(255)
+  configVersion           Int?                   @map("config_version")
+  ratingStatus            CdrRatingStatus        @default(UNRATED) @map("rating_status")
+  payload                 Json?
+  receivedAt              DateTime               @default(now()) @map("received_at") @db.DateTime(3)
+  createdAt               DateTime               @default(now()) @map("created_at") @db.DateTime(3)
+
+  customer                Customer?              @relation(fields: [customerId], references: [id], onDelete: SetNull)
+  customerGateway         CustomerGateway?       @relation(fields: [customerGatewayId], references: [id], onDelete: SetNull)
+  customerGatewayPolicy   CustomerGatewayPolicy? @relation(fields: [customerGatewayPolicyId], references: [id], onDelete: SetNull)
+  vendor                  Vendor?                @relation(fields: [vendorId], references: [id], onDelete: SetNull)
+  vendorGateway           VendorGateway?         @relation(fields: [vendorGatewayId], references: [id], onDelete: SetNull)
+  lineGroup               LandingLineGroup?      @relation(fields: [lineGroupId], references: [id], onDelete: SetNull)
+  ratedCdr                RatedCdr?
+  recording               Recording?
+
+  @@unique([callId, endedAt])
+  @@index([customerId, startedAt])
+  @@index([vendorId, startedAt])
+  @@index([sipCode])
+  @@index([ratingStatus])
+  @@map("raw_cdrs")
+}
+
+model RatedCdr {
+  id                 String   @id @db.VarChar(40)
+  rawCdrId           String   @unique @map("raw_cdr_id") @db.VarChar(40)
+  billSec            Int      @map("bill_sec")
+  customerFee        Decimal  @default(0) @map("customer_fee") @db.Decimal(20, 6)
+  vendorCost         Decimal  @default(0) @map("vendor_cost") @db.Decimal(20, 6)
+  grossProfit        Decimal  @default(0) @map("gross_profit") @db.Decimal(20, 6)
+  customerRate       Json?    @map("customer_rate")
+  vendorRate         Json?    @map("vendor_rate")
+  ratedAt            DateTime @default(now()) @map("rated_at") @db.DateTime(3)
+  createdAt          DateTime @default(now()) @map("created_at") @db.DateTime(3)
+
+  rawCdr             RawCdr   @relation(fields: [rawCdrId], references: [id], onDelete: Restrict)
+
+  @@index([ratedAt])
+  @@map("rated_cdrs")
+}
+
+model Recording {
+  id           String          @id @db.VarChar(40)
+  rawCdrId     String?         @unique @map("raw_cdr_id") @db.VarChar(40)
+  storageKey   String          @unique @map("storage_key") @db.VarChar(255)
+  storagePath  String          @map("storage_path") @db.VarChar(500)
+  sha256       String?         @db.Char(64)
+  bytes        BigInt          @default(0)
+  durationSec  Int             @default(0) @map("duration_sec")
+  status       RecordingStatus @default(PENDING)
+  movedAt      DateTime?       @map("moved_at") @db.DateTime(3)
+  createdAt    DateTime        @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt    DateTime        @updatedAt @map("updated_at") @db.DateTime(3)
+
+  rawCdr       RawCdr?         @relation(fields: [rawCdrId], references: [id], onDelete: SetNull)
+  reviews      QualityReview[]
+
+  @@index([status, createdAt])
+  @@map("recordings")
+}
+
+model QualitySamplingRule {
+  id          String            @id @db.VarChar(32)
+  name        String            @db.VarChar(120)
+  customerId  String?           @map("customer_id") @db.VarChar(32)
+  lineGroupId String?           @map("line_group_id") @db.VarChar(32)
+  ratio       Decimal           @db.Decimal(5, 2)
+  status      EntityStatus      @default(ENABLED)
+  effectiveAt DateTime          @default(now()) @map("effective_at") @db.DateTime(3)
+  expiresAt   DateTime?         @map("expires_at") @db.DateTime(3)
+  createdAt   DateTime          @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt   DateTime          @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy   String?           @map("created_by") @db.VarChar(32)
+  updatedBy   String?           @map("updated_by") @db.VarChar(32)
+  version     Int               @default(1)
+  deletedAt   DateTime?         @map("deleted_at") @db.DateTime(3)
+
+  customer    Customer?         @relation(fields: [customerId], references: [id], onDelete: SetNull)
+  lineGroup   LandingLineGroup? @relation(fields: [lineGroupId], references: [id], onDelete: SetNull)
+
+  @@index([customerId, status])
+  @@index([lineGroupId, status])
+  @@index([deletedAt])
+  @@map("quality_sampling_rules")
+}
+
+model QualityReview {
+  id           String              @id @db.VarChar(40)
+  recordingId  String              @map("recording_id") @db.VarChar(40)
+  reviewerId   String              @map("reviewer_id") @db.VarChar(32)
+  score        Int?
+  result       QualityReviewResult
+  issueTags    Json?               @map("issue_tags")
+  notes        String?             @db.VarChar(1000)
+  reviewedAt   DateTime            @default(now()) @map("reviewed_at") @db.DateTime(3)
+  createdAt    DateTime            @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt    DateTime            @updatedAt @map("updated_at") @db.DateTime(3)
+  version      Int                 @default(1)
+
+  recording    Recording           @relation(fields: [recordingId], references: [id], onDelete: Restrict)
+  reviewer     User                @relation(fields: [reviewerId], references: [id], onDelete: Restrict)
+
+  @@index([recordingId])
+  @@index([reviewerId, reviewedAt])
+  @@map("quality_reviews")
+}
+
+model User {
+  id                    String          @id @db.VarChar(32)
+  username              String          @unique @db.VarChar(80)
+  displayName           String          @map("display_name") @db.VarChar(80)
+  phone                 String?         @db.VarChar(32)
+  email                 String?         @unique @db.VarChar(160)
+  passwordHash          String?         @map("password_hash") @db.VarChar(255)
+  passwordAlgo          String?         @map("password_algo") @db.VarChar(32)
+  status                EntityStatus    @default(ENABLED)
+  failedLoginCount      Int             @default(0) @map("failed_login_count")
+  lockedUntil           DateTime?       @map("locked_until") @db.DateTime(3)
+  requirePasswordChange Boolean         @default(false) @map("require_password_change")
+  lastLoginAt           DateTime?       @map("last_login_at") @db.DateTime(3)
+  lastLoginIp           String?         @map("last_login_ip") @db.VarChar(45)
+  createdAt             DateTime        @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt             DateTime        @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy             String?         @map("created_by") @db.VarChar(32)
+  updatedBy             String?         @map("updated_by") @db.VarChar(32)
+  version               Int             @default(1)
+  deletedAt             DateTime?       @map("deleted_at") @db.DateTime(3)
+
+  userRoles             UserRole[]
+  qualityReviews        QualityReview[]
+  sessions              UserSession[]
+
+  @@index([status])
+  @@index([deletedAt])
+  @@map("users")
+}
+
+model UserSession {
+  id               String    @id @db.VarChar(40)
+  userId           String    @map("user_id") @db.VarChar(32)
+  refreshTokenHash String    @unique @map("refresh_token_hash") @db.Char(64)
+  userAgent        String?   @map("user_agent") @db.VarChar(500)
+  ip               String?   @db.VarChar(45)
+  expiresAt        DateTime  @map("expires_at") @db.DateTime(3)
+  revokedAt        DateTime? @map("revoked_at") @db.DateTime(3)
+  rotatedFromId    String?   @map("rotated_from_id") @db.VarChar(40)
+  createdAt        DateTime  @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt        DateTime  @updatedAt @map("updated_at") @db.DateTime(3)
+
+  user             User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId, createdAt])
+  @@index([expiresAt])
+  @@index([revokedAt])
+  @@map("user_sessions")
+}
+
+model Role {
+  id          String           @id @db.VarChar(32)
+  name        String           @unique @db.VarChar(80)
+  description String?          @db.VarChar(300)
+  builtIn     Boolean          @default(false) @map("built_in")
+  status      EntityStatus     @default(ENABLED)
+  createdAt   DateTime         @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt   DateTime         @updatedAt @map("updated_at") @db.DateTime(3)
+  createdBy   String?          @map("created_by") @db.VarChar(32)
+  updatedBy   String?          @map("updated_by") @db.VarChar(32)
+  version     Int              @default(1)
+  deletedAt   DateTime?        @map("deleted_at") @db.DateTime(3)
+
+  userRoles   UserRole[]
+  permissions RolePermission[]
+
+  @@index([status])
+  @@index([deletedAt])
+  @@map("roles")
+}
+
+model Permission {
+  id          String           @id @db.VarChar(80)
+  module      String           @db.VarChar(80)
+  action      String           @db.VarChar(80)
+  description String?          @db.VarChar(300)
+  createdAt   DateTime         @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt   DateTime         @updatedAt @map("updated_at") @db.DateTime(3)
+
+  roles       RolePermission[]
+
+  @@unique([module, action])
+  @@map("permissions")
+}
+
+model UserRole {
+  userId    String   @map("user_id") @db.VarChar(32)
+  roleId    String   @map("role_id") @db.VarChar(32)
+  createdAt DateTime @default(now()) @map("created_at") @db.DateTime(3)
+  createdBy String?  @map("created_by") @db.VarChar(32)
+
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  role      Role     @relation(fields: [roleId], references: [id], onDelete: Cascade)
+
+  @@id([userId, roleId])
+  @@index([roleId])
+  @@map("user_roles")
+}
+
+model RolePermission {
+  roleId       String     @map("role_id") @db.VarChar(32)
+  permissionId String     @map("permission_id") @db.VarChar(80)
+  createdAt    DateTime   @default(now()) @map("created_at") @db.DateTime(3)
+  createdBy    String?    @map("created_by") @db.VarChar(32)
+
+  role         Role       @relation(fields: [roleId], references: [id], onDelete: Cascade)
+  permission   Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
+
+  @@id([roleId, permissionId])
+  @@index([permissionId])
+  @@map("role_permissions")
+}
+
+model AuditLog {
+  id             String      @id @db.VarChar(40)
+  requestId      String      @map("request_id") @db.VarChar(64)
+  userId         String?     @map("user_id") @db.VarChar(32)
+  username       String?     @db.VarChar(80)
+  roleNames      String?     @map("role_names") @db.VarChar(300)
+  ip             String?     @db.VarChar(45)
+  userAgent      String?     @map("user_agent") @db.VarChar(500)
+  module         String      @db.VarChar(80)
+  action         String      @db.VarChar(80)
+  objectType     String      @map("object_type") @db.VarChar(80)
+  objectId       String?     @map("object_id") @db.VarChar(80)
+  beforeSummary  Json?       @map("before_summary")
+  afterSummary   Json?       @map("after_summary")
+  result         AuditResult
+  errorCode      String?     @map("error_code") @db.VarChar(80)
+  createdAt      DateTime    @default(now()) @map("created_at") @db.DateTime(3)
+
+  @@index([userId, createdAt])
+  @@index([module, action, createdAt])
+  @@index([objectType, objectId])
+  @@map("audit_logs")
+}
+
+model OutboxEvent {
+  id            String       @id @db.VarChar(40)
+  aggregateType String       @map("aggregate_type") @db.VarChar(80)
+  aggregateId   String       @map("aggregate_id") @db.VarChar(80)
+  eventType     String       @map("event_type") @db.VarChar(120)
+  payload       Json
+  status        OutboxStatus @default(PENDING)
+  attempts      Int          @default(0)
+  availableAt   DateTime     @default(now()) @map("available_at") @db.DateTime(3)
+  lockedAt      DateTime?    @map("locked_at") @db.DateTime(3)
+  processedAt   DateTime?    @map("processed_at") @db.DateTime(3)
+  lastError     String?      @map("last_error") @db.VarChar(1000)
+  createdAt     DateTime     @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt     DateTime     @updatedAt @map("updated_at") @db.DateTime(3)
+
+  @@index([status, availableAt])
+  @@index([aggregateType, aggregateId])
+  @@map("outbox_events")
+}
+
+model IdempotencyKey {
+  id             String            @id @db.VarChar(40)
+  key            String            @unique @db.VarChar(128)
+  scope          String            @db.VarChar(80)
+  requestHash    String            @map("request_hash") @db.Char(64)
+  responseStatus Int?              @map("response_status")
+  responseBody   Json?             @map("response_body")
+  status         IdempotencyStatus @default(IN_PROGRESS)
+  lockedUntil    DateTime?         @map("locked_until") @db.DateTime(3)
+  expiresAt      DateTime          @map("expires_at") @db.DateTime(3)
+  createdAt      DateTime          @default(now()) @map("created_at") @db.DateTime(3)
+  updatedAt      DateTime          @updatedAt @map("updated_at") @db.DateTime(3)
+
+  @@index([scope, status])
+  @@index([expiresAt])
+  @@map("idempotency_keys")
+}
diff --git a/prisma/seed.ts b/prisma/seed.ts
new file mode 100644
index 0000000..2d2f0ff
--- /dev/null
+++ b/prisma/seed.ts
@@ -0,0 +1,144 @@
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+
+const permissions = [
+  ['dashboard.view', 'dashboard', 'view', '查看 Dashboard 指标'],
+  ['customers.view', 'customers', 'view', '查看客户'],
+  ['customers.manage', 'customers', 'manage', '管理客户'],
+  ['customer_gateways.view', 'customer_gateways', 'view', '查看客户网关'],
+  ['customer_gateways.manage', 'customer_gateways', 'manage', '管理客户网关和策略'],
+  ['vendors.view', 'vendors', 'view', '查看供应商'],
+  ['vendors.manage', 'vendors', 'manage', '管理供应商'],
+  ['vendor_gateways.view', 'vendor_gateways', 'view', '查看落地网关'],
+  ['vendor_gateways.manage', 'vendor_gateways', 'manage', '管理落地网关'],
+  ['line_groups.view', 'line_groups', 'view', '查看落地线路组'],
+  ['line_groups.manage', 'line_groups', 'manage', '管理落地线路组'],
+  ['recharges.view', 'recharges', 'view', '查看充值流水'],
+  ['recharges.manage', 'recharges', 'manage', '执行客户或供应商充值'],
+  ['cdr.view', 'cdr', 'view', '查看话单'],
+  ['recordings.play', 'recordings', 'play', '播放录音'],
+  ['quality.view', 'quality', 'view', '查看质检任务'],
+  ['quality.manage', 'quality', 'manage', '保存质检结果'],
+  ['users.view', 'users', 'view', '查看用户'],
+  ['users.manage', 'users', 'manage', '管理用户'],
+  ['roles.view', 'roles', 'view', '查看角色权限'],
+  ['roles.manage', 'roles', 'manage', '管理角色权限'],
+  ['audit.view', 'audit', 'view', '查看操作日志']
+] as const;
+
+const roles = [
+  {
+    id: 'ROLE_SUPER_ADMIN',
+    name: '超级管理员',
+    description: '系统内置最高权限角色',
+    permissionIds: permissions.map(([id]) => id)
+  },
+  {
+    id: 'ROLE_OPERATOR',
+    name: '运营管理员',
+    description: '客户、网关、线路和话单运营',
+    permissionIds: [
+      'dashboard.view',
+      'customers.view',
+      'customers.manage',
+      'customer_gateways.view',
+      'customer_gateways.manage',
+      'vendors.view',
+      'vendor_gateways.view',
+      'line_groups.view',
+      'line_groups.manage',
+      'cdr.view',
+      'recordings.play'
+    ]
+  },
+  {
+    id: 'ROLE_FINANCE',
+    name: '财务',
+    description: '充值、余额和财务流水',
+    permissionIds: ['dashboard.view', 'customers.view', 'vendors.view', 'recharges.view', 'recharges.manage', 'cdr.view']
+  },
+  {
+    id: 'ROLE_QUALITY',
+    name: '质检',
+    description: '录音抽检和质检结果维护',
+    permissionIds: ['dashboard.view', 'cdr.view', 'recordings.play', 'quality.view', 'quality.manage']
+  },
+  {
+    id: 'ROLE_TECH_OPS',
+    name: '技术运维',
+    description: '网关、线路、信令和审计排障',
+    permissionIds: [
+      'dashboard.view',
+      'customer_gateways.view',
+      'vendors.view',
+      'vendor_gateways.view',
+      'vendor_gateways.manage',
+      'line_groups.view',
+      'cdr.view',
+      'recordings.play',
+      'audit.view'
+    ]
+  }
+];
+
+async function main(): Promise<void> {
+  await prisma.$transaction(
+    async (tx) => {
+      for (const [id, module, action, description] of permissions) {
+        await tx.permission.upsert({
+          where: { id },
+          update: { module, action, description },
+          create: { id, module, action, description }
+        });
+      }
+
+      for (const role of roles) {
+        await tx.role.upsert({
+          where: { id: role.id },
+          update: {
+            name: role.name,
+            description: role.description,
+            builtIn: true,
+            status: 'ENABLED'
+          },
+          create: {
+            id: role.id,
+            name: role.name,
+            description: role.description,
+            builtIn: true,
+            status: 'ENABLED'
+          }
+        });
+
+        for (const permissionId of role.permissionIds) {
+          await tx.rolePermission.upsert({
+            where: {
+              roleId_permissionId: {
+                roleId: role.id,
+                permissionId
+              }
+            },
+            update: {},
+            create: {
+              roleId: role.id,
+              permissionId
+            }
+          });
+        }
+      }
+    },
+    {
+      timeout: 30000
+    }
+  );
+}
+
+main()
+  .finally(async () => {
+    await prisma.$disconnect();
+  })
+  .catch((error) => {
+    console.error(error);
+    process.exit(1);
+  });
diff --git a/scripts/pnpm-run.mjs b/scripts/pnpm-run.mjs
new file mode 100755
index 0000000..844c4d8
--- /dev/null
+++ b/scripts/pnpm-run.mjs
@@ -0,0 +1,23 @@
+import { spawnSync } from 'node:child_process';
+
+const args = process.argv.slice(2);
+const npmExecPath = process.env.npm_execpath;
+
+const command = npmExecPath && npmExecPath.includes('pnpm')
+  ? process.execPath
+  : 'pnpm';
+const commandArgs = npmExecPath && npmExecPath.includes('pnpm')
+  ? [npmExecPath, ...args]
+  : args;
+
+const result = spawnSync(command, commandArgs, {
+  stdio: 'inherit',
+  shell: false
+});
+
+if (result.error) {
+  console.error(result.error.message);
+  process.exit(1);
+}
+
+process.exit(result.status ?? 1);
diff --git a/tsconfig.base.json b/tsconfig.base.json
new file mode 100644
index 0000000..8063e3c
--- /dev/null
+++ b/tsconfig.base.json
@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": ["ES2022"],
+    "strict": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "types": ["node"]
+  }
+}
diff --git a/tsconfig.build.json b/tsconfig.build.json
new file mode 100644
index 0000000..9bae83c
--- /dev/null
+++ b/tsconfig.build.json
@@ -0,0 +1,15 @@
+{
+  "files": [],
+  "references": [
+    { "path": "./packages/contracts" },
+    { "path": "./packages/domain" },
+    { "path": "./packages/database" },
+    { "path": "./packages/redis" },
+    { "path": "./packages/auth" },
+    { "path": "./packages/observability" },
+    { "path": "./apps/api" },
+    { "path": "./apps/worker-cdr" },
+    { "path": "./apps/worker-recording" },
+    { "path": "./apps/worker-config-publisher" }
+  ]
+}
diff --git a/vitest.config.ts b/vitest.config.ts
new file mode 100644
index 0000000..179a0d7
--- /dev/null
+++ b/vitest.config.ts
@@ -0,0 +1,10 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    globals: true,
+    include: ['apps/**/*.spec.ts', 'packages/**/*.spec.ts', 'tests/**/*.spec.ts'],
+    environment: 'node',
+    testTimeout: 10000
+  }
+});