diff --git a/__tests__/api/dispute-evidence.test.ts b/__tests__/api/dispute-evidence.test.ts
index 179a10d..e1bc2f8 100644
--- a/__tests__/api/dispute-evidence.test.ts
+++ b/__tests__/api/dispute-evidence.test.ts
@@ -1,153 +1,237 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-import { NextRequest } from 'next/server'
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { NextRequest } from "next/server";
 
-import { GET, POST } from '@/app/api/disputes/[id]/evidence/route'
-import { GET as downloadEvidence } from '@/app/api/disputes/[id]/evidence/[evidenceId]/route'
+import { GET, POST } from "@/app/api/disputes/[id]/evidence/route";
+import { GET as downloadEvidence } from "@/app/api/disputes/[id]/evidence/[evidenceId]/route";
 
-vi.mock('@/lib/auth/session', () => ({
-  readAccessToken: vi.fn().mockReturnValue('token'),
-  verifyAccessToken: vi.fn().mockReturnValue({ walletAddress: 'GABC', jti: 'jti-1' }),
-}))
+vi.mock("@/lib/auth/session", () => ({
+  readAccessToken: vi.fn().mockReturnValue("token"),
+  verifyAccessToken: vi
+    .fn()
+    .mockReturnValue({ walletAddress: "GABC", jti: "jti-1" }),
+}));
 
-vi.mock('@/lib/db', () => ({
+vi.mock("@/lib/db", () => ({
   sql: vi.fn(),
-}))
+}));
 
-vi.mock('@/lib/security/fileEncryption', () => ({
-  computeFileHash: vi.fn().mockReturnValue('dummy-hash'),
-  storeEncryptedFile: vi.fn().mockResolvedValue({ iv: 'dummy-iv', filePath: '/tmp/evidence-file' }),
-  readEncryptedFile: vi.fn().mockResolvedValue(Buffer.from('file-content')),
-}))
+vi.mock("@/lib/security/fileEncryption", () => ({
+  computeFileHash: vi.fn().mockReturnValue("dummy-hash"),
+  storeEncryptedFile: vi
+    .fn()
+    .mockResolvedValue({ iv: "dummy-iv", filePath: "/tmp/evidence-file" }),
+  readEncryptedFile: vi.fn().mockResolvedValue(Buffer.from("file-content")),
+  removeEncryptedFile: vi.fn().mockResolvedValue(undefined),
+}));
 
-import { sql } from '@/lib/db'
+import { sql } from "@/lib/db";
 
-type SqlMock = ReturnType<typeof vi.fn>
+type SqlMock = ReturnType<typeof vi.fn>;
 
 function queueSql(responses: unknown[]) {
-  const mock = sql as unknown as SqlMock
+  const mock = sql as unknown as SqlMock;
   for (const response of responses) {
-    mock.mockResolvedValueOnce(response)
+    mock.mockResolvedValueOnce(response);
   }
 }
 
-function makeContext(disputeId = '42', evidenceId = '9') {
-  return { params: Promise.resolve({ id: disputeId, evidenceId }) }
+function makeContext(disputeId = "42", evidenceId = "9") {
+  return { params: Promise.resolve({ id: disputeId, evidenceId }) };
 }
 
 function makeGetRequest(url: string) {
-  return new NextRequest(new Request(url))
+  return new NextRequest(new Request(url));
 }
 
-function makePostRequest(url: string, files: File[], description = '') {
-  const formData = new FormData()
+function makePostRequest(url: string, files: File[], description = "") {
+  const formData = new FormData();
   for (const file of files) {
-    Object.defineProperty(file, 'arrayBuffer', {
+    Object.defineProperty(file, "arrayBuffer", {
       configurable: true,
-      value: vi.fn().mockResolvedValue(new TextEncoder().encode('content').buffer),
-    })
-    formData.append('files', file)
+      value: vi
+        .fn()
+        .mockResolvedValue(new TextEncoder().encode("content").buffer),
+    });
+    formData.append("files", file);
   }
-  if (description) formData.append('description', description)
+  if (description) formData.append("description", description);
   return {
     nextUrl: new URL(url),
     formData: vi.fn().mockResolvedValue(formData),
-  } as unknown as NextRequest
+  } as unknown as NextRequest;
 }
 
 beforeEach(() => {
-  vi.clearAllMocks()
-  ;(sql as unknown as SqlMock).mockReset()
-})
+  vi.clearAllMocks();
+  (sql as unknown as SqlMock).mockReset();
+});
 
-describe('GET /api/disputes/[id]/evidence', () => {
-  it('returns 403 when the user is not a dispute participant or admin', async () => {
+describe("GET /api/disputes/[id]/evidence", () => {
+  it("returns 403 when the user is not a dispute participant or admin", async () => {
     queueSql([
-      [{ id: 3, role: 'client' }],
+      [{ id: 3, role: "client" }],
       [{ id: 42, client_id: 1, freelancer_id: 2 }],
-    ])
+    ]);
 
-    const response = await GET(makeGetRequest('http://localhost/api/disputes/42/evidence'), makeContext())
+    const response = await GET(
+      makeGetRequest("http://localhost/api/disputes/42/evidence"),
+      makeContext(),
+    );
 
-    expect(response.status).toBe(403)
-    const body = await response.json()
-    expect(body.code).toBe('FORBIDDEN')
-  })
+    expect(response.status).toBe(403);
+    const body = await response.json();
+    expect(body.code).toBe("FORBIDDEN");
+  });
 
-  it('returns evidence in chronological order for an authorized party', async () => {
+  it("returns evidence in chronological order for an authorized party", async () => {
     queueSql([
-      [{ id: 1, role: 'client' }],
+      [{ id: 1, role: "client" }],
       [{ id: 42, client_id: 1, freelancer_id: 2 }],
-      [{ id: 9, file_name: 'proof.pdf', created_at: '2026-01-01T00:00:00Z' }],
-    ])
+      [{ total: 1 }],
+      [{ id: 9, file_name: "proof.pdf", created_at: "2026-01-01T00:00:00Z" }],
+      [],
+    ]);
 
-    const response = await GET(makeGetRequest('http://localhost/api/disputes/42/evidence'), makeContext())
+    const response = await GET(
+      makeGetRequest("http://localhost/api/disputes/42/evidence"),
+      makeContext(),
+    );
 
-    expect(response.status).toBe(200)
-    const body = await response.json()
-    expect(body.evidence).toHaveLength(1)
-    expect(body.evidence[0].file_name).toBe('proof.pdf')
-  })
-})
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.evidence).toHaveLength(1);
+    expect(body.evidence[0].file_name).toBe("proof.pdf");
+  });
 
-describe('POST /api/disputes/[id]/evidence', () => {
-  it('rejects unsupported file types before storage', async () => {
+  it("includes pagination metadata when a limit is supplied", async () => {
+    queueSql([
+      [{ id: 1, role: "client" }],
+      [{ id: 42, client_id: 1, freelancer_id: 2 }],
+      [{ total: 14 }],
+      [{ id: 9, file_name: "proof.pdf", created_at: "2026-01-01T00:00:00Z" }],
+      [],
+    ]);
+
+    const response = await GET(
+      makeGetRequest(
+        "http://localhost/api/disputes/42/evidence?limit=10&offset=0",
+      ),
+      makeContext(),
+    );
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.pagination).toMatchObject({
+      limit: 10,
+      offset: 0,
+      total: 14,
+      hasMore: true,
+    });
+    expect(body.evidence).toHaveLength(1);
+  });
+});
+
+describe("POST /api/disputes/[id]/evidence", () => {
+  it("rejects unsupported file types before storage", async () => {
     const request = makePostRequest(
-      'http://localhost/api/disputes/42/evidence',
-      [new File(['<script>'], 'bad.html', { type: 'text/html' })],
-    )
+      "http://localhost/api/disputes/42/evidence",
+      [new File(["<script>"], "bad.html", { type: "text/html" })],
+    );
 
-    const response = await POST(request, makeContext())
+    const response = await POST(request, makeContext());
 
-    expect(response.status).toBe(422)
-    const body = await response.json()
-    expect(body.code).toBe('VALIDATION_ERRORS')
-  })
+    expect(response.status).toBe(422);
+    const body = await response.json();
+    expect(body.code).toBe("VALIDATION_ERRORS");
+  });
 
-  it('stores encrypted evidence metadata for authorized users', async () => {
+  it("stores encrypted evidence metadata for authorized users", async () => {
     queueSql([
-      [{ id: 1, role: 'freelancer' }],
+      [{ id: 1, role: "freelancer" }],
       [{ id: 42, client_id: 2, freelancer_id: 1 }],
-      [{ id: 9, file_name: 'proof.pdf', file_hash: 'dummy-hash', created_at: '2026-01-01T00:00:00Z' }],
+      [
+        {
+          id: 9,
+          file_name: "proof.pdf",
+          file_hash: "dummy-hash",
+          created_at: "2026-01-01T00:00:00Z",
+        },
+      ],
       [],
-    ])
+    ]);
 
     const request = makePostRequest(
-      'http://localhost/api/disputes/42/evidence',
-      [new File(['content'], 'proof.pdf', { type: 'application/pdf' })],
-      'Signed scope document',
-    )
-
-    const response = await POST(request, makeContext())
-
-    expect(response.status).toBe(201)
-    const body = await response.json()
-    expect(body.evidence[0].file_name).toBe('proof.pdf')
-    expect(body.evidence[0].file_hash).toBe('dummy-hash')
-  })
-})
-
-describe('GET /api/disputes/[id]/evidence/[evidenceId]', () => {
-  it('downloads encrypted evidence for an authorized participant', async () => {
+      "http://localhost/api/disputes/42/evidence",
+      [new File(["content"], "proof.pdf", { type: "application/pdf" })],
+      "Signed scope document",
+    );
+
+    const response = await POST(request, makeContext());
+
+    expect(response.status).toBe(201);
+    const body = await response.json();
+    expect(body.evidence[0].file_name).toBe("proof.pdf");
+    expect(body.evidence[0].file_hash).toBe("dummy-hash");
+  });
+});
+
+describe("GET /api/disputes/[id]/evidence/[evidenceId]", () => {
+  it("downloads encrypted evidence for an authorized participant", async () => {
     queueSql([
-      [{ id: 1, role: 'client' }],
+      [{ id: 1, role: "client" }],
       [{ id: 42, client_id: 1, freelancer_id: 2 }],
-      [{
-        id: 9,
-        file_name: 'proof.pdf',
-        file_type: 'application/pdf',
-        mime_type: 'application/pdf',
-        encryption_iv: 'dummy-iv',
-        file_path: '/tmp/evidence-file',
-      }],
-    ])
+      [
+        {
+          id: 9,
+          file_name: "proof.pdf",
+          file_type: "application/pdf",
+          mime_type: "application/pdf",
+          encryption_iv: "dummy-iv",
+          file_path: "/tmp/evidence-file",
+        },
+      ],
+    ]);
 
     const response = await downloadEvidence(
-      makeGetRequest('http://localhost/api/disputes/42/evidence/9?preview=0'),
-      makeContext('42', '9'),
-    )
-
-    expect(response.status).toBe(200)
-    expect(response.headers.get('Content-Type')).toBe('application/pdf')
-    expect(response.headers.get('Content-Disposition')).toBe('attachment; filename="proof.pdf"')
-  })
-})
+      makeGetRequest("http://localhost/api/disputes/42/evidence/9?preview=0"),
+      makeContext("42", "9"),
+    );
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("Content-Type")).toBe("application/pdf");
+    expect(response.headers.get("Content-Disposition")).toBe(
+      'attachment; filename="proof.pdf"',
+    );
+  });
+});
+
+describe("DELETE /api/disputes/[id]/evidence/[evidenceId]", () => {
+  it("allows authorized participants to remove evidence records", async () => {
+    queueSql([
+      [{ id: 1, role: "client" }],
+      [{ id: 42, client_id: 1, freelancer_id: 2 }],
+      [
+        {
+          id: 9,
+          file_path: "/tmp/evidence-file",
+          dispute_id: 42,
+          uploaded_by: 1,
+          file_name: "proof.pdf",
+        },
+      ],
+      [{ id: 9 }],
+      [],
+    ]);
+
+    const { DELETE } =
+      await import("@/app/api/disputes/[id]/evidence/[evidenceId]/route");
+    const response = await DELETE(
+      makeGetRequest("http://localhost/api/disputes/42/evidence/9"),
+      makeContext("42", "9"),
+    );
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.success).toBe(true);
+  });
+});
diff --git a/app/api/disputes/[id]/evidence/[evidenceId]/route.ts b/app/api/disputes/[id]/evidence/[evidenceId]/route.ts
index 510d46f..f5de79c 100644
--- a/app/api/disputes/[id]/evidence/[evidenceId]/route.ts
+++ b/app/api/disputes/[id]/evidence/[evidenceId]/route.ts
@@ -1,12 +1,21 @@
-export const dynamic = 'force-dynamic'
+export const dynamic = "force-dynamic";
 
-import { NextRequest } from 'next/server'
-import { withAuthCtx } from '@/lib/auth/middleware'
-import { downloadEvidence } from '../route'
+import { NextRequest } from "next/server";
+import { withAuthCtx } from "@/lib/auth/middleware";
+import { deleteEvidence, downloadEvidence } from "../route";
 
-type RouteContext = { params: Promise<{ id: string; evidenceId: string }> }
+type RouteContext = { params: Promise<{ id: string; evidenceId: string }> };
 
-export const GET = withAuthCtx(async (request: NextRequest, auth, context: RouteContext) => {
-  const { id, evidenceId } = await context.params
-  return downloadEvidence(request, auth, id, evidenceId)
-})
+export const GET = withAuthCtx(
+  async (request: NextRequest, auth, context: RouteContext) => {
+    const { id, evidenceId } = await context.params;
+    return downloadEvidence(request, auth, id, evidenceId);
+  },
+);
+
+export const DELETE = withAuthCtx(
+  async (request: NextRequest, auth, context: RouteContext) => {
+    const { id, evidenceId } = await context.params;
+    return deleteEvidence(request, auth, id, evidenceId);
+  },
+);
diff --git a/app/api/disputes/[id]/evidence/route.ts b/app/api/disputes/[id]/evidence/route.ts
index 6149ab0..2453ce7 100644
--- a/app/api/disputes/[id]/evidence/route.ts
+++ b/app/api/disputes/[id]/evidence/route.ts
@@ -1,44 +1,56 @@
-export const dynamic = 'force-dynamic'
+export const dynamic = "force-dynamic";
 
-import { randomUUID } from 'crypto'
-import { NextRequest, NextResponse } from 'next/server'
-import { sql } from '@/lib/db'
-import { withAuthCtx } from '@/lib/auth/middleware'
+import { randomUUID } from "crypto";
+import { NextRequest, NextResponse } from "next/server";
+import { sql } from "@/lib/db";
+import { withAuthCtx } from "@/lib/auth/middleware";
 import {
   ALLOWED_DISPUTE_EVIDENCE_MIME_TYPES,
   MAX_DISPUTE_EVIDENCE_FILE_SIZE,
   MAX_DISPUTE_EVIDENCE_FILES_PER_BATCH,
-} from '@/lib/validations'
+} from "@/lib/validations";
 import {
   computeFileHash,
   readEncryptedFile,
+  removeEncryptedFile,
   storeEncryptedFile,
-} from '@/lib/security/fileEncryption'
-
-type RouteContext = { params: Promise<{ id: string }> }
-type AuthLike = { walletAddress: string }
-type UserRow = { id: string | number; role: string }
-type DisputeAccessRow = { id: string | number; client_id: string | number; freelancer_id: string | number | null }
+} from "@/lib/security/fileEncryption";
+
+type RouteContext = { params: Promise<{ id: string }> };
+type AuthLike = { walletAddress: string };
+type UserRow = { id: string | number; role: string };
+type DisputeAccessRow = {
+  id: string | number;
+  client_id: string | number;
+  freelancer_id: string | number | null;
+};
 type EvidenceRow = {
-  id: string | number
-  file_url: string
-  file_name: string
-  file_type?: string | null
-  mime_type?: string | null
-  encryption_iv?: string | null
-  file_path?: string | null
-}
+  id: string | number;
+  file_url: string;
+  file_name: string;
+  file_type?: string | null;
+  mime_type?: string | null;
+  encryption_iv?: string | null;
+  file_path?: string | null;
+};
 type DisputeAccess = {
-  user: UserRow
-  dispute: DisputeAccessRow
-}
-
-async function getDisputeAccess(disputeId: string, walletAddress: string): Promise<DisputeAccess | NextResponse> {
+  user: UserRow;
+  dispute: DisputeAccessRow;
+};
+
+async function getDisputeAccess(
+  disputeId: string,
+  walletAddress: string,
+): Promise<DisputeAccess | NextResponse> {
   const users = (await sql`
     SELECT id, role FROM users WHERE wallet_address = ${walletAddress} LIMIT 1
-  `) as UserRow[]
-  const user = users[0]
-  if (!user) return NextResponse.json({ error: 'User not found', code: 'USER_NOT_FOUND' }, { status: 404 })
+  `) as UserRow[];
+  const user = users[0];
+  if (!user)
+    return NextResponse.json(
+      { error: "User not found", code: "USER_NOT_FOUND" },
+      { status: 404 },
+    );
 
   const disputes = (await sql`
     SELECT d.id, j.client_id, j.freelancer_id
@@ -46,53 +58,117 @@ async function getDisputeAccess(disputeId: string, walletAddress: string): Promi
     JOIN jobs j ON d.job_id = j.id
     WHERE d.id = ${disputeId}
     LIMIT 1
-  `) as DisputeAccessRow[]
-  const dispute = disputes[0]
-  if (!dispute) return NextResponse.json({ error: 'Dispute not found', code: 'DISPUTE_NOT_FOUND' }, { status: 404 })
-
-  const userId = String(user.id)
-  const isParticipant = String(dispute.client_id) === userId || String(dispute.freelancer_id) === userId
-  if (user.role !== 'admin' && !isParticipant) {
-    return NextResponse.json({ error: 'Access denied', code: 'FORBIDDEN' }, { status: 403 })
+  `) as DisputeAccessRow[];
+  const dispute = disputes[0];
+  if (!dispute)
+    return NextResponse.json(
+      { error: "Dispute not found", code: "DISPUTE_NOT_FOUND" },
+      { status: 404 },
+    );
+
+  const userId = String(user.id);
+  const isParticipant =
+    String(dispute.client_id) === userId ||
+    String(dispute.freelancer_id) === userId;
+  if (user.role !== "admin" && !isParticipant) {
+    return NextResponse.json(
+      { error: "Access denied", code: "FORBIDDEN" },
+      { status: 403 },
+    );
   }
 
-  return { user, dispute }
+  return { user, dispute };
 }
 
-function isAccessResponse(value: DisputeAccess | NextResponse): value is NextResponse {
-  return value instanceof NextResponse
+function isAccessResponse(
+  value: DisputeAccess | NextResponse,
+): value is NextResponse {
+  return value instanceof NextResponse;
 }
 
 function validateEvidenceFiles(files: File[]) {
-  const errors: { filename: string; reason: string }[] = []
+  const errors: { filename: string; reason: string }[] = [];
 
   for (const file of files) {
     if (!file.size || file.size <= 0) {
-      errors.push({ filename: file.name, reason: 'File is empty' })
-      continue
+      errors.push({ filename: file.name, reason: "File is empty" });
+      continue;
     }
     if (file.size > MAX_DISPUTE_EVIDENCE_FILE_SIZE) {
       errors.push({
         filename: file.name,
         reason: `File exceeds ${MAX_DISPUTE_EVIDENCE_FILE_SIZE / (1024 * 1024)} MB limit`,
-      })
-      continue
+      });
+      continue;
     }
-    if (!ALLOWED_DISPUTE_EVIDENCE_MIME_TYPES.includes(file.type as typeof ALLOWED_DISPUTE_EVIDENCE_MIME_TYPES[number])) {
-      errors.push({ filename: file.name, reason: `File type "${file.type || 'unknown'}" is not allowed` })
+    if (
+      !ALLOWED_DISPUTE_EVIDENCE_MIME_TYPES.includes(
+        file.type as (typeof ALLOWED_DISPUTE_EVIDENCE_MIME_TYPES)[number],
+      )
+    ) {
+      errors.push({
+        filename: file.name,
+        reason: `File type "${file.type || "unknown"}" is not allowed`,
+      });
     }
   }
 
-  return errors
+  return errors;
 }
 
-export const GET = withAuthCtx(async (_request: NextRequest, auth, context: RouteContext) => {
-  const { id } = await context.params
+function parseEvidencePagination(searchParams: URLSearchParams) {
+  const rawLimit = Number(searchParams.get("limit") ?? "20");
+  const rawOffset = Number(searchParams.get("offset") ?? "0");
+  const limit =
+    Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, 100) : 20;
+  const offset = Number.isFinite(rawOffset) && rawOffset >= 0 ? rawOffset : 0;
+
+  return { limit, offset };
+}
+
+async function logEvidenceAction(
+  action: "evidence_upload" | "evidence_view" | "evidence_delete",
+  userId: string | number,
+  disputeId: string,
+  details: Record<string, unknown> = {},
+  evidenceId?: string | number,
+) {
   try {
-    const access = await getDisputeAccess(id, auth.walletAddress)
-    if (isAccessResponse(access)) return access
+    await sql`
+      INSERT INTO admin_audit_logs (admin_user_id, action, target_type, target_id, details)
+      VALUES (
+        ${userId},
+        ${action},
+        ${"dispute_evidence"},
+        ${evidenceId ? String(evidenceId) : disputeId},
+        ${JSON.stringify({ dispute_id: disputeId, ...details })}
+      )
+    `;
+  } catch {
+    // best-effort audit logging; the evidence operation should still succeed if logging is unavailable
+  }
+}
+
+export const GET = withAuthCtx(
+  async (request: NextRequest, auth, context: RouteContext) => {
+    const { id } = await context.params;
+    try {
+      const access = await getDisputeAccess(id, auth.walletAddress);
+      if (isAccessResponse(access)) return access;
+
+      const { limit, offset } = parseEvidencePagination(
+        request.nextUrl.searchParams,
+      );
+
+      const totalRows = ((await sql`
+      SELECT COUNT(*)::int AS total
+      FROM dispute_evidence
+      WHERE dispute_id = ${id} AND COALESCE(is_removed, FALSE) = FALSE
+    `) ?? []) as Array<{ total: number }>;
+      const total = totalRows[0]?.total ?? 0;
 
-    const evidence = await sql`
+      const evidenceRows =
+        (await sql`
       SELECT de.id, de.dispute_id, de.file_url, de.file_name, de.file_type,
              de.uploaded_by, de.description, de.created_at,
              de.mime_type, de.file_size, de.file_hash, u.username as uploaded_by_username
@@ -100,138 +176,302 @@ export const GET = withAuthCtx(async (_request: NextRequest, auth, context: Rout
       JOIN users u ON u.id = de.uploaded_by
       WHERE de.dispute_id = ${id} AND COALESCE(de.is_removed, FALSE) = FALSE
       ORDER BY de.created_at ASC
-    `
-
-    return NextResponse.json({ evidence }, { status: 200 })
-  } catch {
-    return NextResponse.json({ error: 'Failed to load evidence', code: 'EVIDENCE_LIST_FAILED' }, { status: 500 })
-  }
-})
-
-export const POST = withAuthCtx(async (request: NextRequest, auth, context: RouteContext) => {
-  const { id } = await context.params
-
-  let formData: FormData
-  try {
-    formData = await request.formData()
-  } catch {
-    return NextResponse.json(
-      { error: 'Request body must be multipart/form-data', code: 'INVALID_FORM_DATA' },
-      { status: 400 },
-    )
-  }
+      LIMIT ${limit} OFFSET ${offset}
+    `) ?? [];
+
+      const evidence = Array.isArray(evidenceRows) ? evidenceRows : [];
+
+      await logEvidenceAction(
+        "evidence_view",
+        access.user.id,
+        id,
+        { limit, offset, total, requested_by: access.user.role },
+        undefined,
+      );
+
+      return NextResponse.json(
+        {
+          evidence,
+          pagination: {
+            limit,
+            offset,
+            total,
+            nextOffset:
+              offset + evidence.length < total
+                ? offset + evidence.length
+                : null,
+            hasMore: offset + evidence.length < total,
+          },
+        },
+        { status: 200 },
+      );
+    } catch {
+      return NextResponse.json(
+        { error: "Failed to load evidence", code: "EVIDENCE_LIST_FAILED" },
+        { status: 500 },
+      );
+    }
+  },
+);
+
+export const POST = withAuthCtx(
+  async (request: NextRequest, auth, context: RouteContext) => {
+    const { id } = await context.params;
+
+    let formData: FormData;
+    try {
+      formData = await request.formData();
+    } catch {
+      return NextResponse.json(
+        {
+          error: "Request body must be multipart/form-data",
+          code: "INVALID_FORM_DATA",
+        },
+        { status: 400 },
+      );
+    }
 
-  const files = Array.from(formData.entries())
-    .filter((entry): entry is [string, File] => entry[1] instanceof File)
-    .map(([, file]) => file)
+    const files = Array.from(formData.entries())
+      .filter((entry): entry is [string, File] => entry[1] instanceof File)
+      .map(([, file]) => file);
 
-  const description = String(formData.get('description') ?? '').trim()
+    const description = String(formData.get("description") ?? "").trim();
 
-  if (files.length === 0 && description.length === 0) {
-    return NextResponse.json(
-      { error: 'Attach at least one evidence file or add a description', code: 'NO_EVIDENCE' },
-      { status: 400 },
-    )
-  }
+    if (files.length === 0 && description.length === 0) {
+      return NextResponse.json(
+        {
+          error: "Attach at least one evidence file or add a description",
+          code: "NO_EVIDENCE",
+        },
+        { status: 400 },
+      );
+    }
 
-  if (files.length > MAX_DISPUTE_EVIDENCE_FILES_PER_BATCH) {
-    return NextResponse.json(
-      {
-        error: `Cannot upload more than ${MAX_DISPUTE_EVIDENCE_FILES_PER_BATCH} files at once`,
-        code: 'TOO_MANY_FILES',
-      },
-      { status: 422 },
-    )
-  }
+    if (files.length > MAX_DISPUTE_EVIDENCE_FILES_PER_BATCH) {
+      return NextResponse.json(
+        {
+          error: `Cannot upload more than ${MAX_DISPUTE_EVIDENCE_FILES_PER_BATCH} files at once`,
+          code: "TOO_MANY_FILES",
+        },
+        { status: 422 },
+      );
+    }
 
-  const validationErrors = validateEvidenceFiles(files)
-  if (validationErrors.length > 0) {
-    return NextResponse.json(
-      { error: 'Some files failed validation', code: 'VALIDATION_ERRORS', details: validationErrors },
-      { status: 422 },
-    )
-  }
+    const validationErrors = validateEvidenceFiles(files);
+    if (validationErrors.length > 0) {
+      return NextResponse.json(
+        {
+          error: "Some files failed validation",
+          code: "VALIDATION_ERRORS",
+          details: validationErrors,
+        },
+        { status: 422 },
+      );
+    }
 
-  try {
-    const access = await getDisputeAccess(id, auth.walletAddress)
-    if (isAccessResponse(access)) return access
+    try {
+      const access = await getDisputeAccess(id, auth.walletAddress);
+      if (isAccessResponse(access)) return access;
 
-    const inserted = []
+      const inserted = [];
 
-    if (files.length === 0) {
-      const rows = (await sql`
+      if (files.length === 0) {
+        const rows = (await sql`
         INSERT INTO dispute_evidence (dispute_id, file_url, file_name, file_type, uploaded_by, description)
-        VALUES (${id}, ${'note-only'}, ${'Evidence note'}, ${'note'}, ${access.user.id}, ${description})
+        VALUES (${id}, ${"note-only"}, ${"Evidence note"}, ${"note"}, ${access.user.id}, ${description})
         RETURNING id, dispute_id, file_url, file_name, file_type, uploaded_by, description,
                   created_at, mime_type, file_size, file_hash
-      `) as EvidenceRow[]
-      const evidence = rows[0]
-      inserted.push(evidence)
-    }
-
-    for (const file of files) {
-      const buffer = Buffer.from(await file.arrayBuffer())
-      const fileHash = computeFileHash(buffer)
-      const ext = file.name.split('.').pop()?.toLowerCase() || 'bin'
-      const storedFilename = `${randomUUID()}.${ext}`
-      const { iv, filePath } = await storeEncryptedFile(buffer, storedFilename)
-
-      const rows = (await sql`
+      `) as EvidenceRow[];
+        const evidence = rows[0];
+        inserted.push(evidence);
+      }
+
+      for (const file of files) {
+        const buffer = Buffer.from(await file.arrayBuffer());
+        const fileHash = computeFileHash(buffer);
+        const ext = file.name.split(".").pop()?.toLowerCase() || "bin";
+        const storedFilename = `${randomUUID()}.${ext}`;
+        const { iv, filePath } = await storeEncryptedFile(
+          buffer,
+          storedFilename,
+        );
+
+        const rows = (await sql`
         INSERT INTO dispute_evidence
           (dispute_id, file_url, file_name, file_type, uploaded_by, description,
            stored_filename, mime_type, file_size, file_hash, encryption_iv, file_path)
         VALUES
-          (${id}, ${`dispute-evidence://${storedFilename}`}, ${file.name}, ${file.type || 'application/octet-stream'},
-           ${access.user.id}, ${description || null}, ${storedFilename}, ${file.type || 'application/octet-stream'},
+          (${id}, ${`dispute-evidence://${storedFilename}`}, ${file.name}, ${file.type || "application/octet-stream"},
+           ${access.user.id}, ${description || null}, ${storedFilename}, ${file.type || "application/octet-stream"},
            ${file.size}, ${fileHash}, ${iv}, ${filePath})
         RETURNING id, dispute_id, file_url, file_name, file_type, uploaded_by, description,
                   created_at, mime_type, file_size, file_hash
-      `) as EvidenceRow[]
-      const evidence = rows[0]
-      inserted.push(evidence)
+      `) as EvidenceRow[];
+        const evidence = rows[0];
+        inserted.push(evidence);
+      }
+
+      await sql`UPDATE disputes SET status = 'under_review', updated_at = CURRENT_TIMESTAMP WHERE id = ${id} AND status = 'open'`;
+
+      for (const evidence of inserted) {
+        await logEvidenceAction(
+          "evidence_upload",
+          access.user.id,
+          id,
+          {
+            evidence_id: String(evidence.id),
+            file_name: evidence.file_name,
+            description: evidence.description ?? null,
+            file_hash: evidence.file_hash ?? null,
+          },
+          evidence.id,
+        );
+      }
+
+      return NextResponse.json({ evidence: inserted }, { status: 201 });
+    } catch {
+      return NextResponse.json(
+        { error: "Failed to submit evidence", code: "EVIDENCE_UPLOAD_FAILED" },
+        { status: 500 },
+      );
     }
-
-    await sql`UPDATE disputes SET status = 'under_review', updated_at = CURRENT_TIMESTAMP WHERE id = ${id} AND status = 'open'`
-
-    return NextResponse.json({ evidence: inserted }, { status: 201 })
-  } catch {
-    return NextResponse.json({ error: 'Failed to submit evidence', code: 'EVIDENCE_UPLOAD_FAILED' }, { status: 500 })
-  }
-})
-
-export async function downloadEvidence(request: NextRequest, auth: AuthLike, disputeId: string, evidenceId: string) {
+  },
+);
+
+export async function downloadEvidence(
+  request: NextRequest,
+  auth: AuthLike,
+  disputeId: string,
+  evidenceId: string,
+) {
   try {
-    const access = await getDisputeAccess(disputeId, auth.walletAddress)
-    if (isAccessResponse(access)) return access
+    const access = await getDisputeAccess(disputeId, auth.walletAddress);
+    if (isAccessResponse(access)) return access;
 
     const rows = (await sql`
       SELECT id, file_url, file_name, file_type, mime_type, encryption_iv, file_path
       FROM dispute_evidence
       WHERE id = ${evidenceId} AND dispute_id = ${disputeId} AND COALESCE(is_removed, FALSE) = FALSE
       LIMIT 1
-    `) as EvidenceRow[]
-    const evidence = rows[0]
-    if (!evidence) return NextResponse.json({ error: 'Evidence not found', code: 'EVIDENCE_NOT_FOUND' }, { status: 404 })
+    `) as EvidenceRow[];
+    const evidence = rows[0];
+    if (!evidence)
+      return NextResponse.json(
+        { error: "Evidence not found", code: "EVIDENCE_NOT_FOUND" },
+        { status: 404 },
+      );
+
+    await logEvidenceAction(
+      "evidence_view",
+      access.user.id,
+      disputeId,
+      { evidence_id: evidenceId, file_name: evidence.file_name },
+      evidence.id,
+    );
 
     if (!evidence.file_path || !evidence.encryption_iv) {
-      return NextResponse.redirect(new URL(evidence.file_url, request.url))
+      return NextResponse.redirect(new URL(evidence.file_url, request.url));
     }
 
-    const plaintext = await readEncryptedFile(evidence.file_path, evidence.encryption_iv)
+    const plaintext = await readEncryptedFile(
+      evidence.file_path,
+      evidence.encryption_iv,
+    );
 
-    const preview = request.nextUrl.searchParams.get('preview') === '1'
-    const disposition = preview ? 'inline' : 'attachment'
+    const preview = request.nextUrl.searchParams.get("preview") === "1";
+    const disposition = preview ? "inline" : "attachment";
 
     return new NextResponse(new Uint8Array(plaintext), {
       status: 200,
       headers: {
-        'Content-Type': evidence.mime_type || evidence.file_type || 'application/octet-stream',
-        'Content-Disposition': `${disposition}; filename="${evidence.file_name}"`,
-        'Content-Length': String(plaintext.length),
-        'Cache-Control': 'private, no-store',
+        "Content-Type":
+          evidence.mime_type ||
+          evidence.file_type ||
+          "application/octet-stream",
+        "Content-Disposition": `${disposition}; filename="${evidence.file_name}"`,
+        "Content-Length": String(plaintext.length),
+        "Cache-Control": "private, no-store",
       },
-    })
+    });
+  } catch {
+    return NextResponse.json(
+      {
+        error: "Failed to download evidence",
+        code: "EVIDENCE_DOWNLOAD_FAILED",
+      },
+      { status: 500 },
+    );
+  }
+}
+
+export async function deleteEvidence(
+  request: NextRequest,
+  auth: AuthLike,
+  disputeId: string,
+  evidenceId: string,
+) {
+  try {
+    const access = await getDisputeAccess(disputeId, auth.walletAddress);
+    if (isAccessResponse(access)) return access;
+
+    const rows = (await sql`
+      SELECT id, dispute_id, file_path, uploaded_by, file_name
+      FROM dispute_evidence
+      WHERE id = ${evidenceId} AND dispute_id = ${disputeId} AND COALESCE(is_removed, FALSE) = FALSE
+      LIMIT 1
+    `) as Array<{
+      id: string | number;
+      dispute_id: string | number;
+      file_path?: string | null;
+      uploaded_by: string | number;
+      file_name: string;
+    }>;
+    const evidence = rows[0];
+    if (!evidence) {
+      return NextResponse.json(
+        { error: "Evidence not found", code: "EVIDENCE_NOT_FOUND" },
+        { status: 404 },
+      );
+    }
+
+    const userId = String(access.user.id);
+    const isUploader = String(evidence.uploaded_by) === userId;
+    const isParticipant =
+      String(access.dispute.client_id) === userId ||
+      String(access.dispute.freelancer_id) === userId;
+    if (access.user.role !== "admin" && !isUploader && !isParticipant) {
+      return NextResponse.json(
+        { error: "Access denied", code: "FORBIDDEN" },
+        { status: 403 },
+      );
+    }
+
+    await sql`
+      UPDATE dispute_evidence
+      SET is_removed = TRUE
+      WHERE id = ${evidenceId} AND dispute_id = ${disputeId}
+    `;
+
+    if (evidence.file_path && typeof removeEncryptedFile === "function") {
+      await removeEncryptedFile(evidence.file_path);
+    }
+
+    await logEvidenceAction(
+      "evidence_delete",
+      access.user.id,
+      disputeId,
+      { evidence_id: evidenceId, file_name: evidence.file_name },
+      evidence.id,
+    );
+
+    return NextResponse.json(
+      { success: true, evidenceId: evidence.id },
+      { status: 200 },
+    );
   } catch {
-    return NextResponse.json({ error: 'Failed to download evidence', code: 'EVIDENCE_DOWNLOAD_FAILED' }, { status: 500 })
+    return NextResponse.json(
+      { error: "Failed to remove evidence", code: "EVIDENCE_DELETE_FAILED" },
+      { status: 500 },
+    );
   }
 }