优化

.dockerignore

@@ -3,6 +3,8 @@
 dist
 node_modules
 node_modules.broken-by-path
-.env.local
+.env
+.env.*
+!.env.example
 npm-debug.log*
 pnpm-debug.log*

.env.example

@@ -1,10 +1,13 @@
 VITE_API_BASE_URL=/api
-# 按本机联调环境填写国内 Gateway origin，不提交真实环境地址。
+# 按本机联调环境填写统一 Gateway origin，不提交真实环境地址。
 API_PROXY_TARGET=http://localhost:9000
-# 可选：本地分别直连 Auth、IAM、Warehouse；未设置时复用 API_PROXY_TARGET。
-# AUTH_API_PROXY_TARGET=http://localhost:9001
-# IAM_API_PROXY_TARGET=http://localhost:9002
-# WAREHOUSE_API_PROXY_TARGET=http://localhost:9003
-# 按本机联调环境填写海外 Gateway origin，不提交真实环境地址。
 # Local Vite fallback. Container deployments should use CLIENT_WEB_URL instead.
 VITE_CLIENT_WEB_URL=http://localhost:5174
+
+# Test container deployment (Jenkins environment or untracked .env).
+# API_UPSTREAM: unified Gateway origin, no /api suffix.
+# TEST_NETWORK: shared test Docker network.
+API_UPSTREAM=http://gateway:9000
+TEST_NETWORK=firstleg-test-network
+IMAGE_TAG=
+CLIENT_WEB_URL=

AGENTS.md

@@ -6,7 +6,7 @@
 2. 视觉还原、布局/交互承载方式变更或真实页面验收时读取 `../../docs/Admin-Client前端原型还原验收规则.md`；需要原型依据才读取 `../../docs/悦/货代SAAS平台后台/AGENTS.md` 并定位目标片段。纯文案、逻辑或单元测试任务不自动读取。
    Admin 样式优化还须读取 `../../docs/Admin高密度界面规范.md` 的“样式维护边界”和“新模块接入规则”；以已确认密度与彩色页签为视觉基线，逐操作保留业务语义和承载方式。国内仓、客户管理是样板；新增菜单按本轮范围显式接入，货柜管理入口见 `../../docs/Admin货柜管理样式核对记录.md`。
 3. 标准列表或公共组件任务读取 `src/shared/components/AGENTS.md`；国内/海外 HTTP、Token 或刷新任务读取 `src/shared/api/AGENTS.md`；Finance 任务读取 `src/modules/finance/AGENTS.md`；海外仓全流程任务先读 `../../docs/海外仓业务/README.md`。
-4. 平台/客户层级与权限公共语义读取 `../../docs/平台客户层级与权限契约.md`；双区域 API、海外 Token 和跨区事件读取 `../../docs/跨区域认证与服务通信契约.md`。
+4. 平台/客户层级与权限公共语义读取 `../../docs/平台客户层级与权限契约.md`；双区域 API、海外 Token 和跨区事件读取 `../../docs/统一认证与服务通信契约.md`。
 
 普通单端任务的最小读取集是本文件、目标模块最近的 `AGENTS.md` 和目标代码命中段；只有跨服务状态、权限或接口边界无法判断时才增加后端契约。累计超过约 250 行时改用定向检索，不全文加载无关专题。
 
@@ -31,8 +31,8 @@
 
 - 依赖方向为 `app → modules/core/shared`、`modules → core/shared`、`core → shared`、`shared → 无上层依赖`。模块间只通过对方公开入口或契约协作，不引用其他模块的页面和内部目录。
 - 路由级页面放 `modules/*/pages/`，模块路由放 `modules/*/routes.ts` 并由 `app/router/index.ts` 装配；新增模块同步维护 `core/navigation/adminNavigation.ts`。
-- 领域接口放 `modules/*/api/`；国内、海外公共客户端分别为 `shared/api/http.ts`、`shared/api/overseasHttp.ts`，具体 Token 与刷新规则见 `shared/api/AGENTS.md`。
-- `VITE_API_BASE_URL`、`VITE_OVERSEAS_API_BASE_URL` 分别控制国内、海外浏览器前缀；开发代理上游只由 Vite 读取。环境变量变化同步 `.env.example`，不提交真实地址或凭据。
+- 领域接口放 `modules/*/api/`；全部业务共用 `shared/api/http.ts`，具体 Token 与刷新规则见 `shared/api/AGENTS.md`。
+- `VITE_API_BASE_URL` 控制唯一浏览器前缀；`API_PROXY_TARGET` 由 Vite 读取并指向统一 Gateway。环境变量变化同步 `.env.example`，不提交真实地址或凭据。
 
 ## 模块快速路由
 
@@ -40,7 +40,7 @@
 
 | 业务 | Admin 入口 | 联查 |
 |---|---|---|
-| 登录、会话与双区域 Token | `modules/auth/`、`core/auth/` | 国内 `auth/`、`iam/`；海外请求客户端再读 `shared/api/AGENTS.md` |
+| 登录、会话与统一 Token | `modules/auth/`、`core/auth/` | 国内 `auth/`、`iam/`；海外请求客户端再读 `shared/api/AGENTS.md` |
 | 启动与懒加载资源恢复 | `main.ts`、`core/routing/navigationRecovery.ts` | 仅识别动态模块/Chunk 资源过期；30 秒内同目标最多自动恢复一次，存在未保存编辑时必须先确认 |
 | 工作台与指标 | `modules/dashboard/` | 指标所属模块与服务端，不复制领域契约 |
 | 船期日历 | `modules/sailing-calendar/` | 当前日历入口覆盖渠道、周模板、单次船期、收货截止时间和按渠道货量统计；后端按 `firstleg/` 船期接口定位，不读取已归档的货柜开发规划 |
@@ -68,8 +68,8 @@
 | 目的港码头拖车与还空预警 | 海外清关提柜工作台/详情 `modules/container-loading/pages/OverseasContainersView.vue`、`OverseasContainerDetailView.vue`，API `modules/container-loading/api/terminalDrayages.ts`、`containerArrivalTimes.ts` | 与订舱级拖车预约是不同生命周期；按 `containerBookingId` 读取服务端状态、`allowedActions` 和历史，不能复用订舱级拖车表单或自行推进状态。列表“预计到仓”列直接提供人工日期时间选择器，保存时通过 Lastleg 柜级版本和幂等键原子更新该柜全部尾程订单，已有入库计划后禁止修改；“实际到仓”只读 `ll_receiving_container_session.receiving_at`，即海外 PDA 首次开始收货时间。还空截止、超时天/小时只展示服务端基于权威卸柜完成时间加 72 小时计算的结果；Backend `firstleg/terminaldrayage/`、`lastleg-service/`，邮件记录通过 `terminalDrayages.ts` 查询与重试。 |
 | 历史报关协同与国内出仓 | `modules/customs/`、`modules/outbound-dispatch/` | `modules/customs/` 是历史报关案件/清单/代理提交与回执入口；装柜完成后的整柜退税/买单资料从货柜详情进入，不在旧模块复制；Backend `firstleg/outbound/dispatch/`、`firstleg/customs/`、`file/` |
 | 主数据、下载、退避任务重试、审计 | `modules/master-data/`、`modules/downloads/pages/DownloadCenterView.vue`、`modules/audit/` | File 导出任务返回 `attemptCount/maxAttempts/nextRetryAt`；仅失败或已进入自动退避的等待任务显示重试，等待任务重试用于立即执行当前投递，不创建新任务；联查 `warehouse/`、`file/`、`audit-service/` |
-| 海外接柜、入库、库存与库内服务 | `modules/overseas-warehouse/` | `gateway-overseas/`、`lastleg-service/`、`warehouse-overseas-service/`；与排车、出库、派送、异常退回和一件代发共同组成海外仓全流程 |
-| 海外采购、卡车、散板 | `modules/overseas-business/` | `gateway-overseas/`、`lastleg-service/` |
+| 海外接柜、入库、库存与库内服务 | `modules/overseas-warehouse/` | `gateway/`、`lastleg-service/`、`warehouse-overseas-service/`；与排车、出库、派送、异常退回和一件代发共同组成海外仓全流程 |
+| 海外采购、卡车、散板 | `modules/overseas-business/` | `gateway/`、`lastleg-service/` |
 | 海外仓业务合作仓与通用资料 | 合作仓 `modules/warehouses/`；报价/汇率/车辆 `modules/overseas-master-data/` | 国内 `warehouse/`、海外实际资源与服务 |
 | 海外仓业务国内出仓后船节点 | `modules/port-schedules/`、`modules/ocean-bookings/`、货柜详情 | `firstleg/portschedule/`、`integration-service/`；预计节点只展示不推进实际进度，手工实际节点必须严格向后追加并防重复，十节点标准见 `../../docs/海外仓业务/船节点标准化契约.md` |
 | 海外排车、出库与派送 | `modules/overseas-warehouse/AGENTS.md` | 按模块表定位排车、出库、派送页面及 API；履约边界在模块内维护 |
@@ -98,7 +98,7 @@
 - 国内出仓以真实货柜为原子边界：货柜详情只在装柜完成、全部入仓绑定门禁通过且有写权限时显示确认离仓；成功后由服务端同事务推进全部技术行并幂等创建船节点查询。前端不得逐入仓确认、把拖车状态当阻断门禁或重复追加实际船节点。
 - `core/navigation/adminNavigation.ts`、`app/router/index.ts` 和模块 `routes.ts` 是共享装配文件；并行任务不得覆盖总控已确认语义，重叠时保留现有改动并回传总控。
 - `core/routing/navigationRecovery.ts` 只处理已识别的动态 import/Chunk 资源过期；普通路由错误直接提示。自动恢复前保护未保存表单，同一目标 30 秒内不得重复刷新或形成重载循环。
-- 认证统一经过 `core/auth/auth.ts`、`shared/api/http.ts` 和 `shared/api/overseasHttp.ts`。登录/刷新原子替换国内、海外 Token，海外 401 统一刷新并最多重放一次；页面不读写 Token 或手工拼 `Authorization`。
+- 认证统一经过 `core/auth/auth.ts` 和 `shared/api/http.ts`。登录/刷新替换统一 Access/Refresh Token，全部 401 共用刷新并最多重放一次；页面不读写 Token 或手工拼 `Authorization`。
 - 接入真实接口时删除对应模拟路径，不允许生产逻辑静默回退假数据。客户专属写操作显式选择客户，长整型 ID 按字符串透传，不从本地存储推断。
 - 订舱代理、拖车承运商和报关代理提交服务端供应商 ID，从公共供应商列表选择 `ACTIVE` 且类别/范围匹配的记录；参数变化同步检查 API、类型、表单、展示、Mock/Fixture、测试和 OpenAPI。
 - 删除、停用、改权限等高风险操作必须有确认、处理中、成功和失败反馈；失败保留用户上下文。日志、提示和示例不得包含真实账号、Token、隐私或生产数据。

Jenkinsfile

@@ -1,252 +1,38 @@
-def sendProductionWeComNotification(String title, String status, String color, String detail) {
-  withCredentials([string(credentialsId: 'wecom-prod-webhook', variable: 'WECOM_WEBHOOK')]) {
-    String sourceVersion = env.SOURCE_TAG ?: env.GIT_COMMIT ?: '未解析'
-    String duration = currentBuild.durationString?.replace(' and counting', '') ?: '—'
-    String content = """## ${title}
-> 应用：管理后台
-> Job：${env.JOB_NAME}
-> 构建：[#${env.BUILD_NUMBER}](${env.BUILD_URL})
-> 提交：${sourceVersion}
-> 状态：<font color="${color}">${status}</font>
-${detail}
-> 耗时：${duration}
-> 时间：${new Date().format('yyyy-MM-dd HH:mm:ss', TimeZone.getTimeZone('Asia/Shanghai'))}
-"""
-    String payloadFile = 'wecom-production-notification.json'
-    writeFile(
-      file: payloadFile,
-      text: groovy.json.JsonOutput.toJson([
-        msgtype: 'markdown',
-        markdown: [content: content]
-      ]),
-      encoding: 'UTF-8'
-    )
-    sh '''
-      set -eu
-      payload_file='wecom-production-notification.json'
-      trap 'rm -f "$payload_file"' EXIT HUP INT TERM
-      response="$(curl --fail --silent --show-error \
-        -H 'Content-Type: application/json' \
-        --data-binary @"$payload_file" \
-        "$WECOM_WEBHOOK")"
-      printf '%s\n' "$response"
-      printf '%s' "$response" | grep -Eq '"errcode"[[:space:]]*:[[:space:]]*0([[:space:]]*[,}])'
-    '''
-  }
-}
-
 pipeline {
-  agent {
-    label "${env.JOB_BASE_NAME?.endsWith('-prod') ? 'java-builder' : (env.JOB_BASE_NAME?.endsWith('-dev') ? 'java-dev' : 'java-test')}"
-  }
-
-  environment {
-    DEVELOPMENT_COMPOSE_FILE = 'docker-compose.development.yml'
-    DEVELOPMENT_COMPOSE_PROJECT = 'admin-web'
-    REGISTRY_HOST = '172.31.198.7:10082'
-    REGISTRY_CREDENTIALS = 'gitea-registry-token'
-    NODE_BASE_IMAGE = '172.31.198.7:10082/java-project/node:22-alpine'
-    NGINX_BASE_IMAGE = '172.31.198.7:10082/java-project/nginx:1.27-alpine'
-    PRODUCTION_IMAGE_REPOSITORY = 'git.buggoglobal.com/html/admin-web'
-  }
-
+  agent { label 'java-test' }
   options {
     timestamps()
     disableConcurrentBuilds()
   }
-
   stages {
-    stage('确认提交版本') {
+    stage('检查测试发布参数') {
       steps {
         script {
-          env.IS_DEVELOPMENT = env.JOB_BASE_NAME?.endsWith('-dev') ? 'true' : 'false'
-          env.IS_PRODUCTION = env.JOB_BASE_NAME?.endsWith('-prod') ? 'true' : 'false'
-          if (env.IS_PRODUCTION == 'true') {
-            sh '''
-              set -eu
-              git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
-              test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" || {
-                echo "生产部署只允许 origin/main 当前提交；请先合并代码到 main" >&2
-                exit 1
-              }
-            '''
+          if (env.JOB_BASE_NAME?.endsWith('-dev') || env.JOB_BASE_NAME?.endsWith('-prod')) {
+            error('当前仅支持 test，请使用测试环境 Job')
           }
-          env.SOURCE_TAG = sh(script: 'git rev-parse --short=12 HEAD', returnStdout: true).trim()
+          env.IMAGE_TAG = sh(script: 'git rev-parse --short=12 HEAD', returnStdout: true).trim()
         }
-        sh 'git log -1 --oneline'
+        sh '''set -eu
+          export API_UPSTREAM="${API_UPSTREAM:-http://gateway:9000}"
+          export TEST_NETWORK="${TEST_NETWORK:-firstleg-test-network}"
+          : "${CLIENT_WEB_URL:?CLIENT_WEB_URL 未设置}"
+          docker network inspect "$TEST_NETWORK" >/dev/null
+          docker compose -f docker-compose.test.yml config --quiet
+        '''
       }
     }
-
     stage('构建并部署测试前端') {
-      when { expression { env.IS_DEVELOPMENT != 'true' && env.IS_PRODUCTION != 'true' } }
       steps {
-        withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
-          sh '''
-            set -eu
-            export DOCKER_CONFIG="${WORKSPACE}@tmp/docker-auth"
-            rm -rf "$DOCKER_CONFIG"
-            mkdir -p "$DOCKER_CONFIG"
-            cleanup_registry() {
-              docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true
-              rm -rf "$DOCKER_CONFIG"
-            }
-            trap cleanup_registry EXIT HUP INT TERM
-            printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "$REGISTRY_HOST"
-            docker compose -f docker-compose.test.yml build --pull=false
-            docker compose -f docker-compose.test.yml up -d --remove-orphans
-          '''
-        }
-      }
-    }
-
-    stage('构建并发布生产镜像') {
-      when { expression { env.IS_PRODUCTION == 'true' } }
-      steps {
-        withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
-          sh '''
-            set -eu
-            export DOCKER_CONFIG="${WORKSPACE}@tmp/docker-auth"
-            rm -rf "$DOCKER_CONFIG"
-            mkdir -p "$DOCKER_CONFIG"
-            cleanup_registry() {
-              docker logout git.buggoglobal.com >/dev/null 2>&1 || true
-              rm -rf "$DOCKER_CONFIG"
-            }
-            trap cleanup_registry EXIT HUP INT TERM
-            printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin git.buggoglobal.com
-            image="$PRODUCTION_IMAGE_REPOSITORY:$SOURCE_TAG"
-            docker build \
-              --build-arg NODE_IMAGE="$NODE_BASE_IMAGE" \
-              --build-arg NGINX_IMAGE="$NGINX_BASE_IMAGE" \
-              --build-arg VITE_CLIENT_WEB_URL=https://app.buggoglobal.com/ \
-              -t "$image" .
-            docker push "$image"
-          '''
-        }
-      }
-    }
-
-    stage('部署生产前端') {
-      when { expression { env.IS_PRODUCTION == 'true' } }
-      steps {
-        lock(resource: 'firstleg-production-admin-web-deploy', inversePrecedence: true) {
-          withCredentials([
-            usernamePassword(credentialsId: 'gitea-production-pull-token', usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD'),
-            sshUserPrivateKey(credentialsId: 'firstleg-production-ssh', keyFileVariable: 'TARGET_SSH_KEY', usernameVariable: 'TARGET_SSH_USER'),
-            string(credentialsId: 'firstleg-production-host', variable: 'TARGET_SSH_HOST'),
-            file(credentialsId: 'firstleg-production-known-hosts', variable: 'TARGET_SSH_KNOWN_HOSTS')
-          ]) {
-            withEnv([
-              'TARGET_DEPLOY_DIR=/data/firstleg/deploy/frontend',
-              'TARGET_SSH_TARGET=' + env.TARGET_SSH_USER + '@' + env.TARGET_SSH_HOST
-            ]) {
-              sh "sh scripts/deploy-production.sh admin-web '${env.PRODUCTION_IMAGE_REPOSITORY}' '${env.SOURCE_TAG}' docker-compose.production.yml"
-            }
-          }
-        }
-      }
-    }
-
-    stage('构建并部署开发前端') {
-      when { expression { env.IS_DEVELOPMENT == 'true' } }
-      steps {
-        withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
-          sh '''
-            set -eu
-            export DOCKER_CONFIG="${WORKSPACE}@tmp/docker-auth"
-            rm -rf "$DOCKER_CONFIG"
-            mkdir -p "$DOCKER_CONFIG"
-            cleanup_registry() {
-              docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true
-              rm -rf "$DOCKER_CONFIG"
-            }
-            trap cleanup_registry EXIT HUP INT TERM
-            printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "$REGISTRY_HOST"
-            image="admin-web-development:${SOURCE_TAG}"
-
-            docker build \
-              --build-arg NODE_IMAGE="$NODE_BASE_IMAGE" \
-              --build-arg NGINX_IMAGE="$NGINX_BASE_IMAGE" \
-              --build-arg VITE_CLIENT_WEB_URL="${CLIENT_WEB_URL:-https://dev-app.buggoglobal.com/}" \
-              -t "$image" .
-            export IMAGE_TAG="$SOURCE_TAG"
-            docker compose -p "$DEVELOPMENT_COMPOSE_PROJECT" -f "$DEVELOPMENT_COMPOSE_FILE" up -d --remove-orphans --pull never
-            docker compose -p "$DEVELOPMENT_COMPOSE_PROJECT" -f "$DEVELOPMENT_COMPOSE_FILE" ps
-            docker compose -p "$DEVELOPMENT_COMPOSE_PROJECT" -f "$DEVELOPMENT_COMPOSE_FILE" exec -T admin-web wget -qO- http://127.0.0.1/healthz
-          '''
-        }
-      }
-    }
-
-    stage('部署检查') {
-      when { expression { env.IS_DEVELOPMENT != 'true' && env.IS_PRODUCTION != 'true' } }
-      steps {
-        sh '''
-          set -eu
-          docker compose -f docker-compose.test.yml ps
+        sh '''set -eu
+          docker compose -f docker-compose.test.yml build --pull=false
+          docker compose -f docker-compose.test.yml up -d --wait --wait-timeout 120
           docker compose -f docker-compose.test.yml exec -T admin-web wget -qO- http://127.0.0.1/healthz
         '''
       }
     }
   }
-
   post {
-    success {
-      script {
-        if (env.JOB_BASE_NAME?.endsWith('-prod')) {
-          try {
-            sendProductionWeComNotification(
-              '✅ 生产部署成功',
-              '成功',
-              'info',
-              '> 结果：Admin 生产前端已完成发布和部署流程'
-            )
-          } catch (Exception error) {
-            echo "企业微信通知失败，不影响原构建结果：${error.message}"
-          }
-        }
-      }
-    }
-    failure {
-      sh '''
-        if [ "${IS_PRODUCTION:-false}" = "true" ]; then
-          echo "生产部署失败，请查看上方远程部署日志"
-        elif [ "${IS_DEVELOPMENT:-false}" = "true" ]; then
-          docker logs --tail=100 admin-web-development || true
-        else
-          docker compose -f docker-compose.test.yml logs --tail=100 || true
-        fi
-      '''
-      script {
-        if (env.JOB_BASE_NAME?.endsWith('-prod')) {
-          try {
-            sendProductionWeComNotification(
-              '❌ 生产发布失败',
-              '失败',
-              'warning',
-              '> 说明：请打开 Jenkins 构建日志查看失败阶段'
-            )
-          } catch (Exception error) {
-            echo "企业微信通知失败，不影响原构建结果：${error.message}"
-          }
-        }
-      }
-    }
-    aborted {
-      script {
-        if (env.JOB_BASE_NAME?.endsWith('-prod')) {
-          try {
-            sendProductionWeComNotification(
-              '⏹ 生产部署已取消',
-              '已取消',
-              'comment',
-              '> 说明：生产部署流程被人工取消或中止'
-            )
-          } catch (Exception error) {
-            echo "企业微信通知失败，不影响原构建结果：${error.message}"
-          }
-        }
-      }
-    }
+    failure { sh 'docker compose -f docker-compose.test.yml logs --tail=100 || true' }
   }
 }

README.md

@@ -10,7 +10,7 @@ pnpm install
 pnpm dev
 ```
 
-生产构建：
+发布资源构建：
 
 ```bash
 pnpm typecheck
@@ -54,16 +54,16 @@ pnpm test
 ```dotenv
 VITE_API_BASE_URL=/api
 API_PROXY_TARGET=http://localhost:9000
-VITE_OVERSEAS_API_BASE_URL=/overseas-api
-OVERSEAS_API_PROXY_TARGET=http://localhost:9300
 VITE_CLIENT_WEB_URL=http://localhost:5174
 ```
 
-国内业务继续使用 `http` 和 `/api` 代理；海外业务统一使用 `overseasHttp` 和 `/overseas-api` 代理。Vite 会把 `/overseas-api/platform/...` 重写为海外 Gateway 的 `/api/platform/...`。海外 Token 的签发、缓存和会话刷新由统一认证层维护，业务模块不得读取 Token、手拼 `Authorization` 或复用国内 `http`。
+全部业务使用共享 `http` 和同源 `/api`，通过统一 Gateway 访问。Access/Refresh Token 与并发刷新由认证层维护，业务模块不得读取 Token 或手拼 `Authorization`。
 
-切换开发或测试环境时，只修改未提交的 `.env.local` 中 `API_PROXY_TARGET`、`OVERSEAS_API_PROXY_TARGET` 和 `VITE_CLIENT_WEB_URL`，然后重启 `pnpm dev`；无需修改业务代码。真实环境地址不写入受版本控制的配置模板或说明。
+本地工具只连接同一测试环境：在未提交 `.env.local` 配置 `API_PROXY_TARGET` 和 `VITE_CLIENT_WEB_URL`；不提供业务服务直连或独立海外代理。
 
-客户代登录打开的工作台地址是运行时配置，不需要为每个环境重新构建镜像。Docker 部署时为 Admin 容器设置当前环境的 `CLIENT_WEB_URL`；容器启动时会生成 `/runtime-config.js`。开发、测试和生产分别在各自部署任务中注入自己的 Client 根地址，禁止复用其他环境的域名。本地 Vite 开发使用 `VITE_CLIENT_WEB_URL` 作为兜底。部署后可读取 `/runtime-config.js` 核对最终生效值。
+唯一部署入口是 `docker-compose.test.yml` 和 test Jenkins Job。发布前在 Job/未提交环境文件配置 `API_UPSTREAM`（统一 Gateway origin，不含 `/api`）、`TEST_NETWORK`（后端共享测试网络）、`CLIENT_WEB_URL`（客户工作台地址）及 `IMAGE_TAG`。可选 `HOST_PORT` 默认 9001，`NODE_BASE_IMAGE`/`NGINX_BASE_IMAGE` 可指定已授权拉取的基础镜像；私有镜像仓库认证由构建节点配置，不在源码存放凭据。Jenkins 从当前提交生成 IMAGE_TAG，不再按 Job 后缀切换 dev/prod。宿主机反向代理连接 loopback 端口。
+
+容器启动通过 `CLIENT_WEB_URL` 生成 `/runtime-config.js`；本地 Vite 使用 `VITE_CLIENT_WEB_URL`。本地构建通过不代表容器或测试环境已发布。真实 HTTP 验收入口为 `pnpm test:phase4:test --environment test --gateway <统一入口>`，凭据通过环境变量传入，仅在取得对应测试写入授权后执行。
 
 认证请求使用 `/api/auth/**`，平台 IAM 请求使用 `/api/platform/v1/iam/**`。登录后只从 JWT 读取平台身份，菜单和操作权限通过当前用户授权接口实时加载，不从 JWT 携带或解析角色权限。企业审核调用 `/reviews`，打开审核详情后按租户调用 `/tenants/{tenantId}/qualifications`；营业执照通过 `/api/platform/v1/files/qualifications/{tenantId}/{fileName}` 携带平台 Token 临时读取，关闭预览后释放本地对象地址。客户端自主注册企业审核通过后继续使用注册账号作为管理员，不展示新凭据；Admin 代建企业并由后端创建管理员时，页面必须展示不可通过遮罩、Esc 或关闭按钮跳过的一次性凭据弹窗，运营人员确认保存后才清除账号密码。平台角色查询、新增、编辑、启停、删除和权限全量保存均已按 `RbacController` 接入真实 `/roles` 契约，角色返回的 `permissionIds` 用于授权回显；系统内置角色及仍被成员使用的角色继续由服务端保护。权限资源查询和新增调用 `/permissions`，尚未提供的权限编辑、删除和启停不会模拟成功。订单与客户真实权限资源只创建 `MENU` 与 `BUTTON`，不创建 `PAGE` 或 `API` 类型。其余业务页面需在对应服务契约确认后逐项替换，生产逻辑不得静默回退到模拟数据。
 
@@ -74,3 +74,5 @@ VITE_CLIENT_WEB_URL=http://localhost:5174
 真实接口错误会保留后端返回的业务错误码、`requestId` 和 `traceId`。登录、企业审核、平台角色及权限资源的主要失败态支持直接复制追踪标识，便于与后端日志关联。
 
 登录表单在开发和生产环境均默认留空，不包含联调账号、密码或演示提示。菜单、路由和操作权限只使用真实登录会话返回的服务端权限快照；前端控制仅改善体验，服务端仍须独立校验身份、角色权限和数据范围。接口失败时页面展示真实错误及追踪标识，不回退到假数据或模拟成功。
+
+同机目标默认值：`API_UPSTREAM=http://gateway:9000`、`TEST_NETWORK=firstleg-test-network`；必须与后端同批 test Compose 配置一致。

docker-compose.development.yml

@@ -1,22 +0,0 @@
-services:
-  admin-web:
-    image: admin-web-development:${IMAGE_TAG:?IMAGE_TAG is required}
-    container_name: admin-web-development
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:9001:80"
-    environment:
-      CLIENT_WEB_URL: "${CLIENT_WEB_URL:-https://dev-app.buggoglobal.com/}"
-      API_UPSTREAM: "http://firstleg-development-gateway:9000"
-      OVERSEAS_API_UPSTREAM: "http://firstleg-development-gateway-overseas:9300"
-    networks:
-      - development-backend
-      - development-overseas-backend
-
-networks:
-  development-backend:
-    external: true
-    name: firstleg-development-network
-  development-overseas-backend:
-    external: true
-    name: firstleg-development-overseas-network

docker-compose.production.yml

@@ -1,24 +0,0 @@
-name: firstleg-prod-admin-web
-
-services:
-  admin-web:
-    image: ${IMAGE_REPOSITORY:?IMAGE_REPOSITORY is required}:${IMAGE_TAG:?IMAGE_TAG is required}
-    container_name: firstleg-prod-admin-web
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:${HOST_PORT:-9001}:80"
-    environment:
-      CLIENT_WEB_URL: "https://app.buggoglobal.com/"
-      API_UPSTREAM: "http://gateway-active:9000"
-      OVERSEAS_API_UPSTREAM: "http://gateway-overseas-active:9300"
-    networks:
-      - infra-network
-      - routing-network
-
-networks:
-  infra-network:
-    external: true
-    name: firstleg-prod-infra-network
-  routing-network:
-    external: true
-    name: firstleg-production-routing

docker-compose.test.yml

@@ -1,3 +1,4 @@
+name: firstleg-test-admin-web
 services:
   admin-web:
     build:
@@ -6,16 +7,23 @@ services:
       args:
         NODE_IMAGE: "${NODE_BASE_IMAGE:-node:22-alpine}"
         NGINX_IMAGE: "${NGINX_BASE_IMAGE:-nginx:1.27-alpine}"
-    image: admin-web-test:local
+    image: admin-web-test:${IMAGE_TAG:?IMAGE_TAG is required}
     container_name: admin-web-test
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/healthz"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+      start_period: 5s
     ports:
-      - "${HOST_PORT:-9001}:80"
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
+      - "127.0.0.1:${HOST_PORT:-9001}:80"
     environment:
-      # Runtime URL used by the secure customer-workbench handoff. Each
-      # environment may override it without rebuilding the Admin image.
-      CLIENT_WEB_URL: "${CLIENT_WEB_URL:-https://test-app.buggoglobal.com/}"
-      API_UPSTREAM: "${API_UPSTREAM:-http://host.docker.internal:9000}"
-      OVERSEAS_API_UPSTREAM: "${OVERSEAS_API_UPSTREAM:-http://host.docker.internal:9300}"
+      CLIENT_WEB_URL: "${CLIENT_WEB_URL:?CLIENT_WEB_URL is required}"
+      API_UPSTREAM: "${API_UPSTREAM:-http://gateway:9000}"
+    networks:
+      - test-backend
+networks:
+  test-backend:
+    external: true
+    name: "${TEST_NETWORK:-firstleg-test-network}"

nginx/default.conf.template

@@ -30,7 +30,7 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    # 墨家测量设备使用独立 OpenAPI 前缀，直接转发到国内 Gateway。
+    # 墨家测量设备使用独立 OpenAPI 前缀，直接转发到统一 Gateway。
     # 该入口不经过 Admin 前端路由，供设备以固定 AppKey/HMAC 调用。
     location /openapi/ {
         client_max_body_size 55m;
@@ -42,17 +42,6 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    # 海外业务使用独立 Gateway；将浏览器前缀改写为 Gateway 的 /api 前缀。
-    location /overseas-api/ {
-        client_max_body_size 55m;
-        rewrite ^/overseas-api/(.*)$ /api/$1 break;
-        proxy_pass ${OVERSEAS_API_UPSTREAM};
-        proxy_http_version 1.1;
-        proxy_set_header Host $proxy_host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
 
     # HTML must be revalidated on every visit so a new deployment cannot keep
     # referencing hashed chunks that were removed with the previous image.

package.json

@@ -8,7 +8,7 @@
     "build": "vue-tsc --noEmit && vite build",
     "typecheck": "vue-tsc --noEmit",
     "test": "vitest run",
-    "test:phase4:development": "node scripts/phase4-development-frontend-acceptance.mjs",
+    "test:phase4:test": "node scripts/phase4-test-frontend-acceptance.mjs",
     "preview": "vite preview --port 4173"
   },
   "dependencies": {

scripts/deploy-production.sh

@@ -1,150 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-if [ "$#" -ne 4 ]; then
-  echo "用法: $0 <服务名> <镜像仓库> <镜像标签> <Compose 文件>" >&2
-  exit 2
-fi
-
-SERVICE="$1"
-IMAGE_REPOSITORY="$2"
-IMAGE_TAG="$3"
-COMPOSE_FILE="$4"
-IMAGE="$IMAGE_REPOSITORY:$IMAGE_TAG"
-REGISTRY_HOST="${IMAGE_REPOSITORY%%/*}"
-SSH_TARGET="${TARGET_SSH_TARGET:?TARGET_SSH_TARGET 未设置}"
-SSH_KEY="${TARGET_SSH_KEY:?TARGET_SSH_KEY 未设置}"
-SSH_KNOWN_HOSTS="${TARGET_SSH_KNOWN_HOSTS:?TARGET_SSH_KNOWN_HOSTS 未设置}"
-REMOTE_DIR="${TARGET_DEPLOY_DIR:?TARGET_DEPLOY_DIR 未设置}"
-: "${REGISTRY_USER:?REGISTRY_USER 未设置}"
-: "${REGISTRY_PASSWORD:?REGISTRY_PASSWORD 未设置}"
-
-run_ssh() {
-  ssh -i "$SSH_KEY" -o BatchMode=yes -o StrictHostKeyChecking=yes \
-    -o UserKnownHostsFile="$SSH_KNOWN_HOSTS" -o ConnectTimeout=10 "$SSH_TARGET" "$@"
-}
-
-run_scp() {
-  scp -i "$SSH_KEY" -o BatchMode=yes -o StrictHostKeyChecking=yes \
-    -o UserKnownHostsFile="$SSH_KNOWN_HOSTS" -o ConnectTimeout=10 "$@"
-}
-
-run_ssh install -d -m 750 "$REMOTE_DIR"
-REMOTE_COMPOSE="$REMOTE_DIR/docker-compose.$SERVICE.yml"
-run_scp "$COMPOSE_FILE" "$SSH_TARGET:$REMOTE_COMPOSE.tmp"
-run_ssh sh -s -- "$REMOTE_COMPOSE.tmp" "$REMOTE_COMPOSE" <<'REMOTE_PREPARE'
-set -eu
-compose_tmp="$1"
-compose_target="$2"
-chmod 644 "$compose_tmp"
-mv -f "$compose_tmp" "$compose_target"
-REMOTE_PREPARE
-
-printf '%s' "$REGISTRY_PASSWORD" | run_ssh docker login -u "$REGISTRY_USER" --password-stdin "$REGISTRY_HOST"
-trap 'run_ssh docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true' EXIT HUP INT TERM
-run_ssh docker pull "$IMAGE"
-
-run_ssh sh -s -- "$REMOTE_DIR" "$SERVICE" "$IMAGE_REPOSITORY" "$IMAGE_TAG" <<'REMOTE_DEPLOY'
-set -eu
-remote_dir="$1"
-service="$2"
-image_repository="$3"
-image_tag="$4"
-compose_file="docker-compose.$service.yml"
-project_name="firstleg-prod-$service"
-cd "$remote_dir"
-export IMAGE_REPOSITORY="$image_repository" IMAGE_TAG="$image_tag"
-
-compose() {
-  docker compose --project-name "$project_name" -f "$compose_file" "$@"
-}
-
-case "$service" in
-  admin-web)
-    base_port=9001
-    nginx_config=/www/server/panel/vhost/nginx/00-blue-green-admin-web.conf
-    legacy_container=firstleg-prod-admin-web
-    ;;
-  client-web)
-    base_port=9002
-    nginx_config=/www/server/panel/vhost/nginx/00-blue-green-client-web.conf
-    legacy_container=firstleg-prod-client-web
-    ;;
-  *) echo "不支持蓝绿部署的前端服务: $service" >&2; exit 2 ;;
-esac
-
-state_root=/data/firstleg/deploy/blue-green-state
-state_file="$state_root/frontend-$service.active"
-routing_network=firstleg-production-routing
-mkdir -p "$state_root"
-chmod 750 "$state_root"
-docker network inspect "$routing_network" >/dev/null 2>&1 || docker network create "$routing_network" >/dev/null
-
-for pair in gateway-active:firstleg-production-gateway gateway-overseas-active:firstleg-production-gateway-overseas; do
-  alias_name="${pair%%:*}"
-  container="${pair#*:}"
-  if docker inspect "$container" >/dev/null 2>&1; then
-    docker network inspect "$routing_network" --format '{{json .Containers}}' | grep -q "\"$container\"" \
-      || docker network connect --alias "$alias_name" "$routing_network" "$container"
-  fi
-done
-
-active_slot=""
-active_container=""
-active_port=""
-if [ -s "$state_file" ]; then
-  IFS='|' read -r active_slot active_container active_port active_image < "$state_file"
-elif docker inspect "$legacy_container" >/dev/null 2>&1; then
-  active_slot=legacy
-  active_container="$legacy_container"
-  active_port="$base_port"
-fi
-
-if [ "$active_slot" = blue ]; then target_slot=green; else target_slot=blue; fi
-[ "$active_slot" = legacy ] && target_slot=green
-if [ "$target_slot" = blue ]; then target_port=$((base_port + 20000)); else target_port=$((base_port + 10000)); fi
-candidate="${legacy_container}-${target_slot}"
-docker rm -f "$candidate" >/dev/null 2>&1 || true
-
-if ! compose run -d --no-deps --name "$candidate" \
-    -p "127.0.0.1:$target_port:80" "$service" >/dev/null; then
-  docker rm -f "$candidate" >/dev/null 2>&1 || true
-  exit 1
-fi
-
-healthy=false
-elapsed=0
-while [ "$elapsed" -lt 120 ]; do
-  if docker exec "$candidate" wget -qO- http://127.0.0.1/healthz >/dev/null 2>&1; then
-    healthy=true
-    break
-  fi
-  sleep 2
-  elapsed=$((elapsed + 2))
-done
-if [ "$healthy" != true ]; then
-  docker logs --tail 100 "$candidate" >&2 || true
-  docker rm -f "$candidate" >/dev/null 2>&1 || true
-  exit 1
-fi
-
-backup="$nginx_config.blue-green-backup"
-cp -f "$nginx_config" "$backup"
-if ! sed -i "s#127\.0\.0\.1:${active_port:-$base_port}#127.0.0.1:$target_port#g" "$nginx_config" \
-  || cmp -s "$nginx_config" "$backup" || ! nginx -t || ! nginx -s reload; then
-  cp -f "$backup" "$nginx_config"
-  nginx -t && nginx -s reload || true
-  docker rm -f "$candidate" >/dev/null 2>&1 || true
-  exit 1
-fi
-rm -f "$backup"
-
-if [ -n "$active_container" ] && docker inspect "$active_container" >/dev/null 2>&1; then
-  docker stop --time 30 "$active_container" >/dev/null
-  docker rm "$active_container" >/dev/null
-fi
-printf '%s|%s|%s|%s\n' "$target_slot" "$candidate" "$target_port" "$image_repository:$image_tag" > "$state_file.tmp"
-chmod 640 "$state_file.tmp"
-mv -f "$state_file.tmp" "$state_file"
-echo "生产前端蓝绿部署成功: service=$service slot=$target_slot port=$target_port image=$image_repository:$image_tag"
-REMOTE_DEPLOY

scripts/phase4-test-frontend-acceptance.mjs

@@ -1,4 +1,3 @@
-import { existsSync, readFileSync } from 'node:fs'
 import { spawnSync } from 'node:child_process'
 
 function option(name) {
@@ -15,22 +14,13 @@ function normalizeOrigin(value, name) {
   return url.origin
 }
 
-function acceptancePassword() {
-  if (process.env.CHONGCHONG_ADMIN_ACCEPTANCE_PASSWORD) return process.env.CHONGCHONG_ADMIN_ACCEPTANCE_PASSWORD
-  const file = 'C:/Users/BY-OY/.codex/chongchong-global-dev-acceptance.env'
-  if (!existsSync(file)) return ''
-  const match = readFileSync(file, 'utf8').match(/^CHONGCHONG_ADMIN_ACCEPTANCE_PASSWORD=(.*)$/m)
-  return match?.[1]?.trim() || ''
-}
-
 const environment = option('--environment')
-if (environment !== 'development') throw new Error('本入口仅允许显式指定 --environment development')
-const gateway = normalizeOrigin(option('--gateway') || process.env.ADMIN_DEVELOPMENT_GATEWAY, '--gateway')
-const overseasGateway = normalizeOrigin(option('--overseas-gateway') || process.env.ADMIN_DEVELOPMENT_OVERSEAS_GATEWAY, '--overseas-gateway')
-const password = acceptancePassword()
-if (!password) throw new Error('缺少 CHONGCHONG_ADMIN_ACCEPTANCE_PASSWORD 或本机开发验收凭据文件')
+if (environment !== 'test') throw new Error('本入口仅允许显式指定 --environment test')
+const gateway = normalizeOrigin(option('--gateway') || process.env.ADMIN_TEST_GATEWAY, '--gateway')
+const password = process.env.CHONGCHONG_ADMIN_ACCEPTANCE_PASSWORD
+if (!password) throw new Error('缺少 CHONGCHONG_ADMIN_ACCEPTANCE_PASSWORD')
 
-const result = spawnSync('pnpm', ['exec', 'vitest', 'run', '--config', 'vitest.phase4-development.config.ts'], {
+const result = spawnSync('pnpm', ['exec', 'vitest', 'run', '--config', 'vitest.phase4-test.config.ts'], {
   cwd: process.cwd(),
   stdio: 'inherit',
   shell: process.platform === 'win32',
@@ -39,10 +29,8 @@ const result = spawnSync('pnpm', ['exec', 'vitest', 'run', '--config', 'vitest.p
     ADMIN_PHASE4_LIVE: '1',
     ADMIN_ACCEPTANCE_USERNAME: process.env.ADMIN_ACCEPTANCE_USERNAME || 'platform_admin',
     ADMIN_ACCEPTANCE_PASSWORD: password,
-    ADMIN_DEVELOPMENT_GATEWAY: gateway,
-    ADMIN_DEVELOPMENT_OVERSEAS_GATEWAY: overseasGateway,
+    ADMIN_TEST_GATEWAY: gateway,
     VITE_API_BASE_URL: `${gateway}/api`,
-    VITE_OVERSEAS_API_BASE_URL: `${overseasGateway}/api`,
   },
 })
 if (result.error) throw result.error

scripts/phase4-test-frontend-contract.test.mjs

@@ -2,14 +2,14 @@ import assert from 'node:assert/strict'
 import { readFileSync } from 'node:fs'
 import test from 'node:test'
 
-const runner = readFileSync(new URL('./phase4-development-frontend-acceptance.mjs', import.meta.url), 'utf8')
-const suite = readFileSync(new URL('./phase4-development-frontend.acceptance.ts', import.meta.url), 'utf8')
+const runner = readFileSync(new URL('./phase4-test-frontend-acceptance.mjs', import.meta.url), 'utf8')
+const suite = readFileSync(new URL('./phase4-test-frontend.acceptance.ts', import.meta.url), 'utf8')
 
-test('development runner requires an explicit development environment and gateways', () => {
+test('test runner requires an explicit test environment and unified gateway', () => {
   assert.match(runner, /--environment/)
-  assert.match(runner, /environment !== 'development'/)
+  assert.match(runner, /environment !== 'test'/)
   assert.match(runner, /--gateway/)
-  assert.match(runner, /--overseas-gateway/)
+  assert.doesNotMatch(runner, /--overseas-gateway|VITE_OVERSEAS/)
   assert.match(runner, /shell: process\.platform === 'win32'/)
   assert.match(runner, /if \(result\.error\) throw result\.error/)
   assert.doesNotMatch(runner, /ADMIN_ACCEPTANCE_PASSWORD\s*[:=]\s*['"][^'"]+['"]/)
@@ -17,7 +17,7 @@ test('development runner requires an explicit development environment and gatewa
 
 test('live suite uses production auth clients and domain adapters', () => {
   assert.match(suite, /useAuthStore/)
-  assert.match(suite, /clearOverseasAccessToken/)
+  assert.match(suite, /refreshAuthenticatedSession/)
   assert.match(suite, /createQuote/)
   assert.match(suite, /createUsTruckOrder/)
   assert.match(suite, /createLocalLooseboardOrder/)

scripts/phase4-test-frontend.acceptance.ts

@@ -8,7 +8,7 @@ import { defineComponent, nextTick } from 'vue'
 import { mount, type VueWrapper } from '@vue/test-utils'
 import ElementPlus from 'element-plus'
 import { http, ApiResponseError } from '@/shared/api/http'
-import { clearOverseasAccessToken, overseasHttp } from '@/shared/api/overseasHttp'
+import { refreshAuthenticatedSession } from '@/shared/api/http'
 import { useAuthStore } from '@/core/auth/auth'
 import { listPlatformTenants } from '@/modules/iam/api/platformIam'
 import {
@@ -45,7 +45,7 @@ import InventoryTransactionsView from '@/modules/overseas-warehouse/pages/Invent
 import PalletsView from '@/modules/overseas-warehouse/pages/PalletsView.vue'
 import QueryToolbar from '@/shared/components/QueryToolbar.vue'
 
-type Region = 'domestic' | 'overseas'
+type Region = 'unified'
 interface TraceStep { region: Region; method: string; path: string; params: unknown; body: unknown; httpStatus: number; code?: string; requestId?: string; traceId?: string; authorization: boolean }
 interface CoverageGap { area: string; reason: string }
 
@@ -150,7 +150,7 @@ async function masterDataLifecycle() {
 }
 
 async function cleanupTransport(path: string, customerId: string, version: number) {
-  await overseasHttp.patch(`${path}/status`, { version, status: 'CANCELLED', remark: `${marker} cleanup` }, { params: { customerId } })
+  await http.patch(`${path}/status`, { version, status: 'CANCELLED', remark: `${marker} cleanup` }, { params: { customerId } })
 }
 async function overseasBusinessLifecycle() {
   const customers = (await listPlatformTenants({ page: 1, size: 200, status: 'ACTIVE' })).records.filter(item => item.status === 'ACTIVE')
@@ -355,25 +355,25 @@ async function pageRequestCoverage() {
     { occurredDate: ['2098-01-01', '2098-01-02'], customerName: `${marker}-CUSTOMER`, warehouse: `${marker}-WAREHOUSE`, sku: `${marker}-SKU`, businessType: 'ADJUST', businessOrderNo: `${marker}-BUSINESS`, inboundCode: `${marker}-INBOUND`, inboundOrderNo: `${marker}-INBOUND-ORDER`, outboundOrderNo: `${marker}-OUTBOUND` },
     { customerName: `${marker}-CUSTOMER`, destinationWarehouseCode: `${marker}-WAREHOUSE`, skuCode: `${marker}-SKU`, businessType: 'ADJUST', businessOrderNo: `${marker}-BUSINESS`, inboundCode: `${marker}-INBOUND`, inboundOrderNo: `${marker}-INBOUND-ORDER`, outboundOrderNo: `${marker}-OUTBOUND`, occurredFrom: '2098-01-01T00:00:00', occurredTo: '2098-01-02T23:59:59' })
 
-  const pallets = await mountPage(PalletsView, 'GET', '/platform/v1/warehouse-admin/pallets')
-  await exerciseListSearch(pallets, '/platform/v1/warehouse-admin/pallets',
+  const pallets = await mountPage(PalletsView, 'GET', '/platform/v1/overseas-warehouse-resources/pallets')
+  await exerciseListSearch(pallets, '/platform/v1/overseas-warehouse-resources/pallets',
     { warehouseId: '', code: `${marker}-PALLET`, type: 'WOOD', status: 'IDLE' },
     { keyword: `${marker}-PALLET`, palletType: 'WOOD', status: 'IDLE' })
 }
 
-describe.skipIf(!enabled).sequential('phase4 development frontend acceptance', () => {
+describe.skipIf(!enabled).sequential('phase4 test frontend acceptance', () => {
   beforeAll(async () => {
     Object.defineProperty(window, 'matchMedia', { writable: true, value: () => ({ matches: false, addEventListener() {}, removeEventListener() {} }) })
     globalThis.ResizeObserver = class { observe() {}; unobserve() {}; disconnect() {} }
-    installTracingAdapter(http, 'domestic'); installTracingAdapter(overseasHttp, 'overseas')
+    installTracingAdapter(http, 'unified')
     const pinia = createPinia(); setActivePinia(pinia)
     const auth = useAuthStore(pinia)
     await auth.login(process.env.ADMIN_ACCEPTANCE_USERNAME || 'platform_admin', process.env.ADMIN_ACCEPTANCE_PASSWORD || '')
     expect(localStorage.getItem('cc-admin-token')).toBeTruthy()
-    clearOverseasAccessToken()
+    await refreshAuthenticatedSession()
     await listVehicles({ page: 1, size: 1 })
-    expect(traces.some(item => item.region === 'domestic' && item.path === '/auth/refresh')).toBe(true)
-    expect(traces.some(item => item.region === 'overseas' && item.authorization)).toBe(true)
+    expect(traces.some(item => item.region === 'unified' && item.path === '/auth/refresh')).toBe(true)
+    expect(traces.some(item => item.region === 'unified' && item.authorization)).toBe(true)
   })
   it('runs marker-owned adapter lifecycles and real page requests', async () => {
     await masterDataLifecycle()
@@ -388,7 +388,7 @@ describe.skipIf(!enabled).sequential('phase4 development frontend acceptance', (
     const reportDir = resolve(process.cwd(), 'reports')
     mkdirSync(reportDir, { recursive: true })
     const report = { generatedAt: new Date().toISOString(), marker, summary: { requests: traces.length, coverageGaps: coverageGaps.length }, traces, coverageGaps, createdResources }
-    const file = resolve(reportDir, `phase4-frontend-development-${marker.replace(/[^A-Za-z0-9-]/g, '')}.json`)
+    const file = resolve(reportDir, `phase4-frontend-test-${marker.replace(/[^A-Za-z0-9-]/g, '')}.json`)
     writeFileSync(file, `${JSON.stringify(report, null, 2)}\n`, 'utf8')
     console.info(`PHASE4_FRONTEND_REPORT=${file}`)
   })

src/deployment/blueGreenDeployment.test.mjs

@@ -1,27 +0,0 @@
-import assert from 'node:assert/strict'
-import { readFile } from 'node:fs/promises'
-import test from 'node:test'
-
-const script = (await readFile(new URL('../../scripts/deploy-production.sh', import.meta.url), 'utf8'))
-  .replaceAll('\r\n', '\n')
-
-test('production frontend starts and validates the candidate before switching nginx', () => {
-  const start = script.indexOf('compose run -d --no-deps --name "$candidate"')
-  const health = script.indexOf('docker exec "$candidate" wget')
-  const nginx = script.indexOf('nginx -t || ! nginx -s reload')
-  const stop = script.indexOf('docker stop --time 30 "$active_container"')
-  const state = script.indexOf('mv -f "$state_file.tmp" "$state_file"')
-  assert.ok(start >= 0 && start < health && health < nginx && nginx < stop && stop < state)
-})
-
-test('production frontend supports both slots and restores nginx on failure', () => {
-  assert.match(script, /target_port=\$\(\(base_port \+ 20000\)\)/)
-  assert.match(script, /target_port=\$\(\(base_port \+ 10000\)\)/)
-  assert.match(script, /00-blue-green-admin-web\.conf/)
-  assert.match(script, /00-blue-green-client-web\.conf/)
-  assert.doesNotMatch(script, /nginx_config=\/www\/server\/panel\/vhost\/nginx\/(?:admin|app)\.buggoglobal\.com\.conf/)
-  assert.match(script, /cp -f "\$nginx_config" "\$backup"/)
-  assert.match(script, /cp -f "\$backup" "\$nginx_config"/)
-  assert.match(script, /docker rm -f "\$candidate"/)
-  assert.match(script, /gateway-active:firstleg-production-gateway/)
-})

src/deployment/nginxConfig.test.ts

@@ -1,85 +1,55 @@
-import { readFileSync } from 'node:fs'
+import assert from 'node:assert/strict'
+import { readFileSync, existsSync } from 'node:fs'
 import { resolve } from 'node:path'
-import { describe, expect, it } from 'vitest'
+import { test } from 'vitest'
 
-const config = readFileSync(resolve(process.cwd(), 'nginx/default.conf.template'), 'utf8').replace(/\r\n/g, '\n')
-const testCompose = readFileSync(resolve(process.cwd(), 'docker-compose.test.yml'), 'utf8')
-const developmentCompose = readFileSync(resolve(process.cwd(), 'docker-compose.development.yml'), 'utf8')
-const productionCompose = readFileSync(resolve(process.cwd(), 'docker-compose.production.yml'), 'utf8')
-const jenkinsfile = readFileSync(resolve(process.cwd(), 'Jenkinsfile'), 'utf8')
-const dockerfile = readFileSync(resolve(process.cwd(), 'Dockerfile'), 'utf8')
+const root = process.cwd()
+const config = readFileSync(resolve(root, 'nginx/default.conf.template'), 'utf8')
+const compose = readFileSync(resolve(root, 'docker-compose.test.yml'), 'utf8')
+const jenkins = readFileSync(resolve(root, 'Jenkinsfile'), 'utf8')
+const vite = readFileSync(resolve(root, 'vite.config.ts'), 'utf8')
 
-describe('admin nginx deployment config', () => {
-  it('allows 50 MiB files plus multipart overhead through both bounded API proxies', () => {
-    expect(config.match(/client_max_body_size 55m;/g)).toHaveLength(3)
-    expect(config).not.toContain('client_max_body_size 12m;')
-    expect(config).not.toContain('client_max_body_size 0;')
-  })
-
-  it('prevents the application shell from retaining stale chunk references', () => {
-    expect(config).toContain('location = /index.html')
-    expect(config).toContain('Cache-Control "no-cache, no-store, must-revalidate"')
-  })
-
-  it('serves hashed assets immutably and never falls back missing chunks to HTML', () => {
-    expect(config).toContain('location /assets/')
-    expect(config).toContain('try_files $uri =404;')
-    expect(config).toContain('Cache-Control "public, max-age=31536000, immutable"')
-  })
-
-  it('keeps Vue history routes on the application shell without caching them', () => {
-    expect(config).toContain('try_files $uri $uri/ /index.html;')
-    expect(config).toContain('Cache-Control "no-cache"')
-  })
-
-  it('proxies overseas API requests to the gateway API prefix', () => {
-    expect(config).toContain('location /overseas-api/')
-    expect(config).toContain('rewrite ^/overseas-api/(.*)$ /api/$1 break;')
-    expect(config).toContain('proxy_pass ${OVERSEAS_API_UPSTREAM};')
-  })
-
-  it('declares an explicit overseas gateway upstream in container deployments', () => {
-    expect(testCompose).toContain('- "host.docker.internal:host-gateway"')
-    expect(testCompose).toContain('API_UPSTREAM: "${API_UPSTREAM:-http://host.docker.internal:9000}"')
-    expect(testCompose).toContain('OVERSEAS_API_UPSTREAM: "${OVERSEAS_API_UPSTREAM:-http://host.docker.internal:9300}"')
-    expect(testCompose).not.toContain('http://test-api-cn.buggoglobal.com')
-    expect(testCompose).not.toContain('http://test-api-global.buggoglobal.com')
-    expect(testCompose).toContain('CLIENT_WEB_URL: "${CLIENT_WEB_URL:-https://test-app.buggoglobal.com/}"')
-    expect(testCompose).not.toContain('CLIENT_WEB_URL: "http://8.163.')
-    expect(developmentCompose).toContain('CLIENT_WEB_URL: "${CLIENT_WEB_URL:-https://dev-app.buggoglobal.com/}"')
-    expect(developmentCompose).toContain('OVERSEAS_API_UPSTREAM: "http://firstleg-development-gateway-overseas:9300"')
-    expect(config).toContain('proxy_set_header Host $proxy_host;')
-  })
-
-  it('keeps local environments on target nodes and uses credential-managed SSH for production', () => {
-    expect(jenkinsfile).toContain("env.JOB_BASE_NAME?.endsWith('-prod') ? 'java-builder'")
-    expect(jenkinsfile).toContain("DEVELOPMENT_COMPOSE_PROJECT = 'admin-web'")
-    expect(jenkinsfile).toContain('docker compose -p "$DEVELOPMENT_COMPOSE_PROJECT" -f "$DEVELOPMENT_COMPOSE_FILE" up -d')
-    expect(jenkinsfile).not.toContain('/var/jenkins_home/.ssh')
-    expect(jenkinsfile).not.toContain('docker save')
-    expect(jenkinsfile).toContain("credentialsId: 'firstleg-production-ssh'")
-    expect(jenkinsfile).toContain('git rev-parse origin/main')
-    expect(productionCompose).toContain('127.0.0.1:${HOST_PORT:-9001}:80')
-    expect(productionCompose).toContain('API_UPSTREAM: "http://gateway-active:9000"')
-    expect(productionCompose).toContain('OVERSEAS_API_UPSTREAM: "http://gateway-overseas-active:9300"')
-    expect(productionCompose).toContain('name: firstleg-production-routing')
-    expect(productionCompose).toContain('name: firstleg-prod-infra-network')
-  })
-
-  it('uses authenticated internal base images in CI instead of pulling from Docker Hub', () => {
-    expect(dockerfile).toContain('ARG NODE_IMAGE=node:22-alpine')
-    expect(dockerfile).toContain('ARG NGINX_IMAGE=nginx:1.27-alpine')
-    expect(dockerfile).toContain('FROM ${NODE_IMAGE} AS build')
-    expect(dockerfile).toContain('FROM ${NGINX_IMAGE}')
-    expect(jenkinsfile).toContain("NODE_BASE_IMAGE = '172.31.198.7:10082/java-project/node:22-alpine'")
-    expect(jenkinsfile).toContain("NGINX_BASE_IMAGE = '172.31.198.7:10082/java-project/nginx:1.27-alpine'")
-    expect(jenkinsfile).toContain('withCredentials([usernamePassword(')
-    expect(jenkinsfile).toContain('export DOCKER_CONFIG="${WORKSPACE}@tmp/docker-auth"')
-    expect(jenkinsfile).toContain('--build-arg VITE_CLIENT_WEB_URL="${CLIENT_WEB_URL:-https://dev-app.buggoglobal.com/}"')
-  })
-
-  it('proxies Mojia measurement OpenAPI requests to the domestic gateway', () => {
-    expect(config).toContain('location /openapi/')
-    expect(config).toContain('location /openapi/ {\n        client_max_body_size 55m;\n        proxy_pass ${API_UPSTREAM};')
-  })
+test('all business traffic uses one Gateway without rewriting API paths', () => {
+  assert.match(config, /location \/api\//)
+  assert.match(config, /proxy_pass \$\{API_UPSTREAM\};/)
+  assert.doesNotMatch(config, /overseas-api|OVERSEAS_API_UPSTREAM|rewrite/)
+  assert.match(config, /client_max_body_size 55m;/)
+  assert.match(config, /proxy_set_header Host \$proxy_host;/)
+  assert.doesNotMatch(vite, /OVERSEAS_API|AUTH_API_PROXY_TARGET|IAM_API_PROXY_TARGET|WAREHOUSE_API_PROXY_TARGET/)
+})
+
+test('test deployment requires an explicit shared network, Gateway and version', () => {
+  for (const key of ['IMAGE_TAG']) {
+    assert.ok(compose.includes('${' + key + ':?'))
+  }
+  assert.ok(compose.includes('${API_UPSTREAM:-http://gateway:9000}'))
+  assert.ok(compose.includes('${TEST_NETWORK:-firstleg-test-network}'))
+  assert.match(compose, /external: true/)
+  assert.match(compose, /127\.0\.0\.1:/)
+  assert.doesNotMatch(compose, /overseas|host\.docker\.internal|production|development/)
+  assert.match(jenkins, /label 'java-test'/)
+  assert.match(jenkins, /docker compose -f docker-compose\.test\.yml config --quiet/)
+  assert.match(jenkins, /docker network inspect/)
+  assert.doesNotMatch(jenkins, /docker-compose\.(production|development)|deploy-production|sshUserPrivateKey/)
+  for (const file of ['docker-compose.production.yml', 'docker-compose.development.yml', 'scripts/deploy-production.sh']) {
+    assert.equal(existsSync(resolve(root, file)), false)
+  }
+})
+
+test('application shell is revalidated and missing chunks remain 404', () => {
+  assert.match(config, /location = \/index\.html/)
+  assert.match(config, /no-store/)
+  assert.match(config, /max-age=31536000, immutable/)
+  assert.match(config, /try_files \$uri =404;/)
+  assert.match(config, /try_files \$uri \$uri\/ \/index\.html;/)
+})
+
+
+test('container build excludes local environment values and waits for Nginx health', () => {
+  const ignore = readFileSync(resolve(root, '.dockerignore'), 'utf8')
+  assert.match(ignore, /^\.env$/m)
+  assert.match(ignore, /^\.env\.\*$/m)
+  assert.match(compose, /healthcheck:/)
+  assert.match(compose, /http:\/\/127\.0\.0\.1\/healthz/)
+  assert.match(jenkins, /up -d --wait --wait-timeout 120/)
 })

src/modules/overseas-master-data/components/ContractPendingNotice.vue

@@ -5,7 +5,7 @@ withDefaults(defineProps<{ domain: string; detail?: boolean }>(), { detail: fals
 <template>
   <el-alert class="contract-pending" type="warning" :closable="false" show-icon>
     <template #title>{{ domain }}海外区域接口待接入</template>
-    <p>{{ detail ? '当前详情没有可查询的真实记录。' : '页面已按四期原型冻结字段与布局。' }}海外请求统一经 gateway-overseas；在统一 Base/Token 选择及本页面端点、DTO 与权限适配完成前，不展示演示数据，也不会模拟查询或写操作成功。</p>
+    <p>当前功能尚未完成接口接入，暂不可操作。</p>
   </el-alert>
 </template>
 

src/modules/overseas-warehouse/AGENTS.md

@@ -9,7 +9,7 @@
 
 - 本文件适用于 `src/modules/overseas-warehouse/`，路径默认相对此目录；其他模块以 `../` 开头。应用公共规则见 `../../../AGENTS.md`。
 - 先按下表定位页面，再沿 `routes.ts`、页面 import 与 `api/` 追踪；页面是否开放以正式路由、权限和测试为准。后台接口与状态进入 `../../../../../baiyue-firstleg/lastleg-service/AGENTS.md`，不扩大扫描其他业务模块。
-- 请求统一使用 `../../shared/api/overseasHttp.ts`；不以 `PROTOTYPE_MATRIX.md` 或 `CONTRACT_GAPS.md` 代替代码与服务端契约。
+- 请求统一使用 `../../shared/api/http.ts`；不以 `PROTOTYPE_MATRIX.md` 或 `CONTRACT_GAPS.md` 代替代码与服务端契约。
 
 ## 页面与业务快速索引
 

src/modules/overseas-warehouse/components/ContractPendingNotice.vue

@@ -5,7 +5,7 @@ defineProps<{ domain: string }>()
 <template>
   <el-alert class="contract-pending" type="warning" :closable="false" show-icon>
     <template #title>{{ domain }}海外区域接口待接入</template>
-    <p>后端边界已固定为 gateway-overseas → lastleg-service / warehouse-overseas-service；统一海外 Base/Token 选择及本页面端点、DTO 与权限适配完成前，不展示演示数据，也不会模拟查询或写操作成功。</p>
+    <p>当前功能尚未完成接口接入，暂不可操作。</p>
   </el-alert>
 </template>
 

src/shared/api/AGENTS.md

@@ -1,25 +1,8 @@
 # Admin Shared API Instructions
 
-## 适用范围与入口
-
-- 本文件适用于 `src/shared/api/` 及其测试。业务模块只通过领域 `api/` 适配层调用这里的客户端，不在页面和组件直接创建 Axios 实例。
-- 国内 API 客户端为 `http.ts`；海外 API 客户端为 `overseasHttp.ts`。认证会话编排在 `../../core/auth/auth.ts`，不得在本目录复制登录状态。
-
-## 国内与海外请求
-
-- `http` 使用 `VITE_API_BASE_URL`，默认走国内代理；国内登录、刷新和退出仍由统一 Auth 处理。
-- `overseasHttp` 使用 `VITE_OVERSEAS_API_BASE_URL`，默认 `/overseas-api`；Vite 将该前缀改写为海外 Gateway 的 `/api`。代理上游由开发环境配置，不在源码或指引中记录真实地址。
-- 登录和刷新响应一次性返回国内 Token、`overseasAccessToken`、`overseasExpiresIn`；`core/auth/auth.ts` 必须原子替换两套访问凭据。不得恢复 Token 兑换端点或让业务模块单独刷新海外 Token。
-- 海外 Token 只由 `replaceOverseasAccessToken`、`clearOverseasAccessToken` 管理；业务模块不得读写缓存、LocalStorage 或手工拼装 `Authorization`。
-- 国内、海外 401 共用统一会话刷新编排。海外请求最多统一刷新一次并重放一次；刷新失败按会话失效处理，不循环重试或回退假数据。
-
-## 领域调用边界
-
-- 国内业务领域 API 使用 `http`；海外尾程、海外仓资源和海外本土业务使用 `overseasHttp`，不得经国内 Gateway 中转。
-- 页面只调用所属模块的 API 封装；模块 API 负责路径、DTO 和错误适配，不把 Axios 响应或区域选择泄漏到页面。
-- 跨区域 Token、Audience、JWKS 和服务通信公共契约读取 `../../../../../docs/跨区域认证与服务通信契约.md`。
-
-## 修改与验证
-
-- 修改客户端、拦截器、刷新、Token 生命周期或 Base URL 时，联查 `http.test.ts`、`overseasHttp.test.ts`、`core/auth/auth.test.ts`、Vite 代理、`.env.example` 和全部实际消费者。
-- 至少运行相关 API/Auth 测试和 `pnpm typecheck`；交付前按项目指引运行完整测试与构建。
+- 本目录及测试承载统一请求基础设施。全部领域 API 使用 `http.ts`，业务模块不得创建区域客户端或自行持久化 Token。
+- 会话编排唯一入口为 `../../core/auth/auth.ts`；统一 Access/Refresh Token 由 Auth 签发，并发 401 共用一次刷新，每个原请求最多重放一次。
+- `VITE_API_BASE_URL` 默认 `/api`，Vite 只通过 `API_PROXY_TARGET` 代理到统一 Gateway，不直连业务服务。
+- 页面只调用领域 API 封装；模块适配路径、DTO 与错误，不暴露客户端选择或手工 Authorization。
+- 正式契约见 `../../../../../docs/统一认证与服务通信契约.md`；业务服务仍负责权限和客户隔离。
+- 修改拦截器、刷新或 Base URL 后联查 `http.test.ts`、`../../core/auth/auth.test.ts`、Vite、`.env.example` 及直接消费者，运行定向测试、`pnpm typecheck`、完整测试与构建。

vite.config.ts

@@ -7,10 +7,7 @@ import { ElementPlusResolver } from 'unplugin-vue-components/resolvers'
 
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd(), '')
-  const proxyTarget = process.env.API_PROXY_TARGET || env.API_PROXY_TARGET || 'http://localhost:8080'
-  const authProxyTarget = process.env.AUTH_API_PROXY_TARGET || env.AUTH_API_PROXY_TARGET || proxyTarget
-  const iamProxyTarget = process.env.IAM_API_PROXY_TARGET || env.IAM_API_PROXY_TARGET || proxyTarget
-  const warehouseProxyTarget = process.env.WAREHOUSE_API_PROXY_TARGET || env.WAREHOUSE_API_PROXY_TARGET || proxyTarget
+  const proxyTarget = process.env.API_PROXY_TARGET || env.API_PROXY_TARGET || 'http://localhost:9000'
 
   return {
     plugins: [
@@ -32,33 +29,6 @@ export default defineConfig(({ mode }) => {
     server: {
       strictPort: true,
       proxy: {
-        '/api/auth': {
-          target: authProxyTarget,
-          changeOrigin: true,
-          configure(proxy) {
-            proxy.on('proxyReq', (proxyRequest) => {
-              proxyRequest.removeHeader('origin')
-            })
-          },
-        },
-        '/api/platform/v1/iam': {
-          target: iamProxyTarget,
-          changeOrigin: true,
-          configure(proxy) {
-            proxy.on('proxyReq', (proxyRequest) => {
-              proxyRequest.removeHeader('origin')
-            })
-          },
-        },
-        '/api/platform/v1/warehouse-admin': {
-          target: warehouseProxyTarget,
-          changeOrigin: true,
-          configure(proxy) {
-            proxy.on('proxyReq', (proxyRequest) => {
-              proxyRequest.removeHeader('origin')
-            })
-          },
-        },
         '/api': {
           target: proxyTarget,
           changeOrigin: true,

vitest.phase4-test.config.ts

@@ -7,7 +7,7 @@ export default defineConfig({
   resolve: { alias: { '@': fileURLToPath(new URL('./src', import.meta.url)) } },
   test: {
     environment: 'jsdom',
-    include: ['scripts/phase4-development-frontend.acceptance.ts'],
+    include: ['scripts/phase4-test-frontend.acceptance.ts'],
     fileParallelism: false,
     testTimeout: 120_000,
     hookTimeout: 120_000,