Merge pull request 'v1.0.45' (#57) from dev into master

Reviewed-on: #57

pom.xml

@@ -11,7 +11,7 @@
 
 	<groupId>com.imyeyu.timiserverapi</groupId>
 	<artifactId>TimiServerAPI</artifactId>
-	<version>1.0.19</version>
+	<version>1.0.45</version>
 	<packaging>jar</packaging>
 	<name>TimiServerAPI</name>
 	<description>imyeyu.com API</description>
@@ -180,6 +180,11 @@
 	</repositories>
 
 	<dependencies>
+		<dependency>
+			<groupId>org.apache.groovy</groupId>
+			<artifactId>groovy</artifactId>
+			<version>4.0.29</version>
+		</dependency>
 		<dependency>
 			<groupId>com.imyeyu.spring</groupId>
 			<artifactId>timi-spring</artifactId>
@@ -198,7 +203,7 @@
 		<dependency>
 			<groupId>com.imyeyu.java</groupId>
 			<artifactId>timi-java</artifactId>
-			<version>0.0.7</version>
+			<version>0.0.11</version>
 		</dependency>
 		<dependency>
 			<groupId>com.imyeyu.utils</groupId>
@@ -210,10 +215,15 @@
 			<artifactId>tinypinyin</artifactId>
 			<version>2.0.3</version>
 		</dependency>
+		<dependency>
+			<groupId>com.hankcs</groupId>
+			<artifactId>hanlp</artifactId>
+			<version>portable-1.8.4</version>
+		</dependency>
 		<dependency>
 			<groupId>com.imyeyu.font.icon</groupId>
 			<artifactId>timi-icon-font</artifactId>
-			<version>0.0.1</version>
+			<version>0.0.3</version>
 		</dependency>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
@@ -240,11 +250,6 @@
 			<groupId>org.flywaydb</groupId>
 			<artifactId>flyway-mysql</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>com.e2ins.ms.notify</groupId>
-			<artifactId>e2ins-msg-notify-service-sdk</artifactId>
-			<version>0.0.9</version>
-		</dependency>
 		<dependency>
 			<groupId>com.tencentcloudapi</groupId>
 			<artifactId>tencentcloud-sdk-java-sms</artifactId>

src/main/java/com/imyeyu/api/annotation/EnableSetting.java

@@ -1,35 +0,0 @@
-package com.imyeyu.api.annotation;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-/**
- * 启用配置注解
- *
- * @author 夜雨
- * @since 2023-07-15 10:00
- */
-@Target(ElementType.METHOD)
-@Retention(RetentionPolicy.RUNTIME)
-public @interface EnableSetting {
-
-	/**
-	 *
-	 *
-	 * @author 夜雨
-	 * @since 2026-04-27 14:45
-	 */
-	enum Logic {
-
-		AND,
-
-		OR
-	}
-
-	Logic logic() default Logic.AND;
-
-	/** @return 未启用配置时响应消息语言映射键 */
-	String message() default "service.offline";
-}

src/main/java/com/imyeyu/api/annotation/EnableSettingInterceptor.java

@@ -1,55 +0,0 @@
-package com.imyeyu.api.annotation;
-
-import com.imyeyu.api.modules.common.service.SettingService;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import lombok.RequiredArgsConstructor;
-import org.springframework.context.annotation.Lazy;
-import org.springframework.lang.NonNull;
-import org.springframework.stereotype.Component;
-import org.springframework.web.method.HandlerMethod;
-import org.springframework.web.servlet.HandlerInterceptor;
-
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * 启用配置注解处理器
- *
- * @author 夜雨
- * @since 2023-07-15 10:01
- */
-@Component
-@RequiredArgsConstructor(onConstructor_ = {@Lazy})
-public class EnableSettingInterceptor implements HandlerInterceptor {
-
-	private final SettingService service;
-
-	public boolean preHandle(@NonNull HttpServletRequest req, @NonNull HttpServletResponse resp, @NonNull Object handler) throws InvocationTargetException, IllegalAccessException {
-		if (handler instanceof HandlerMethod handlerMethod) {
-			EnableSetting annotation = handlerMethod.getMethodAnnotation(EnableSetting.class);
-			if (annotation == null) {
-				return true;
-			}
-			EnableSetting.Logic logic = annotation.logic();
-			List<Boolean> valueList = new ArrayList<>();
-			for (Method method : annotation.getClass().getMethods()) {
-				if (method.getName().equals("message")) {
-					continue;
-				}
-				Enum<?>[] enums = (Enum<?>[]) method.invoke(annotation);
-				for (Enum<?> anEnum : enums) {
-					valueList.add(service.getSystem(anEnum).isTrue());
-				}
-			}
-			if (logic == EnableSetting.Logic.AND) {
-				return valueList.stream().allMatch(Boolean::booleanValue);
-			} else {
-				return valueList.stream().anyMatch(Boolean::booleanValue);
-			}
-		}
-		return true;
-	}
-}

src/main/java/com/imyeyu/api/annotation/SettingBizType.java

@@ -0,0 +1,17 @@
+package com.imyeyu.api.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+///
+///
+/// @author 夜雨
+/// @since 2026-09-08 15:22
+@Target(ElementType.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface SettingBizType {
+
+	String value();
+}

src/main/java/com/imyeyu/api/bean/CorePermissionCode.java

@@ -45,6 +45,11 @@ public enum CorePermissionCode implements BuiltinPermissionCode {
 	TAG_UPDATE("TAG:UPDATE", "标签修改", false, true),
 	TAG_DELETE("TAG:DELETE", "标签删除", false, true),
 
+	ARTICLE_CREATE("ARTICLE:CREATE", "文章创建", false, true),
+	ARTICLE_READ("ARTICLE:READ", "文章读取", false, true),
+	ARTICLE_UPDATE("ARTICLE:UPDATE", "文章修改", false, true),
+	ARTICLE_DELETE("ARTICLE:DELETE", "文章删除", false, true),
+
 	USER_CREATE("USER:CREATE", "用户创建", false, true),
 	USER_READ("USER:READ", "用户读取", false, true),
 	USER_UPDATE("USER:UPDATE", "用户修改", false, true),

src/main/java/com/imyeyu/api/bean/SettingEnum.java

@@ -0,0 +1,27 @@
+package com.imyeyu.api.bean;
+
+import com.imyeyu.api.annotation.SettingBizType;
+import com.imyeyu.api.modules.common.entity.Setting;
+import com.imyeyu.utils.Text;
+
+///
+///
+/// @author 夜雨
+/// @since 2026-09-08 15:18
+public interface SettingEnum {
+
+	default String getBizType() {
+		Class<? extends SettingEnum> implEnum = getClass();
+		SettingBizType bizType = implEnum.getAnnotation(SettingBizType.class);
+		if (bizType == null) {
+			return Text.bizClassName(implEnum);
+		}
+		return bizType.value();
+	}
+
+	String name();
+
+	String getDefaultValue();
+
+	Setting.ValueType getValueType();
+}

src/main/java/com/imyeyu/api/config/BeanConfig.java

@@ -1,12 +1,9 @@
 package com.imyeyu.api.config;
 
-import com.e2ins.ms.notify.SmsNotifyService;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.databind.DeserializationFeature;
 import com.fasterxml.jackson.databind.MapperFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.PropertyNamingStrategies;
-import com.fasterxml.jackson.databind.PropertyNamingStrategy;
 import com.fasterxml.jackson.databind.json.JsonMapper;
 import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import com.imyeyu.utils.Time;
@@ -32,12 +29,6 @@ public class BeanConfig {
 		                 .build();
 	}
 
-	@Bean
-	public SmsNotifyService smsNotifyService() {
-		// TODO
-		return new SmsNotifyService(null, null);
-	}
-
 	@Bean
 	public Yaml yaml() {
 		return new Yaml();

src/main/java/com/imyeyu/api/config/ThreadPoolConfig.java

@@ -32,4 +32,22 @@ public class ThreadPoolConfig {
 		executor.initialize();
 		return executor;
 	}
+
+	/// 创建操作审计线程池
+	///
+	/// @return 操作审计线程池
+	@Bean(name = "auditTaskExecutor")
+	public ThreadPoolTaskExecutor auditTaskExecutor() {
+		ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
+		executor.setCorePoolSize(4);
+		executor.setMaxPoolSize(8);
+		executor.setQueueCapacity(2000);
+		executor.setKeepAliveSeconds(60);
+		executor.setWaitForTasksToCompleteOnShutdown(true);
+		executor.setAwaitTerminationSeconds(60);
+		executor.setThreadNamePrefix("audit-task-executor-");
+		executor.setRejectedExecutionHandler(new ThreadPoolExecutor.CallerRunsPolicy());
+		executor.initialize();
+		return executor;
+	}
 }

src/main/java/com/imyeyu/api/config/WebConfig.java

@@ -6,7 +6,6 @@ import com.fasterxml.jackson.databind.MapperFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.json.JsonMapper;
 import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
-import com.imyeyu.api.annotation.EnableSettingInterceptor;
 import com.imyeyu.api.annotation.RequestRateLimitInterceptor;
 import com.imyeyu.api.annotation.RequireCorePermissionInterceptor;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermissionInterceptor;
@@ -40,7 +39,6 @@ public class WebConfig implements WebMvcConfigurer {
 	private final ObjectMapper jackson;
 	private final SystemAPIInterceptor systemAPIInterceptor;
 	private final JournalAPIInterceptor journalAPIInterceptor;
-	private final EnableSettingInterceptor enableSettingInterceptor;
 	private final RequestRateLimitInterceptor requestRateLimitInterceptor;
 	private final RequireGaoPermissionInterceptor requireGaoPermissionInterceptor;
 	private final RequireCorePermissionInterceptor requireCorePermissionInterceptor;
@@ -54,7 +52,6 @@ public class WebConfig implements WebMvcConfigurer {
 	public void addInterceptors(InterceptorRegistry registry) {
 		registry.addInterceptor(systemAPIInterceptor).addPathPatterns(SystemAPIInterceptor.PATH);
 		registry.addInterceptor(journalAPIInterceptor).addPathPatterns(JournalAPIInterceptor.PATH);
-		registry.addInterceptor(enableSettingInterceptor).addPathPatterns("/**");
 		registry.addInterceptor(requireCorePermissionInterceptor).addPathPatterns("/**");
 		registry.addInterceptor(requireGaoPermissionInterceptor).addPathPatterns("/**");
 		registry.addInterceptor(requestRateLimitInterceptor).addPathPatterns("/**");

src/main/java/com/imyeyu/api/modules/common/bean/GroovyScriptExecutionResult.java

@@ -0,0 +1,9 @@
+package com.imyeyu.api.modules.common.bean;
+
+/// Groovy 脚本执行结果
+///
+/// @param <T> 脚本返回值类型
+/// @author Codex
+/// @since 2026-09-04
+public record GroovyScriptExecutionResult<T>(String scriptId, String versionId, Integer version, String checksum, T result) {
+}

src/main/java/com/imyeyu/api/modules/common/bean/SettingModule.java

@@ -1,52 +0,0 @@
-package com.imyeyu.api.modules.common.bean;
-
-import com.imyeyu.api.modules.common.entity.Setting;
-import com.imyeyu.java.bean.timi.TimiCode;
-import com.imyeyu.java.bean.timi.TimiException;
-import lombok.AllArgsConstructor;
-import lombok.Getter;
-
-/**
- * 设置模块
- *
- * @author 夜雨
- * @since 2026-04-24 00:59
- */
-@Getter
-@AllArgsConstructor
-public enum SettingModule {
-
-	COMMON(Setting.Module.Common.class),
-
-	DOMAIN(Setting.Module.Domain.class),
-
-	FOREVER_MC(Setting.Module.ForeverMC.class),
-
-	MULTILINGUAL(Setting.Module.Multilingual.class),
-
-	GITEA(Setting.Module.Gitea.class),
-
-	MUSIC(Setting.Module.Music.class),
-
-	JOURNAL(Setting.Module.Journal.class),
-
-	TEMP_FILE(Setting.Module.TempFile.class),
-
-	USER(Setting.Module.User.class),
-
-	SYSTEM(Setting.Module.System.class),
-
-	SYSTEM_STATUS(Setting.Module.SystemStatus.class);
-
-	/** 模块枚举类 */
-	final Class<? extends Enum<?>> clazz;
-
-	public static <T extends Enum<?>> SettingModule fromClass(Class<T> clazz) {
-		for (SettingModule value : values()) {
-			if (value.clazz.equals(clazz)) {
-				return value;
-			}
-		}
-		throw new TimiException(TimiCode.ERROR, "not found System Module: %s".formatted(clazz.getName()));
-	}
-}

src/main/java/com/imyeyu/api/modules/common/bean/TempFileSetting.java

@@ -0,0 +1,41 @@
+package com.imyeyu.api.modules.common.bean;
+
+import com.imyeyu.api.annotation.SettingBizType;
+import com.imyeyu.api.bean.SettingEnum;
+import com.imyeyu.api.modules.common.entity.Setting;
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+/**
+ *
+ *
+ * @author 夜雨
+ * @since 2026-04-24 14:47
+ */
+@Getter
+@SettingBizType("TEMP_FILE")
+@AllArgsConstructor
+public enum TempFileSetting implements SettingEnum {
+
+	/** 启用服务 */
+	ENABLE(Boolean.TRUE.toString(), Setting.ValueType.BOOLEAN),
+
+	/** 最小缓存时长 */
+	TTL_MIN("1h", Setting.ValueType.TIME),
+
+	/** 默认缓存时长 */
+	TTL_DEFAULT("3d", Setting.ValueType.TIME),
+
+	/** 最大缓存时长 */
+	TTL_MAX("7d", Setting.ValueType.TIME),
+
+	/** 已过期文件残留时长 */
+	RESIDUE_TTL("90d", Setting.ValueType.TIME),
+
+	/** 每个 IP 限制有效临时文件容量 */
+	LIMIT_SIZE_OF_IP("10 GB", Setting.ValueType.BYTE_SIZE);
+
+	final String defaultValue;
+
+	final Setting.ValueType valueType;
+}

src/main/java/com/imyeyu/api/modules/common/bean/attachment/Metadata.java

@@ -1,48 +0,0 @@
-package com.imyeyu.api.modules.common.bean.attachment;
-
-import lombok.Data;
-import lombok.EqualsAndHashCode;
-
-/**
- * @author 夜雨
- * @since 2025-12-11 18:14
- */
-public class Metadata {
-
-	/**
-	 * 图片
-	 *
-	 * @author 夜雨
-	 * @since 2025-12-11 18:15
-	 */
-	@Data
-	public static class Image {
-
-		private int width;
-
-		private int height;
-	}
-
-	/**
-	 * 缩略图
-	 *
-	 * @author 夜雨
-	 * @since 2026-01-04 18:10
-	 */
-	@Data
-	@EqualsAndHashCode(callSuper = true)
-	public static class ThumbImage extends Image {
-
-		private String sourceId;
-
-		private String sourceMongoId;
-
-		private String sourceMimeType;
-
-		/** 请求宽度（缓存键之一，null 表示未指定） */
-		private Integer requestWidth;
-
-		/** 请求高度（缓存键之一，null 表示未指定） */
-		private Integer requestHeight;
-	}
-}

src/main/java/com/imyeyu/api/modules/common/bean/attachment/ThumbnailFitMode.java

@@ -0,0 +1,17 @@
+package com.imyeyu.api.modules.common.bean.attachment;
+
+/// 缩略图缩放模式
+///
+/// @author 夜雨
+/// @since 2026-08-21
+public enum ThumbnailFitMode {
+
+	/// 保持比例完整放入目标尺寸
+	FIT,
+
+	/// 保持比例裁剪填满目标尺寸
+	COVER,
+
+	/// 强制缩放到目标尺寸，可能导致图片变形
+	STRETCH
+}

src/main/java/com/imyeyu/api/modules/common/config/NotifyQueueConfig.java

@@ -42,6 +42,19 @@ public class NotifyQueueConfig {
 		private String secretId;
 
 		private String secretKey;
+
+		private Captcha captcha;
+
+		/// 短信验证码
+		@Data
+		public static class Captcha {
+
+			private String templateId;
+
+			private int ttlMinute;
+
+			private int argIndex;
+		}
 	}
 
 	/// 微信队列配置

src/main/java/com/imyeyu/api/modules/common/controller/ArticleController.java

@@ -0,0 +1,96 @@
+package com.imyeyu.api.modules.common.controller;
+
+import com.fasterxml.jackson.annotation.JsonView;
+import com.imyeyu.api.annotation.RequireCorePermission;
+import com.imyeyu.api.bean.CorePermissionCode;
+import com.imyeyu.api.modules.common.entity.Article;
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.common.service.ArticleService;
+import com.imyeyu.api.modules.common.service.AttachmentService;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.bean.Page;
+import com.imyeyu.spring.bean.PageResult;
+import com.imyeyu.spring.util.ResponseView;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+/// 文章接口
+///
+/// @author Codex
+/// @since 2026-09-09
+@Slf4j
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/article")
+public class ArticleController {
+
+	private final ArticleService service;
+	private final AttachmentService attachmentService;
+
+	/// 查询文章列表
+	///
+	/// @param page 分页参数
+	/// @return 文章分页
+	@JsonView(ResponseView.Public.class)
+	@RequestRateLimit
+	@RequireCorePermission(CorePermissionCode.ARTICLE_READ)
+	@PostMapping("/list")
+	public PageResult<Article> list(@RequestBody Page<Article> page) {
+		return service.page(page);
+	}
+
+	/// 查询文章详情
+	///
+	/// @param id 文章 ID
+	/// @return 文章详情
+	@JsonView(ResponseView.Public.class)
+	@RequestRateLimit
+	@RequestMapping("/detail")
+	public Article detail(@RequestParam String id) {
+		Article article = service.get(id);
+		article.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.ARTICLE, article.getId()));
+		return article;
+	}
+
+	/// 创建文章
+	///
+	/// @param article 文章
+	/// @return 创建后的文章
+	@AOPLog
+	@JsonView(ResponseView.Public.class)
+	@RequestRateLimit
+	@RequireCorePermission(CorePermissionCode.ARTICLE_CREATE)
+	@PostMapping("/create")
+	public Article create(@RequestBody Article article) {
+		service.create(article);
+		return article;
+	}
+
+	/// 更新文章
+	///
+	/// @param article 文章
+	@AOPLog
+	@RequestRateLimit
+	@RequireCorePermission(CorePermissionCode.ARTICLE_UPDATE)
+	@PostMapping("/update")
+	public void update(@RequestBody Article article) {
+		service.update(article);
+	}
+
+	/// 删除文章
+	///
+	/// @param id 文章 ID
+	@AOPLog
+	@RequestRateLimit
+	@RequireCorePermission(CorePermissionCode.ARTICLE_DELETE)
+	@PostMapping("/delete")
+	public void delete(@RequestParam String id) {
+		service.delete(id);
+	}
+}

src/main/java/com/imyeyu/api/modules/common/controller/AttachmentController.java

@@ -1,7 +1,9 @@
 package com.imyeyu.api.modules.common.controller;
 
 import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.common.bean.attachment.ThumbnailFitMode;
 import com.imyeyu.api.modules.common.service.AttachmentService;
+import com.imyeyu.api.modules.common.service.AttachmentVariantService;
 import com.imyeyu.api.modules.common.service.TempFileService;
 import com.imyeyu.api.modules.common.vo.attach.TempFileResp;
 import com.imyeyu.java.TimiJava;
@@ -41,6 +43,7 @@ public class AttachmentController {
 
 	private final TempFileService tempFileService;
 	private final AttachmentService service;
+	private final AttachmentVariantService variantService;
 
 	/**
 	 * 查询附件详情
@@ -184,14 +187,19 @@ public class AttachmentController {
 	@AOPLog
 	@IgnoreGlobalReturn
 	@GetMapping({"/read/{id}", "/download/{id}"})
-	public void readById(@PathVariable String id, @RequestParam(required = false) Integer thumbWidth, @RequestParam(required = false) Integer thumbHeight) throws UnsupportedEncodingException {
+	public void readById(
+		@PathVariable String id,
+		@RequestParam(required = false) Integer thumbWidth,
+		@RequestParam(required = false) Integer thumbHeight,
+		@RequestParam(defaultValue = "FIT") ThumbnailFitMode fitMode
+	) throws UnsupportedEncodingException {
 		HttpServletResponse resp = TimiSpring.getResponse();
 		Attachment attach = service.get(id);
 		if (attach == null) {
 			resp.setStatus(HttpServletResponse.SC_NOT_FOUND);
 			return;
 		}
-		responseAttachment(attach, thumbWidth, thumbHeight);
+		responseAttachment(attach, thumbWidth, thumbHeight, fitMode);
 	}
 
 	@AOPLog
@@ -207,21 +215,31 @@ public class AttachmentController {
 	public void read(@RequestParam String id) throws UnsupportedEncodingException {
 		HttpServletResponse resp = TimiSpring.getResponse();
 		Attachment attach = service.get(id);
+		if (attach == null) {
+			resp.setStatus(HttpServletResponse.SC_NOT_FOUND);
+			return;
+		}
 		if (TimiSpring.getRequest().getRequestURI().endsWith("/download")) {
 			resp.setHeader("Content-Disposition", Network.getFileDownloadHeader(attach.getName()));
 		}
-		response(attach);
+		response(attach, false);
 	}
 
-	private void responseAttachment(Attachment attach, Integer thumbWidth, Integer thumbHeight) throws UnsupportedEncodingException {
+	private void responseAttachment(
-		HttpServletResponse resp = TimiSpring.getResponse();
+		Attachment attach,
-		if (attach != null && TimiSpring.getRequest().getRequestURI().endsWith("/download") && attach.getName() != null) {
+		Integer thumbWidth,
-			resp.setHeader("Content-Disposition", Network.getFileDownloadHeader(attach.getName()));
+		Integer thumbHeight,
-		}
+		ThumbnailFitMode fitMode
-		responseThumb(attach, thumbWidth, thumbHeight);
+	) throws UnsupportedEncodingException {
+		responseThumb(attach, thumbWidth, thumbHeight, fitMode);
 	}
 
-	protected void responseThumb(Attachment attachment, Integer thumbWidth, Integer thumbHeight) {
+	protected void responseThumb(
+		Attachment attachment,
+		Integer thumbWidth,
+		Integer thumbHeight,
+		ThumbnailFitMode fitMode
+	) throws UnsupportedEncodingException {
 		HttpServletResponse resp = TimiSpring.getResponse();
 		if (TimiJava.isEmpty(attachment)) {
 			resp.setStatus(HttpServletResponse.SC_NOT_FOUND);
@@ -229,21 +247,65 @@ public class AttachmentController {
 		}
 		if (thumbWidth == null && thumbHeight == null) {
 			// 原图
+			setDownloadHeader(attachment);
 			response(attachment);
 			return;
 		}
 		// 缩略图
-		Attachment thumb = service.fetchThumb(attachment, thumbWidth, thumbHeight);
+		Attachment thumb = variantService.fetchThumb(attachment, thumbWidth, thumbHeight, fitMode);
-		response(TimiJava.defaultIfNull(thumb, attachment));
+		setDownloadHeader(thumb);
+		response(thumb);
+	}
+
+	private void setDownloadHeader(Attachment attachment) throws UnsupportedEncodingException {
+		if (attachment != null && TimiSpring.getRequest().getRequestURI().endsWith("/download") && attachment.getName() != null) {
+			TimiSpring.getResponse().setHeader("Content-Disposition", Network.getFileDownloadHeader(attachment.getName()));
+		}
+	}
+
+	/// 设置附件缓存头并处理条件请求
+	///
+	/// @param attachment 实际响应附件
+	/// @return true 表示客户端缓存仍有效，已返回 304
+	private boolean responseCache(Attachment attachment) {
+		HttpServletResponse resp = TimiSpring.getResponse();
+		resp.setHeader("Cache-Control", "private, no-cache");
+		String md5 = attachment.getMd5();
+		if (md5 == null || md5.isBlank()) {
+			return false;
+		}
+		String etag = "\"%s\"".formatted(md5);
+		resp.setHeader("ETag", etag);
+		String ifNoneMatch = TimiSpring.getHeader("If-None-Match");
+		if (ifNoneMatch == null) {
+			return false;
+		}
+		for (String value : ifNoneMatch.split(",")) {
+			String candidate = value.trim();
+			if ("*".equals(candidate) || etag.equals(candidate) || ("W/" + etag).equals(candidate)) {
+				resp.setStatus(HttpServletResponse.SC_NOT_MODIFIED);
+				return true;
+			}
+		}
+		return false;
 	}
 
 	protected void response(Attachment attachment) {
+		response(attachment, true);
+	}
+
+	private void response(Attachment attachment, boolean cacheable) {
 		HttpServletResponse resp = TimiSpring.getResponse();
 		try {
 			if (TimiJava.isEmpty(attachment)) {
 				resp.setStatus(HttpServletResponse.SC_NOT_FOUND);
 				return;
 			}
+			if (!cacheable) {
+				resp.setHeader("Cache-Control", "private, no-store");
+			} else if (responseCache(attachment)) {
+				return;
+			}
 			resp.setContentType(attachment.getMimeType());
 			attachment.doResponse();
 		} catch (Exception e) {

src/main/java/com/imyeyu/api/modules/common/controller/LoggerController.java

@@ -1,5 +1,6 @@
 package com.imyeyu.api.modules.common.controller;
 
+import com.imyeyu.api.modules.common.vo.ClientLogRequest;
 import com.imyeyu.api.modules.system.entity.Logger;
 import com.imyeyu.api.modules.system.service.LoggerService;
 import com.imyeyu.spring.annotation.AOPLog;
@@ -29,7 +30,9 @@ public class LoggerController {
 	@AOPLog
 	@RequiredToken
 	@PostMapping("/create")
-	public void create(@Valid @RequestBody Logger logger) {
+	public void create(@Valid @RequestBody ClientLogRequest request) {
+		Logger logger = Logger.info(Logger.Module.COMMON, "CLIENT_LOG");
+		logger.setContent(request.getContent());
 		service.create(logger);
 	}
 }

src/main/java/com/imyeyu/api/modules/common/controller/NotifyController.java

@@ -7,11 +7,17 @@ import com.imyeyu.api.modules.common.entity.Notify;
 import com.imyeyu.api.modules.common.entity.NotifyDetail;
 import com.imyeyu.api.modules.common.service.NotifyDetailService;
 import com.imyeyu.api.modules.common.service.NotifyService;
+import com.imyeyu.api.modules.common.service.SmsService;
+import com.imyeyu.api.modules.common.vo.NotifyManagementItem;
 import com.imyeyu.api.modules.user.entity.User;
 import com.imyeyu.api.modules.user.service.UserLoginService;
 import com.imyeyu.api.modules.user.service.UserService;
 import com.imyeyu.java.TimiJava;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.CaptchaValid;
+import com.imyeyu.spring.annotation.RequestRateLimit;
 import com.imyeyu.spring.annotation.RequiredToken;
+import com.imyeyu.spring.bean.CaptchaData;
 import com.imyeyu.spring.bean.Page;
 import com.imyeyu.spring.bean.PageResult;
 import com.imyeyu.spring.util.ResponseView;
@@ -37,6 +43,8 @@ import java.util.stream.Stream;
 @RequestMapping("/notify")
 public class NotifyController {
 
+
+	private final SmsService smsService;
 	private final UserService userService;
 	private final NotifyService service;
 	private final UserLoginService userLoginService;
@@ -50,6 +58,14 @@ public class NotifyController {
 	@RequiredToken
 	@PostMapping("/create")
 	public Notify create(@RequestBody Notify notify) {
+		String sendFrom = userLoginService.isLogged() ? userLoginService.getRequireLoginUserId() : null;
+		notify.setCreatedBy(sendFrom);
+		for (NotifyDetail detail : notify.getDetailList()) {
+			detail.setNotifyId(notify.getId());
+			if (TimiJava.isNotEmpty(sendFrom)) {
+				detail.setSendFrom(sendFrom);
+			}
+		}
 		service.create(notify);
 		return notify;
 	}
@@ -63,25 +79,31 @@ public class NotifyController {
 	@RequiredToken
 	@RequestMapping("/detail")
 	public Notify detail(@RequestParam String id) {
-		Notify notify = service.get(id);
+		return fillDetailList(service.get(id));
-		{
-			List<NotifyDetail> detailList = detailService.listByNotifyId(id);
-			Set<String> userIdSet = detailList.stream()
-			                                  .filter(item -> item.getMsgType() == NotifyDetail.MsgType.INTERNAL)
-			                                  .flatMap(item -> Stream.of(item.getSendFrom(), item.getSendTo()))
-			                                  .collect(Collectors.toSet());
-			Map<String, User> userMap = userService.mapByIdList(userIdSet);
-			for (NotifyDetail detail : detailList) {
-				if (TimiJava.isNotEmpty(detail.getSendFrom())) {
-					detail.setFromUser(userMap.get(detail.getSendFrom()));
 	}
-				if (TimiJava.isNotEmpty(detail.getSendTo())) {
+
-					detail.setToUser(userMap.get(detail.getSendTo()));
+	/// 查询管理端通知列表
+	///
+	/// @param page 分页参数
+	/// @return 管理端通知列表
+	@JsonView(ResponseView.Admin.class)
+	@RequireCorePermission(CorePermissionCode.NOTIFY_READ)
+	@RequiredToken
+	@PostMapping("/management/list")
+	public PageResult<NotifyManagementItem> managementList(@RequestBody(required = false) Page<Notify> page) {
+		return service.pageManagement(page, userLoginService.getRequireLoginUserId());
 	}
-			}
+
-			notify.setDetailList(detailList);
+	/// 查询管理端通知详情及收件人
-		}
+	///
-		return notify;
+	/// @param id 通知 ID
+	/// @return 通知详情及收件人
+	@JsonView(ResponseView.Admin.class)
+	@RequireCorePermission(CorePermissionCode.NOTIFY_READ)
+	@RequiredToken
+	@PostMapping("/management/detail")
+	public Notify managementDetail(@RequestParam String id) {
+		return fillDetailList(service.getManagement(id, userLoginService.getRequireLoginUserId()));
 	}
 
 	/// 删除通知及其通知详情
@@ -104,6 +126,34 @@ public class NotifyController {
 		service.cancel(id);
 	}
 
+	/// 删除管理端通知及其通知详情
+	///
+	/// @param id 通知 ID
+	@RequireCorePermission(CorePermissionCode.NOTIFY_DELETE)
+	@RequiredToken
+	@PostMapping("/management/delete")
+	public void managementDelete(@RequestParam String id) {
+		service.deleteManagement(id, userLoginService.getRequireLoginUserId());
+	}
+
+	/// 取消管理端尚未成功发送的通知
+	///
+	/// @param id 通知 ID
+	@RequireCorePermission(CorePermissionCode.NOTIFY_CANCEL)
+	@RequiredToken
+	@PostMapping("/management/cancel")
+	public void managementCancel(@RequestParam String id) {
+		service.cancelManagement(id, userLoginService.getRequireLoginUserId());
+	}
+
+	@AOPLog
+	@CaptchaValid
+	@RequestRateLimit(value = 1, inSeconds = 59)
+	@PostMapping("/sms/captcha/create")
+	public String smsCaptchaCreate(@RequestBody CaptchaData<Notify> req) {
+		return smsService.captchaCreate(req.getData());
+	}
+
 	/// 查询当前用户的站内通知
 	///
 	/// @param page 分页参数
@@ -134,14 +184,14 @@ public class NotifyController {
 		return detail;
 	}
 
-	/// 删除当前用户的一条站内通知
+	/// 隐藏当前用户的一条站内通知
 	///
 	/// @param id 通知详情 ID
 	@RequireCorePermission(CorePermissionCode.NOTIFY_READ)
 	@RequiredToken
 	@PostMapping("/internal/delete")
 	public void deleteInternal(@RequestParam String id) {
-		detailService.deleteInternalByUserId(id, userLoginService.getRequireLoginUserId());
+		detailService.hideInternalByUserId(id, userLoginService.getRequireLoginUserId());
 	}
 
 	/// 查询当前用户未读通知数量
@@ -171,4 +221,30 @@ public class NotifyController {
 	public void markAllSiteRead() {
 		detailService.markAllSiteRead(userLoginService.getRequireLoginUserId());
 	}
+
+	/// 回填通知详情中的用户信息
+	///
+	/// @param notify 通知
+	/// @return 已回填用户信息的通知
+	private Notify fillDetailList(Notify notify) {
+		if (notify == null) {
+			return null;
+		}
+		List<NotifyDetail> detailList = detailService.listByNotifyId(notify.getId());
+		Set<String> userIdSet = detailList.stream()
+		                                  .filter(item -> item.getMsgType() == NotifyDetail.MsgType.INTERNAL)
+		                                  .flatMap(item -> Stream.of(item.getSendFrom(), item.getSendTo()))
+		                                  .collect(Collectors.toSet());
+		Map<String, User> userMap = userService.mapByIdList(userIdSet);
+		for (NotifyDetail detail : detailList) {
+			if (TimiJava.isNotEmpty(detail.getSendFrom())) {
+				detail.setFromUser(userMap.get(detail.getSendFrom()));
+			}
+			if (TimiJava.isNotEmpty(detail.getSendTo())) {
+				detail.setToUser(userMap.get(detail.getSendTo()));
+			}
+		}
+		notify.setDetailList(detailList);
+		return notify;
+	}
 }

src/main/java/com/imyeyu/api/modules/common/controller/SettingController.java

@@ -15,8 +15,12 @@ import lombok.extern.slf4j.Slf4j;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
+import java.util.List;
+import java.util.Map;
+
 /**
  *
  *
@@ -26,11 +30,30 @@ import org.springframework.web.bind.annotation.RestController;
 @Slf4j
 @RestController
 @RequiredArgsConstructor
-@RequestMapping("/system/setting")
+@RequestMapping("/setting")
 public class SettingController {
 
 	private final SettingService service;
 
+	/**
+	 * 查询公开配置映射
+	 *
+	 * @param bizType 业务类型
+	 * @param bizId 业务 ID，可为空
+	 * @param code 配置代码列表，可为空
+	 * @return 公开配置映射
+	 */
+	@JsonView(ResponseView.Public.class)
+	@RequestRateLimit
+	@RequestMapping("/map")
+	public Map<String, Setting> map(
+			@RequestParam String bizType,
+			@RequestParam(required = false) String bizId,
+			@RequestParam(required = false) List<String> code
+	) {
+		return service.mapPublic(bizType, bizId, code);
+	}
+
 	/**
 	 * 查询配置列表
 	 *
@@ -53,6 +76,7 @@ public class SettingController {
 	 */
 	@JsonView(ResponseView.Admin.class)
 	@RequestRateLimit
+	@RequireCorePermission(CorePermissionCode.SETTING_READ)
 	@PostMapping("/detail")
 	public Setting detail(@RequestBody String id) {
 		return service.get(id);
@@ -66,6 +90,7 @@ public class SettingController {
 	 */
 	@AOPLog
 	@JsonView(ResponseView.Admin.class)
+	@RequireCorePermission(CorePermissionCode.SETTING_CREATE)
 	@RequestRateLimit
 	@PostMapping("/create")
 	public Setting create(@RequestBody Setting setting) {
@@ -80,6 +105,7 @@ public class SettingController {
 	 */
 	@AOPLog
 	@RequestRateLimit
+	@RequireCorePermission(CorePermissionCode.SETTING_UPDATE)
 	@PostMapping("/update")
 	public void update(@RequestBody Setting setting) {
 		service.update(setting);

src/main/java/com/imyeyu/api/modules/common/entity/Article.java

@@ -1,6 +1,7 @@
 package com.imyeyu.api.modules.common.entity;
 
 import com.imyeyu.api.modules.common.bean.attachment.SettingSupport;
+import com.imyeyu.api.modules.user.entity.User;
 import com.imyeyu.spring.annotation.table.PageIgnore;
 import com.imyeyu.spring.annotation.table.Transient;
 import com.imyeyu.spring.entity.UUIDEntity;
@@ -30,6 +31,11 @@ public class Article extends UUIDEntity implements SettingSupport {
 		/** 博客 */
 		BLOG,
 
+		/// GAO 门店日记
+		GAO_STORE_DIARY,
+
+		GAO_SYSTEM,
+
 		/// 反馈
 		FEEDBACK
 	}
@@ -93,6 +99,12 @@ public class Article extends UUIDEntity implements SettingSupport {
 	/** 文章状态 */
 	protected Status status;
 
+	/// 最后更新用户 ID
+	protected String updatedBy;
+
+	@Transient
+	protected User updater;
+
 	@Transient
 	protected List<Setting> settingList;
 

src/main/java/com/imyeyu/api/modules/common/entity/Attachment.java

@@ -32,12 +32,26 @@ public class Attachment extends UUIDEntity {
 
 		ARTICLE,
 
+		NOTIFY_DETAIL,
+
 		USER,
 
 		GAO_CUSTOMER,
 
+		GAO_PRODUCT,
+
+		GAO_PRODUCT_SKU,
+
 		GAO_EVENT_RECORD,
 
+		GAO_FUND_RECORD,
+
+		GAO_STOCK_RECORD,
+
+		GAO_ORDER_FULFILLMENT,
+
+		GAO_SALES_ORDER,
+
 		TEMP_FILE,
 
 		MIRROR

src/main/java/com/imyeyu/api/modules/common/entity/AttachmentVariant.java

@@ -0,0 +1,68 @@
+package com.imyeyu.api.modules.common.entity;
+
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.imyeyu.api.modules.common.bean.attachment.ThumbnailFitMode;
+import com.imyeyu.spring.annotation.table.AutoUUID;
+import com.imyeyu.spring.annotation.table.Id;
+import lombok.Data;
+
+/// 附件缩略图变体记录
+///
+/// @author 夜雨
+/// @since 2026-08-21
+@Data
+public class AttachmentVariant {
+
+	/// 变体 ID
+	@Id
+	@AutoUUID
+	private String id;
+
+	/// 源附件 ID
+	private String sourceAttachmentId;
+
+	/// 源文件版本，使用源 GridFS ID
+	private String sourceMongoId;
+
+	/// 源文件摘要
+	private String sourceMd5;
+
+	/// 请求宽度，0 表示未指定
+	private int requestWidth;
+
+	/// 请求高度，0 表示未指定
+	private int requestHeight;
+
+	/// 缩放模式
+	private ThumbnailFitMode fitMode;
+
+	/// 输出格式
+	private String outputFormat;
+
+	/// 缩略图算法版本
+	private String algorithmVersion;
+
+	/// 缩略图 GridFS ID
+	private String mongoId;
+
+	/// 缩略图名称
+	private String name;
+
+	/// 缩略图 MIME 类型
+	private String mimeType;
+
+	/// 缩略图元数据
+	private ObjectNode metadata;
+
+	/// 缩略图大小
+	private long size;
+
+	/// 缩略图摘要
+	private String md5;
+
+	/// 创建时间
+	private long createdAt;
+
+	/// 过期时间
+	private long expireAt;
+}

src/main/java/com/imyeyu/api/modules/common/entity/BaseQueueEntity.java

@@ -1,5 +1,6 @@
 package com.imyeyu.api.modules.common.entity;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import com.imyeyu.spring.annotation.table.AutoUUID;
 import com.imyeyu.spring.annotation.table.Id;
 import com.imyeyu.spring.entity.Creatable;
@@ -25,10 +26,10 @@ public class BaseQueueEntity implements IDEntity<String>, Creatable, Destroyable
 	protected String notifyDetailId;
 
 	/** 内容 */
-	protected String data;
+	protected String content;
 
 	/** 参数 */
-	protected String args;
+	protected JsonNode args;
 
 	/** 发送去向 */
 	protected String sendTo;
@@ -50,7 +51,7 @@ public class BaseQueueEntity implements IDEntity<String>, Creatable, Destroyable
 	/// @param detail 通知详情
 	public BaseQueueEntity(NotifyDetail detail) {
 		notifyDetailId = detail.getId();
-		data = detail.getData();
+		content = detail.getContent();
 		args = detail.getArgs();
 		sendTo = detail.getSendTo();
 		sendAt = detail.getSendAt();

src/main/java/com/imyeyu/api/modules/common/entity/GroovyScript.java

@@ -0,0 +1,46 @@
+package com.imyeyu.api.modules.common.entity;
+
+import com.imyeyu.spring.annotation.table.Transient;
+import com.imyeyu.spring.entity.UUIDEntity;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+/// Groovy 脚本
+///
+/// @author Codex
+/// @since 2026-09-04
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class GroovyScript extends UUIDEntity {
+
+	///
+	///
+	/// @author 夜雨
+	/// @since 2026/9/4 14:54
+	public enum BizType {
+
+		/// GAO 积分规则
+		GAO_POINT_RULE
+	}
+
+	/// 业务归属
+	private BizType bizType;
+
+	/// 业务内唯一代码
+	private String code;
+
+	/// 名称
+	private String name;
+
+	/// 说明
+	private String description;
+
+	/// true 为允许执行已发布版本
+	private Boolean enabled;
+
+	/// 当前发布版本 ID
+	private String publishedVersionId;
+
+	@Transient
+	private GroovyScriptVersion latest;
+}

src/main/java/com/imyeyu/api/modules/common/entity/GroovyScriptVersion.java

@@ -0,0 +1,26 @@
+package com.imyeyu.api.modules.common.entity;
+
+import com.imyeyu.spring.entity.UUIDEntity;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+/// Groovy 脚本版本
+///
+/// @author Codex
+/// @since 2026-09-04
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class GroovyScriptVersion extends UUIDEntity {
+
+	/// 脚本 ID
+	private String scriptId;
+
+	/// 版本号
+	private Integer version;
+
+	/// 脚本内容
+	private String content;
+
+	/// 脚本内容 SHA-256
+	private String checksum;
+}

src/main/java/com/imyeyu/api/modules/common/entity/Notify.java

@@ -20,11 +20,11 @@ public class Notify extends UUIDEntity {
 	/** 业务类型 */
 	private String bizType;
 
-	/** 提醒业务类型 */
+	/** 业务提醒类型 */
 	private String bizRemindedType;
 
-	/** 提醒业务 ID */
+	/** 业务提醒查重键 */
-	private String bizRemindedId;
+	private String bizRemindedKey;
 
 	/** 参数 */
 	private String args;

src/main/java/com/imyeyu/api/modules/common/entity/NotifyDetail.java

@@ -1,6 +1,8 @@
 package com.imyeyu.api.modules.common.entity;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonView;
+import com.fasterxml.jackson.databind.JsonNode;
 import com.imyeyu.api.TimiServerAPI;
 import com.imyeyu.api.modules.common.service.BaseQueueService;
 import com.imyeyu.api.modules.common.service.HTTPQueueService;
@@ -15,6 +17,8 @@ import lombok.AllArgsConstructor;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
 
+import java.util.List;
+
 /**
  * 通知详情
  *
@@ -81,6 +85,19 @@ public class NotifyDetail extends UUIDEntity {
 		FAIL
 	}
 
+	/// 内容类型
+	///
+	/// @author 夜雨
+	/// @since 2026-08-24
+	public enum ContentType {
+
+		/** 纯文本 */
+		TEXT,
+
+		/** TipTap 富文本 */
+		TIP_TAP
+	}
+
 	/** 所属通知 ID */
 	@JsonView(ResponseView.Public.class)
 	private String notifyId;
@@ -99,11 +116,15 @@ public class NotifyDetail extends UUIDEntity {
 
 	/** 内容 */
 	@JsonView(ResponseView.Public.class)
-	private String data;
+	private String content;
+
+	/// 内容类型
+	@JsonView(ResponseView.Public.class)
+	private ContentType contentType;
 
 	/** 参数 */
 	@JsonView(ResponseView.Public.class)
-	private String args;
+	private JsonNode args;
 
 	/** 发送来源 */
 	@JsonView(ResponseView.Public.class)
@@ -137,6 +158,10 @@ public class NotifyDetail extends UUIDEntity {
 	@JsonView(ResponseView.Public.class)
 	private Long readAt;
 
+	/// 收件人隐藏时间，仅站内通知生效
+	@JsonIgnore
+	private Long hiddenAt;
+
 	@Transient
 	protected Notify notify;
 
@@ -145,4 +170,9 @@ public class NotifyDetail extends UUIDEntity {
 
 	@Transient
 	protected User toUser;
+
+	/// 媒体附件列表
+	@JsonView(ResponseView.Public.class)
+	@Transient
+	protected List<Attachment> attachmentList;
 }

src/main/java/com/imyeyu/api/modules/common/entity/Setting.java

@@ -7,7 +7,6 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ArrayNode;
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import com.imyeyu.api.TimiServerAPI;
-import com.imyeyu.api.modules.common.bean.SettingModule;
 import com.imyeyu.spring.annotation.table.Transient;
 import com.imyeyu.spring.entity.UUIDEntity;
 import com.imyeyu.spring.util.ResponseView;
@@ -62,6 +61,9 @@ public class Setting extends UUIDEntity {
 		/** 时间 */
 		TIME,
 
+		/// 字节大小
+		BYTE_SIZE,
+
 		/** 时长 */
 		DURATION,
 
@@ -102,16 +104,6 @@ public class Setting extends UUIDEntity {
 	@Transient
 	private Enum<?> keyRaw;
 
-	public Setting(Enum<?> key) {
-		setKeyRaw(key);
-	}
-
-	public Setting(Enum<?> key, Object value, ValueType valueType) {
-		setKeyRaw(key);
-		this.value = value.toString();
-		this.valueType = valueType;
-	}
-
 	/**
 	 * 以字符串形式返回配置值
 	 *
@@ -221,298 +213,4 @@ public class Setting extends UUIDEntity {
 			throw new IllegalArgumentException("setting value is not valid json: %s".formatted(value), e);
 		}
 	}
-
-	public void setKeyRaw(Enum<?> key) {
-		this.keyRaw = key;
-		this.bizType = SettingModule.fromClass(key.getClass()).toString();
-		this.code = key.toString();
-	}
-
-	public boolean is(Enum<?> key) {
-		return SettingModule.fromClass(key.getClass()).toString().equals(bizType) && key.toString().equals(code);
-	}
-
-	/**
-	 *
-	 *
-	 * @author 夜雨
-	 * @since 2026-04-24 14:23
-	 */
-	public static final class Module {
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 15:39
-		 */
-		public enum Common {
-
-			/** 微信收款码 */
-			WECHAT_RECEIVE_QR_CODE
-		}
-
-		/**
-		 * 域名
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-26 17:18
-		 */
-		public enum Domain {
-
-			ROOT,
-
-			API,
-
-			GIT,
-
-			BLOG,
-
-			SPACE,
-
-			FOREVER_MC
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 15:14
-		 */
-		public enum Blog {
-
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 15:03
-		 */
-		public enum User {
-
-			/** 启用登录 */
-			ENABLE_LOGIN,
-
-			/** 启用注册 */
-			ENABLE_REGISTER,
-
-			/** 允许数据更新 */
-			ENABLE_PROFILE_UPDATE,
-
-			/** 令牌有效期 */
-			TOKEN_TTL
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 15:21
-		 */
-		public enum Comment {
-
-			/** 启用服务 */
-			ENABLE
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 15:03
-		 */
-		public enum ICP {
-
-			IMYEYU_COM
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 15:01
-		 */
-		public enum ForeverMC {
-
-			PLAYER_BIND_MAX,
-
-			LOGIN_TOKEN_TTL
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 14:57
-		 */
-		public enum Multilingual {
-
-			/** 翻译 API */
-			TRANSLATE_API,
-
-			/** 翻译 AppId */
-			TRANSLATE_APP_ID,
-
-			/** 翻译密钥 */
-			TRANSLATE_KEY,
-
-			/** 翻译计划任务表达式 */
-			TRANSLATE_CORN,
-
-			/** 缓存时长 */
-			CACHE_TTL
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 14:55
-		 */
-		public enum Gitea {
-
-			/** 接口地址 */
-			API,
-
-			/** 关于页面所属文章 ID */
-			ABOUT_ARTICLE_ID,
-
-			/** 仓库文件地址 */
-			REPOSITORY_PATH
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 14:52
-		 */
-		public enum Music {
-
-			/** 启用服务 */
-			ENABLE,
-
-			/** 通信消息最大帧长度 */
-			MAX_FRAME_LENGTH,
-
-			/** 受控端 IP */
-			PLAYER_IP,
-
-			/** 受控端端口 */
-			PLAYER_PORT,
-
-			/** 控制端 IP */
-			CONTROLLER_IP,
-
-			/** 控制端端口 */
-			CONTROLLER_PORT,
-
-			/** 控制端入口地址 */
-			CONTROLLER_URI,
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 14:49
-		 */
-		public enum Journal {
-
-			/** 启用服务 */
-			ENABLE,
-
-			/** 审核中 */
-			REVIEWING,
-
-			/** 访问密钥 */
-			KEY,
-
-			/** 微信小程序 AppId */
-			APP_ID,
-
-			/** 微信小程序 AppSecret */
-			APP_SECRET,
-
-			/** 备忘录内容 */
-			MEMO,
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 14:47
-		 */
-		public enum TempFile {
-
-			/** 启用服务 */
-			ENABLE,
-
-			/** 最小缓存时长 */
-			TTL_MIN,
-
-			/** 默认缓存时长 */
-			TTL_DEFAULT,
-
-			/** 最大缓存时长 */
-			TTL_MAX,
-
-			/** 已过期文件残留时长 */
-			RESIDUE_TTL,
-
-			/** 每个 IP 限制有效临时文件容量 */
-			LIMIT_SIZE_OF_IP
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-27 14:35
-		 */
-		public enum FileSync {
-
-			ENABLE,
-
-			CRON,
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 14:23
-		 */
-		public enum System {
-
-			/** 文件系统基准路径 */
-			FILE_BASE_PATH,
-
-			/** 设置缓存时长 */
-			SETTING_TTL,
-
-			/** 哀悼滤镜 */
-			ENABLE_MOURN_FILTER,
-		}
-
-		/**
-		 *
-		 *
-		 * @author 夜雨
-		 * @since 2026-04-24 14:23
-		 */
-		public enum SystemStatus {
-
-			/** 状态采集数据量 */
-			LIMIT,
-
-			/** 状态采集网卡 */
-			NETWORK_MAC,
-
-			/** 状态采集频率 */
-			RATE,
-		}
-	}
 }

src/main/java/com/imyeyu/api/modules/common/mapper/AttachmentMapper.java

@@ -34,28 +34,10 @@ public interface AttachmentMapper extends BaseMapper<Attachment, String>, RawMap
 
 	List<Attachment> selectAllByBizIdList(Attachment.BizType bizType, Collection<String> bizIdList, List<String> attachTypes);
 
+	List<Attachment> selectImageByBizIdList(Attachment.BizType bizType, Collection<String> bizIdList, String attachType);
+
 	long countByBizId(Attachment.BizType bizType, String bizId, List<String> attachTypes);
 
-	/**
-	 * 按源附件 ID 与请求尺寸查询已缓存缩略图
-	 *
-	 * @param bizType       源附件业务类型
-	 * @param sourceId      源附件 ID
-	 * @param requestWidth  请求宽度，{@code null} 表示未指定
-	 * @param requestHeight 请求高度，{@code null} 表示未指定
-	 * @return 缩略图附件，不存在返回 {@code null}
-	 */
-	Attachment selectThumb(Attachment.BizType bizType, String sourceId, Integer requestWidth, Integer requestHeight);
-
-	/**
-	 * 查询源附件的所有未销毁缩略图（含已软删除）
-	 *
-	 * @param sourceId 源附件 ID
-	 * @return 缩略图列表
-	 */
-	@Select("SELECT * FROM attachment WHERE biz_id = #{sourceId} AND attach_type = 'THUMB' AND is_destroyed = FALSE")
-	List<Attachment> selectThumbsBySourceId(String sourceId);
-
 	@Select("SELECT * FROM attachment WHERE `is_destroyed` = FALSE AND `destroy_at` < " + UNIX_TIME)
 	List<Attachment> selectNeedDestroy();
 }

src/main/java/com/imyeyu/api/modules/common/mapper/AttachmentVariantMapper.java

@@ -0,0 +1,86 @@
+package com.imyeyu.api.modules.common.mapper;
+
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.common.entity.AttachmentVariant;
+import org.apache.ibatis.annotations.Param;
+
+import java.util.List;
+
+/// 附件缩略图变体 Mapper
+///
+/// @author 夜雨
+/// @since 2026-08-21
+public interface AttachmentVariantMapper {
+
+	/// 查询有效缩略图附件
+	///
+	/// @param sourceAttachmentId 源附件 ID
+	/// @param sourceMongoId      源 GridFS ID
+	/// @param requestWidth       请求宽度，0 表示未指定
+	/// @param requestHeight      请求高度，0 表示未指定
+	/// @param fitMode            缩放模式
+	/// @param outputFormat       输出格式
+	/// @param algorithmVersion   算法版本
+	/// @param now                当前时间
+	/// @return 缩略图附件
+	Attachment selectValidAttachment(
+		@Param("sourceAttachmentId") String sourceAttachmentId,
+		@Param("sourceMongoId") String sourceMongoId,
+		@Param("requestWidth") int requestWidth,
+		@Param("requestHeight") int requestHeight,
+		@Param("fitMode") String fitMode,
+		@Param("outputFormat") String outputFormat,
+		@Param("algorithmVersion") String algorithmVersion,
+		@Param("now") long now
+	);
+
+	/// 查询指定变体记录，不判断是否过期
+	///
+	/// @param sourceAttachmentId 源附件 ID
+	/// @param sourceMongoId      源 GridFS ID
+	/// @param requestWidth       请求宽度，0 表示未指定
+	/// @param requestHeight      请求高度，0 表示未指定
+	/// @param fitMode            缩放模式
+	/// @param outputFormat       输出格式
+	/// @param algorithmVersion   算法版本
+	/// @return 变体记录
+	AttachmentVariant selectByKey(
+		@Param("sourceAttachmentId") String sourceAttachmentId,
+		@Param("sourceMongoId") String sourceMongoId,
+		@Param("requestWidth") int requestWidth,
+		@Param("requestHeight") int requestHeight,
+		@Param("fitMode") String fitMode,
+		@Param("outputFormat") String outputFormat,
+		@Param("algorithmVersion") String algorithmVersion
+	);
+
+	/// 查询源附件的所有变体
+	///
+	/// @param sourceAttachmentId 源附件 ID
+	/// @return 变体列表
+	List<AttachmentVariant> selectBySourceAttachmentId(@Param("sourceAttachmentId") String sourceAttachmentId);
+
+	/// 查询已过期变体
+	///
+	/// @param now 当前时间
+	/// @return 已过期变体列表
+	List<AttachmentVariant> selectExpired(@Param("now") long now);
+
+	/// 新增变体
+	///
+	/// @param variant 变体
+	void insert(AttachmentVariant variant);
+
+	/// 延长缩略图变体的过期时间
+	///
+	/// @param id       变体 ID
+	/// @param now      当前时间
+	/// @param expireAt 新的过期时间
+	/// @return 更新记录数
+	int updateExpireAt(@Param("id") String id, @Param("now") long now, @Param("expireAt") long expireAt);
+
+	/// 删除变体
+	///
+	/// @param id 变体 ID
+	void delete(@Param("id") String id);
+}

src/main/java/com/imyeyu/api/modules/common/mapper/GroovyScriptMapper.java

@@ -0,0 +1,11 @@
+package com.imyeyu.api.modules.common.mapper;
+
+import com.imyeyu.api.modules.common.entity.GroovyScript;
+import com.imyeyu.spring.mapper.BaseMapper;
+
+/// Groovy 脚本 Mapper
+///
+/// @author Codex
+/// @since 2026-09-04
+public interface GroovyScriptMapper extends BaseMapper<GroovyScript, String> {
+}

src/main/java/com/imyeyu/api/modules/common/mapper/GroovyScriptVersionMapper.java

@@ -0,0 +1,15 @@
+package com.imyeyu.api.modules.common.mapper;
+
+import com.imyeyu.api.modules.common.entity.GroovyScriptVersion;
+import com.imyeyu.spring.mapper.BaseMapper;
+import org.apache.ibatis.annotations.Select;
+
+/// Groovy 脚本版本 Mapper
+///
+/// @author Codex
+/// @since 2026-09-04
+public interface GroovyScriptVersionMapper extends BaseMapper<GroovyScriptVersion, String> {
+
+	@Select("SELECT * FROM `groovy_script_version` WHERE `script_id` = #{scriptId} " + NOT_DELETE + " ORDER BY `version` DESC " + LIMIT_1)
+	GroovyScriptVersion selectLatest(String scriptId);
+}

src/main/java/com/imyeyu/api/modules/common/mapper/NotifyDetailMapper.java

@@ -16,35 +16,37 @@ import java.util.List;
  */
 public interface NotifyDetailMapper extends BaseMapper<NotifyDetail, String> {
 
+	String NOT_HIDDEN = " AND `hidden_at` IS NULL";
+
 	/** 查询用户的站内通知 */
-	@Select("SELECT * FROM `notify_detail` WHERE `msg_type` = 'INTERNAL' AND `send_to` = #{userId} " + NOT_DELETE + " ORDER BY `created_at` DESC LIMIT #{offset}, #{limit}")
+	@Select("SELECT * FROM `notify_detail` WHERE `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `send_at` < " + UNIX_TIME + NOT_HIDDEN + NOT_DELETE + " ORDER BY `created_at` DESC LIMIT #{offset}, #{limit}")
 	List<NotifyDetail> selectSiteByUserId(@Param("userId") String userId, @Param("offset") long offset, @Param("limit") long limit);
 
 	/** 查询用户的未读站内通知 */
-	@Select("SELECT * FROM `notify_detail` WHERE `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `read_at` IS NULL " + NOT_DELETE + " ORDER BY `created_at` DESC LIMIT #{offset}, #{limit}")
+	@Select("SELECT * FROM `notify_detail` WHERE `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `send_at` < " + UNIX_TIME + " AND `read_at` IS NULL " + NOT_HIDDEN + NOT_DELETE + " ORDER BY `created_at` DESC LIMIT #{offset}, #{limit}")
 	List<NotifyDetail> selectUnreadSiteByUserId(@Param("userId") String userId, @Param("offset") long offset, @Param("limit") long limit);
 
 	/** 统计用户的站内通知数量 */
-	@Select("SELECT COUNT(*) FROM `notify_detail` WHERE `msg_type` = 'INTERNAL' AND `send_to` = #{userId} " + NOT_DELETE)
+	@Select("SELECT COUNT(*) FROM `notify_detail` WHERE `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `send_at` < " + UNIX_TIME + NOT_HIDDEN + NOT_DELETE)
 	long countSiteByUserId(@Param("userId") String userId);
 
 	/** 统计用户的未读站内通知数量 */
-	@Select("SELECT COUNT(*) FROM `notify_detail` WHERE `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `read_at` IS NULL " + NOT_DELETE)
+	@Select("SELECT COUNT(*) FROM `notify_detail` WHERE `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `send_at` < " + UNIX_TIME + " AND `read_at` IS NULL " + NOT_HIDDEN + NOT_DELETE)
 	long countUnreadSiteByUserId(@Param("userId") String userId);
 
 	/** 查询用户拥有的站内通知 */
-	@Select("SELECT * FROM `notify_detail` WHERE `id` = #{detailId} AND `msg_type` = 'INTERNAL' AND `send_to` = #{userId} " + NOT_DELETE + " LIMIT 1")
+	@Select("SELECT * FROM `notify_detail` WHERE `id` = #{detailId} AND `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `send_at` < " + UNIX_TIME + NOT_HIDDEN + NOT_DELETE + " LIMIT 1")
 	NotifyDetail selectSiteByIdAndUserId(@Param("detailId") String detailId, @Param("userId") String userId);
 
-	/** 删除用户的站内通知 */
+	/** 隐藏用户的站内通知 */
-	@Update("UPDATE `notify_detail` SET `deleted_at` = " + UNIX_TIME + ", `updated_at` = " + UNIX_TIME + " WHERE `id` = #{detailId} AND `msg_type` = 'INTERNAL' AND `send_to` = #{userId} " + NOT_DELETE)
+	@Update("UPDATE `notify_detail` SET `hidden_at` = " + UNIX_TIME + ", `updated_at` = " + UNIX_TIME + " WHERE `id` = #{detailId} AND `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `send_at` < " + UNIX_TIME + NOT_HIDDEN + NOT_DELETE)
-	int deleteSiteByIdAndUserId(@Param("detailId") String detailId, @Param("userId") String userId);
+	int hideSiteByIdAndUserId(@Param("detailId") String detailId, @Param("userId") String userId);
 
 	/** 标记站内通知已读 */
-	@Update("UPDATE `notify_detail` SET `read_at` = #{readAt}, `updated_at` = " + UNIX_TIME + " WHERE `id` = #{detailId} AND `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `read_at` IS NULL " + NOT_DELETE)
+	@Update("UPDATE `notify_detail` SET `read_at` = #{readAt}, `updated_at` = " + UNIX_TIME + " WHERE `id` = #{detailId} AND `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `send_at` < " + UNIX_TIME + " AND `read_at` IS NULL " + NOT_HIDDEN + NOT_DELETE)
 	int markSiteRead(@Param("detailId") String detailId, @Param("userId") String userId, @Param("readAt") long readAt);
 
 	/** 标记用户全部站内通知已读 */
-	@Update("UPDATE `notify_detail` SET `read_at` = #{readAt}, `updated_at` = " + UNIX_TIME + " WHERE `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `read_at` IS NULL " + NOT_DELETE)
+	@Update("UPDATE `notify_detail` SET `read_at` = #{readAt}, `updated_at` = " + UNIX_TIME + " WHERE `msg_type` = 'INTERNAL' AND `send_to` = #{userId} AND `send_at` < " + UNIX_TIME + " AND `read_at` IS NULL " + NOT_HIDDEN + NOT_DELETE)
 	int markAllSiteRead(@Param("userId") String userId, @Param("readAt") long readAt);
 }

src/main/java/com/imyeyu/api/modules/common/mapper/NotifyMapper.java

@@ -1,7 +1,11 @@
 package com.imyeyu.api.modules.common.mapper;
 
 import com.imyeyu.api.modules.common.entity.Notify;
+import com.imyeyu.api.modules.common.vo.NotifyManagementItem;
 import com.imyeyu.spring.mapper.BaseMapper;
+import org.apache.ibatis.annotations.Param;
+
+import java.util.List;
 
 /**
  * 通知 Mapper
@@ -10,4 +14,28 @@ import com.imyeyu.spring.mapper.BaseMapper;
  * @since 2026-05-13 14:46
  */
 public interface NotifyMapper extends BaseMapper<Notify, String> {
+
+	/// 原子创建业务提醒
+	int insertIfAbsent(Notify notify);
+
+	/// 分页查询管理端通知
+	///
+	/// @param userId 管理员用户 ID
+	/// @param offset 分页偏移量
+	/// @param limit 分页大小
+	/// @return 通知列表
+	List<NotifyManagementItem> selectManagementPage(@Param("userId") String userId, @Param("offset") long offset, @Param("limit") long limit);
+
+	/// 统计管理端通知数量
+	///
+	/// @param userId 管理员用户 ID
+	/// @return 通知数量
+	long countManagement(@Param("userId") String userId);
+
+	/// 查询管理员可管理的通知
+	///
+	/// @param notifyId 通知 ID
+	/// @param userId 管理员用户 ID
+	/// @return 通知
+	Notify selectManagement(@Param("notifyId") String notifyId, @Param("userId") String userId);
 }

src/main/java/com/imyeyu/api/modules/common/mapper/SettingMapper.java

@@ -3,6 +3,8 @@ package com.imyeyu.api.modules.common.mapper;
 import com.imyeyu.api.modules.common.entity.Setting;
 import com.imyeyu.spring.mapper.BaseMapper;
 
+import java.util.List;
+
 /**
  * 系统配置
  *
@@ -10,4 +12,6 @@ import com.imyeyu.spring.mapper.BaseMapper;
  * @since 2021-07-20 22:26
  */
 public interface SettingMapper extends BaseMapper<Setting, String> {
+
+	List<Setting> selectPublicByQuery(String bizType, String bizId, List<String> codeList);
 }

src/main/java/com/imyeyu/api/modules/common/service/ArticleService.java

@@ -3,6 +3,8 @@ package com.imyeyu.api.modules.common.service;
 import com.imyeyu.api.modules.common.entity.Article;
 import com.imyeyu.spring.service.BaseService;
 
+import java.util.List;
+
 /**
  * 文章服务
  *
@@ -10,4 +12,10 @@ import com.imyeyu.spring.service.BaseService;
  * @since 2021-02-23 21:33
  */
 public interface ArticleService extends BaseService<Article, String> {
+
+	/// 按示例查询文章
+	///
+	/// @param example 查询示例
+	/// @return 文章列表
+	List<Article> listByExample(Article example);
 }

src/main/java/com/imyeyu/api/modules/common/service/AttachmentService.java

@@ -25,18 +25,6 @@ public interface AttachmentService extends BaseService<Attachment, String> {
 	/// @return 克隆后的附件
 	Attachment clone(String id);
 
-	/**
-	 * 按需获取或创建缩略图附件。
-	 * <p>当附件为图片或视频时，若指定尺寸的缩略图已存在则直接返回缓存，
-	 * 否则生成并持久化后返回。不支持缩略图的附件类型返回 {@code null}。</p>
-	 *
-	 * @param source        源附件（必须已持久化，mimeType 已填充）
-	 * @param requestWidth  请求宽度，{@code null} 表示未指定
-	 * @param requestHeight 请求高度，{@code null} 表示未指定
-	 * @return 缩略图附件，不支持时返回 {@code null}
-	 */
-	Attachment fetchThumb(Attachment source, Integer requestWidth, Integer requestHeight);
-
 	Attachment getByBizId(Attachment.BizType bizType, String bizId);
 
 	Attachment getByAttachType(Attachment.BizType bizType, String bizId, String attachType);
@@ -57,6 +45,12 @@ public interface AttachmentService extends BaseService<Attachment, String> {
 	 */
 	List<Attachment> listByBizId(Attachment.BizType bizType, String bizId, String... attachTypes);
 
+	default Map<String, Attachment> mapFirstImageByIdList(Attachment.BizType bizType, Collection<String> bizIdList) {
+		return mapFirstImageByIdList(bizType, bizIdList, null);
+	}
+
+	Map<String, Attachment> mapFirstImageByIdList(Attachment.BizType bizType, Collection<String> bizIdList, String attachType);
+
 	/**
 	 * 根据多个业务 ID 批量获取附件
 	 *

src/main/java/com/imyeyu/api/modules/common/service/AttachmentVariantService.java

@@ -0,0 +1,28 @@
+package com.imyeyu.api.modules.common.service;
+
+import com.imyeyu.api.modules.common.bean.attachment.ThumbnailFitMode;
+import com.imyeyu.api.modules.common.entity.Attachment;
+
+/// 附件缩略图变体服务
+///
+/// @author 夜雨
+/// @since 2026-08-21
+public interface AttachmentVariantService {
+
+	/// 按需获取或创建缩略图附件
+	///
+	/// @param source        源附件
+	/// @param requestWidth  请求宽度
+	/// @param requestHeight 请求高度
+	/// @param fitMode       缩放模式
+	/// @return 缩略图附件
+	Attachment fetchThumb(Attachment source, Integer requestWidth, Integer requestHeight, ThumbnailFitMode fitMode);
+
+	/// 删除源附件对应的全部缩略图变体
+	///
+	/// @param sourceAttachmentId 源附件 ID
+	void deleteBySourceId(String sourceAttachmentId);
+
+	/// 清理已过期的缩略图变体
+	void clearExpired();
+}

src/main/java/com/imyeyu/api/modules/common/service/GroovyScriptService.java

@@ -0,0 +1,109 @@
+package com.imyeyu.api.modules.common.service;
+
+import com.imyeyu.api.modules.common.bean.GroovyScriptExecutionResult;
+import com.imyeyu.api.modules.common.entity.GroovyScript;
+import com.imyeyu.api.modules.common.entity.GroovyScriptVersion;
+import com.imyeyu.spring.service.BaseService;
+
+import java.util.List;
+import java.util.Map;
+
+/// Groovy 脚本服务
+///
+/// 脚本仅限可信管理员维护，不能作为不可信用户代码的执行环境
+///
+/// @author Codex
+/// @since 2026-09-04
+public interface GroovyScriptService extends BaseService<GroovyScript, String> {
+
+	/// 按业务归属查询脚本列表
+	///
+	/// @param bizType 业务归属
+	/// @return 脚本列表
+	List<GroovyScript> listByBizType(GroovyScript.BizType bizType);
+
+	/// 按业务归属和代码查询脚本
+	///
+	/// @param bizType 业务归属
+	/// @param code 业务内唯一代码
+	/// @return 脚本，不存在时返回 null
+	GroovyScript getByCode(GroovyScript.BizType bizType, String code);
+
+	/// 设置脚本启用状态
+	///
+	/// @param id 脚本 ID
+	/// @param enabled true 为允许执行已发布版本
+	void setEnabled(String id, boolean enabled);
+
+	GroovyScriptVersion getLatestVersion(String scriptId);
+
+	/// 创建不可变的脚本版本
+	///
+	/// @param scriptId 脚本 ID
+	/// @param content 脚本内容
+	/// @return 新版本
+	GroovyScriptVersion createVersion(String scriptId, String content);
+
+	/// 查询脚本的全部版本
+	///
+	/// @param scriptId 脚本 ID
+	/// @return 按版本号升序的版本列表
+	List<GroovyScriptVersion> listVersion(String scriptId);
+
+	/// 发布指定版本
+	///
+	/// @param scriptId 脚本 ID
+	/// @param versionId 脚本版本 ID
+	void publish(String scriptId, String versionId);
+
+	/// 取消当前发布版本
+	///
+	/// @param scriptId 脚本 ID
+	void unpublish(String scriptId);
+
+	/// 执行已发布且启用的脚本
+	///
+	/// @param bizType 业务归属
+	/// @param code 业务内唯一代码
+	/// @param bindings 传给脚本的变量
+	/// @return 脚本返回值
+	Object execute(GroovyScript.BizType bizType, String code, Map<String, Object> bindings);
+
+	/// 执行已发布且启用的脚本并返回实际执行版本
+	///
+	/// @param bizType 业务归属
+	/// @param code 业务内唯一代码
+	/// @param bindings 传给脚本的变量
+	/// @param resultType 返回值类型
+	/// @param <T> 返回值类型
+	/// @return 脚本执行结果
+	<T> GroovyScriptExecutionResult<T> executePublished(GroovyScript.BizType bizType, String code, Map<String, Object> bindings, Class<T> resultType);
+
+	/// 按指定历史版本执行脚本
+	///
+	/// 用于按积分发生时的脚本版本复算，脚本当前是否发布或启用不影响执行；脚本返回 null 表示未命中，属合法结果
+	///
+	/// @param versionId 脚本版本 ID
+	/// @param bindings 传给脚本的变量
+	/// @param resultType 返回值类型
+	/// @param <T> 返回值类型
+	/// @return 脚本执行结果
+	<T> GroovyScriptExecutionResult<T> executeVersion(String versionId, Map<String, Object> bindings, Class<T> resultType);
+
+	/// 执行已发布且启用的脚本并验证返回值类型
+	///
+	/// @param bizType 业务归属
+	/// @param code 业务内唯一代码
+	/// @param bindings 传给脚本的变量
+	/// @param resultType 返回值类型
+	/// @param <T> 返回值类型
+	/// @return 脚本返回值
+	<T> T execute(GroovyScript.BizType bizType, String code, Map<String, Object> bindings, Class<T> resultType);
+
+	/// 清除脚本的本地编译缓存
+	///
+	/// 多实例部署时，其他节点在收到脚本变更通知后调用此方法
+	///
+	/// @param scriptId 脚本 ID
+	void invalidate(String scriptId);
+}

src/main/java/com/imyeyu/api/modules/common/service/NotifyDetailService.java

@@ -41,11 +41,11 @@ public interface NotifyDetailService extends BaseService<NotifyDetail, String> {
 	/// @return 通知详情
 	NotifyDetail getInternalByUserId(String detailId, String userId);
 
-	/// 删除当前用户拥有的站内通知详情
+	/// 隐藏当前用户拥有的站内通知详情
 	///
 	/// @param detailId 通知详情 ID
 	/// @param userId 用户 ID
-	void deleteInternalByUserId(String detailId, String userId);
+	void hideInternalByUserId(String detailId, String userId);
 
 	/// 查询用户未读站内通知数量
 	///

src/main/java/com/imyeyu/api/modules/common/service/NotifyService.java

@@ -1,6 +1,9 @@
 package com.imyeyu.api.modules.common.service;
 
 import com.imyeyu.api.modules.common.entity.Notify;
+import com.imyeyu.api.modules.common.vo.NotifyManagementItem;
+import com.imyeyu.spring.bean.Page;
+import com.imyeyu.spring.bean.PageResult;
 import com.imyeyu.spring.service.BaseService;
 
 /**
@@ -11,6 +14,37 @@ import com.imyeyu.spring.service.BaseService;
  */
 public interface NotifyService extends BaseService<Notify, String> {
 
+	/// 原子创建业务提醒，重复查重键不会创建通知详情
+	///
+	/// @param notify 通知
+	void createIfAbsent(Notify notify);
+
+	/// 分页查询当前用户创建的通知
+	///
+	/// @param page 分页参数
+	/// @param userId 用户 ID
+	/// @return 管理端通知列表
+	PageResult<NotifyManagementItem> pageManagement(Page<Notify> page, String userId);
+
+	/// 查询当前用户可管理的通知
+	///
+	/// @param notifyId 通知 ID
+	/// @param userId 用户 ID
+	/// @return 通知
+	Notify getManagement(String notifyId, String userId);
+
+	/// 删除当前用户创建的通知
+	///
+	/// @param notifyId 通知 ID
+	/// @param userId 用户 ID
+	void deleteManagement(String notifyId, String userId);
+
+	/// 取消当前用户创建的通知
+	///
+	/// @param notifyId 通知 ID
+	/// @param userId 用户 ID
+	void cancelManagement(String notifyId, String userId);
+
 	/// 取消通知中尚未成功发送的通知详情
 	///
 	/// @param notifyId 通知 ID

src/main/java/com/imyeyu/api/modules/common/service/SettingService.java

@@ -1,12 +1,13 @@
 package com.imyeyu.api.modules.common.service;
 
-import com.imyeyu.api.modules.common.bean.SettingModule;
+import com.imyeyu.api.bean.SettingEnum;
 import com.imyeyu.api.modules.common.bean.attachment.SettingSupport;
 import com.imyeyu.api.modules.common.entity.Setting;
 import com.imyeyu.java.TimiJava;
 import com.imyeyu.spring.service.BaseService;
 
 import java.util.List;
+import java.util.Map;
 
 /**
  * 配置服务
@@ -18,12 +19,22 @@ public interface SettingService extends BaseService<Setting, String> {
 
 	Setting getByCode(String bizType, String bizId, String code);
 
-	default Setting getSystem(Enum<?> bizType) {
+	default Setting getSystem(SettingEnum setting) {
-		return getByCode(SettingModule.fromClass(bizType.getClass()).name(), TimiJava.ZERO_UUID, bizType.toString());
+		return getByCode(setting.getBizType(), TimiJava.ZERO_UUID, setting.name());
 	}
 
 	List<Setting> listByBizId(String bizType, String bizId);
 
+	/**
+	 * 查询公开配置映射
+	 *
+	 * @param bizType 业务类型
+	 * @param bizId 业务 ID，可为空
+	 * @param code 配置代码列表，可为空
+	 * @return 公开配置映射
+	 */
+	Map<String, Setting> mapPublic(String bizType, String bizId, List<String> code);
+
 	default List<Setting> listBySettingSupport(SettingSupport settingSupport) {
 		String bizType = settingSupport.getClass().getSimpleName().toUpperCase();
 		return listByBizId(bizType, settingSupport.getId());

src/main/java/com/imyeyu/api/modules/common/service/SmsService.java

@@ -0,0 +1,30 @@
+package com.imyeyu.api.modules.common.service;
+
+import com.imyeyu.api.modules.common.entity.Notify;
+import com.imyeyu.api.modules.common.entity.NotifyDetail;
+
+/**
+ *
+ *
+ * @author 夜雨
+ * @since 2026-05-14 12:12
+ */
+public interface SmsService {
+
+	/**
+	 * 创建短信验证码通知
+	 *
+	 * @param detail 通知
+	 * @return 通知详情 ID
+	 */
+	String captchaCreate(Notify detail);
+
+	/**
+	 * 校验短信验证码
+	 *
+	 * @param detailId 通知详情 ID
+	 * @param captcha  请求验证码
+	 * @return 通知详情
+	 */
+	NotifyDetail captchaVerify(String detailId, String captcha);
+}

src/main/java/com/imyeyu/api/modules/common/service/TagService.java

@@ -39,4 +39,10 @@ public interface TagService extends BaseService<Tag, String> {
 	/// @param bizId 业务 ID
 	/// @param tagIdList 标签 ID 列表
 	void apply(TagApply.BizType bizType, String bizId, List<String> tagIdList);
+
+	/// 删除指定归属下的全部标签
+	///
+	/// @param ownerType 归属类型
+	/// @param ownerId 归属 ID
+	void deleteByOwner(Tag.OwnerType ownerType, String ownerId);
 }

src/main/java/com/imyeyu/api/modules/common/service/implement/ArticleServiceImplement.java

@@ -16,6 +16,8 @@ import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Service;
 
+import java.util.List;
+
 /**
  * 文章服务实现
  *
@@ -37,6 +39,11 @@ public class ArticleServiceImplement extends AbstractEntityService<Article, Stri
 		return mapper;
 	}
 
+	@Override
+	public List<Article> listByExample(Article example) {
+		return mapper.selectAllByExample(example);
+	}
+
 	@Override
 	public void create(Article article) {
 		Logger logger = new Logger(Logger.Module.COMMON, "COMMON_ARTICLE_CREATE");

src/main/java/com/imyeyu/api/modules/common/service/implement/AttachmentServiceImplement.java

@@ -3,19 +3,14 @@ package com.imyeyu.api.modules.common.service.implement;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import com.imyeyu.api.config.dbsource.TimiServerDBConfig;
-import com.imyeyu.api.modules.common.bean.attachment.MediaAttach;
-import com.imyeyu.api.modules.common.bean.attachment.Metadata;
 import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.mapper.AttachmentMapper;
 import com.imyeyu.api.modules.common.service.AttachmentService;
-import com.imyeyu.api.util.JavaCV;
+import com.imyeyu.api.modules.common.service.AttachmentVariantService;
 import com.imyeyu.io.IO;
 import com.imyeyu.java.TimiJava;
-import com.imyeyu.java.bean.CallbackArg;
 import com.imyeyu.java.bean.timi.TimiCode;
 import com.imyeyu.java.bean.timi.TimiException;
-import com.imyeyu.java.ref.Ref;
-import com.imyeyu.network.Network;
 import com.imyeyu.spring.TimiSpring;
 import com.imyeyu.spring.bean.Page;
 import com.imyeyu.spring.bean.PageResult;
@@ -26,7 +21,6 @@ import com.mongodb.client.gridfs.GridFSBucket;
 import com.mongodb.client.gridfs.model.GridFSFile;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import net.coobird.thumbnailator.Thumbnails;
 import org.apache.tika.Tika;
 import org.springframework.data.mongodb.core.query.Criteria;
 import org.springframework.data.mongodb.core.query.Query;
@@ -36,18 +30,16 @@ import org.springframework.transaction.annotation.Transactional;
 
 import javax.imageio.ImageIO;
 import java.awt.image.BufferedImage;
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
-import java.util.UUID;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 
 /**
@@ -64,6 +56,7 @@ public class AttachmentServiceImplement extends AbstractEntityService<Attachment
 	private final ObjectMapper jackson;
 	private final GridFSBucket gridFSBucket;
 	private final GridFsTemplate gridFsTemplate;
+	private final AttachmentVariantService variantService;
 
 	@Override
 	protected BaseMapper<Attachment, String> mapper() {
@@ -124,6 +117,7 @@ public class AttachmentServiceImplement extends AbstractEntityService<Attachment
 			}
 			// 有新文件时，先查旧记录获取旧 mongoId 和兜底字段
 			Attachment old = mapper.selectRaw(attachment.getId());
+			TimiException.required(old, "not found attachment");
 			// 存储新文件
 			newMongoId = gridFsTemplate.store(stream, attachment.buildMongoName()).toString();
 			GridFSFile gridFSFile = gridFsTemplate.findOne(new Query(Criteria.where("_id").is(newMongoId)));
@@ -141,6 +135,8 @@ public class AttachmentServiceImplement extends AbstractEntityService<Attachment
 
 			// 更新数据库后删除旧 GridFS 文件
 			super.update(attachment);
+			// 源文件版本已变化，旧缩略图全部失效
+			variantService.deleteBySourceId(attachment.getId());
 			gridFsTemplate.delete(Query.query(Criteria.where("_id").is(old.getMongoId())));
 		} catch (Exception e) {
 			// 新文件已上传但后续操作失败，清理新文件防止孤儿数据
@@ -155,36 +151,18 @@ public class AttachmentServiceImplement extends AbstractEntityService<Attachment
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void delete(String id) {
-		mapper.selectThumbsBySourceId(id).forEach(thumb -> super.delete(thumb.getId()));
+		variantService.deleteBySourceId(id);
 		super.delete(id);
 	}
 
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void destroy(String id) {
-		CallbackArg<Attachment> doDestroy = attach -> {
+		variantService.deleteBySourceId(id);
-			try {
+		Attachment attachment = mapper.selectRaw(id);
-				if (attach.getMongoId() != null) {
+		if (attachment != null) {
-					gridFsTemplate.delete(Query.query(Criteria.where("_id").is(attach.getMongoId())));
+			destroyAttachment(attachment);
 		}
-				if (!attach.isDeleted()) {
-					attach.setDeletedAt(Time.now());
-				}
-				attach.setIsDestroyed(true);
-				attach.setDestroyAt(Time.now());
-				mapper.update(attach);
-
-				if (Ref.toType(MediaAttach.Type.class, attach.getAttachType()) == MediaAttach.Type.THUMB) {
-					// 缩略图记录物理删除
-					mapper.destroy(attach.getId());
-				}
-			} catch (Exception e) {
-				log.error("delete mongo file error, id={}", attach.getId(), e);
-				throw new TimiException(TimiCode.ERROR, "TODO delete mongo file error");
-			}
-		};
-		mapper.selectThumbsBySourceId(id).forEach(doDestroy::handler);
-		doDestroy.handler(mapper.selectRaw(id));
 	}
 
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
@@ -216,74 +194,20 @@ public class AttachmentServiceImplement extends AbstractEntityService<Attachment
 		}
 	}
 
-	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	private void destroyAttachment(Attachment attachment) {
-	@Override
-	public Attachment fetchThumb(Attachment source, Integer requestWidth, Integer requestHeight) {
-		TimiException.requiredTrue(requestWidth != null || requestHeight != null, "required width or height");
-		String mimeType = source.getMimeType();
-		boolean isImage = mimeType != null && Set.of("image/png", "image/bmp", "image/jpeg").contains(mimeType);
-		boolean isVideo = mimeType != null && Set.of("video/mp4", "video/quicktime").contains(mimeType);
-		if (!isImage && !isVideo) {
-			return null;
-		}
-		Attachment cached = mapper.selectThumb(source.getBizType(), source.getId(), requestWidth, requestHeight);
-		if (cached != null) {
-			// 命中缓存直接返回
-			return cached;
-		}
 		try {
-			ByteArrayOutputStream thumbStream = new ByteArrayOutputStream();
+			if (attachment.getMongoId() != null) {
-			CallbackArg<InputStream> applyThumbSize = inputStream -> {
+				gridFsTemplate.delete(Query.query(Criteria.where("_id").is(attachment.getMongoId())));
-				try {
-					Thumbnails.Builder<? extends InputStream> builder = Thumbnails.of(inputStream);
-					if (requestWidth != null && requestHeight != null) {
-						builder.size(requestWidth, requestHeight).keepAspectRatio(false).toOutputStream(thumbStream);
-					} else if (requestWidth != null) {
-						builder.width(requestWidth).keepAspectRatio(true).toOutputStream(thumbStream);
-					} else {
-						builder.height(requestHeight).keepAspectRatio(true).toOutputStream(thumbStream);
 			}
-				} catch (IOException e) {
+			if (!attachment.isDeleted()) {
-					log.error("applyThumbSize error for fetchThumb", e);
+				attachment.setDeletedAt(Time.now());
-					throw new RuntimeException(e);
 			}
-			};
+			attachment.setIsDestroyed(true);
-			if (isImage) {
+			attachment.setDestroyAt(Time.now());
-				applyThumbSize.handler(source.openInputStream());
+			mapper.update(attachment);
-			} else {
-				String name = source.getName();
-				File tempFile = IO.file("temp/%s_%s".formatted(UUID.randomUUID(), name));
-				try {
-					IO.toFile(tempFile, source.openInputStream());
-					ByteArrayOutputStream baos = JavaCV.captureThumbnail(IO.getInputStream(tempFile), 2);
-					applyThumbSize.handler(IO.toInputStream(baos));
-				} finally {
-					IO.destroy(tempFile);
-				}
-			}
-			Metadata.ThumbImage thumbMeta = new Metadata.ThumbImage();
-			thumbMeta.setSourceId(source.getId());
-			thumbMeta.setSourceMongoId(source.getMongoId());
-			thumbMeta.setSourceMimeType(mimeType);
-			thumbMeta.setRequestWidth(requestWidth);
-			thumbMeta.setRequestHeight(requestHeight);
-
-			Attachment thumb = new Attachment();
-			thumb.setName(Network.simpleURIFileName(source.getName()) + ".png");
-			thumb.setBizType(source.getBizType());
-			thumb.setBizId(source.getId());
-			thumb.setAttachType(MediaAttach.Type.THUMB.toString());
-			thumb.setMetadata(jackson.valueToTree(thumbMeta));
-			thumb.setInputStream(new ByteArrayInputStream(thumbStream.toByteArray()));
-			// 缩略图 7 天后过期，额外 1 天宽限供后台任务销毁
-			long expireAt = Time.now() + 7 * Time.D;
-			thumb.setDeletedAt(expireAt);
-			thumb.setDestroyAt(expireAt + Time.D);
-			create(thumb);
-			return thumb;
 		} catch (Exception e) {
-			log.error("create thumbnail error", e);
+			log.error("delete mongo file error, id={}", attachment.getId(), e);
-			throw new TimiException(TimiCode.ERROR, "exception.attachment.create.error");
+			throw new TimiException(TimiCode.ERROR, "TODO delete mongo file error", e);
 		}
 	}
 
@@ -322,9 +246,14 @@ public class AttachmentServiceImplement extends AbstractEntityService<Attachment
 		return mapper.selectAllByBizIdList(bizType, List.of(bizId), List.of(attachTypes));
 	}
 
+	@Override
+	public Map<String, Attachment> mapFirstImageByIdList(Attachment.BizType bizType, Collection<String> bizIdList, String attachType) {
+		return mapper.selectImageByBizIdList(bizType, new HashSet<>(bizIdList), attachType).stream().collect(Collectors.toMap(Attachment::getBizId, Function.identity()));
+	}
+
 	@Override
 	public Map<String, List<Attachment>> mapByBizIdList(Attachment.BizType bizType, Collection<String> bizIdList, String... attachTypes) {
-		return mapper.selectAllByBizIdList(bizType, bizIdList, List.of(attachTypes)).stream().collect(Collectors.groupingBy(Attachment::getBizId));
+		return mapper.selectAllByBizIdList(bizType, new HashSet<>(bizIdList), List.of(attachTypes)).stream().collect(Collectors.groupingBy(Attachment::getBizId));
 	}
 
 	@Override
@@ -390,6 +319,8 @@ public class AttachmentServiceImplement extends AbstractEntityService<Attachment
 				// 将临时文件的 GridFS 存储转移至当前永久记录，废弃临时记录
 				Attachment current = mapper.selectRaw(item.getId());
 				Attachment tempFile = mapper.selectRaw(tempFileId);
+				// 源文件版本已变化，旧缩略图全部失效
+				variantService.deleteBySourceId(current.getId());
 				// 删除旧 GridFS 文件
 				gridFsTemplate.delete(Query.query(Criteria.where("_id").is(current.getMongoId())));
 				// 将存储信息从临时记录迁移到永久记录

src/main/java/com/imyeyu/api/modules/common/service/implement/AttachmentVariantServiceImplement.java

@@ -0,0 +1,377 @@
+package com.imyeyu.api.modules.common.service.implement;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.imyeyu.api.config.dbsource.TimiServerDBConfig;
+import com.imyeyu.api.modules.common.bean.attachment.MediaAttach;
+import com.imyeyu.api.modules.common.bean.attachment.ThumbnailFitMode;
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.common.entity.AttachmentVariant;
+import com.imyeyu.api.modules.common.mapper.AttachmentVariantMapper;
+import com.imyeyu.api.modules.common.service.AttachmentVariantService;
+import com.imyeyu.api.util.JavaCV;
+import com.imyeyu.io.IO;
+import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiCode;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.network.Network;
+import com.imyeyu.spring.util.Redis;
+import com.imyeyu.utils.Time;
+import com.mongodb.client.gridfs.GridFSBucket;
+import com.mongodb.client.gridfs.model.GridFSFile;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import net.coobird.thumbnailator.Thumbnails;
+import net.coobird.thumbnailator.geometry.Positions;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.dao.DuplicateKeyException;
+import org.springframework.data.mongodb.core.query.Criteria;
+import org.springframework.data.mongodb.core.query.Query;
+import org.springframework.data.mongodb.gridfs.GridFsTemplate;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import javax.imageio.ImageIO;
+import java.awt.image.BufferedImage;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
+import java.util.Set;
+import java.util.UUID;
+
+/// 附件缩略图变体服务实现
+///
+/// 负责缩略图生成、变体缓存、并发控制和变体文件清理，源附件生命周期由 `AttachmentService` 负责
+///
+/// @author 夜雨
+/// @since 2026-08-21
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class AttachmentVariantServiceImplement implements AttachmentVariantService {
+
+	private static final int THUMB_MAX_WIDTH = 4096;
+	private static final int THUMB_MAX_HEIGHT = 4096;
+	private static final long THUMB_MAX_PIXELS = 16_000_000L;
+	private static final long THUMB_CACHE_TTL = Time.D * 7;
+	private static final long THUMB_LOCK_TTL = Time.M * 10;
+	private static final double THUMB_TARGET_SECONDS = 2;
+	private static final int VARIANT_NAME_MAX_LENGTH = 255;
+	private static final String THUMB_OUTPUT_FORMAT = "png";
+	private static final String THUMB_ALGORITHM_VERSION = "v3";
+	private static final String THUMB_LOCK_KEY_PREFIX = "ATTACHMENT:THUMB:LOCK:";
+
+	private final AttachmentVariantMapper variantMapper;
+	private final ObjectMapper jackson;
+	private final GridFSBucket gridFSBucket;
+	private final GridFsTemplate gridFsTemplate;
+
+	@Qualifier("redisLocker")
+	private final Redis<String, Integer> redisLocker;
+
+	@Override
+	public Attachment fetchThumb(Attachment source, Integer requestWidth, Integer requestHeight, ThumbnailFitMode fitMode) {
+		TimiException.required(source, "not found source attachment");
+		TimiException.required(source.getId(), "not found source attachment.id");
+		TimiException.required(source.getMongoId(), "not found source attachment.mongoId");
+		TimiException.requiredTrue(requestWidth != null || requestHeight != null, "required width or height");
+		if (requestWidth != null && !(0 < requestWidth && requestWidth < THUMB_MAX_WIDTH + 1)) {
+			throw new TimiException(TimiCode.ARG_BAD, "attachment.thumbnail.width.invalid");
+		}
+		if (requestHeight != null && !(0 < requestHeight && requestHeight < THUMB_MAX_HEIGHT + 1)) {
+			throw new TimiException(TimiCode.ARG_BAD, "attachment.thumbnail.height.invalid");
+		}
+		if (requestWidth != null && requestHeight != null) {
+			long pixels = (long) requestWidth * requestHeight;
+			if (THUMB_MAX_PIXELS < pixels) {
+				throw new TimiException(TimiCode.ARG_BAD, "attachment.thumbnail.area.invalid");
+			}
+		}
+		fitMode = TimiJava.defaultIfNull(fitMode, ThumbnailFitMode.FIT);
+
+		String mimeType = source.getMimeType();
+		boolean isImage = mimeType != null && Set.of("image/png", "image/bmp", "image/jpeg").contains(mimeType);
+		boolean isVideo = mimeType != null && Set.of("video/mp4", "video/quicktime").contains(mimeType);
+		if (!isImage && !isVideo) {
+			throw new TimiException(TimiCode.ARG_BAD, "attachment.thumbnail.not.support");
+		}
+
+		int width = TimiJava.defaultIfNull(requestWidth, 0);
+		int height = TimiJava.defaultIfNull(requestHeight, 0);
+		long now = Time.now();
+		Attachment cached = variantMapper.selectValidAttachment(
+			source.getId(),
+			source.getMongoId(),
+			width,
+			height,
+			fitMode.toString(),
+			THUMB_OUTPUT_FORMAT,
+			THUMB_ALGORITHM_VERSION,
+			now
+		);
+		if (cached != null) {
+			Attachment refreshed = refreshCachedThumb(cached);
+			if (refreshed != null) {
+				return refreshed;
+			}
+		}
+
+		String lockKey = buildThumbLockKey(source, width, height, fitMode);
+		if (!redisLocker.lock(lockKey, 1, THUMB_LOCK_TTL)) {
+			throw new TimiException(TimiCode.ERROR_SERVICE_BUSY, "attachment.thumbnail.generating");
+		}
+		try {
+			cached = variantMapper.selectValidAttachment(
+				source.getId(),
+				source.getMongoId(),
+				width,
+				height,
+				fitMode.toString(),
+				THUMB_OUTPUT_FORMAT,
+				THUMB_ALGORITHM_VERSION,
+				Time.now()
+			);
+			if (cached != null) {
+				Attachment refreshed = refreshCachedThumb(cached);
+				if (refreshed != null) {
+					return refreshed;
+				}
+			}
+			AttachmentVariant oldVariant = variantMapper.selectByKey(
+				source.getId(),
+				source.getMongoId(),
+				width,
+				height,
+				fitMode.toString(),
+				THUMB_OUTPUT_FORMAT,
+				THUMB_ALGORITHM_VERSION
+			);
+			if (oldVariant != null) {
+				deleteVariant(oldVariant);
+			}
+			File thumbFile = null;
+			AttachmentVariant variant = null;
+			boolean variantInserted = false;
+			try {
+				thumbFile = createThumbFile(source, requestWidth, requestHeight, fitMode, isImage);
+				variant = new AttachmentVariant();
+				variant.setId(UUID.randomUUID().toString());
+				variant.setName(buildVariantName(source.getName()));
+				variant.setMimeType("image/" + THUMB_OUTPUT_FORMAT);
+				long expireAt = Time.now() + THUMB_CACHE_TTL;
+				variant.setSourceAttachmentId(source.getId());
+				variant.setSourceMongoId(source.getMongoId());
+				variant.setSourceMd5(source.getMd5());
+				variant.setRequestWidth(width);
+				variant.setRequestHeight(height);
+				variant.setFitMode(fitMode);
+				variant.setOutputFormat(THUMB_OUTPUT_FORMAT);
+				variant.setAlgorithmVersion(THUMB_ALGORITHM_VERSION);
+				variant.setCreatedAt(Time.now());
+				variant.setExpireAt(expireAt);
+				BufferedImage image = ImageIO.read(thumbFile);
+				if (image != null) {
+					ObjectNode metadata = jackson.createObjectNode();
+					metadata.put("width", image.getWidth());
+					metadata.put("height", image.getHeight());
+					variant.setMetadata(metadata);
+				}
+				try (InputStream inputStream = Files.newInputStream(thumbFile.toPath())) {
+					String mongoId = gridFsTemplate.store(inputStream, variant.getName()).toString();
+					GridFSFile gridFSFile = gridFsTemplate.findOne(new Query(Criteria.where("_id").is(mongoId)));
+					variant.setMongoId(mongoId);
+					variant.setSize(gridFSFile.getLength());
+					try (InputStream md5InputStream = gridFSBucket.openDownloadStream(gridFSFile.getObjectId())) {
+						variant.setMd5(IO.md5(md5InputStream));
+					}
+				}
+				try {
+					variantMapper.insert(variant);
+					variantInserted = true;
+				} catch (DuplicateKeyException e) {
+					destroyVariantFile(variant);
+					Attachment concurrent = variantMapper.selectValidAttachment(
+						source.getId(),
+						source.getMongoId(),
+						width,
+						height,
+						fitMode.toString(),
+						THUMB_OUTPUT_FORMAT,
+						THUMB_ALGORITHM_VERSION,
+						Time.now()
+					);
+					if (concurrent != null) {
+						Attachment refreshed = refreshCachedThumb(concurrent);
+						if (refreshed != null) {
+							return refreshed;
+						}
+					}
+					throw e;
+				}
+				return toThumbAttachment(source, variant);
+			} catch (Exception e) {
+				if (variant != null) {
+					destroyVariantFile(variant);
+					if (variantInserted) {
+						variantMapper.delete(variant.getId());
+					}
+				}
+				throw e;
+			} finally {
+				IO.destroy(thumbFile);
+			}
+		} catch (TimiException e) {
+			throw e;
+		} catch (Exception e) {
+			log.error("create thumbnail error", e);
+			throw new TimiException(TimiCode.ERROR, "exception.attachment.create.error", e);
+		} finally {
+			redisLocker.releaseLock(lockKey);
+		}
+	}
+
+	/// 延长已命中缩略图缓存的有效期
+	///
+	/// @param cached 已命中的缩略图
+	/// @return 更新成功时返回刷新后的缩略图，记录已不存在或已过期时返回 `null`
+	private Attachment refreshCachedThumb(Attachment cached) {
+		long now = Time.now();
+		long expireAt = now + THUMB_CACHE_TTL;
+		if (!(0 < variantMapper.updateExpireAt(cached.getId(), now, expireAt))) {
+			return null;
+		}
+		cached.setDestroyAt(expireAt);
+		return cached;
+	}
+
+	private String buildThumbLockKey(Attachment source, int width, int height, ThumbnailFitMode fitMode) {
+		return "%s%s:%s:%s:%s:%s".formatted(
+			THUMB_LOCK_KEY_PREFIX,
+			source.getId(),
+			source.getMongoId(),
+			width,
+			height,
+			fitMode
+		);
+	}
+
+	/// 构建不超过数据库字段长度的变体名称
+	///
+	/// @param sourceName 源附件名称
+	/// @return 变体名称
+	private String buildVariantName(String sourceName) {
+		String suffix = "." + THUMB_OUTPUT_FORMAT;
+		String baseName = Network.simpleURIFileName(sourceName);
+		int maxBaseLength = VARIANT_NAME_MAX_LENGTH - suffix.length();
+		if (maxBaseLength < baseName.codePointCount(0, baseName.length())) {
+			baseName = baseName.substring(0, baseName.offsetByCodePoints(0, maxBaseLength));
+		}
+		return baseName + suffix;
+	}
+
+	private File createThumbFile(
+		Attachment source,
+		Integer requestWidth,
+		Integer requestHeight,
+		ThumbnailFitMode fitMode,
+		boolean isImage
+	) throws Exception {
+		File thumbFile = Files.createTempFile("timi-thumb-", ".png").toFile();
+		try {
+			if (isImage) {
+				try (InputStream inputStream = source.openInputStream()) {
+					resize(inputStream, thumbFile, requestWidth, requestHeight, fitMode);
+				}
+				return thumbFile;
+			}
+
+			try (InputStream inputStream = source.openInputStream()) {
+				ByteArrayOutputStream frame = JavaCV.captureThumbnail(inputStream, THUMB_TARGET_SECONDS);
+				if (!(0 < frame.size())) {
+					throw new TimiException(TimiCode.ERROR_NOT_SUPPORT, "attachment.thumbnail.video.frame.empty");
+				}
+				try (InputStream frameInputStream = new ByteArrayInputStream(frame.toByteArray())) {
+					resize(frameInputStream, thumbFile, requestWidth, requestHeight, fitMode);
+				}
+				return thumbFile;
+			}
+		} catch (Exception e) {
+			IO.destroy(thumbFile);
+			throw e;
+		}
+	}
+
+	private void resize(
+		InputStream inputStream,
+		File outputFile,
+		Integer requestWidth,
+		Integer requestHeight,
+		ThumbnailFitMode fitMode
+	) throws IOException {
+		Thumbnails.Builder<? extends InputStream> builder = Thumbnails.of(inputStream)
+			.useExifOrientation(true)
+			.outputFormat(THUMB_OUTPUT_FORMAT);
+		if (requestWidth != null && requestHeight != null) {
+			switch (fitMode) {
+				case FIT -> builder.size(requestWidth, requestHeight).keepAspectRatio(true);
+				case COVER -> builder.size(requestWidth, requestHeight).keepAspectRatio(true).crop(Positions.CENTER);
+				case STRETCH -> builder.size(requestWidth, requestHeight).keepAspectRatio(false);
+			}
+		} else if (requestWidth != null) {
+			builder.width(requestWidth).keepAspectRatio(true);
+		} else {
+			builder.height(requestHeight).keepAspectRatio(true);
+		}
+		builder.toFile(outputFile);
+	}
+
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void deleteBySourceId(String sourceAttachmentId) {
+		for (AttachmentVariant variant : variantMapper.selectBySourceAttachmentId(sourceAttachmentId)) {
+			deleteVariant(variant);
+		}
+	}
+
+	private void deleteVariant(AttachmentVariant variant) {
+		destroyVariantFile(variant);
+		variantMapper.delete(variant.getId());
+	}
+
+	private void destroyVariantFile(AttachmentVariant variant) {
+		if (variant.getMongoId() != null) {
+			gridFsTemplate.delete(Query.query(Criteria.where("_id").is(variant.getMongoId())));
+		}
+	}
+
+	private Attachment toThumbAttachment(Attachment source, AttachmentVariant variant) {
+		Attachment thumb = new Attachment();
+		thumb.setId(variant.getId());
+		thumb.setBizType(source.getBizType());
+		thumb.setBizId(source.getId());
+		thumb.setAttachType(MediaAttach.Type.THUMB.toString());
+		thumb.setMongoId(variant.getMongoId());
+		thumb.setName(variant.getName());
+		thumb.setMimeType(variant.getMimeType());
+		thumb.setMetadata(variant.getMetadata());
+		thumb.setSize(variant.getSize());
+		thumb.setMd5(variant.getMd5());
+		thumb.setIsDestroyed(false);
+		thumb.setDestroyAt(variant.getExpireAt());
+		return thumb;
+	}
+
+	@Override
+	public void clearExpired() {
+		for (AttachmentVariant variant : variantMapper.selectExpired(Time.now())) {
+			try {
+				deleteVariant(variant);
+			} catch (Exception e) {
+				log.error("clear expired thumbnail variant error, id={}", variant.getId(), e);
+			}
+		}
+	}
+}

src/main/java/com/imyeyu/api/modules/common/service/implement/GroovyScriptServiceImplement.java

@@ -0,0 +1,299 @@
+package com.imyeyu.api.modules.common.service.implement;
+
+import com.imyeyu.api.config.dbsource.TimiServerDBConfig;
+import com.imyeyu.api.modules.common.bean.GroovyScriptExecutionResult;
+import com.imyeyu.api.modules.common.entity.GroovyScript;
+import com.imyeyu.api.modules.common.entity.GroovyScriptVersion;
+import com.imyeyu.api.modules.common.mapper.GroovyScriptMapper;
+import com.imyeyu.api.modules.common.mapper.GroovyScriptVersionMapper;
+import com.imyeyu.api.modules.common.service.GroovyScriptService;
+import com.imyeyu.java.bean.timi.TimiCode;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.mapper.BaseMapper;
+import com.imyeyu.spring.service.AbstractEntityService;
+import groovy.lang.Binding;
+import groovy.lang.GroovyClassLoader;
+import groovy.lang.Script;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.transaction.support.TransactionSynchronization;
+import org.springframework.transaction.support.TransactionSynchronizationManager;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+/// Groovy 脚本服务实现
+///
+/// 每个已编译版本使用独立类加载器，缓存失效后可释放对应类及其元数据
+///
+/// @author Codex
+/// @since 2026-09-04
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class GroovyScriptServiceImplement extends AbstractEntityService<GroovyScript, String> implements GroovyScriptService {
+
+	private final GroovyScriptMapper mapper;
+	private final GroovyScriptVersionMapper versionMapper;
+	private final Map<String, CompiledScript> compiledScriptMap = new ConcurrentHashMap<>();
+
+	@Override
+	protected BaseMapper<GroovyScript, String> mapper() {
+		return mapper;
+	}
+
+	@Override
+	public List<GroovyScript> listByBizType(GroovyScript.BizType bizType) {
+		TimiException.required(bizType, "未找到脚本业务归属");
+		GroovyScript example = new GroovyScript();
+		example.setBizType(bizType);
+		return mapper.selectAllByExample(example);
+	}
+
+	@Override
+	public GroovyScript getByCode(GroovyScript.BizType bizType, String code) {
+		GroovyScript example = new GroovyScript();
+		example.setBizType(bizType);
+		example.setCode(code);
+		return mapper.selectByExample(example);
+	}
+
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void create(GroovyScript script) {
+		TimiException.required(script, "未找到脚本");
+		TimiException.required(script.getBizType(), "未找到脚本业务归属");
+		TimiException.required(script.getCode(), "未找到脚本代码");
+		TimiException.required(script.getName(), "未找到脚本名称");
+		TimiException.requiredNull(getByCode(script.getBizType(), script.getCode()), "Groovy 脚本已存在");
+		script.setEnabled(false);
+		script.setPublishedVersionId(null);
+		super.create(script);
+	}
+
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void update(GroovyScript script) {
+		TimiException.required(script, "未找到脚本");
+		TimiException.required(script.getId(), "未找到脚本 ID");
+		TimiException.required(script.getName(), "未找到脚本名称");
+		GroovyScript dbScript = get(script.getId());
+		TimiException.required(dbScript, "未找到脚本");
+		dbScript.setName(script.getName());
+		dbScript.setDescription(script.getDescription());
+		mapper.update(dbScript);
+	}
+
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void setEnabled(String id, boolean enabled) {
+		GroovyScript script = requireScript(id);
+		script.setEnabled(enabled);
+		mapper.update(script);
+		invalidateAfterCommit(script.getId());
+	}
+
+	@Override
+	public GroovyScriptVersion getLatestVersion(String scriptId) {
+		return versionMapper.selectLatest(scriptId);
+	}
+
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public GroovyScriptVersion createVersion(String scriptId, String content) {
+		requireScript(scriptId);
+		TimiException.required(content, "未找到脚本内容");
+		TimiException.requiredTrue(!content.isBlank(), "脚本内容不能为空");
+
+		GroovyScriptVersion version = new GroovyScriptVersion();
+		version.setScriptId(scriptId);
+		version.setVersion(versionMapper.selectLatest(scriptId).getVersion() + 1);
+		version.setContent(content);
+		version.setChecksum(checksum(content));
+		versionMapper.insert(version);
+		return version;
+	}
+
+	@Override
+	public List<GroovyScriptVersion> listVersion(String scriptId) {
+		TimiException.required(scriptId, "未找到脚本 ID");
+		GroovyScriptVersion example = new GroovyScriptVersion();
+		example.setScriptId(scriptId);
+		List<GroovyScriptVersion> versionList = new ArrayList<>(versionMapper.selectAllByExample(example));
+		versionList.sort(Comparator.comparing(GroovyScriptVersion::getVersion));
+		return versionList;
+	}
+
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void publish(String scriptId, String versionId) {
+		GroovyScript script = requireScript(scriptId);
+		GroovyScriptVersion version = requireVersion(versionId);
+		TimiException.requiredTrue(script.getId().equals(version.getScriptId()), "脚本版本不属于当前脚本");
+		script.setPublishedVersionId(version.getId());
+		mapper.update(script);
+		invalidateAfterCommit(script.getId());
+	}
+
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void unpublish(String scriptId) {
+		GroovyScript script = requireScript(scriptId);
+		script.setPublishedVersionId(null);
+		mapper.update(script);
+		invalidateAfterCommit(script.getId());
+	}
+
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void delete(String id) {
+		requireScript(id);
+		super.delete(id);
+		invalidateAfterCommit(id);
+	}
+
+	@Override
+	public Object execute(GroovyScript.BizType bizType, String code, Map<String, Object> bindings) {
+		return executePublished(bizType, code, bindings, Object.class).result();
+	}
+
+	@Override
+	public <T> GroovyScriptExecutionResult<T> executePublished(GroovyScript.BizType bizType, String code, Map<String, Object> bindings, Class<T> resultType) {
+		TimiException.required(bizType, "未找到脚本业务归属");
+		TimiException.required(code, "未找到脚本代码");
+		TimiException.required(resultType, "未找到返回值类型");
+		GroovyScript script = getByCode(bizType, code);
+		TimiException.required(script, "未找到 Groovy 脚本");
+		TimiException.requiredTrue(Boolean.TRUE.equals(script.getEnabled()), "Groovy 脚本已停用");
+		TimiException.required(script.getPublishedVersionId(), "Groovy 脚本尚未发布");
+		GroovyScriptExecutionResult<T> result = executeVersion(script.getPublishedVersionId(), bindings, resultType);
+		TimiException.requiredTrue(script.getId().equals(result.scriptId()), "Groovy 脚本已发布版本无效");
+		return result;
+	}
+
+	@Override
+	public <T> T execute(GroovyScript.BizType bizType, String code, Map<String, Object> bindings, Class<T> resultType) {
+		return executePublished(bizType, code, bindings, resultType).result();
+	}
+
+	@Override
+	public <T> GroovyScriptExecutionResult<T> executeVersion(String versionId, Map<String, Object> bindings, Class<T> resultType) {
+		TimiException.required(resultType, "未找到返回值类型");
+		GroovyScriptVersion version = requireVersion(versionId);
+		CompiledScript compiledScript = compiledScriptMap.computeIfAbsent(cacheKey(version), key -> compile(version.getScriptId(), version));
+		try {
+			Object result = compiledScript.execute(bindings);
+			TimiException.requiredTrue(result == null || resultType.isInstance(result), "Groovy 脚本返回值类型不匹配");
+			return new GroovyScriptExecutionResult<>(version.getScriptId(), version.getId(), version.getVersion(), version.getChecksum(), resultType.cast(result));
+		} catch (TimiException e) {
+			throw e;
+		} catch (RuntimeException e) {
+			log.warn("Groovy 脚本执行失败，scriptId={}, versionId={}", version.getScriptId(), version.getId(), e);
+			throw new TimiException(TimiCode.ERROR, "Groovy 脚本执行失败");
+		}
+	}
+
+	@Override
+	public void invalidate(String scriptId) {
+		if (scriptId == null) {
+			return;
+		}
+		compiledScriptMap.entrySet().removeIf(entry -> {
+			if (!scriptId.equals(entry.getValue().scriptId())) {
+				return false;
+			}
+			entry.getValue().close();
+			return true;
+		});
+	}
+
+	private GroovyScript requireScript(String id) {
+		TimiException.required(id, "未找到脚本 ID");
+		GroovyScript script = get(id);
+		TimiException.required(script, "未找到脚本");
+		return script;
+	}
+
+	private GroovyScriptVersion requireVersion(String id) {
+		TimiException.required(id, "未找到脚本版本 ID");
+		GroovyScriptVersion version = versionMapper.select(id);
+		TimiException.required(version, "未找到脚本版本");
+		return version;
+	}
+
+	private String cacheKey(GroovyScriptVersion version) {
+		return "%s:%s".formatted(version.getId(), version.getChecksum());
+	}
+
+	private CompiledScript compile(String scriptId, GroovyScriptVersion version) {
+		GroovyClassLoader classLoader = new GroovyClassLoader(getClass().getClassLoader());
+		try {
+			Class<?> type = classLoader.parseClass(version.getContent(), "GroovyScript_%s_%d.groovy".formatted(version.getId().replace('-', '_'), version.getVersion()));
+			return new CompiledScript(scriptId, type.asSubclass(Script.class), classLoader);
+		} catch (RuntimeException e) {
+			close(classLoader);
+			log.warn("Groovy 脚本编译失败，scriptId={}, versionId={}", scriptId, version.getId(), e);
+			throw new TimiException(TimiCode.ERROR, "Groovy 脚本编译失败");
+		}
+	}
+
+	private String checksum(String content) {
+		try {
+			return java.util.HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(content.getBytes(StandardCharsets.UTF_8)));
+		} catch (NoSuchAlgorithmException e) {
+			throw new IllegalStateException("JVM 缺少 SHA-256 算法", e);
+		}
+	}
+
+	private void invalidateAfterCommit(String scriptId) {
+		if (!TransactionSynchronizationManager.isSynchronizationActive()) {
+			invalidate(scriptId);
+			return;
+		}
+		TransactionSynchronizationManager.registerSynchronization(new TransactionSynchronization() {
+
+			@Override
+			public void afterCommit() {
+				invalidate(scriptId);
+			}
+		});
+	}
+
+	private void close(GroovyClassLoader classLoader) {
+		try {
+			classLoader.close();
+		} catch (IOException e) {
+			log.warn("关闭 Groovy 脚本类加载器失败", e);
+		}
+	}
+
+	private record CompiledScript(String scriptId, Class<? extends Script> type, GroovyClassLoader classLoader) {
+
+		private Object execute(Map<String, Object> bindings) {
+			try {
+				Script script = type.getDeclaredConstructor().newInstance();
+				script.setBinding(new Binding(bindings == null ? Map.of() : new HashMap<>(bindings)));
+				return script.run();
+			} catch (ReflectiveOperationException e) {
+				throw new IllegalStateException("Groovy 脚本实例化失败", e);
+			}
+		}
+
+		private void close() {
+			try {
+				classLoader.close();
+			} catch (IOException ignored) {
+			}
+		}
+	}
+}

src/main/java/com/imyeyu/api/modules/common/service/implement/MailQueueServiceImplement.java

@@ -60,7 +60,7 @@ public class MailQueueServiceImplement extends AbstractQueueService<MailQueue, N
 		message.setFrom(queue.getSendFrom());
 		message.setTo(queue.getSendTo());
 		message.setSubject(queue.getSubject());
-		message.setText(queue.getData());
+		message.setText(queue.getContent());
 		mailSender.send(message);
 		log.info("邮件发送成功，目标：{}", queue.getSendTo());
 	}

src/main/java/com/imyeyu/api/modules/common/service/implement/NotifyDetailServiceImplement.java

@@ -1,10 +1,12 @@
 package com.imyeyu.api.modules.common.service.implement;
 
 import com.imyeyu.api.config.dbsource.TimiServerDBConfig;
-import com.imyeyu.api.modules.common.entity.NotifyDetail;
+import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.entity.Notify;
+import com.imyeyu.api.modules.common.entity.NotifyDetail;
 import com.imyeyu.api.modules.common.mapper.NotifyDetailMapper;
 import com.imyeyu.api.modules.common.mapper.NotifyMapper;
+import com.imyeyu.api.modules.common.service.AttachmentService;
 import com.imyeyu.api.modules.common.service.NotifyDetailService;
 import com.imyeyu.java.TimiJava;
 import com.imyeyu.java.bean.timi.TimiCode;
@@ -19,6 +21,7 @@ import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 import java.util.List;
+import java.util.Map;
 
 /**
  * 通知详情服务实现
@@ -31,6 +34,7 @@ import java.util.List;
 public class NotifyDetailServiceImplement extends AbstractEntityService<NotifyDetail, String> implements NotifyDetailService {
 
 	private final NotifyMapper notifyMapper;
+	private final AttachmentService attachmentService;
 
 	private final NotifyDetailMapper mapper;
 
@@ -53,15 +57,22 @@ public class NotifyDetailServiceImplement extends AbstractEntityService<NotifyDe
 		if (detail.getMsgType() == NotifyDetail.MsgType.INTERNAL) {
 			TimiException.required(detail.getSendTo(), "未找到站内通知接收用户 ID");
 		}
+		detail.setContentType(TimiJava.defaultIfNull(detail.getContentType(), detail.getMsgType() == NotifyDetail.MsgType.INTERNAL
+			? NotifyDetail.ContentType.TIP_TAP
+			: NotifyDetail.ContentType.TEXT));
 
 		detail.setRetry(TimiJava.defaultIfNull(detail.getRetry(), 1));
 		detail.setSendAt(TimiJava.defaultIfNull(detail.getSendAt(), Time.now()));
 		detail.setTimeoutAt(TimiJava.defaultIfNull(detail.getTimeoutAt(), detail.getSendAt() + Time.D));
-		detail.setStatus(detail.getMsgType() == NotifyDetail.MsgType.INTERNAL
+		boolean scheduled = Time.now() < detail.getSendAt();
+		detail.setStatus(detail.getMsgType() == NotifyDetail.MsgType.INTERNAL && !scheduled
 			? NotifyDetail.Status.REMINDED
 			: NotifyDetail.Status.WAITING);
 		detail.setReadAt(null);
 		super.create(detail);
+		if (detail.getMsgType() == NotifyDetail.MsgType.INTERNAL) {
+			attachmentService.updateByBizId(Attachment.BizType.NOTIFY_DETAIL, detail.getId(), detail.getAttachmentList());
+		}
 
 		if (detail.getMsgType().isQueue()) {
 			// 加入外部消息队列
@@ -77,7 +88,9 @@ public class NotifyDetailServiceImplement extends AbstractEntityService<NotifyDe
 	public List<NotifyDetail> listByNotifyId(String notifyId) {
 		NotifyDetail example = new NotifyDetail();
 		example.setNotifyId(notifyId);
-		return mapper.selectAllByExample(example);
+		List<NotifyDetail> detailList = mapper.selectAllByExample(example);
+		loadAttachments(detailList);
+		return detailList;
 	}
 
 	/// 删除通知详情
@@ -135,9 +148,11 @@ public class NotifyDetailServiceImplement extends AbstractEntityService<NotifyDe
 		result.setTotal(unreadOnly
 			? mapper.countUnreadSiteByUserId(userId)
 			: mapper.countSiteByUserId(userId));
-		result.setList(unreadOnly
+		List<NotifyDetail> detailList = unreadOnly
 			? mapper.selectUnreadSiteByUserId(userId, validPage.getOffset(), validPage.getLimit())
-			: mapper.selectSiteByUserId(userId, validPage.getOffset(), validPage.getLimit()));
+			: mapper.selectSiteByUserId(userId, validPage.getOffset(), validPage.getLimit());
+		loadAttachments(detailList);
+		result.setList(detailList);
 		return result;
 	}
 
@@ -152,19 +167,51 @@ public class NotifyDetailServiceImplement extends AbstractEntityService<NotifyDe
 		TimiException.required(userId, "未找到用户 ID");
 		NotifyDetail detail = mapper.selectSiteByIdAndUserId(detailId, userId);
 		TimiException.required(detail, "未找到站内通知");
+		loadAttachments(detail);
 		return detail;
 	}
 
-	/// 删除当前用户拥有的站内通知详情
+	/// 回填通知详情的媒体附件
+	///
+	/// @param detailList 通知详情列表
+	private void loadAttachments(List<NotifyDetail> detailList) {
+		List<String> detailIdList = detailList.stream()
+				.filter(detail -> detail.getMsgType() == NotifyDetail.MsgType.INTERNAL)
+				.map(NotifyDetail::getId)
+				.toList();
+		if (detailIdList.isEmpty()) {
+			return;
+		}
+		Map<String, List<Attachment>> attachmentMap = attachmentService.mapByBizIdList(
+			Attachment.BizType.NOTIFY_DETAIL,
+			detailIdList
+		);
+		for (NotifyDetail detail : detailList) {
+			if (detail.getMsgType() == NotifyDetail.MsgType.INTERNAL) {
+				detail.setAttachmentList(attachmentMap.getOrDefault(detail.getId(), List.of()));
+			}
+		}
+	}
+
+	/// 回填通知详情的媒体附件
+	///
+	/// @param detail 通知详情
+	private void loadAttachments(NotifyDetail detail) {
+		if (detail.getMsgType() == NotifyDetail.MsgType.INTERNAL) {
+			detail.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.NOTIFY_DETAIL, detail.getId()));
+		}
+	}
+
+	/// 隐藏当前用户拥有的站内通知详情
 	///
 	/// @param detailId 通知详情 ID
 	/// @param userId 用户 ID
 	@Override
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
-	public void deleteInternalByUserId(String detailId, String userId) {
+	public void hideInternalByUserId(String detailId, String userId) {
 		TimiException.required(detailId, "未找到通知详情 ID");
 		TimiException.required(userId, "未找到用户 ID");
-		int affected = mapper.deleteSiteByIdAndUserId(detailId, userId);
+		int affected = mapper.hideSiteByIdAndUserId(detailId, userId);
 		TimiException.requiredTrue(0 < affected, "未找到站内通知");
 	}
 

src/main/java/com/imyeyu/api/modules/common/service/implement/NotifyServiceImplement.java

@@ -6,20 +6,23 @@ import com.imyeyu.api.modules.common.entity.NotifyDetail;
 import com.imyeyu.api.modules.common.mapper.NotifyMapper;
 import com.imyeyu.api.modules.common.service.NotifyDetailService;
 import com.imyeyu.api.modules.common.service.NotifyService;
-import com.imyeyu.api.modules.system.entity.Logger;
+import com.imyeyu.api.modules.common.vo.NotifyManagementItem;
-import com.imyeyu.api.modules.system.service.LoggerService;
+import com.imyeyu.api.modules.system.audit.AuditOperation;
-import com.imyeyu.api.modules.user.service.UserLoginService;
+import com.imyeyu.api.modules.system.audit.OperationAudit;
 import com.imyeyu.java.TimiJava;
 import com.imyeyu.java.bean.timi.TimiCode;
 import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.bean.Page;
+import com.imyeyu.spring.bean.PageResult;
 import com.imyeyu.spring.mapper.BaseMapper;
 import com.imyeyu.spring.service.AbstractEntityService;
+import com.imyeyu.utils.Time;
 import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 import java.util.List;
+import java.util.UUID;
 
 /**
  * 通知服务实现
@@ -27,13 +30,10 @@ import java.util.List;
  * @author 夜雨
  * @since 2026-05-13 14:46
  */
-@Slf4j
 @Service
 @RequiredArgsConstructor
 public class NotifyServiceImplement extends AbstractEntityService<Notify, String> implements NotifyService {
 
-	private final LoggerService loggerService;
-	private final UserLoginService userLoginService;
 	private final NotifyDetailService detailService;
 
 	private final NotifyMapper mapper;
@@ -46,50 +46,112 @@ public class NotifyServiceImplement extends AbstractEntityService<Notify, String
 	/// 创建通知并级联创建通知详情
 	///
 	/// @param notify 通知
+	@OperationAudit(AuditOperation.COMMON_NOTIFY_CREATE)
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void create(Notify notify) {
-		Logger logger = new Logger(Logger.Module.COMMON, "COMMON_NOTIFY_CREATE");
+		prepareCreate(notify);
-		try {
+		super.create(notify);
+		createDetails(notify);
+	}
+
+	/// 原子创建业务提醒并级联创建通知详情
+	///
+	/// @param notify 通知
+	@OperationAudit(AuditOperation.COMMON_NOTIFY_CREATE)
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void createIfAbsent(Notify notify) {
+		prepareCreate(notify);
+		if (mapper.insertIfAbsent(notify) == 0) {
+			return;
+		}
+		createDetails(notify);
+	}
+
+	/// 校验并补全通知创建字段
+	///
+	/// @param notify 通知
+	private void prepareCreate(Notify notify) {
 		TimiException.required(notify, "未找到通知");
 		TimiException.required(notify.getDetailList(), "未找到通知详情列表");
-			super.create(notify);
+		notify.setId(TimiJava.defaultIfEmpty(notify.getId(), UUID.randomUUID().toString()));
-
+		notify.setCreatedBy(TimiJava.defaultIfEmpty(notify.getCreatedBy(), TimiJava.ZERO_UUID));
-			String sendFrom = null;
+		notify.setCreatedAt(TimiJava.defaultIfNull(notify.getCreatedAt(), Time.now()));
-			if (userLoginService.isLogged()) {
+		notify.setUpdatedAt(null);
-				sendFrom = userLoginService.getRequireLoginUserId();
+		notify.setDeletedAt(null);
 	}
+
+	/// 创建通知详情
+	///
+	/// @param notify 通知
+	private void createDetails(Notify notify) {
 		for (NotifyDetail detail : notify.getDetailList()) {
 			detail.setNotifyId(notify.getId());
-				if (TimiJava.isNotEmpty(sendFrom)) {
+			detail.setSendFrom(TimiJava.defaultIfEmpty(detail.getSendFrom(), TimiJava.ZERO_UUID));
-					detail.setSendFrom(sendFrom);
-				}
 			detailService.create(detail);
 		}
-			logger.setLevel(Logger.Level.INFO);
-			logger.setResult(notify.getId());
-		} catch (TimiException e) {
-			logger.setLevel(Logger.Level.WARN);
-			logger.setException(e.getMessage());
-			throw e;
-		} catch (Exception e) {
-			logger.setLevel(Logger.Level.ERROR);
-			logger.setException(TimiJava.serializeThrowable(e));
-			log.error("创建通知失败", e);
-			throw new TimiException(TimiCode.ERROR, "创建通知失败", e);
-		} finally {
-			loggerService.create(logger);
 	}
+
+	/// 分页查询当前用户创建的通知
+	///
+	/// @param page 分页参数
+	/// @param userId 用户 ID
+	/// @return 管理端通知列表
+	@Override
+	public PageResult<NotifyManagementItem> pageManagement(Page<Notify> page, String userId) {
+		TimiException.required(userId, "未找到用户 ID");
+		Page<Notify> validPage = TimiJava.defaultIfNull(page, new Page<>());
+		PageResult<NotifyManagementItem> result = new PageResult<>();
+		result.setTotal(mapper.countManagement(userId));
+		result.setList(mapper.selectManagementPage(userId, validPage.getOffset(), validPage.getLimit()));
+		return result;
+	}
+
+	/// 查询当前用户可管理的通知
+	///
+	/// @param notifyId 通知 ID
+	/// @param userId 用户 ID
+	/// @return 通知
+	@Override
+	public Notify getManagement(String notifyId, String userId) {
+		TimiException.required(notifyId, "未找到通知 ID");
+		TimiException.required(userId, "未找到用户 ID");
+		Notify notify = mapper.selectManagement(notifyId, userId);
+		TimiException.required(notify, "未找到可管理的通知");
+		return notify;
+	}
+
+	/// 删除当前用户创建的通知
+	///
+	/// @param notifyId 通知 ID
+	/// @param userId 用户 ID
+	@Override
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@OperationAudit(AuditOperation.COMMON_NOTIFY_DELETE)
+	public void deleteManagement(String notifyId, String userId) {
+		getManagement(notifyId, userId);
+		delete(notifyId);
+	}
+
+	/// 取消当前用户创建的通知
+	///
+	/// @param notifyId 通知 ID
+	/// @param userId 用户 ID
+	@Override
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	public void cancelManagement(String notifyId, String userId) {
+		getManagement(notifyId, userId);
+		cancel(notifyId);
 	}
 
 	/// 删除通知并级联软删除通知详情
 	///
 	/// @param notifyId 通知 ID
+	@OperationAudit(AuditOperation.COMMON_NOTIFY_DELETE)
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void delete(String notifyId) {
-		Logger logger = new Logger(Logger.Module.COMMON, "COMMON_NOTIFY_DELETE");
-		try {
 		TimiException.required(notifyId, "未找到通知 ID");
 		TimiException.required(get(notifyId), "未找到通知");
 		List<NotifyDetail> detailList = detailService.listByNotifyId(notifyId);
@@ -97,20 +159,6 @@ public class NotifyServiceImplement extends AbstractEntityService<Notify, String
 			detailService.delete(detail.getId());
 		}
 		super.delete(notifyId);
-			logger.setLevel(Logger.Level.INFO);
-			logger.setResult(notifyId);
-		} catch (TimiException e) {
-			logger.setLevel(Logger.Level.WARN);
-			logger.setException(e.getMessage());
-			throw e;
-		} catch (Exception e) {
-			logger.setLevel(Logger.Level.ERROR);
-			logger.setException(TimiJava.serializeThrowable(e));
-			log.error("删除通知失败", e);
-			throw new TimiException(TimiCode.ERROR, "删除通知失败", e);
-		} finally {
-			loggerService.create(logger);
-		}
 	}
 
 	/// 取消通知中尚未成功发送的通知详情

src/main/java/com/imyeyu/api/modules/common/service/implement/SettingServiceImplement.java

@@ -17,6 +17,8 @@ import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Function;
+import java.util.stream.Collectors;
 
 /**
  * 系统配置服务实现
@@ -53,6 +55,12 @@ public class SettingServiceImplement extends AbstractEntityService<Setting, Stri
 		return mapper.selectAllByExample(example);
 	}
 
+	@Override
+	public Map<String, Setting> mapPublic(String bizType, String bizId, List<String> code) {
+		TimiException.required(bizType, "not found bizType");
+		return mapper.selectPublicByQuery(bizType, bizId, code).stream().collect(Collectors.toMap(Setting::getCode, Function.identity()));
+	}
+
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void updateByBizId(String bizType, String bizId, List<Setting> list) {

src/main/java/com/imyeyu/api/modules/common/service/implement/SmsQueueServiceImplement.java

@@ -1,6 +1,5 @@
 package com.imyeyu.api.modules.common.service.implement;
 
-import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.imyeyu.api.modules.common.config.NotifyQueueConfig;
 import com.imyeyu.api.modules.common.entity.NotifyDetail;
@@ -11,9 +10,9 @@ import com.imyeyu.api.modules.common.service.SmsQueueService;
 import com.imyeyu.api.modules.common.util.QCloudSmsProxy;
 import com.imyeyu.java.bean.timi.TimiCode;
 import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.utils.Regex;
 import com.tencentcloudapi.sms.v20210111.models.SendSmsResponse;
 import com.tencentcloudapi.sms.v20210111.models.SendStatus;
-import com.imyeyu.utils.Regex;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Service;
@@ -56,12 +55,7 @@ public class SmsQueueServiceImplement extends AbstractQueueService<SmsQueue, Not
 	@Override
 	protected void doSend(SmsQueue queue) {
 		try {
-			String[] args = new String[0];
+			String[] args = jackson.treeToValue(queue.getArgs(), String[].class);
-			if (queue.getArgs() != null && !queue.getArgs().isBlank()) {
-				JsonNode argsNode = jackson.readTree(queue.getArgs());
-				TimiException.requiredTrue(argsNode != null && argsNode.isArray(), "短信参数必须是数组");
-				args = jackson.treeToValue(argsNode, String[].class);
-			}
 			SendSmsResponse response = smsProxy.send(queue.getSendTo(), queue.getTemplateId(), args);
 			TimiException.required(response, "未找到短信响应");
 			SendStatus[] statusSet = response.getSendStatusSet();

src/main/java/com/imyeyu/api/modules/common/service/implement/SmsServiceImplement.java

@@ -0,0 +1,85 @@
+package com.imyeyu.api.modules.common.service.implement;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.imyeyu.api.modules.common.config.NotifyQueueConfig;
+import com.imyeyu.api.modules.common.entity.Notify;
+import com.imyeyu.api.modules.common.entity.NotifyDetail;
+import com.imyeyu.api.modules.common.service.NotifyDetailService;
+import com.imyeyu.api.modules.common.service.NotifyService;
+import com.imyeyu.api.modules.common.service.SmsService;
+import com.imyeyu.java.bean.timi.TimiCode;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.utils.Regex;
+import com.imyeyu.utils.Text;
+import com.imyeyu.utils.Time;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Service;
+
+import java.util.List;
+
+/**
+ *
+ *
+ * @author 夜雨
+ * @since 2026-05-14 12:12
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class SmsServiceImplement implements SmsService {
+
+	@Value("${spring.profiles.active}")
+	private String env;
+
+	private final NotifyQueueConfig config;
+	private final ObjectMapper jackson;
+
+	private final NotifyService notifyService;
+	private final NotifyDetailService notifyDetailService;
+
+	@Override
+	public String captchaCreate(Notify notify) {
+		NotifyQueueConfig.Sms.Captcha captchaConf = config.getSms().getCaptcha();
+
+		NotifyDetail detail = notify.getDetailList().getFirst();
+
+		TimiException.requiredTrue(Regex.isMatch(Regex.MOBILE_PHONE, detail.getSendTo()), "invalid mobilePhone");
+
+		String code = Text.randomString("0123456789", 6);
+		if (!env.equalsIgnoreCase("prod")) {
+			code = "123456";
+		}
+		detail.setMsgType(NotifyDetail.MsgType.SMS);
+		detail.setTemplateId(captchaConf.getTemplateId());
+		detail.setArgs(jackson.valueToTree(List.of(code, captchaConf.getTtlMinute())));
+
+		notifyService.create(notify);
+		return notifyDetailService.listByNotifyId(notify.getId()).getFirst().getId();
+	}
+
+	@Override
+	public NotifyDetail captchaVerify(String detailId, String captcha) {
+		NotifyQueueConfig.Sms.Captcha captchaConf = config.getSms().getCaptcha();
+
+		NotifyDetail detail = notifyDetailService.get(detailId);
+		TimiException.required(detail, "短信验证码无效");
+		TimiException.required(detail.getSendAt(), "短信验证码无效");
+		TimiException.requiredTrue(NotifyDetail.MsgType.SMS == detail.getMsgType(), "短信验证码无效");
+		if (Time.M * captchaConf.getTtlMinute() < Time.now() - detail.getSendAt()) {
+			throw new TimiException(TimiCode.ARG_EXPIRED, "验证码过期");
+		}
+		if (detail.getArgs() instanceof ArrayNode array) {
+			String dbCaptcha = array.get(captchaConf.getArgIndex()).asText();
+			if (!dbCaptcha.equalsIgnoreCase(captcha)) {
+				throw new TimiException(TimiCode.RESULT_BAD, "验证码错误");
+			}
+		} else {
+			throw new TimiException(TimiCode.ERROR, "not array args");
+		}
+		detail.setNotify(notifyService.get(detail.getNotifyId()));
+		return detail;
+	}
+}

src/main/java/com/imyeyu/api/modules/common/service/implement/TagServiceImplement.java

@@ -1,5 +1,6 @@
 package com.imyeyu.api.modules.common.service.implement;
 
+import com.imyeyu.api.config.dbsource.TimiServerDBConfig;
 import com.imyeyu.api.modules.common.entity.Tag;
 import com.imyeyu.api.modules.common.entity.TagApply;
 import com.imyeyu.api.modules.common.mapper.TagApplyMapper;
@@ -14,6 +15,7 @@ import com.imyeyu.spring.service.AbstractEntityService;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
 
 import java.util.Collection;
 import java.util.HashSet;
@@ -104,6 +106,19 @@ public class TagServiceImplement extends AbstractEntityService<Tag, String> impl
 		}
 	}
 
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void deleteByOwner(Tag.OwnerType ownerType, String ownerId) {
+		TimiException.required(ownerType, "not found ownerType");
+		TimiException.required(ownerId, "not found ownerId");
+		Tag example = new Tag();
+		example.setOwnerType(ownerType);
+		example.setOwnerId(ownerId);
+		for (Tag tag : mapper.selectAllByExample(example)) {
+			super.delete(tag.getId());
+		}
+	}
+
 	private List<TagApply> listApply(TagApply.BizType bizType, String bizId) {
 		TimiException.required(bizType, "not found bizType");
 		TimiException.required(bizId, "not found bizId");

src/main/java/com/imyeyu/api/modules/common/service/implement/TempFileServiceImplement.java

@@ -3,6 +3,7 @@ package com.imyeyu.api.modules.common.service.implement;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ArrayNode;
 import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.imyeyu.api.modules.common.bean.TempFileSetting;
 import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.entity.Setting;
 import com.imyeyu.api.modules.common.service.AttachmentService;
@@ -52,11 +53,11 @@ public class TempFileServiceImplement implements TempFileService {
 		try {
 			logger.setContent(jackson.writeValueAsString(logRequestArgs(files, ttl)));
 
-			Setting ttlMin = settingService.getSystem(Setting.Module.TempFile.TTL_MIN);
+			Setting ttlMin = settingService.getSystem(TempFileSetting.TTL_MIN);
-			Setting ttlMax = settingService.getSystem(Setting.Module.TempFile.TTL_MAX);
+			Setting ttlMax = settingService.getSystem(TempFileSetting.TTL_MAX);
-			Setting ttlDefault = settingService.getSystem(Setting.Module.TempFile.TTL_DEFAULT);
+			Setting ttlDefault = settingService.getSystem(TempFileSetting.TTL_DEFAULT);
-			Setting residueTime = settingService.getSystem(Setting.Module.TempFile.RESIDUE_TTL);
+			Setting residueTime = settingService.getSystem(TempFileSetting.RESIDUE_TTL);
-			String limitStr = settingService.getSystem(Setting.Module.TempFile.LIMIT_SIZE_OF_IP).asString();
+			String limitStr = settingService.getSystem(TempFileSetting.LIMIT_SIZE_OF_IP).asString();
 
 			long limit = IOSize.parse(limitStr);
 
@@ -71,6 +72,7 @@ public class TempFileServiceImplement implements TempFileService {
 				page.setSize(Long.MAX_VALUE);
 				{
 					Attachment example = new Attachment();
+					example.setBizType(BIZ_TYPE);
 					example.setUploaderIp(TimiSpring.getRequestIP());
 					page.setEqualsExample(example);
 				}

src/main/java/com/imyeyu/api/modules/common/task/AttachmentClearTask.java

@@ -2,6 +2,7 @@ package com.imyeyu.api.modules.common.task;
 
 import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.service.AttachmentService;
+import com.imyeyu.api.modules.common.service.AttachmentVariantService;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.context.annotation.Configuration;
@@ -23,6 +24,7 @@ import java.util.List;
 public class AttachmentClearTask {
 
 	private final AttachmentService attachmentService;
+	private final AttachmentVariantService attachmentVariantService;
 
 	@Scheduled(cron = "0 0 1 * * ?")
 	public void run() {
@@ -31,8 +33,7 @@ public class AttachmentClearTask {
 			List<Attachment> needDestroyList = attachmentService.listNeedDestroy();
 			if (needDestroyList.isEmpty()) {
 				log.info("nothing attachment need clear");
-				return;
+			} else {
-			}
 				for (Attachment attach : needDestroyList) {
 					try {
 						attachmentService.destroy(attach.getId());
@@ -41,6 +42,8 @@ public class AttachmentClearTask {
 						log.error("clear attachment error: id[{}]", attach.getId(), e);
 					}
 				}
+			}
+			attachmentVariantService.clearExpired();
 			log.info("end clear expired attachments");
 		} catch (Exception e) {
 			log.error("attachment clear task error", e);

src/main/java/com/imyeyu/api/modules/common/vo/ClientLogRequest.java

@@ -0,0 +1,18 @@
+package com.imyeyu.api.modules.common.vo;
+
+import jakarta.validation.constraints.Size;
+import lombok.Data;
+
+/// 客户端诊断日志请求
+///
+/// 客户端日志不是操作审计，操作编码、模块、级别、用户和 IP 均由服务端决定
+///
+/// @author Codex
+/// @since 2026-09-09
+@Data
+public class ClientLogRequest {
+
+	/// 日志内容
+	@Size(max = 32768, message = "日志内容不能超过 32 KB")
+	private String content;
+}

src/main/java/com/imyeyu/api/modules/common/vo/NotifyManagementItem.java

@@ -0,0 +1,57 @@
+package com.imyeyu.api.modules.common.vo;
+
+import com.imyeyu.api.modules.common.entity.NotifyDetail;
+import lombok.Data;
+
+/// 管理端通知列表项
+///
+/// @author 夜雨
+/// @since 2026-08-25
+@Data
+public class NotifyManagementItem {
+
+	/// 通知 ID
+	private String id;
+
+	/// 创建者用户 ID
+	private String createdBy;
+
+	/// 创建时间
+	private Long createdAt;
+
+	/// 更新时间
+	private Long updatedAt;
+
+	/// 通知标题
+	private String subject;
+
+	/// 通知内容
+	private String content;
+
+	/// 内容类型
+	private NotifyDetail.ContentType contentType;
+
+	/// 发送时间
+	private Long sendAt;
+
+	/// 接收用户数量
+	private Long recipientCount;
+
+	/// 已读用户数量
+	private Long readCount;
+
+	/// 等待发送数量
+	private Long waitingCount;
+
+	/// 已发送数量
+	private Long remindedCount;
+
+	/// 超时数量
+	private Long timeoutCount;
+
+	/// 已取消数量
+	private Long cancelCount;
+
+	/// 失败数量
+	private Long failCount;
+}

src/main/java/com/imyeyu/api/modules/common/vo/SmsCaptchaVerifyRequest.java

@@ -0,0 +1,15 @@
+package com.imyeyu.api.modules.common.vo;
+
+import lombok.Data;
+
+///
+///
+/// @author 夜雨
+/// @since 2026-08-21 17:59
+@Data
+public class SmsCaptchaVerifyRequest {
+
+	private String detailId;
+
+	private String captcha;
+}

src/main/java/com/imyeyu/api/modules/gao/bean/GaoPermissionCode.java

@@ -21,6 +21,14 @@ public enum GaoPermissionCode implements BuiltinPermissionCode {
 
 	STORE_DELETE("STORE:DELETE", "门店删除", false, true),
 
+	STORE_DIARY_CREATE("STORE_DIARY:CREATE", "门店日记创建", true, false),
+
+	STORE_DIARY_READ("STORE_DIARY:READ", "门店日记读取", true, false),
+
+	STORE_DIARY_UPDATE("STORE_DIARY:UPDATE", "门店日记修改", true, false),
+
+	STORE_DIARY_DELETE("STORE_DIARY:DELETE", "门店日记删除", true, false),
+
 	CUSTOMER_CREATE("CUSTOMER:CREATE", "客户创建", false, false),
 
 	CUSTOMER_READ("CUSTOMER:READ", "客户读取", false, false),
@@ -43,12 +51,78 @@ public enum GaoPermissionCode implements BuiltinPermissionCode {
 
 	EVENT_RECORD_READ("EVENT_RECORD:READ", "登记事件记录读取", false, false),
 
+	EVENT_RECORD_VERIFY("EVENT_RECORD:VERIFY", "登记事件核销", true, false),
+
 	EVENT_RECORD_EXPORT("EVENT_RECORD:EXPORT", "登记事件记录导出", true, false),
 
 	EVENT_RECORD_UPDATE("EVENT_RECORD:UPDATE", "登记事件记录修改", false, false),
 
 	EVENT_RECORD_DELETE("EVENT_RECORD:DELETE", "登记事件记录删除", false, false),
 
+	PRODUCT_CATEGORY_CREATE("PRODUCT_CATEGORY:CREATE", "产品分类创建", true, true),
+
+	PRODUCT_CATEGORY_READ("PRODUCT_CATEGORY:READ", "产品分类读取", true, true),
+
+	PRODUCT_CATEGORY_UPDATE("PRODUCT_CATEGORY:UPDATE", "产品分类修改", true, true),
+
+	PRODUCT_CREATE("PRODUCT:CREATE", "产品创建", true, true),
+
+	PRODUCT_READ("PRODUCT:READ", "产品读取", true, true),
+
+	PRODUCT_UPDATE("PRODUCT:UPDATE", "产品修改", true, true),
+
+	PRODUCT_STOCK_READ("PRODUCT_STOCK:READ", "产品库存读取", true, true),
+
+	PRODUCT_STOCK_CREATE("PRODUCT_STOCK:CREATE", "产品库存操作", true, true),
+
+	PRODUCT_STOCK_MANUAL_REVOKE("PRODUCT_STOCK:MANUAL_REVOKE", "手工库存流水冲正", true, true),
+
+	SALES_ORDER_CREATE("SALES_ORDER:CREATE", "销售订单创建", true, true),
+
+	SALES_ORDER_READ("SALES_ORDER:READ", "销售订单读取", true, true),
+
+	SALES_ORDER_UPDATE("SALES_ORDER:UPDATE", "销售订单修改", true, true),
+
+	SALES_ORDER_CANCEL("SALES_ORDER:CANCEL", "销售订单取消", true, true),
+
+	SALES_ORDER_PRICE_OVERRIDE("SALES_ORDER:PRICE_OVERRIDE", "销售订单价格修改", true, true),
+
+	ORDER_FULFILLMENT_CREATE("ORDER_FULFILLMENT:CREATE", "统一履约创建", true, true),
+
+	ORDER_FULFILLMENT_READ("ORDER_FULFILLMENT:READ", "统一履约读取", true, true),
+
+	ORDER_FULFILLMENT_VERIFY("ORDER_FULFILLMENT:VERIFY", "统一履约核销", true, true),
+
+	ORDER_FULFILLMENT_REVOKE("ORDER_FULFILLMENT:REVOKE", "统一履约冲正", true, true),
+
+	PACKAGE_CONFIG_CREATE("PACKAGE_CONFIG:CREATE", "套餐配置创建", true, true),
+
+	PACKAGE_CONFIG_READ("PACKAGE_CONFIG:READ", "套餐配置读取", true, true),
+
+	PACKAGE_CONFIG_UPDATE("PACKAGE_CONFIG:UPDATE", "套餐配置修改", true, true),
+
+	PACKAGE_CONFIG_DELETE("PACKAGE_CONFIG:DELETE", "套餐配置删除", true, true),
+
+	CUSTOMER_PACKAGE_CREATE("CUSTOMER_PACKAGE:CREATE", "客户套餐创建", true, true),
+
+	CUSTOMER_PACKAGE_READ("CUSTOMER_PACKAGE:READ", "客户套餐读取", true, true),
+
+	CUSTOMER_PACKAGE_CANCEL("CUSTOMER_PACKAGE:CANCEL", "客户套餐取消", true, true),
+
+	CUSTOMER_PACKAGE_PRICE_OVERRIDE("CUSTOMER_PACKAGE:PRICE_OVERRIDE", "客户套餐成交价和权益配额调整", true, true),
+
+	CUSTOMER_PACKAGE_GIFT_CREATE("CUSTOMER_PACKAGE:GIFT_CREATE", "客户套餐创建赠送", true, true),
+
+	FUND_RECORD_READ("FUND_RECORD:READ", "资金流水读取", true, true),
+
+	FUND_RECEIVE_CREATE("FUND_RECEIVE:CREATE", "线下收款创建", true, true),
+
+	FUND_RECEIVE_VERIFY("FUND_RECEIVE:VERIFY", "线下收款核销", true, true),
+
+	FUND_REFUND("FUND:REFUND", "套餐退款", true, true),
+
+	FUND_REVOKE("FUND:REVOKE", "资金流水冲正", true, true),
+
 	POINT_ACCOUNT_READ("POINT_ACCOUNT:READ", "客户积分账户读取", true, true),
 
 	POINT_LEDGER_READ("POINT_LEDGER:READ", "客户积分流水读取", true, true),

src/main/java/com/imyeyu/api/modules/gao/bean/GaoRoleCode.java

@@ -16,7 +16,7 @@ public enum GaoRoleCode implements BuiltinRoleCode {
 	GLOBAL_MANAGER("门店管理", null),
 
 	/// 店长
-	STORE_MANAGER("店长", GLOBAL_MANAGER.name());
+	STORE_MANAGER("店长", null);
 
 	final String defaultName;
 	final String parentCode;

src/main/java/com/imyeyu/api/modules/gao/bean/GaoSystemSetting.java

@@ -0,0 +1,27 @@
+package com.imyeyu.api.modules.gao.bean;
+
+import com.imyeyu.api.annotation.SettingBizType;
+import com.imyeyu.api.bean.SettingEnum;
+import com.imyeyu.api.modules.common.entity.Setting;
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+///
+///
+/// @author 夜雨
+/// @since 2026-09-09 16:11
+@Getter
+@SettingBizType("GAO_SYSTEM")
+@AllArgsConstructor
+public enum GaoSystemSetting implements SettingEnum {
+
+	SERVICE_LICENSE(null, Setting.ValueType.STRING),
+
+	PRIVACY_LICENSE(null, Setting.ValueType.STRING),
+
+	OPEN_SOURCE_LICENSE(null, Setting.ValueType.STRING);
+
+	final String defaultValue;
+
+	final Setting.ValueType valueType;
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerChartController.java

@@ -3,9 +3,13 @@ package com.imyeyu.api.modules.gao.controller;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
 import com.imyeyu.api.modules.gao.service.GaoCustomerChartService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
 import com.imyeyu.api.modules.gao.vo.GaoCustomerChartReq;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerDiseaseWordReq;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerDiseaseWordView;
 import com.imyeyu.api.modules.gao.vo.GaoEventRecordCalendarView;
 import com.imyeyu.api.modules.gao.vo.GaoEventRecordDailyStatView;
+import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.spring.annotation.AOPLog;
 import com.imyeyu.spring.annotation.RequestRateLimit;
 import lombok.RequiredArgsConstructor;
@@ -26,6 +30,7 @@ import java.util.List;
 public class GaoCustomerChartController {
 
 	private final GaoCustomerChartService service;
+	private final GaoStoreScopeService storeScopeService;
 
 	/// 查询客户登记每日统计，可同时支撑登记趋势和登记事件结构图表
 	@AOPLog
@@ -33,6 +38,8 @@ public class GaoCustomerChartController {
 	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
 	@PostMapping("/event/record/daily")
 	public List<GaoEventRecordDailyStatView> eventRecordDaily(@RequestBody GaoCustomerChartReq req) {
+		TimiException.required(req, "not found req");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
 		return service.eventRecordDailyStat(req);
 	}
 
@@ -42,6 +49,19 @@ public class GaoCustomerChartController {
 	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
 	@PostMapping("/event/record/calendar")
 	public List<GaoEventRecordCalendarView> eventRecordCalendar(@RequestBody GaoCustomerChartReq req) {
+		TimiException.required(req, "not found req");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
 		return service.eventRecordCalendar(req);
 	}
+
+	/// 查询客户病症词频
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/customer/disease/word")
+	public List<GaoCustomerDiseaseWordView> customerDiseaseWord(@RequestBody GaoCustomerDiseaseWordReq req) {
+		TimiException.required(req, "not found req");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
+		return service.customerDiseaseWord(req);
+	}
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerConsumptionRecordController.java

@@ -0,0 +1,66 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.common.service.AttachmentService;
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.entity.GaoCustomerConsumptionRecord;
+import com.imyeyu.api.modules.gao.service.GaoCustomerConsumptionRecordService;
+import com.imyeyu.api.modules.gao.service.GaoCustomerService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerConsumptionRecordPage;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerConsumptionRecordPageResult;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.Map;
+
+/// GAO 客户消费事实接口
+///
+/// @author Codex
+/// @since 2026-09-07
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/customer/consumption-record")
+public class GaoCustomerConsumptionRecordController {
+
+	private final AttachmentService attachmentService;
+	private final GaoCustomerService customerService;
+	private final GaoStoreScopeService storeScopeService;
+	private final GaoCustomerConsumptionRecordService service;
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.SALES_ORDER_READ)
+	@PostMapping("/list")
+	public GaoCustomerConsumptionRecordPageResult list(@RequestBody GaoCustomerConsumptionRecordPage page) {
+		TimiException.required(page, "not found consumption record page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+
+		GaoCustomerConsumptionRecordPageResult result = service.pageByQuery(page);
+		List<String> customerIdList = result.getList()
+		                                    .stream()
+		                                    .map(GaoCustomerConsumptionRecord::getCustomerId)
+		                                    .filter(customerId -> customerId != null && !customerId.isBlank())
+		                                    .distinct()
+		                                    .toList();
+		var customerMap = customerService.mapByIdList(customerIdList);
+		Map<String, List<Attachment>> attachmentMap = attachmentService.mapByBizIdList(Attachment.BizType.GAO_CUSTOMER, customerIdList);
+		for (GaoCustomerConsumptionRecord record : result.getList()) {
+			var customer = customerMap.get(record.getCustomerId());
+			if (customer == null) {
+				continue;
+			}
+			customer.setAttachmentList(attachmentMap.getOrDefault(customer.getId(), List.of()));
+			record.setCustomer(customer);
+		}
+		return result;
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerController.java

@@ -1,21 +1,17 @@
 package com.imyeyu.api.modules.gao.controller;
 
 import com.fasterxml.jackson.annotation.JsonView;
-import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.service.AttachmentService;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
-import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.gao.entity.GaoCustomer;
 import com.imyeyu.api.modules.gao.service.GaoCustomerService;
-import com.imyeyu.api.modules.gao.service.GaoStoreService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
 import com.imyeyu.api.modules.gao.vo.GaoCustomerDailyStateView;
 import com.imyeyu.api.modules.gao.vo.GaoCustomerGenderStatView;
 import com.imyeyu.api.modules.gao.vo.GaoCustomerPage;
 import com.imyeyu.api.modules.gao.vo.GaoCustomerTrendStateReq;
-import com.imyeyu.api.modules.user.service.RoleChecker;
-import com.imyeyu.api.modules.user.service.UserLoginService;
 import com.imyeyu.api.modules.user.service.UserService;
 import com.imyeyu.java.TimiJava;
 import com.imyeyu.java.bean.timi.TimiException;
@@ -50,11 +46,9 @@ import java.util.Map;
 public class GaoCustomerController {
 
 	private final UserService userService;
-	private final RoleChecker roleChecker;
 	private final AttachmentService attachmentService;
 	private final GaoCustomerService service;
-	private final GaoStoreService gaoStoreService;
+	private final GaoStoreScopeService storeScopeService;
-	private final UserLoginService userLoginService;
 
 	@AOPLog
 	@RequestRateLimit
@@ -62,6 +56,8 @@ public class GaoCustomerController {
 	@PostMapping("/list")
 	@JsonView(ResponseView.Public.class)
 	public PageResult<GaoCustomer> list(@RequestBody GaoCustomerPage page) {
+		TimiException.required(page, "not found page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
 		PageResult<GaoCustomer> result = service.pageByQuery(page);
 
 		List<String> idList = result.getList().stream().map(GaoCustomer::getId).distinct().toList();
@@ -79,6 +75,8 @@ public class GaoCustomerController {
 	@JsonView(ResponseView.Public.class)
 	public GaoCustomer detail(@RequestParam String id) {
 		GaoCustomer customer = service.get(id);
+		TimiException.required(customer, "not found customer");
+		storeScopeService.checkStoreId(customer.getStoreId());
 		if (TimiJava.isNotEmpty(customer.getIntroducerCustomerId())) {
 			GaoCustomer introducerCustomer = service.get(customer.getIntroducerCustomerId());
 			introducerCustomer.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.GAO_CUSTOMER, introducerCustomer.getId()));
@@ -97,9 +95,7 @@ public class GaoCustomerController {
 	@PostMapping("/create")
 	@JsonView(ResponseView.Public.class)
 	public String create(@RequestBody GaoCustomer customer) {
-		if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+		customer.setStoreId(storeScopeService.resolveStoreId(customer.getStoreId()));
-			customer.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId());
-		}
 		service.create(customer);
 		return customer.getId();
 	}
@@ -109,9 +105,12 @@ public class GaoCustomerController {
 	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_UPDATE)
 	@PostMapping("/update")
 	public void update(@RequestBody GaoCustomer customer) {
-		if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+		TimiException.required(customer, "not found customer");
-			customer.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId());
+		TimiException.required(customer.getId(), "not found customer.id");
-		}
+		GaoCustomer dbCustomer = service.get(customer.getId());
+		TimiException.required(dbCustomer, "not found customer");
+		storeScopeService.checkStoreId(dbCustomer.getStoreId());
+		customer.setStoreId(dbCustomer.getStoreId());
 		service.updateWithAttachment(customer);
 	}
 
@@ -120,6 +119,9 @@ public class GaoCustomerController {
 	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_DELETE)
 	@PostMapping("/delete")
 	public void delete(@RequestParam String id) {
+		GaoCustomer customer = service.get(id);
+		TimiException.required(customer, "not found customer");
+		storeScopeService.checkStoreId(customer.getStoreId());
 		service.delete(id);
 	}
 
@@ -131,6 +133,7 @@ public class GaoCustomerController {
 	public GaoCustomer findById(@RequestParam String id) {
 		GaoCustomer customer = service.get(id);
 		TimiException.required(customer, "not found customer");
+		storeScopeService.checkStoreId(customer.getStoreId());
 		customer.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.GAO_CUSTOMER, customer.getId()));
 		return customer;
 	}
@@ -141,7 +144,7 @@ public class GaoCustomerController {
 	@PostMapping("/find/code")
 	@JsonView(ResponseView.Public.class)
 	public GaoCustomer findByCode(@RequestParam String storeId, @RequestParam String code) {
-		GaoCustomer customer = service.getByCode(storeId, code);
+		GaoCustomer customer = service.getByCode(storeScopeService.resolveStoreId(storeId), code);
 		if (customer == null) {
 			return null;
 		}
@@ -155,7 +158,7 @@ public class GaoCustomerController {
 	@PostMapping("/find/name")
 	@JsonView(ResponseView.Public.class)
 	public GaoCustomer findByName(@RequestParam String storeId, @RequestParam String name) {
-		GaoCustomer customer = service.getByName(storeId, name);
+		GaoCustomer customer = service.getByName(storeScopeService.resolveStoreId(storeId), name);
 		if (customer == null) {
 			return null;
 		}
@@ -169,6 +172,12 @@ public class GaoCustomerController {
 	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_EXPORT)
 	@PostMapping("/export")
 	public void export(@RequestBody Page<GaoCustomer> page) throws IOException {
+		TimiException.required(page, "not found page");
+		if (!storeScopeService.hasGlobalScope()) {
+			GaoCustomer example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoCustomer());
+			example.setStoreId(storeScopeService.resolveStoreId(example.getStoreId()));
+			page.setEqualsExample(example);
+		}
 		HttpServletResponse resp = TimiSpring.getResponse();
 		String contentDisposition = Network.getFileDownloadHeader("客户列表-%s.xlsx".formatted(Time.serialize.format(Time.now())));
 		resp.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
@@ -182,6 +191,9 @@ public class GaoCustomerController {
 	@PostMapping("/invited/list")
 	@JsonView(ResponseView.Public.class)
 	public List<GaoCustomer> listInvited(@RequestParam String introducerCustomerId) {
+		GaoCustomer introducerCustomer = service.get(introducerCustomerId);
+		TimiException.required(introducerCustomer, "not found introducerCustomer");
+		storeScopeService.checkStoreId(introducerCustomer.getStoreId());
 		List<GaoCustomer> result = service.listInvited(introducerCustomerId);
 		List<String> idList = result.stream().map(GaoCustomer::getId).distinct().toList();
 		Map<String, List<Attachment>> attachMap = attachmentService.mapByBizIdList(Attachment.BizType.GAO_CUSTOMER, idList);
@@ -196,6 +208,9 @@ public class GaoCustomerController {
 	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_UPDATE)
 	@PostMapping("/invite/save")
 	public void saveInvite(@RequestParam String introducerCustomerId, @RequestParam String customerId) {
+		GaoCustomer customer = service.get(customerId);
+		TimiException.required(customer, "not found customer");
+		storeScopeService.checkStoreId(customer.getStoreId());
 		service.saveInviteRelation(introducerCustomerId, customerId);
 	}
 
@@ -204,6 +219,9 @@ public class GaoCustomerController {
 	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_UPDATE)
 	@PostMapping("/invite/delete")
 	public void deleteInvite(@RequestParam String customerId) {
+		GaoCustomer customer = service.get(customerId);
+		TimiException.required(customer, "not found customer");
+		storeScopeService.checkStoreId(customer.getStoreId());
 		service.deleteInviteRelation(customerId);
 	}
 
@@ -213,6 +231,8 @@ public class GaoCustomerController {
 	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_READ)
 	@PostMapping("/state/daily")
 	public List<GaoCustomerDailyStateView> dailyStat(@RequestBody GaoCustomerTrendStateReq req) {
+		TimiException.required(req, "not found req");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
 		return service.stateDailyTrend(req);
 	}
 
@@ -222,6 +242,6 @@ public class GaoCustomerController {
 	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_READ)
 	@PostMapping("/state/gender")
 	public List<GaoCustomerGenderStatView> genderStat(@RequestParam String storeId) {
-		return service.stateGender(storeId);
+		return service.stateGender(storeScopeService.resolveStoreId(storeId));
 	}
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerPackageController.java

@@ -0,0 +1,143 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.common.service.AttachmentService;
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.entity.GaoCustomer;
+import com.imyeyu.api.modules.gao.entity.GaoCustomerPackage;
+import com.imyeyu.api.modules.gao.entity.GaoSalesOrder;
+import com.imyeyu.api.modules.gao.service.GaoCustomerPackageService;
+import com.imyeyu.api.modules.gao.service.GaoCustomerService;
+import com.imyeyu.api.modules.gao.service.GaoOrderFulfillmentService;
+import com.imyeyu.api.modules.gao.service.GaoSalesOrderService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerPackageCancelRequest;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerPackagePage;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerPackagePurchaseRequest;
+import com.imyeyu.api.modules.user.entity.User;
+import com.imyeyu.api.modules.user.service.UserService;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.bean.PageResult;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.Map;
+
+/// GAO 客户套餐接口
+///
+/// @author Codex
+/// @since 2026-08-31
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/customer/package")
+public class GaoCustomerPackageController {
+
+	private final GaoCustomerPackageService service;
+	private final GaoCustomerService customerService;
+	private final GaoOrderFulfillmentService fulfillmentService;
+	private final GaoSalesOrderService salesOrderService;
+	private final AttachmentService attachmentService;
+	private final GaoStoreScopeService storeScopeService;
+	private final UserService userService;
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_PACKAGE_READ)
+	@PostMapping("/list")
+	public PageResult<GaoCustomerPackage> list(@RequestBody GaoCustomerPackagePage page) {
+		TimiException.required(page, "not found page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		PageResult<GaoCustomerPackage> result = service.pageByQuery(page);
+		fillTransient(result.getList());
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_PACKAGE_READ)
+	@PostMapping("/detail")
+	public GaoCustomerPackage detail(@RequestParam String id) {
+		GaoCustomerPackage result = service.get(id);
+		TimiException.required(result, "not found customer package");
+		storeScopeService.checkStoreId(result.getStoreId());
+		fillTransient(List.of(result));
+		GaoCustomer customer = customerService.get(result.getCustomerId());
+		if (customer != null) {
+			customer.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.GAO_CUSTOMER, customer.getId()));
+		}
+		result.setCustomer(customer);
+		result.setFulfillmentList(fulfillmentService.listBySalesOrderId(result.getSalesOrderId()));
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_PACKAGE_CREATE)
+	@PostMapping("/purchase")
+	public GaoCustomerPackage purchase(@RequestBody GaoCustomerPackagePurchaseRequest request) {
+		GaoCustomerPackage result = service.purchase(request);
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.CUSTOMER_PACKAGE_CANCEL)
+	@PostMapping("/cancel")
+	public GaoCustomerPackage cancel(@RequestBody GaoCustomerPackageCancelRequest request) {
+		GaoCustomerPackage result = service.cancel(request);
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	private void fillTransient(List<GaoCustomerPackage> packageList) {
+		if (packageList == null || packageList.isEmpty()) {
+			return;
+		}
+		Map<String, GaoSalesOrder> orderMap = salesOrderService.mapByIdList(packageList.stream()
+			.map(GaoCustomerPackage::getSalesOrderId)
+			.filter(value -> value != null && !value.isBlank())
+			.distinct()
+			.toList());
+		List<String> customerIdList = packageList.stream()
+			.map(GaoCustomerPackage::getCustomerId)
+			.filter(value -> value != null && !value.isBlank())
+			.distinct()
+			.toList();
+		Map<String, GaoCustomer> customerMap = customerIdList.isEmpty() ? Map.of() : customerService.mapByIdList(customerIdList);
+		Map<String, List<Attachment>> attachmentMap = customerIdList.isEmpty()
+			? Map.of() : attachmentService.mapByBizIdList(Attachment.BizType.GAO_CUSTOMER, customerIdList, GaoCustomer.AttachType.PHOTO.name());
+		List<String> userIdList = packageList.stream()
+			.map(packageEntity -> orderMap.get(packageEntity.getSalesOrderId()))
+			.filter(order -> order != null)
+			.map(GaoSalesOrder::getCancelOperatorUserId)
+			.filter(value -> value != null && !value.isBlank())
+			.distinct()
+			.toList();
+		Map<String, User> userMap = userIdList.isEmpty() ? Map.of() : userService.mapByIdList(userIdList);
+		for (GaoCustomerPackage packageEntity : packageList) {
+			GaoSalesOrder order = orderMap.get(packageEntity.getSalesOrderId());
+			packageEntity.setSalesOrder(order);
+			packageEntity.setStatus(order == null ? null : order.getStatus());
+			packageEntity.setCancelledAt(order == null ? null : order.getCancelledAt());
+			packageEntity.setCancelOperatorUserId(order == null ? null : order.getCancelOperatorUserId());
+			packageEntity.setCancelReason(order == null ? null : order.getCancelReason());
+			packageEntity.setItemList(order == null ? List.of() : order.getItemList());
+			GaoCustomer customer = customerMap.get(packageEntity.getCustomerId());
+			if (customer != null) {
+				customer.setAttachmentList(attachmentMap.getOrDefault(customer.getId(), List.of()));
+			}
+			packageEntity.setCustomer(customer);
+			String cancelOperatorUserId = order == null ? null : order.getCancelOperatorUserId();
+			packageEntity.setCancelOperator(cancelOperatorUserId == null ? null : userMap.get(cancelOperatorUserId));
+		}
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventController.java

@@ -1,14 +1,16 @@
 package com.imyeyu.api.modules.gao.controller;
 
-import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
-import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.gao.entity.GaoEvent;
+import com.imyeyu.api.modules.gao.entity.GaoEventOptionGroup;
+import com.imyeyu.api.modules.gao.entity.GaoPackageConfig;
+import com.imyeyu.api.modules.gao.entity.GaoPackageConfigItem;
 import com.imyeyu.api.modules.gao.service.GaoEventService;
-import com.imyeyu.api.modules.gao.service.GaoStoreService;
+import com.imyeyu.api.modules.gao.service.GaoPackageConfigService;
-import com.imyeyu.api.modules.user.service.RoleChecker;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
-import com.imyeyu.api.modules.user.service.UserLoginService;
+import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.spring.annotation.AOPLog;
 import com.imyeyu.spring.annotation.RequestRateLimit;
 import com.imyeyu.spring.bean.Page;
@@ -33,28 +35,76 @@ import java.util.Map;
 public class GaoEventController {
 
 	private final GaoEventService service;
-	private final RoleChecker roleChecker;
+	private final GaoPackageConfigService packageConfigService;
-	private final GaoStoreService gaoStoreService;
+	private final GaoStoreScopeService storeScopeService;
-	private final UserLoginService userLoginService;
 
 	@AOPLog
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.EVENT_READ)
 	@PostMapping("/list")
 	public PageResult<GaoEvent> list(@RequestBody Page<GaoEvent> page) {
-		PageResult<GaoEvent> result = service.page(page);
+		TimiException.required(page, "not found page");
-		Map<String, List<String>> roleMap = service.mapRoleCodeListByEventIdList(result.getList().stream().map(GaoEvent::getId).toList());
+		resolveStoreScope(page);
-		for (GaoEvent event : result.getList()) {
+		PageResult<GaoEvent> result = service.pageWithoutDeleted(page);
-			event.setRoleCodeList(roleMap.get(event.getId()));
+		return attachEventRelations(result);
-		}
-		return result;
 	}
 
 	@AOPLog
 	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.EVENT_CREATE)
+	@PostMapping("/list/history")
+	public PageResult<GaoEvent> listHistory(@RequestBody Page<GaoEvent> page) {
+		TimiException.required(page, "not found page");
+		resolveStoreScope(page);
+		return attachEventRelations(service.page(page));
+	}
+
+	private void resolveStoreScope(Page<GaoEvent> page) {
+		if (!storeScopeService.hasGlobalScope()) {
+			GaoEvent example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoEvent());
+			example.setStoreId(storeScopeService.resolveStoreId(example.getStoreId()));
+			page.setEqualsExample(example);
+		}
+	}
+
+	private PageResult<GaoEvent> attachEventRelations(PageResult<GaoEvent> result) {
+		Map<String, List<String>> roleMap = service.mapRoleCodeListByEventIdList(result.getList().stream().map(GaoEvent::getId).toList());
+		for (GaoEvent event : result.getList()) {
+			event.setRoleCodeList(roleMap.get(event.getId()));
+		}
+		service.attachOptionGroupList(result.getList());
+		attachPackageConfig(result.getList());
+		return result;
+	}
+
+	private void attachPackageConfig(List<GaoEvent> eventList) {
+		List<String> packageConfigIdList = eventList.stream()
+			.map(GaoEvent::getPackageConfigId)
+			.filter(TimiJava::isNotEmpty)
+			.distinct()
+			.toList();
+		if (packageConfigIdList.isEmpty()) {
+			return;
+		}
+		Map<String, GaoPackageConfig> packageConfigMap = packageConfigService.mapByIdList(packageConfigIdList);
+		Map<String, List<GaoPackageConfigItem>> itemMap = packageConfigService.mapItemListByPackageConfigIdList(packageConfigIdList);
+		for (GaoEvent event : eventList) {
+			GaoPackageConfig packageConfig = packageConfigMap.get(event.getPackageConfigId());
+			if (packageConfig != null) {
+				packageConfig.setItemList(itemMap.getOrDefault(packageConfig.getId(), List.of()));
+				event.setPackageConfig(packageConfig);
+			}
+		}
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.EVENT_READ)
 	@PostMapping("/list/valid")
 	public List<GaoEvent> listValid(@RequestParam String storeId) {
-		return service.listValid(storeId);
+		List<GaoEvent> result = service.listValid(storeScopeService.resolveStoreId(storeId));
+		attachPackageConfig(result);
+		return result;
 	}
 
 	@AOPLog
@@ -63,7 +113,11 @@ public class GaoEventController {
 	@PostMapping("/detail")
 	public GaoEvent detail(@RequestParam String id) {
 		GaoEvent event = service.get(id);
+		TimiException.required(event, "not found event");
+		storeScopeService.checkStoreId(event.getStoreId());
 		event.setRoleCodeList(service.listRoleCode(event.getId()));
+		service.attachOptionGroupList(List.of(event));
+		attachPackageConfig(List.of(event));
 		return event;
 	}
 
@@ -72,9 +126,8 @@ public class GaoEventController {
 	@RequireGaoPermission(GaoPermissionCode.EVENT_CREATE)
 	@PostMapping("/create")
 	public void create(@RequestBody GaoEvent event) {
-		if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+		event.setStoreId(storeScopeService.resolveStoreId(event.getStoreId()));
-			event.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId());
+		validatePackageConfigBinding(event);
-		}
 		service.create(event);
 	}
 
@@ -83,17 +136,48 @@ public class GaoEventController {
 	@RequireGaoPermission(GaoPermissionCode.EVENT_UPDATE)
 	@PostMapping("/update")
 	public void update(@RequestBody GaoEvent event) {
-		if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+		TimiException.required(event, "not found event");
-			event.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId());
+		TimiException.required(event.getId(), "not found event.id");
-		}
+		GaoEvent dbEvent = service.get(event.getId());
+		TimiException.required(dbEvent, "not found event");
+		storeScopeService.checkStoreId(dbEvent.getStoreId());
+		event.setStoreId(dbEvent.getStoreId());
+		validatePackageConfigBinding(event);
 		service.update(event);
 	}
 
+	private void validatePackageConfigBinding(GaoEvent event) {
+		if (event.getBizType() == GaoEvent.BizType.PACKAGE_PURCHASE) {
+			TimiException.required(event.getPackageConfigId(), "购买套餐事件必须绑定套餐配置");
+			GaoPackageConfig packageConfig = packageConfigService.get(event.getPackageConfigId());
+			TimiException.required(packageConfig, "购买套餐事件绑定的套餐配置不存在");
+			TimiException.requiredTrue(event.getStoreId().equals(packageConfig.getStoreId()), "购买事件和套餐配置不属于同一门店");
+		} else {
+			TimiException.requiredNull(event.getPackageConfigId(), "普通事件不能绑定套餐配置");
+		}
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.EVENT_UPDATE)
+	@PostMapping("/options/update")
+	public void updateOptions(@RequestParam String id, @RequestBody List<GaoEventOptionGroup> optionGroupList) {
+		GaoEvent event = service.get(id);
+		TimiException.required(event, "not found event");
+		storeScopeService.checkStoreId(event.getStoreId());
+		service.updateOptionGroupList(id, optionGroupList);
+	}
+
 	@AOPLog
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.EVENT_UPDATE)
 	@PostMapping("/sort")
 	public void sort(@RequestBody List<String> idList) {
+		for (String id : TimiJava.safeIterable(idList)) {
+			GaoEvent event = service.get(id);
+			TimiException.required(event, "not found event");
+			storeScopeService.checkStoreId(event.getStoreId());
+		}
 		service.sort(idList);
 	}
 
@@ -102,6 +186,9 @@ public class GaoEventController {
 	@RequireGaoPermission(GaoPermissionCode.EVENT_DELETE)
 	@PostMapping("/delete")
 	public void delete(@RequestParam String id) {
+		GaoEvent event = service.get(id);
+		TimiException.required(event, "not found event");
+		storeScopeService.checkStoreId(event.getStoreId());
 		service.delete(id);
 	}
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventRecordController.java

@@ -1,27 +1,25 @@
 package com.imyeyu.api.modules.gao.controller;
 
 import com.fasterxml.jackson.annotation.JsonView;
-import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.service.AttachmentService;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
-import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.gao.entity.GaoCustomer;
 import com.imyeyu.api.modules.gao.entity.GaoEvent;
 import com.imyeyu.api.modules.gao.entity.GaoEventRecord;
 import com.imyeyu.api.modules.gao.service.GaoCustomerService;
 import com.imyeyu.api.modules.gao.service.GaoEventRecordService;
 import com.imyeyu.api.modules.gao.service.GaoEventService;
-import com.imyeyu.api.modules.gao.service.GaoStoreService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
 import com.imyeyu.api.modules.gao.vo.GaoCustomerEventRankView;
+import com.imyeyu.api.modules.gao.vo.GaoEventOptionStatView;
 import com.imyeyu.api.modules.gao.vo.GaoEventRecordPage;
 import com.imyeyu.api.modules.gao.vo.GaoEventRecordPageResult;
 import com.imyeyu.api.modules.gao.vo.GaoEventRecordRankPage;
-import com.imyeyu.api.modules.user.service.RoleChecker;
-import com.imyeyu.api.modules.user.service.UserLoginService;
 import com.imyeyu.api.modules.user.service.UserService;
 import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.network.Network;
 import com.imyeyu.spring.TimiSpring;
 import com.imyeyu.spring.annotation.AOPLog;
@@ -52,13 +50,11 @@ import java.util.Map;
 public class GaoEventRecordController {
 
 	private final UserService userService;
-	private final RoleChecker roleChecker;
 	private final GaoEventService eventService;
 	private final AttachmentService attachmentService;
 	private final GaoCustomerService customerService;
-	private final GaoStoreService gaoStoreService;
+	private final GaoStoreScopeService storeScopeService;
 	private final GaoEventRecordService service;
-	private final UserLoginService userLoginService;
 
 	@AOPLog
 	@RequestRateLimit
@@ -66,6 +62,8 @@ public class GaoEventRecordController {
 	@PostMapping("/list")
 	@JsonView(ResponseView.Public.class)
 	public GaoEventRecordPageResult list(@RequestBody GaoEventRecordPage page) {
+		TimiException.required(page, "not found page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
 		PageResult<GaoEventRecord> pageResult = service.pageByRange(page);
 		GaoEventRecordPageResult result = new GaoEventRecordPageResult();
 		result.setTotal(pageResult.getTotal());
@@ -81,6 +79,7 @@ public class GaoEventRecordController {
 				record.setCustomer(customerMap.get(record.getCustomerId()));
 				record.getCustomer().setAttachmentList(attachMap.get(record.getCustomerId()));
 			}
+			service.attachSelectedOptionGroupList(result.getList());
 		}
 		return result;
 	}
@@ -108,22 +107,39 @@ public class GaoEventRecordController {
 	@JsonView(ResponseView.Public.class)
 	public GaoEventRecord detail(@RequestParam String id) {
 		GaoEventRecord record = service.get(id);
+		TimiException.required(record, "not found event record");
+		storeScopeService.checkStoreId(record.getStoreId());
 		record.setCustomer(customerService.get(record.getCustomerId()));
 		record.getCustomer().setAttachmentList(attachmentService.listByBizId(Attachment.BizType.GAO_CUSTOMER, record.getCustomerId()));
 		record.setEvent(eventService.get(record.getEventId()));
+		eventService.attachOptionGroupList(List.of(record.getEvent()));
 		record.setOperator(userService.get(record.getOperatorUserId()));
+		record.setUpdater(userService.get(record.getUpdatedBy()));
+		if (record.getVerifierUserId() != null) {
+			record.setVerifier(userService.get(record.getVerifierUserId()));
+		}
 		record.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.GAO_EVENT_RECORD, record.getId()));
+		service.attachSelectedOptionGroupList(List.of(record));
 		return record;
 	}
 
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_VERIFY)
+	@PostMapping("/verify")
+	public void verify(@RequestParam String id) {
+		GaoEventRecord record = service.get(id);
+		TimiException.required(record, "not found event record");
+		storeScopeService.checkStoreId(record.getStoreId());
+		service.verify(id);
+	}
+
 	@AOPLog
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_CREATE)
 	@PostMapping("/create")
 	public void create(@RequestBody GaoEventRecord record) {
-		if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+		resolveCreateRecordStore(record);
-			record.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId());
-		}
 		service.create(record);
 	}
 
@@ -132,11 +148,8 @@ public class GaoEventRecordController {
 	@RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_CREATE)
 	@PostMapping("/create/batch")
 	public void createBatch(@RequestBody List<GaoEventRecord> recordList) {
-		if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+		for (GaoEventRecord record : TimiJava.safeIterable(recordList)) {
-			String storeId = gaoStoreService.getBelongIdByRequiredLoginUserId();
+			resolveCreateRecordStore(record);
-			for (GaoEventRecord record : recordList) {
-				record.setStoreId(storeId);
-			}
 		}
 		service.createBatch(recordList);
 	}
@@ -146,11 +159,17 @@ public class GaoEventRecordController {
 	@RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_CREATE)
 	@PostMapping("/create/customer")
 	public void createWithCustomer(@RequestBody GaoCustomer customer) {
-		if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+		TimiException.required(customer, "not found customer");
-			String storeId = gaoStoreService.getBelongIdByRequiredLoginUserId();
+		if (TimiJava.isNotEmpty(customer.getId())) {
-			for (GaoEventRecord record : TimiJava.safeIterable(customer.getEventRecordList())) {
+			GaoCustomer dbCustomer = customerService.get(customer.getId());
-				record.setStoreId(storeId);
+			TimiException.required(dbCustomer, "not found customer");
+			storeScopeService.checkStoreId(dbCustomer.getStoreId());
+			customer.setStoreId(dbCustomer.getStoreId());
+		} else {
+			customer.setStoreId(storeScopeService.resolveStoreId(customer.getStoreId()));
 		}
+		for (GaoEventRecord record : TimiJava.safeIterable(customer.getEventRecordList())) {
+			resolveCreateRecordStore(record);
 		}
 		service.createWithCustomer(customer);
 	}
@@ -160,9 +179,12 @@ public class GaoEventRecordController {
 	@RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_UPDATE)
 	@PostMapping("/update")
 	public void update(@RequestBody GaoEventRecord record) {
-		if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+		TimiException.required(record, "not found event record");
-			record.setStoreId(gaoStoreService.getBelongIdByRequiredLoginUserId());
+		TimiException.required(record.getId(), "not found event record.id");
-		}
+		GaoEventRecord dbRecord = service.get(record.getId());
+		TimiException.required(dbRecord, "not found event record");
+		storeScopeService.checkStoreId(dbRecord.getStoreId());
+		record.setStoreId(dbRecord.getStoreId());
 		service.update(record);
 	}
 
@@ -171,6 +193,9 @@ public class GaoEventRecordController {
 	@RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_DELETE)
 	@PostMapping("/delete")
 	public void delete(@RequestParam String id) {
+		GaoEventRecord record = service.get(id);
+		TimiException.required(record, "not found event record");
+		storeScopeService.checkStoreId(record.getStoreId());
 		service.delete(id);
 	}
 
@@ -180,6 +205,8 @@ public class GaoEventRecordController {
 	@RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_EXPORT)
 	@PostMapping("/export")
 	public void export(@RequestBody GaoEventRecordPage page) throws IOException {
+		TimiException.required(page, "not found page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
 		HttpServletResponse resp = TimiSpring.getResponse();
 		String contentDisposition = Network.getFileDownloadHeader("登记事件记录-%s.xlsx".formatted(Time.serialize.format(Time.now())));
 		resp.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
@@ -193,6 +220,8 @@ public class GaoEventRecordController {
 	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
 	@PostMapping("/rank")
 	public PageResult<GaoCustomerEventRankView> eventRank(@RequestBody GaoEventRecordRankPage page) {
+		TimiException.required(page, "not found page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
 		PageResult<GaoCustomerEventRankView> result = service.pageRankByRange(page);
 		List<String> customerIdList = result.getList().stream().map(GaoCustomerEventRankView::getCustomerId).distinct().toList();
 		if (customerIdList.isEmpty()) {
@@ -209,4 +238,22 @@ public class GaoEventRecordController {
 		}
 		return result;
 	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/option/stat")
+	public List<GaoEventOptionStatView> optionStat(@RequestBody GaoEventRecordPage page) {
+		TimiException.required(page, "not found page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		return service.optionStatByRange(page);
+	}
+
+	private void resolveCreateRecordStore(GaoEventRecord record) {
+		TimiException.required(record, "not found event record");
+		GaoEvent event = eventService.get(record.getEventId());
+		TimiException.required(event, "not found event");
+		storeScopeService.checkStoreId(event.getStoreId());
+		record.setStoreId(event.getStoreId());
+	}
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoFundRecordController.java

@@ -0,0 +1,133 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.common.service.AttachmentService;
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.entity.GaoFundRecord;
+import com.imyeyu.api.modules.gao.service.GaoFundRecordService;
+import com.imyeyu.api.modules.gao.service.GaoOrderPaymentService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoFundRecordPage;
+import com.imyeyu.api.modules.gao.vo.GaoFundRevokeRequest;
+import com.imyeyu.api.modules.gao.vo.GaoOrderPaymentRevokeRequest;
+import com.imyeyu.api.modules.user.entity.User;
+import com.imyeyu.api.modules.user.service.UserLoginService;
+import com.imyeyu.api.modules.user.service.UserService;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.bean.PageResult;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Stream;
+
+/// GAO 资金流水接口
+///
+/// @author Codex
+/// @since 2026-08-31
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/fund/record")
+public class GaoFundRecordController {
+
+	private final GaoFundRecordService service;
+	private final GaoOrderPaymentService orderPaymentService;
+	private final GaoStoreScopeService storeScopeService;
+	private final AttachmentService attachmentService;
+	private final UserService userService;
+	private final UserLoginService userLoginService;
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_RECORD_READ)
+	@PostMapping("/list")
+	public PageResult<GaoFundRecord> list(@RequestBody GaoFundRecordPage page) {
+		TimiException.required(page, "not found page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		PageResult<GaoFundRecord> result = service.pageByQuery(page);
+		fillTransient(result.getList());
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_RECORD_READ)
+	@PostMapping("/detail")
+	public GaoFundRecord detail(@RequestParam String id) {
+		GaoFundRecord result = service.detail(id);
+		storeScopeService.checkStoreId(result.getStoreId());
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_RECEIVE_CREATE)
+	@PostMapping("/my-receive/list")
+	public PageResult<GaoFundRecord> listMyReceive(@RequestBody GaoFundRecordPage page) {
+		TimiException.required(page, "not found page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		page.setOperatorUserId(userLoginService.getRequireLoginUserId());
+		page.setOperationType(GaoFundRecord.OperationType.RECEIVE);
+		PageResult<GaoFundRecord> result = service.pageByQuery(page);
+		fillTransient(result.getList());
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_RECEIVE_CREATE)
+	@PostMapping("/my-receive/detail")
+	public GaoFundRecord detailMyReceive(@RequestParam String id) {
+		GaoFundRecord result = service.detail(id);
+		TimiException.requiredTrue(result.getOperationType() == GaoFundRecord.OperationType.RECEIVE, "not found fund receive record");
+		TimiException.requiredTrue(userLoginService.getRequireLoginUserId().equals(result.getOperatorUserId()), "只能读取自己提交的收款");
+		storeScopeService.checkStoreId(result.getStoreId());
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_REVOKE)
+	@PostMapping("/revoke")
+	public GaoFundRecord revoke(@RequestBody GaoFundRevokeRequest request) {
+		GaoOrderPaymentRevokeRequest orderRequest = new GaoOrderPaymentRevokeRequest();
+		orderRequest.setRequestNo(request.getRequestNo());
+		orderRequest.setFundRecordId(request.getFundRecordId());
+		orderRequest.setOccurredAt(request.getOccurredAt());
+		orderRequest.setReason(request.getReason());
+		orderRequest.setAttachmentList(request.getAttachmentList());
+		orderRequest.setRemark(request.getRemark());
+		GaoFundRecord result = orderPaymentService.revoke(orderRequest);
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	private void fillTransient(List<GaoFundRecord> recordList) {
+		if (recordList == null || recordList.isEmpty()) {
+			return;
+		}
+		List<String> idList = recordList.stream().map(GaoFundRecord::getId).toList();
+		Map<String, List<Attachment>> attachmentMap = attachmentService.mapByBizIdList(Attachment.BizType.GAO_FUND_RECORD, idList);
+		List<String> userIdList = recordList.stream()
+			.flatMap(record -> Stream.of(record.getOperatorUserId(), record.getVerifierUserId()))
+			.filter(value -> value != null && !value.isBlank())
+			.distinct()
+			.toList();
+		Map<String, User> userMap = userIdList.isEmpty() ? Map.of() : userService.mapByIdList(userIdList);
+		for (GaoFundRecord record : recordList) {
+			record.setAttachmentList(attachmentMap.getOrDefault(record.getId(), List.of()));
+			record.setOperator(userMap.get(record.getOperatorUserId()));
+			record.setVerifier(userMap.get(record.getVerifierUserId()));
+		}
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoNotifyController.java

@@ -0,0 +1,158 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.fasterxml.jackson.annotation.JsonView;
+import com.imyeyu.api.annotation.RequireCorePermission;
+import com.imyeyu.api.bean.CorePermissionCode;
+import com.imyeyu.api.bean.PermissionMatchMode;
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.common.entity.Notify;
+import com.imyeyu.api.modules.common.entity.NotifyDetail;
+import com.imyeyu.api.modules.common.service.AttachmentService;
+import com.imyeyu.api.modules.common.service.NotifyService;
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.entity.GaoUser;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.service.GaoUserService;
+import com.imyeyu.api.modules.user.entity.User;
+import com.imyeyu.api.modules.user.service.UserLoginService;
+import com.imyeyu.api.modules.user.service.UserService;
+import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.annotation.RequiredToken;
+import com.imyeyu.spring.bean.Page;
+import com.imyeyu.spring.bean.PageResult;
+import com.imyeyu.spring.util.ResponseView;
+import com.imyeyu.utils.Time;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+/// GAO 通知接口
+///
+/// 这里的通知接收用户必须属于当前操作人的 GAO 用户范围，当前登录用户本人除外。
+///
+/// @author Codex
+/// @since 2026-08-25
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/notify")
+public class GaoNotifyController {
+
+	private final GaoUserService gaoUserService;
+	private final GaoStoreScopeService storeScopeService;
+	private final NotifyService notifyService;
+	private final UserLoginService userLoginService;
+	private final UserService userService;
+	private final AttachmentService attachmentService;
+
+	/// 查询可作为通知接收人的 GAO 用户
+	///
+	/// 门店管理范围可以查询全部门店或指定门店，店长只能查询当前门店。
+	///
+	/// @param page 分页参数
+	/// @return 可发送用户分页结果
+	@JsonView(ResponseView.Public.class)
+	@RequiredToken
+	@RequestRateLimit
+	@RequireCorePermission(CorePermissionCode.NOTIFY_CREATE)
+	@RequireGaoPermission(value = {GaoPermissionCode.USER_READ, GaoPermissionCode.STORE_READ}, mode = PermissionMatchMode.ANY)
+	@PostMapping("/recipient/list")
+	public PageResult<GaoUser> recipientList(@RequestBody Page<GaoUser> page) {
+		TimiException.required(page, "未找到分页参数");
+		GaoUser example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoUser());
+		if (storeScopeService.hasGlobalScope()) {
+			if (TimiJava.isNotEmpty(example.getStoreId())) {
+				storeScopeService.checkStoreId(example.getStoreId());
+			}
+		} else {
+			example.setStoreId(storeScopeService.resolveStoreId(example.getStoreId()));
+		}
+		page.setEqualsExample(example);
+
+		PageResult<GaoUser> result = gaoUserService.pageRecipients(page);
+		fillUser(result.getList());
+		return result;
+	}
+
+	/// 创建 GAO 站内通知
+	///
+	/// 只允许发送站内通知，并逐个校验接收用户是否属于当前操作人的门店范围；当前用户可以接收自己发送的通知。
+	///
+	/// @param notify 通知及通知详情
+	/// @return 创建后的通知
+	@RequiredToken
+	@RequestRateLimit
+	@RequireCorePermission(CorePermissionCode.NOTIFY_CREATE)
+	@RequireGaoPermission(value = {GaoPermissionCode.USER_READ, GaoPermissionCode.STORE_READ}, mode = PermissionMatchMode.ANY)
+	@PostMapping("/create")
+	public Notify create(@RequestBody Notify notify) {
+		checkRecipientBoundary(notify);
+		notifyService.create(notify);
+		return notify;
+	}
+
+	/// 校验通知接收用户边界
+	///
+	/// @param notify 通知
+	private void checkRecipientBoundary(Notify notify) {
+		TimiException.required(notify, "未找到通知");
+		List<NotifyDetail> detailList = notify.getDetailList();
+		TimiException.required(detailList, "未找到通知详情列表");
+		TimiException.requiredTrue(!detailList.isEmpty(), "通知详情列表不能为空");
+
+		Set<String> recipientIdSet = detailList.stream().map(detail -> {
+			TimiException.required(detail, "未找到通知详情");
+			TimiException.requiredTrue(detail.getMsgType() == NotifyDetail.MsgType.INTERNAL, "GAO 通知仅支持站内通知");
+			TimiException.required(detail.getSendTo(), "未找到通知接收用户 ID");
+			if (detail.getSendAt() != null) {
+				TimiException.requiredTrue(Time.now() < detail.getSendAt(), "定时发送时间必须晚于当前时间");
+			}
+			return detail.getSendTo();
+		}).collect(Collectors.toSet());
+		TimiException.requiredTrue(recipientIdSet.size() == detailList.size(), "通知接收用户不能重复");
+
+		String loginUserId = userLoginService.getRequireLoginUserId();
+		Set<String> gaoRecipientIdSet = recipientIdSet.stream()
+			.filter(recipientId -> !loginUserId.equals(recipientId))
+			.collect(Collectors.toSet());
+		Map<String, GaoUser> gaoUserMap = gaoUserService.mapByUserIdList(gaoRecipientIdSet);
+		TimiException.requiredTrue(gaoUserMap.size() == gaoRecipientIdSet.size(), "包含无效的通知接收用户");
+		for (GaoUser gaoUser : gaoUserMap.values()) {
+			TimiException.requiredTrue(Boolean.TRUE.equals(gaoUser.getEnabled()), "通知接收用户已停用");
+			storeScopeService.checkStoreId(gaoUser.getStoreId());
+		}
+	}
+
+	/// 回填 GAO 用户的核心用户资料
+	///
+	/// @param gaoUserList GAO 用户列表
+	private void fillUser(List<GaoUser> gaoUserList) {
+		if (TimiJava.isEmpty(gaoUserList)) {
+			return;
+		}
+		List<String> userIdList = gaoUserList.stream().map(GaoUser::getUserId).toList();
+		Map<String, User> userMap = userService.mapByIdList(userIdList);
+		Map<String, List<Attachment>> attachmentMap = attachmentService.mapByBizIdList(
+			Attachment.BizType.USER,
+			userIdList,
+			User.AttachType.AVATAR.toString()
+		);
+		for (GaoUser gaoUser : gaoUserList) {
+			User user = userMap.get(gaoUser.getUserId());
+			if (user == null) {
+				continue;
+			}
+			user.setAttachmentList(attachmentMap.getOrDefault(user.getId(), List.of()));
+			gaoUser.setUser(user);
+		}
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoOrderFulfillmentController.java

@@ -0,0 +1,163 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.common.service.AttachmentService;
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.entity.GaoCustomer;
+import com.imyeyu.api.modules.gao.entity.GaoOrderFulfillment;
+import com.imyeyu.api.modules.gao.service.GaoCustomerService;
+import com.imyeyu.api.modules.gao.service.GaoOrderFulfillmentService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoOrderFulfillmentActionRequest;
+import com.imyeyu.api.modules.gao.vo.GaoOrderFulfillmentCreateRequest;
+import com.imyeyu.api.modules.gao.vo.GaoOrderFulfillmentPage;
+import com.imyeyu.api.modules.gao.vo.GaoOrderFulfillmentPrepareStockRequest;
+import com.imyeyu.api.modules.gao.vo.GaoOrderFulfillmentRevokeRequest;
+import com.imyeyu.api.modules.user.entity.User;
+import com.imyeyu.api.modules.user.service.UserService;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.bean.PageResult;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Stream;
+
+/// GAO 统一履约接口
+///
+/// @author Codex
+/// @since 2026-09-02
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/order/fulfillment")
+public class GaoOrderFulfillmentController {
+
+	private final GaoOrderFulfillmentService service;
+	private final GaoStoreScopeService storeScopeService;
+	private final AttachmentService attachmentService;
+	private final GaoCustomerService customerService;
+	private final UserService userService;
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.ORDER_FULFILLMENT_READ)
+	@PostMapping("/list")
+	public PageResult<GaoOrderFulfillment> list(@RequestBody GaoOrderFulfillmentPage page) {
+		TimiException.required(page, "not found fulfillment page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		PageResult<GaoOrderFulfillment> result = service.pageByQuery(page);
+		fillTransient(result.getList());
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.ORDER_FULFILLMENT_READ)
+	@PostMapping("/detail")
+	public GaoOrderFulfillment detail(@RequestParam String id) {
+		GaoOrderFulfillment result = service.detail(id);
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.ORDER_FULFILLMENT_CREATE)
+	@PostMapping("/create")
+	public GaoOrderFulfillment create(@RequestBody GaoOrderFulfillmentCreateRequest request) {
+		GaoOrderFulfillment result = service.create(request);
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.ORDER_FULFILLMENT_VERIFY)
+	@PostMapping("/prepare-stock")
+	public GaoOrderFulfillment prepareStock(@RequestBody GaoOrderFulfillmentPrepareStockRequest request) {
+		GaoOrderFulfillment result = service.prepareStock(request);
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.ORDER_FULFILLMENT_VERIFY)
+	@PostMapping("/verify")
+	public GaoOrderFulfillment verify(@RequestBody GaoOrderFulfillmentActionRequest request) {
+		GaoOrderFulfillment result = service.verify(request);
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.ORDER_FULFILLMENT_VERIFY)
+	@PostMapping("/reject")
+	public GaoOrderFulfillment reject(@RequestBody GaoOrderFulfillmentActionRequest request) {
+		GaoOrderFulfillment result = service.reject(request);
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.ORDER_FULFILLMENT_CREATE)
+	@PostMapping("/cancel")
+	public GaoOrderFulfillment cancel(@RequestBody GaoOrderFulfillmentActionRequest request) {
+		GaoOrderFulfillment result = service.cancel(request);
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.ORDER_FULFILLMENT_REVOKE)
+	@PostMapping("/revoke")
+	public GaoOrderFulfillment revoke(@RequestBody GaoOrderFulfillmentRevokeRequest request) {
+		GaoOrderFulfillment result = service.revoke(request);
+		fillTransient(List.of(result));
+		return result;
+	}
+
+	private void fillTransient(List<GaoOrderFulfillment> fulfillmentList) {
+		if (fulfillmentList == null || fulfillmentList.isEmpty()) {
+			return;
+		}
+		List<String> idList = fulfillmentList.stream().map(GaoOrderFulfillment::getId).toList();
+		Map<String, List<Attachment>> attachmentMap = attachmentService.mapByBizIdList(Attachment.BizType.GAO_ORDER_FULFILLMENT, idList);
+		List<String> customerIdList = fulfillmentList.stream()
+			.map(GaoOrderFulfillment::getCustomerId)
+			.filter(value -> value != null && !value.isBlank())
+			.distinct()
+			.toList();
+		Map<String, GaoCustomer> customerMap = customerIdList.isEmpty() ? Map.of() : customerService.mapByIdList(customerIdList);
+		Map<String, List<Attachment>> customerAttachmentMap = customerIdList.isEmpty()
+			? Map.of()
+			: attachmentService.mapByBizIdList(Attachment.BizType.GAO_CUSTOMER, customerIdList, GaoCustomer.AttachType.PHOTO.name());
+		List<String> userIdList = fulfillmentList.stream()
+			.flatMap(item -> Stream.of(item.getOperatorUserId(), item.getVerifierUserId()))
+			.filter(value -> value != null && !value.isBlank())
+			.distinct()
+			.toList();
+		Map<String, User> userMap = userIdList.isEmpty() ? Map.of() : userService.mapByIdList(userIdList);
+		for (GaoOrderFulfillment fulfillment : fulfillmentList) {
+			fulfillment.setAttachmentList(attachmentMap.getOrDefault(fulfillment.getId(), List.of()));
+			GaoCustomer customer = customerMap.get(fulfillment.getCustomerId());
+			if (customer != null) {
+				customer.setAttachmentList(customerAttachmentMap.getOrDefault(customer.getId(), List.of()));
+			}
+			fulfillment.setCustomer(customer);
+			fulfillment.setOperator(userMap.get(fulfillment.getOperatorUserId()));
+			fulfillment.setVerifier(userMap.get(fulfillment.getVerifierUserId()));
+		}
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoPackageConfigController.java

@@ -0,0 +1,149 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.entity.GaoPackageConfig;
+import com.imyeyu.api.modules.gao.entity.GaoPackageConfigItem;
+import com.imyeyu.api.modules.gao.entity.GaoProductSku;
+import com.imyeyu.api.modules.gao.service.GaoEventService;
+import com.imyeyu.api.modules.gao.service.GaoPackageConfigService;
+import com.imyeyu.api.modules.gao.service.GaoProductSkuService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoPackageConfigPage;
+import com.imyeyu.api.modules.user.entity.User;
+import com.imyeyu.api.modules.user.service.UserService;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.bean.PageResult;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.Map;
+
+/// GAO 套餐配置接口
+///
+/// @author Codex
+/// @since 2026-08-31
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/package/config")
+public class GaoPackageConfigController {
+
+	private final GaoPackageConfigService service;
+	private final GaoEventService eventService;
+	private final GaoProductSkuService skuService;
+	private final GaoStoreScopeService storeScopeService;
+	private final UserService userService;
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PACKAGE_CONFIG_READ)
+	@PostMapping("/list")
+	public PageResult<GaoPackageConfig> list(@RequestBody GaoPackageConfigPage page) {
+		TimiException.required(page, "not found page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		PageResult<GaoPackageConfig> result = service.pageByQuery(page);
+		fillTransient(result.getList(), false);
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PACKAGE_CONFIG_READ)
+	@PostMapping("/list/valid")
+	public List<GaoPackageConfig> listValid(@RequestParam String storeId) {
+		List<GaoPackageConfig> result = service.listValid(storeScopeService.resolveStoreId(storeId));
+		fillTransient(result, false);
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PACKAGE_CONFIG_READ)
+	@PostMapping("/detail")
+	public GaoPackageConfig detail(@RequestParam String id) {
+		GaoPackageConfig config = service.get(id);
+		TimiException.required(config, "not found package config");
+		storeScopeService.checkStoreId(config.getStoreId());
+		fillTransient(List.of(config), true);
+		return config;
+	}
+
+	private void fillTransient(List<GaoPackageConfig> configList, boolean includeProductDetail) {
+		if (configList == null || configList.isEmpty()) {
+			return;
+		}
+		Map<String, List<GaoPackageConfigItem>> itemMap = service.mapItemListByPackageConfigIdList(configList.stream().map(GaoPackageConfig::getId).toList());
+		List<String> updaterIdList = configList.stream().map(GaoPackageConfig::getUpdatedBy).filter(value -> value != null && !value.isBlank()).distinct().toList();
+		Map<String, User> updaterMap = updaterIdList.isEmpty() ? Map.of() : userService.mapByIdList(updaterIdList);
+		for (GaoPackageConfig config : configList) {
+			config.setItemList(itemMap.getOrDefault(config.getId(), List.of()));
+			config.setUpdater(updaterMap.get(config.getUpdatedBy()));
+		}
+		if (includeProductDetail) {
+			fillProductDetails(configList);
+		}
+	}
+
+	private void fillProductDetails(List<GaoPackageConfig> configList) {
+		List<String> skuIdList = configList.stream()
+			.flatMap(config -> config.getItemList().stream())
+			.map(GaoPackageConfigItem::getSkuId)
+			.filter(value -> value != null && !value.isBlank())
+			.distinct()
+			.toList();
+		if (skuIdList.isEmpty()) {
+			return;
+		}
+		Map<String, GaoProductSku> skuMap = skuIdList.stream()
+			.collect(java.util.stream.Collectors.toMap(item -> item, skuService::detail));
+		for (GaoPackageConfig config : configList) {
+			for (GaoPackageConfigItem item : config.getItemList()) {
+				item.setSku(skuMap.get(item.getSkuId()));
+			}
+		}
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PACKAGE_CONFIG_CREATE)
+	@PostMapping("/create")
+	public String create(@RequestBody GaoPackageConfig config) {
+		TimiException.required(config, "not found package config");
+		config.setStoreId(storeScopeService.resolveStoreId(config.getStoreId()));
+		service.create(config);
+		return config.getId();
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PACKAGE_CONFIG_UPDATE)
+	@PostMapping("/update")
+	public void update(@RequestBody GaoPackageConfig config) {
+		TimiException.required(config, "not found package config");
+		TimiException.required(config.getId(), "not found packageConfig.id");
+		GaoPackageConfig dbConfig = service.get(config.getId());
+		TimiException.required(dbConfig, "not found package config");
+		storeScopeService.checkStoreId(dbConfig.getStoreId());
+		config.setStoreId(dbConfig.getStoreId());
+		service.update(config);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PACKAGE_CONFIG_DELETE)
+	@PostMapping("/delete")
+	public void delete(@RequestParam String id) {
+		GaoPackageConfig config = service.get(id);
+		TimiException.required(config, "not found package config");
+		storeScopeService.checkStoreId(config.getStoreId());
+		TimiException.requiredTrue(0 == eventService.countByPackageConfigId(id), "套餐配置已绑定购买事件，不能删除");
+		service.delete(id);
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointAccountController.java

@@ -1,17 +1,18 @@
 package com.imyeyu.api.modules.gao.controller;
 
-import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
-import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.gao.entity.GaoPointAccount;
 import com.imyeyu.api.modules.gao.service.GaoPointAccountService;
-import com.imyeyu.api.modules.gao.service.GaoStoreService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
-import com.imyeyu.api.modules.user.service.RoleChecker;
+import com.imyeyu.api.modules.gao.vo.GaoPointAccountPage;
+import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.spring.annotation.AOPLog;
 import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.bean.PageResult;
 import lombok.RequiredArgsConstructor;
 import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
@@ -25,23 +26,33 @@ import org.springframework.web.bind.annotation.RestController;
 @RequestMapping("/gao/customer/point")
 public class GaoPointAccountController {
 
-	private final RoleChecker roleChecker;
+	private final GaoStoreScopeService storeScopeService;
-	private final GaoStoreService storeService;
 	private final GaoPointAccountService accountService;
 
 	@AOPLog
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.POINT_ACCOUNT_READ)
-	@PostMapping("/account/detail")
+	@PostMapping("/account/list")
+	public PageResult<GaoPointAccount> list(@RequestBody GaoPointAccountPage page) {
+		TimiException.required(page, "not found page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		return accountService.pageByQuery(page);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.POINT_ACCOUNT_READ)
+	@PostMapping("/account/detail/customer")
 	public GaoPointAccount detail(@RequestParam String customerId, @RequestParam(required = false) String storeId) {
-		storeId = resolveStoreId(storeId);
+		storeId = storeScopeService.resolveStoreId(storeId);
 		return accountService.getByCustomerId(storeId, customerId);
 	}
 
-	private String resolveStoreId(String requestedStoreId) {
+	@AOPLog
-		if (roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+	@RequestRateLimit
-			return requestedStoreId;
+	@RequireGaoPermission(GaoPermissionCode.POINT_ACCOUNT_READ)
-		}
+	@PostMapping("/account/detail")
-		return storeService.getBelongIdByRequiredLoginUserId();
+	public GaoPointAccount detailById(@RequestParam String id, @RequestParam(required = false) String storeId) {
+		return accountService.getByIdAndStoreId(storeScopeService.resolveStoreId(storeId), id);
 	}
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointLedgerController.java

@@ -1,16 +1,13 @@
 package com.imyeyu.api.modules.gao.controller;
 
-import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
-import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.gao.entity.GaoPointLedger;
 import com.imyeyu.api.modules.gao.service.GaoPointLedgerService;
 import com.imyeyu.api.modules.gao.service.GaoPointTriggerService;
-import com.imyeyu.api.modules.gao.service.GaoStoreService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
 import com.imyeyu.api.modules.gao.vo.GaoPointAdjustRequest;
 import com.imyeyu.api.modules.gao.vo.GaoPointLedgerPage;
-import com.imyeyu.api.modules.user.service.RoleChecker;
 import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.spring.annotation.AOPLog;
 import com.imyeyu.spring.annotation.RequestRateLimit;
@@ -30,8 +27,7 @@ import org.springframework.web.bind.annotation.RestController;
 @RequestMapping("/gao/customer/point")
 public class GaoPointLedgerController {
 
-	private final RoleChecker roleChecker;
+	private final GaoStoreScopeService storeScopeService;
-	private final GaoStoreService storeService;
 	private final GaoPointLedgerService ledgerService;
 	private final GaoPointTriggerService triggerService;
 
@@ -41,7 +37,7 @@ public class GaoPointLedgerController {
 	@PostMapping("/ledger/list")
 	public PageResult<GaoPointLedger> list(@RequestBody GaoPointLedgerPage page) {
 		TimiException.required(page, "not found page");
-		page.setStoreId(resolveStoreId(page.getStoreId()));
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
 		return ledgerService.pageByQuery(page);
 	}
 
@@ -50,14 +46,7 @@ public class GaoPointLedgerController {
 	@RequireGaoPermission(GaoPermissionCode.POINT_ADJUST)
 	@PostMapping("/adjust")
 	public void adjust(@RequestBody GaoPointAdjustRequest request) {
-		request.setStoreId(resolveStoreId(request.getStoreId()));
+		request.setStoreId(storeScopeService.resolveStoreId(request.getStoreId()));
 		triggerService.adjust(request);
 	}
-
-	private String resolveStoreId(String requestedStoreId) {
-		if (roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
-			return requestedStoreId;
-		}
-		return storeService.getBelongIdByRequiredLoginUserId();
-	}
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointRuleController.java

@@ -1,13 +1,12 @@
 package com.imyeyu.api.modules.gao.controller;
 
-import com.imyeyu.api.bean.ModuleCode;
+import com.imyeyu.api.modules.common.entity.GroovyScript;
+import com.imyeyu.api.modules.common.service.GroovyScriptService;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
-import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.gao.entity.GaoPointRule;
 import com.imyeyu.api.modules.gao.service.GaoPointRuleService;
-import com.imyeyu.api.modules.gao.service.GaoStoreService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
-import com.imyeyu.api.modules.user.service.RoleChecker;
 import com.imyeyu.java.TimiJava;
 import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.spring.annotation.AOPLog;
@@ -32,9 +31,9 @@ import java.util.List;
 @RequestMapping("/gao/customer/point")
 public class GaoPointRuleController {
 
-	private final RoleChecker roleChecker;
+	private final GaoStoreScopeService storeScopeService;
-	private final GaoStoreService storeService;
 	private final GaoPointRuleService ruleService;
+	private final GroovyScriptService groovyScriptService;
 
 	@AOPLog
 	@RequestRateLimit
@@ -42,9 +41,9 @@ public class GaoPointRuleController {
 	@PostMapping("/rule/list")
 	public PageResult<GaoPointRule> list(@RequestBody Page<GaoPointRule> page) {
 		TimiException.required(page, "not found page");
-		if (!isGlobalManager()) {
+		if (!storeScopeService.hasGlobalScope()) {
 			GaoPointRule example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoPointRule());
-			example.setStoreId(resolveStoreId(null));
+			example.setStoreId(storeScopeService.resolveStoreId(example.getStoreId()));
 			page.setEqualsExample(example);
 		}
 		return ruleService.page(page);
@@ -57,16 +56,29 @@ public class GaoPointRuleController {
 	public GaoPointRule detail(@RequestParam String id) {
 		GaoPointRule rule = ruleService.get(id);
 		TimiException.required(rule, "not found point rule");
-		checkStore(rule.getStoreId());
+		storeScopeService.checkStoreId(rule.getStoreId());
+		if (rule.getRuleMode() == GaoPointRule.RuleMode.GROOVY) {
+			GroovyScript script = groovyScriptService.get(rule.getGroovyScriptId());
+			script.setLatest(groovyScriptService.getLatestVersion(script.getId()));
+			rule.setGroovyScript(script);
+		}
 		return rule;
 	}
 
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.POINT_RULE_READ)
+	@PostMapping("/rule/script/list")
+	public List<GroovyScript> scriptList() {
+		return groovyScriptService.listByBizType(GroovyScript.BizType.GAO_POINT_RULE);
+	}
+
 	@AOPLog
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.POINT_RULE_CREATE)
 	@PostMapping("/rule/create")
 	public String create(@RequestBody GaoPointRule rule) {
-		rule.setStoreId(resolveStoreId(rule.getStoreId()));
+		rule.setStoreId(storeScopeService.resolveStoreId(rule.getStoreId()));
 		ruleService.create(rule);
 		return rule.getId();
 	}
@@ -76,7 +88,7 @@ public class GaoPointRuleController {
 	@RequireGaoPermission(GaoPermissionCode.POINT_RULE_UPDATE)
 	@PostMapping("/rule/update")
 	public void update(@RequestBody GaoPointRule rule) {
-		rule.setStoreId(resolveStoreId(rule.getStoreId()));
+		rule.setStoreId(storeScopeService.resolveStoreId(rule.getStoreId()));
 		ruleService.update(rule);
 	}
 
@@ -87,7 +99,7 @@ public class GaoPointRuleController {
 	public void sort(@RequestBody List<String> idList) {
 		if (idList != null) {
 			for (GaoPointRule rule : ruleService.listByIdList(idList)) {
-				checkStore(rule.getStoreId());
+				storeScopeService.checkStoreId(rule.getStoreId());
 			}
 		}
 		ruleService.sort(idList);
@@ -100,24 +112,7 @@ public class GaoPointRuleController {
 	public void delete(@RequestParam String id) {
 		GaoPointRule rule = ruleService.get(id);
 		TimiException.required(rule, "not found point rule");
-		checkStore(rule.getStoreId());
+		storeScopeService.checkStoreId(rule.getStoreId());
 		ruleService.delete(id);
 	}
-
-	private String resolveStoreId(String requestedStoreId) {
-		if (isGlobalManager()) {
-			return requestedStoreId;
-		}
-		return storeService.getBelongIdByRequiredLoginUserId();
-	}
-
-	private void checkStore(String storeId) {
-		if (!isGlobalManager()) {
-			TimiException.requiredTrue(resolveStoreId(null).equals(storeId), "无权操作其他门店数据");
-		}
-	}
-
-	private boolean isGlobalManager() {
-		return roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name());
-	}
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoProductChartController.java

@@ -0,0 +1,126 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.service.GaoProductChartService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoProductCategoryStatView;
+import com.imyeyu.api.modules.gao.vo.GaoProductChartReq;
+import com.imyeyu.api.modules.gao.vo.GaoProductFulfillmentDailyStatView;
+import com.imyeyu.api.modules.gao.vo.GaoProductFulfillmentRankView;
+import com.imyeyu.api.modules.gao.vo.GaoProductSalesDailyStatView;
+import com.imyeyu.api.modules.gao.vo.GaoProductSalesRankView;
+import com.imyeyu.api.modules.gao.vo.GaoProductStockHealthView;
+import com.imyeyu.api.modules.gao.vo.GaoProductStockMovementDailyStatView;
+import com.imyeyu.api.modules.gao.vo.GaoProductTypeStatView;
+import com.imyeyu.api.modules.gao.vo.GaoProductUnitSalesRankView;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+/// GAO 产品图表接口
+///
+/// @author Codex
+/// @since 2026-09-06
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/product/chart")
+public class GaoProductChartController {
+
+	private final GaoProductChartService service;
+	private final GaoStoreScopeService storeScopeService;
+
+	/// 查询产品每日销售统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/sales/daily")
+	public List<GaoProductSalesDailyStatView> salesDaily(@RequestBody GaoProductChartReq req) {
+		return service.salesDaily(normalize(req));
+	}
+
+	/// 查询产品销售排行
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/sales/rank")
+	public List<GaoProductSalesRankView> salesRank(@RequestBody GaoProductChartReq req) {
+		return service.salesRank(normalize(req));
+	}
+
+	/// 查询产品每日履约统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/fulfillment/daily")
+	public List<GaoProductFulfillmentDailyStatView> fulfillmentDaily(@RequestBody GaoProductChartReq req) {
+		return service.fulfillmentDaily(normalize(req));
+	}
+
+	/// 查询产品履约进度排行
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/fulfillment/rank")
+	public List<GaoProductFulfillmentRankView> fulfillmentRank(@RequestBody GaoProductChartReq req) {
+		return service.fulfillmentRank(normalize(req));
+	}
+
+	/// 查询产品每日库存变动统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/stock/movement/daily")
+	public List<GaoProductStockMovementDailyStatView> stockMovementDaily(@RequestBody GaoProductChartReq req) {
+		return service.stockMovementDaily(normalize(req));
+	}
+
+	/// 查询产品库存健康度
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/stock/health")
+	public List<GaoProductStockHealthView> stockHealth(@RequestBody GaoProductChartReq req) {
+		return service.stockHealth(normalize(req));
+	}
+
+	/// 查询产品类型统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/structure/type")
+	public List<GaoProductTypeStatView> type(@RequestBody GaoProductChartReq req) {
+		return service.type(normalize(req));
+	}
+
+	/// 查询产品分类统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/structure/category")
+	public List<GaoProductCategoryStatView> category(@RequestBody GaoProductChartReq req) {
+		return service.category(normalize(req));
+	}
+
+	/// 查询产品销售单位排行
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/sales/unit/rank")
+	public List<GaoProductUnitSalesRankView> unitSalesRank(@RequestBody GaoProductChartReq req) {
+		return service.unitSalesRank(normalize(req));
+	}
+
+	private GaoProductChartReq normalize(GaoProductChartReq req) {
+		TimiException.required(req, "not found product chart req");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
+		return req;
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoProductController.java

@@ -0,0 +1,248 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.entity.GaoProduct;
+import com.imyeyu.api.modules.gao.entity.GaoProductCategory;
+import com.imyeyu.api.modules.gao.entity.GaoProductSku;
+import com.imyeyu.api.modules.gao.service.GaoProductCategoryService;
+import com.imyeyu.api.modules.gao.service.GaoProductService;
+import com.imyeyu.api.modules.gao.service.GaoProductSkuService;
+import com.imyeyu.api.modules.gao.service.GaoProductSpecService;
+import com.imyeyu.api.modules.gao.entity.GaoProductSpec;
+import com.imyeyu.api.modules.gao.entity.GaoProductSpecValue;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoProductCategoryPage;
+import com.imyeyu.api.modules.gao.vo.GaoProductPage;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.bean.PageResult;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+/// GAO 产品库接口
+///
+/// @author Codex
+/// @since 2026-09-02
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/product")
+public class GaoProductController {
+
+	private final GaoProductCategoryService categoryService;
+	private final GaoProductService productService;
+	private final GaoProductSkuService skuService;
+	private final GaoProductSpecService specService;
+	private final GaoStoreScopeService storeScopeService;
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_CATEGORY_READ)
+	@PostMapping("/category/list")
+	public PageResult<GaoProductCategory> categoryList(@RequestBody GaoProductCategoryPage page) {
+		TimiException.required(page, "not found category page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		return categoryService.pageByQuery(page);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_CATEGORY_CREATE)
+	@PostMapping("/category/create")
+	public String categoryCreate(@RequestBody GaoProductCategory category) {
+		TimiException.required(category, "not found category");
+		category.setStoreId(storeScopeService.resolveStoreId(category.getStoreId()));
+		categoryService.create(category);
+		return category.getId();
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_CATEGORY_UPDATE)
+	@PostMapping("/category/update")
+	public void categoryUpdate(@RequestBody GaoProductCategory request) {
+		TimiException.required(request, "not found category");
+		TimiException.required(request.getId(), "not found category.id");
+		GaoProductCategory category = categoryService.get(request.getId());
+		TimiException.required(category, "not found category");
+		storeScopeService.checkStoreId(category.getStoreId());
+		request.setStoreId(category.getStoreId());
+		categoryService.update(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_CATEGORY_UPDATE)
+	@PostMapping("/category/sort")
+	public void categorySort(@RequestBody List<String> idList) {
+		categoryService.sort(idList);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_CATEGORY_UPDATE)
+	@PostMapping("/category/disable")
+	public void categoryDisable(@RequestParam String id) {
+		categoryService.disable(id);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_READ)
+	@PostMapping("/list")
+	public PageResult<GaoProduct> list(@RequestBody GaoProductPage page) {
+		TimiException.required(page, "not found product page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		return productService.pageByQuery(page);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_READ)
+	@PostMapping("/detail")
+	public GaoProduct detail(@RequestParam String id) {
+		GaoProduct result = productService.detail(id);
+		storeScopeService.checkStoreId(result.getStoreId());
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_CREATE)
+	@PostMapping("/create")
+	public String create(@RequestBody GaoProduct product) {
+		TimiException.required(product, "not found product");
+		product.setStoreId(storeScopeService.resolveStoreId(product.getStoreId()));
+		productService.create(product);
+		return product.getId();
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_UPDATE)
+	@PostMapping("/update")
+	public void update(@RequestBody GaoProduct request) {
+		TimiException.required(request, "not found product");
+		TimiException.required(request.getId(), "not found product.id");
+		GaoProduct product = productService.get(request.getId());
+		TimiException.required(product, "not found product");
+		storeScopeService.checkStoreId(product.getStoreId());
+		request.setStoreId(product.getStoreId());
+		productService.update(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_UPDATE)
+	@PostMapping("/disable")
+	public void disable(@RequestParam String id) {
+		GaoProduct product = productService.get(id);
+		TimiException.required(product, "not found product");
+		storeScopeService.checkStoreId(product.getStoreId());
+		productService.disable(id);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_READ)
+	@PostMapping("/sku/detail")
+	public GaoProductSku skuDetail(@RequestParam String id) {
+		GaoProductSku result = skuService.detail(id);
+		storeScopeService.checkStoreId(result.getStoreId());
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_CREATE)
+	@PostMapping("/sku/create")
+	public String skuCreate(@RequestBody GaoProductSku sku) {
+		TimiException.required(sku, "not found product sku");
+		GaoProduct product = productService.get(sku.getProductId());
+		TimiException.required(product, "not found product");
+		storeScopeService.checkStoreId(product.getStoreId());
+		skuService.create(sku);
+		return sku.getId();
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_UPDATE)
+	@PostMapping("/sku/update")
+	public void skuUpdate(@RequestBody GaoProductSku request) {
+		TimiException.required(request, "not found product sku");
+		TimiException.required(request.getId(), "not found product sku.id");
+		GaoProductSku sku = skuService.get(request.getId());
+		TimiException.required(sku, "not found product sku");
+		storeScopeService.checkStoreId(sku.getStoreId());
+		request.setProductId(sku.getProductId());
+		skuService.update(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_UPDATE)
+	@PostMapping("/sku/disable")
+	public void skuDisable(@RequestParam String id) {
+		GaoProductSku sku = skuService.get(id);
+		TimiException.required(sku, "not found product sku");
+		storeScopeService.checkStoreId(sku.getStoreId());
+		skuService.disable(id);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_READ)
+	@PostMapping("/spec/list")
+	public List<GaoProductSpec> specList(@RequestParam String productId) {
+		GaoProduct product = productService.get(productId);
+		TimiException.required(product, "not found product");
+		storeScopeService.checkStoreId(product.getStoreId());
+		return specService.listByProductId(productId);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_UPDATE)
+	@PostMapping("/spec/create")
+	public String specCreate(@RequestBody GaoProductSpec spec) {
+		TimiException.required(spec, "not found product spec");
+		GaoProduct product = productService.get(spec.getProductId());
+		TimiException.required(product, "not found product");
+		storeScopeService.checkStoreId(product.getStoreId());
+		specService.createSpec(spec);
+		return spec.getId();
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_UPDATE)
+	@PostMapping("/spec/value/create")
+	public String specValueCreate(@RequestBody GaoProductSpecValue value) {
+		TimiException.required(value, "not found product spec value");
+		String productId = specService.getProductIdBySpecId(value.getSpecId());
+		TimiException.required(productId, "规格项不存在");
+		GaoProduct product = productService.get(productId);
+		TimiException.required(product, "not found product");
+		storeScopeService.checkStoreId(product.getStoreId());
+		specService.createValue(value);
+		return value.getId();
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_READ)
+	@PostMapping("/sellable/list")
+	public List<GaoProduct> sellableList(@RequestBody GaoProductPage page) {
+		TimiException.required(page, "not found product page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		return productService.listSellable(page);
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoProductSkuChartController.java

@@ -0,0 +1,106 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.service.GaoProductSkuChartService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoProductChartReq;
+import com.imyeyu.api.modules.gao.vo.GaoProductSkuFulfillmentDailyStatView;
+import com.imyeyu.api.modules.gao.vo.GaoProductSkuFulfillmentRankView;
+import com.imyeyu.api.modules.gao.vo.GaoProductSkuSalesDailyStatView;
+import com.imyeyu.api.modules.gao.vo.GaoProductSkuSalesRankView;
+import com.imyeyu.api.modules.gao.vo.GaoProductSkuStockHealthView;
+import com.imyeyu.api.modules.gao.vo.GaoProductSkuStockMovementDailyStatView;
+import com.imyeyu.api.modules.gao.vo.GaoProductSkuUnitSalesRankView;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+/// GAO SKU 图表接口
+///
+/// @author Codex
+/// @since 2026-09-07
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/product/sku/chart")
+public class GaoProductSkuChartController {
+
+	private final GaoProductSkuChartService service;
+	private final GaoStoreScopeService storeScopeService;
+
+	/// 查询 SKU 每日销售统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/sales/daily")
+	public List<GaoProductSkuSalesDailyStatView> salesDaily(@RequestBody GaoProductChartReq req) {
+		return service.salesDaily(normalize(req));
+	}
+
+	/// 查询 SKU 销售排行
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/sales/rank")
+	public List<GaoProductSkuSalesRankView> salesRank(@RequestBody GaoProductChartReq req) {
+		return service.salesRank(normalize(req));
+	}
+
+	/// 查询 SKU 单位销售排行
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/sales/unit/rank")
+	public List<GaoProductSkuUnitSalesRankView> unitSalesRank(@RequestBody GaoProductChartReq req) {
+		return service.unitSalesRank(normalize(req));
+	}
+
+	/// 查询 SKU 每日履约统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/fulfillment/daily")
+	public List<GaoProductSkuFulfillmentDailyStatView> fulfillmentDaily(@RequestBody GaoProductChartReq req) {
+		return service.fulfillmentDaily(normalize(req));
+	}
+
+	/// 查询 SKU 履约进度排行
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/fulfillment/rank")
+	public List<GaoProductSkuFulfillmentRankView> fulfillmentRank(@RequestBody GaoProductChartReq req) {
+		return service.fulfillmentRank(normalize(req));
+	}
+
+	/// 查询 SKU 每日库存变动统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/stock/movement/daily")
+	public List<GaoProductSkuStockMovementDailyStatView> stockMovementDaily(@RequestBody GaoProductChartReq req) {
+		return service.stockMovementDaily(normalize(req));
+	}
+
+	/// 查询 SKU 库存健康度
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/stock/health")
+	public List<GaoProductSkuStockHealthView> stockHealth(@RequestBody GaoProductChartReq req) {
+		return service.stockHealth(normalize(req));
+	}
+
+	private GaoProductChartReq normalize(GaoProductChartReq req) {
+		TimiException.required(req, "SKU 图表请求不能为空");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
+		return req;
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoProductStockController.java

@@ -0,0 +1,140 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.entity.GaoProductStock;
+import com.imyeyu.api.modules.gao.entity.GaoProductStockRecord;
+import com.imyeyu.api.modules.gao.service.GaoProductStockService;
+import com.imyeyu.api.modules.gao.service.GaoProductStockRecordService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoProductStockChangeRequest;
+import com.imyeyu.api.modules.gao.vo.GaoProductStockManualRevokeRequest;
+import com.imyeyu.api.modules.gao.vo.GaoProductStockPage;
+import com.imyeyu.api.modules.gao.vo.GaoProductStockProductView;
+import com.imyeyu.api.modules.gao.vo.GaoProductStockRecordPage;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.bean.PageResult;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+/// GAO 产品库存接口
+///
+/// @author Codex
+/// @since 2026-09-02
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/product/stock")
+public class GaoProductStockController {
+
+	private final GaoProductStockService stockService;
+	private final GaoProductStockRecordService recordService;
+	private final GaoStoreScopeService storeScopeService;
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_READ)
+	@PostMapping("/list")
+	public PageResult<GaoProductStock> list(@RequestBody GaoProductStockPage page) {
+		TimiException.required(page, "not found stock page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		return stockService.pageByQuery(page);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_READ)
+	@PostMapping("/product-list")
+	public PageResult<GaoProductStockProductView> productList(@RequestBody GaoProductStockPage page) {
+		TimiException.required(page, "not found stock product page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		return stockService.pageProductByQuery(page);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_READ)
+	@PostMapping("/detail")
+	public GaoProductStock detail(@RequestParam(required = false) String storeId, @RequestParam String skuId) {
+		return stockService.detail(storeScopeService.resolveStoreId(storeId), skuId);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_CREATE)
+	@PostMapping("/initial-in")
+	public GaoProductStock initialIn(@RequestBody GaoProductStockChangeRequest request) {
+		return stockService.initialIn(normalize(request));
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_CREATE)
+	@PostMapping("/manual-in")
+	public GaoProductStock manualIn(@RequestBody GaoProductStockChangeRequest request) {
+		return stockService.manualIn(normalize(request));
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_CREATE)
+	@PostMapping("/manual-out")
+	public GaoProductStock manualOut(@RequestBody GaoProductStockChangeRequest request) {
+		return stockService.manualOut(normalize(request));
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_MANUAL_REVOKE)
+	@PostMapping("/manual-revoke")
+	public GaoProductStock manualRevoke(@RequestBody GaoProductStockManualRevokeRequest request) {
+		return stockService.manualRevoke(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_CREATE)
+	@PostMapping("/stocktake-gain")
+	public GaoProductStock stocktakeGain(@RequestBody GaoProductStockChangeRequest request) {
+		return stockService.stocktakeGain(normalize(request));
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_CREATE)
+	@PostMapping("/stocktake-loss")
+	public GaoProductStock stocktakeLoss(@RequestBody GaoProductStockChangeRequest request) {
+		return stockService.stocktakeLoss(normalize(request));
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_READ)
+	@PostMapping("/record/list")
+	public PageResult<GaoProductStockRecord> recordList(@RequestBody GaoProductStockRecordPage page) {
+		TimiException.required(page, "not found stock record page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		return recordService.pageByQuery(page);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.PRODUCT_STOCK_READ)
+	@PostMapping("/record/detail")
+	public GaoProductStockRecord recordDetail(@RequestParam String id) {
+		GaoProductStockRecord result = recordService.detail(id);
+		storeScopeService.checkStoreId(result.getStoreId());
+		return result;
+	}
+
+	private GaoProductStockChangeRequest normalize(GaoProductStockChangeRequest request) {
+		TimiException.required(request, "not found stock change request");
+		request.setStoreId(storeScopeService.resolveStoreId(request.getStoreId()));
+		return request;
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoSalesOrderChartController.java

@@ -0,0 +1,156 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.service.GaoSalesOrderChartService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerOrderProductRankView;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerOrderRankView;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerOrderSkuRankView;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerRepeatDailyStatView;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerRepeatIntervalStatView;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderChartReq;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderCalendarStatView;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderConsumptionDailyStatView;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderDailyStatView;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderPaymentStatView;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderReceivableStatView;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderStatusStatView;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderTypeStatView;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+/// GAO 销售订单图表接口
+///
+/// @author Codex
+/// @since 2026-09-06
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/sales/order/chart")
+public class GaoSalesOrderChartController {
+
+	private final GaoSalesOrderChartService service;
+	private final GaoStoreScopeService storeScopeService;
+
+	/// 查询销售订单每日统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/daily")
+	public List<GaoSalesOrderDailyStatView> daily(@RequestBody GaoSalesOrderChartReq req) {
+		return service.daily(normalize(req));
+	}
+
+	/// 查询销售订单类型统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/type")
+	public List<GaoSalesOrderTypeStatView> type(@RequestBody GaoSalesOrderChartReq req) {
+		return service.type(normalize(req));
+	}
+
+	/// 查询销售订单付款状态统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/payment")
+	public List<GaoSalesOrderPaymentStatView> payment(@RequestBody GaoSalesOrderChartReq req) {
+		return service.payment(normalize(req));
+	}
+
+	/// 查询客户订单排行
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/customer/rank")
+	public List<GaoCustomerOrderRankView> customerRank(@RequestBody GaoSalesOrderChartReq req) {
+		return service.customerRank(normalize(req));
+	}
+
+	/// 查询指定客户订单产品排行
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/customer/product/rank")
+	public List<GaoCustomerOrderProductRankView> customerProductRank(@RequestBody GaoSalesOrderChartReq req) {
+		return service.customerProductRank(normalize(req));
+	}
+
+	/// 查询指定客户订单 SKU 排行
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/customer/sku/rank")
+	public List<GaoCustomerOrderSkuRankView> customerSkuRank(@RequestBody GaoSalesOrderChartReq req) {
+		return service.customerSkuRank(normalize(req));
+	}
+
+	/// 查询销售订单状态统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/status")
+	public List<GaoSalesOrderStatusStatView> status(@RequestBody GaoSalesOrderChartReq req) {
+		return service.status(normalize(req));
+	}
+
+	/// 查询销售订单应收统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/receivable")
+	public GaoSalesOrderReceivableStatView receivable(@RequestBody GaoSalesOrderChartReq req) {
+		return service.receivable(normalize(req));
+	}
+
+	/// 查询客户每日有效消费统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/customer/consumption/daily")
+	public List<GaoSalesOrderConsumptionDailyStatView> consumptionDaily(@RequestBody GaoSalesOrderChartReq req) {
+		return service.consumptionDaily(normalize(req));
+	}
+
+	/// 查询客户订单日历统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/customer/calendar")
+	public List<GaoSalesOrderCalendarStatView> calendar(@RequestBody GaoSalesOrderChartReq req) {
+		return service.calendar(normalize(req));
+	}
+
+	/// 查询客户每日复购统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/customer/repeat/daily")
+	public List<GaoCustomerRepeatDailyStatView> repeatDaily(@RequestBody GaoSalesOrderChartReq req) {
+		return service.repeatDaily(normalize(req));
+	}
+
+	/// 查询客户复购间隔统计
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/customer/repeat/interval")
+	public List<GaoCustomerRepeatIntervalStatView> repeatInterval(@RequestBody GaoSalesOrderChartReq req) {
+		return service.repeatInterval(normalize(req));
+	}
+
+	private GaoSalesOrderChartReq normalize(GaoSalesOrderChartReq req) {
+		TimiException.required(req, "not found sales order chart req");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
+		return req;
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoSalesOrderController.java

@@ -0,0 +1,152 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.imyeyu.api.bean.PermissionMatchMode;
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.entity.GaoFundRecord;
+import com.imyeyu.api.modules.gao.entity.GaoSalesOrder;
+import com.imyeyu.api.modules.gao.service.GaoOrderPaymentService;
+import com.imyeyu.api.modules.gao.service.GaoSalesOrderService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoDirectProductOrderCreateRequest;
+import com.imyeyu.api.modules.gao.vo.GaoOrderPaymentActionRequest;
+import com.imyeyu.api.modules.gao.vo.GaoOrderPaymentNoRefundRequest;
+import com.imyeyu.api.modules.gao.vo.GaoOrderPaymentReceiveRequest;
+import com.imyeyu.api.modules.gao.vo.GaoOrderPaymentRefundRequest;
+import com.imyeyu.api.modules.gao.vo.GaoOrderPaymentRevokeRequest;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderCancelRequest;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderPage;
+import com.imyeyu.api.modules.gao.vo.GaoSalesOrderUpdateRequest;
+import com.imyeyu.api.modules.user.service.UserService;
+import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.bean.PageResult;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+/// GAO 销售订单和资金接口
+///
+/// @author Codex
+/// @since 2026-09-02
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/sales/order")
+public class GaoSalesOrderController {
+
+	private final GaoSalesOrderService service;
+	private final GaoOrderPaymentService paymentService;
+	private final GaoStoreScopeService storeScopeService;
+	private final UserService userService;
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.SALES_ORDER_READ)
+	@PostMapping("/list")
+	public PageResult<GaoSalesOrder> list(@RequestBody GaoSalesOrderPage page) {
+		TimiException.required(page, "not found sales order page");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		return service.pageByQuery(page);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.SALES_ORDER_READ)
+	@PostMapping("/detail")
+	public GaoSalesOrder detail(@RequestParam String id) {
+		GaoSalesOrder result = service.detail(id);
+		if (TimiJava.isNotEmpty(result.getCancelOperatorUserId())) {
+			result.setCancelOperator(userService.get(result.getCancelOperatorUserId()));
+		}
+		return result;
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.SALES_ORDER_CREATE)
+	@PostMapping("/direct-product/create")
+	public GaoSalesOrder createDirectProduct(@RequestBody GaoDirectProductOrderCreateRequest request) {
+		TimiException.required(request, "not found direct product order request");
+		request.setStoreId(storeScopeService.resolveStoreId(request.getStoreId()));
+		return service.createDirectProductOrder(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.SALES_ORDER_UPDATE)
+	@PostMapping("/update")
+	public GaoSalesOrder update(@RequestBody GaoSalesOrderUpdateRequest request) {
+		TimiException.required(request, "not found sales order update request");
+		TimiException.required(request.getId(), "not found sales order.id");
+		return service.updateRemarkAndAttachments(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.SALES_ORDER_CANCEL)
+	@PostMapping("/cancel")
+	public GaoSalesOrder cancel(@RequestBody GaoSalesOrderCancelRequest request) {
+		return service.cancel(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_RECEIVE_CREATE)
+	@PostMapping("/payment/receive")
+	public GaoFundRecord receive(@RequestBody GaoOrderPaymentReceiveRequest request) {
+		return paymentService.receive(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_RECEIVE_VERIFY)
+	@PostMapping("/payment/verify")
+	public GaoFundRecord verify(@RequestParam String id) {
+		return paymentService.verify(id);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_RECEIVE_VERIFY)
+	@PostMapping("/payment/reject")
+	public GaoFundRecord reject(@RequestBody GaoOrderPaymentActionRequest request) {
+		return paymentService.reject(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(value = {GaoPermissionCode.FUND_RECEIVE_CREATE, GaoPermissionCode.FUND_RECORD_READ}, mode = PermissionMatchMode.ANY)
+	@PostMapping("/payment/cancel")
+	public GaoFundRecord cancelPayment(@RequestBody GaoOrderPaymentActionRequest request) {
+		return paymentService.cancel(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_REFUND)
+	@PostMapping("/refund")
+	public GaoFundRecord refund(@RequestBody GaoOrderPaymentRefundRequest request) {
+		return paymentService.refund(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_REFUND)
+	@PostMapping("/refund/confirm-none")
+	public GaoFundRecord confirmNoRefund(@RequestBody GaoOrderPaymentNoRefundRequest request) {
+		return paymentService.confirmNoRefund(request);
+	}
+
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.FUND_REVOKE)
+	@PostMapping("/fund/revoke")
+	public GaoFundRecord revoke(@RequestBody GaoOrderPaymentRevokeRequest request) {
+		return paymentService.revoke(request);
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreBusinessDayController.java

@@ -4,6 +4,9 @@ import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
 import com.imyeyu.api.modules.gao.entity.GaoStoreBusinessDay;
 import com.imyeyu.api.modules.gao.service.GaoStoreBusinessDayService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.spring.annotation.AOPLog;
 import com.imyeyu.spring.annotation.RequestRateLimit;
 import com.imyeyu.spring.bean.Page;
@@ -27,12 +30,17 @@ import java.util.List;
 public class GaoStoreBusinessDayController {
 
 	private final GaoStoreBusinessDayService service;
+	private final GaoStoreScopeService storeScopeService;
 
 	@AOPLog
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.STORE_READ)
 	@PostMapping("/list")
 	public PageResult<GaoStoreBusinessDay> list(@RequestBody Page<GaoStoreBusinessDay> page) {
+		TimiException.required(page, "not found page");
+		GaoStoreBusinessDay example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoStoreBusinessDay());
+		example.setStoreId(storeScopeService.resolveStoreId(example.getStoreId()));
+		page.setEqualsExample(example);
 		return service.page(page);
 	}
 
@@ -41,7 +49,7 @@ public class GaoStoreBusinessDayController {
 	@RequireGaoPermission(GaoPermissionCode.STORE_READ)
 	@PostMapping("/calendar")
 	public List<GaoStoreBusinessDay> calendar(@RequestParam String storeId, @RequestParam Integer beginDateValue, @RequestParam Integer endDateValue) {
-		return service.listByDateRange(storeId, beginDateValue, endDateValue);
+		return service.listByDateRange(storeScopeService.resolveStoreId(storeId), beginDateValue, endDateValue);
 	}
 
 	@AOPLog
@@ -49,7 +57,10 @@ public class GaoStoreBusinessDayController {
 	@RequireGaoPermission(GaoPermissionCode.STORE_READ)
 	@PostMapping("/detail")
 	public GaoStoreBusinessDay detail(@RequestParam String id) {
-		return service.get(id);
+		GaoStoreBusinessDay businessDay = service.get(id);
+		TimiException.required(businessDay, "not found businessDay");
+		storeScopeService.checkStoreId(businessDay.getStoreId());
+		return businessDay;
 	}
 
 	@AOPLog
@@ -57,6 +68,7 @@ public class GaoStoreBusinessDayController {
 	@RequireGaoPermission(GaoPermissionCode.STORE_UPDATE)
 	@PostMapping("/create")
 	public String create(@RequestBody GaoStoreBusinessDay businessDay) {
+		businessDay.setStoreId(storeScopeService.resolveStoreId(businessDay.getStoreId()));
 		service.create(businessDay);
 		return businessDay.getId();
 	}
@@ -66,6 +78,12 @@ public class GaoStoreBusinessDayController {
 	@RequireGaoPermission(GaoPermissionCode.STORE_UPDATE)
 	@PostMapping("/update")
 	public void update(@RequestBody GaoStoreBusinessDay businessDay) {
+		TimiException.required(businessDay, "not found businessDay");
+		TimiException.required(businessDay.getId(), "not found businessDay.id");
+		GaoStoreBusinessDay dbBusinessDay = service.get(businessDay.getId());
+		TimiException.required(dbBusinessDay, "not found businessDay");
+		storeScopeService.checkStoreId(dbBusinessDay.getStoreId());
+		businessDay.setStoreId(dbBusinessDay.getStoreId());
 		service.update(businessDay);
 	}
 
@@ -74,6 +92,9 @@ public class GaoStoreBusinessDayController {
 	@RequireGaoPermission(GaoPermissionCode.STORE_DELETE)
 	@PostMapping("/delete")
 	public void delete(@RequestParam String id) {
+		GaoStoreBusinessDay businessDay = service.get(id);
+		TimiException.required(businessDay, "not found businessDay");
+		storeScopeService.checkStoreId(businessDay.getStoreId());
 		service.delete(id);
 	}
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreChartController.java

@@ -3,12 +3,15 @@ package com.imyeyu.api.modules.gao.controller;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
 import com.imyeyu.api.modules.gao.service.GaoStoreChartService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoCustomerAgeStatView;
 import com.imyeyu.api.modules.gao.vo.GaoCustomerDailyStateView;
 import com.imyeyu.api.modules.gao.vo.GaoCustomerGenderStatView;
 import com.imyeyu.api.modules.gao.vo.GaoEventRecordCalendarView;
 import com.imyeyu.api.modules.gao.vo.GaoEventRecordDailyStatView;
 import com.imyeyu.api.modules.gao.vo.GaoEventRecordNumberValueDailyStatView;
 import com.imyeyu.api.modules.gao.vo.GaoStoreChartReq;
+import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.spring.annotation.AOPLog;
 import com.imyeyu.spring.annotation.RequestRateLimit;
 import lombok.RequiredArgsConstructor;
@@ -30,6 +33,7 @@ import java.util.List;
 public class GaoStoreChartController {
 
 	private final GaoStoreChartService service;
+	private final GaoStoreScopeService storeScopeService;
 
 	/// 查询客户增长趋势
 	@AOPLog
@@ -37,6 +41,8 @@ public class GaoStoreChartController {
 	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
 	@PostMapping("/customer/daily")
 	public List<GaoCustomerDailyStateView> customerDaily(@RequestBody GaoStoreChartReq req) {
+		TimiException.required(req, "not found req");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
 		return service.customerDailyTrend(req);
 	}
 
@@ -46,7 +52,16 @@ public class GaoStoreChartController {
 	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
 	@PostMapping("/customer/gender")
 	public List<GaoCustomerGenderStatView> customerGender(@RequestParam String storeId) {
-		return service.customerGender(storeId);
+		return service.customerGender(storeScopeService.resolveStoreId(storeId));
+	}
+
+	/// 查询客户年龄分布
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
+	@PostMapping("/customer/age")
+	public List<GaoCustomerAgeStatView> customerAge(@RequestParam String storeId) {
+		return service.customerAge(storeScopeService.resolveStoreId(storeId));
 	}
 
 	/// 查询登记事件每日统计，可同时支撑登记趋势和事件结构图表
@@ -55,6 +70,8 @@ public class GaoStoreChartController {
 	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
 	@PostMapping("/event/record/daily")
 	public List<GaoEventRecordDailyStatView> eventRecordDaily(@RequestBody GaoStoreChartReq req) {
+		TimiException.required(req, "not found req");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
 		return service.eventRecordDailyStat(req);
 	}
 
@@ -64,6 +81,8 @@ public class GaoStoreChartController {
 	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
 	@PostMapping("/event/record/number-value/daily")
 	public List<GaoEventRecordNumberValueDailyStatView> eventRecordNumberValueDaily(@RequestBody GaoStoreChartReq req) {
+		TimiException.required(req, "not found req");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
 		return service.eventRecordNumberValueDailyStat(req);
 	}
 
@@ -73,6 +92,8 @@ public class GaoStoreChartController {
 	@RequireGaoPermission(GaoPermissionCode.STAT_READ)
 	@PostMapping("/event/record/calendar")
 	public List<GaoEventRecordCalendarView> eventRecordCalendar(@RequestBody GaoStoreChartReq req) {
+		TimiException.required(req, "not found req");
+		req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId()));
 		return service.eventRecordCalendar(req);
 	}
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreController.java

@@ -1,13 +1,14 @@
 package com.imyeyu.api.modules.gao.controller;
 
-import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.entity.GaoEvent;
 import com.imyeyu.api.modules.gao.entity.GaoStore;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
 import com.imyeyu.api.modules.gao.service.GaoStoreService;
-import com.imyeyu.api.modules.user.service.PermissionChecker;
 import com.imyeyu.api.modules.user.service.UserLoginService;
 import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.network.Network;
 import com.imyeyu.spring.TimiSpring;
 import com.imyeyu.spring.annotation.AOPLog;
@@ -37,14 +38,20 @@ import java.util.List;
 public class GaoStoreController {
 
 	private final GaoStoreService service;
+	private final GaoStoreScopeService storeScopeService;
 	private final UserLoginService userLoginService;
-	private final PermissionChecker permissionChecker;
 
 	@AOPLog
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.STORE_READ)
 	@PostMapping("/list")
 	public PageResult<GaoStore> list(@RequestBody Page<GaoStore> page) {
+		TimiException.required(page, "not found page");
+		if (!storeScopeService.hasGlobalScope()) {
+			GaoStore example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoStore());
+			example.setId(storeScopeService.resolveStoreId(example.getId()));
+			page.setEqualsExample(example);
+		}
 		return service.page(page);
 	}
 
@@ -53,7 +60,9 @@ public class GaoStoreController {
 	@RequireGaoPermission(GaoPermissionCode.STORE_READ)
 	@PostMapping("/detail")
 	public GaoStore detail(@RequestParam String id) {
-		return service.get(id);
+		GaoStore store = service.get(id);
+		storeScopeService.checkStore(store);
+		return store;
 	}
 
 	@AOPLog
@@ -70,12 +79,13 @@ public class GaoStoreController {
 	@RequireGaoPermission(GaoPermissionCode.STORE_UPDATE)
 	@PostMapping("/update")
 	public void update(@RequestBody GaoStore store) {
-		if (permissionChecker.hasAny(ModuleCode.GAO, GaoPermissionCode.STORE_CREATE.getValue())) {
+		if (storeScopeService.hasGlobalScope()) {
 			// 门店管理
 			service.update(store);
 		} else {
 			// 店长
 			GaoStore dbStore = service.get(store.getId());
+			storeScopeService.checkStore(dbStore);
 			dbStore.setName(store.getName());
 			dbStore.setTelephone(store.getTelephone());
 			dbStore.setAddress(store.getAddress());
@@ -98,6 +108,11 @@ public class GaoStoreController {
 	@RequireGaoPermission(GaoPermissionCode.STORE_UPDATE)
 	@PostMapping("/sort")
 	public void sort(@RequestBody List<String> idList) {
+		if (!storeScopeService.hasGlobalScope()) {
+			for (String id : TimiJava.safeIterable(idList)) {
+				storeScopeService.checkStore(service.get(id));
+			}
+		}
 		service.sort(idList);
 	}
 
@@ -107,6 +122,12 @@ public class GaoStoreController {
 	@RequireGaoPermission(GaoPermissionCode.STORE_EXPORT)
 	@PostMapping("/export")
 	public void export(@RequestBody Page<GaoStore> page) throws IOException {
+		TimiException.required(page, "not found page");
+		if (!storeScopeService.hasGlobalScope()) {
+			GaoStore example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoStore());
+			example.setId(storeScopeService.resolveStoreId(example.getId()));
+			page.setEqualsExample(example);
+		}
 		HttpServletResponse resp = TimiSpring.getResponse();
 		String contentDisposition = Network.getFileDownloadHeader("门店列表-%s.xlsx".formatted(Time.serialize.format(Time.now())));
 		resp.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");

src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreDiaryController.java

@@ -0,0 +1,141 @@
+package com.imyeyu.api.modules.gao.controller;
+
+import com.fasterxml.jackson.annotation.JsonView;
+import com.imyeyu.api.modules.common.entity.Article;
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.common.service.AttachmentService;
+import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
+import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
+import com.imyeyu.api.modules.gao.service.GaoStoreDiaryService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
+import com.imyeyu.api.modules.gao.vo.GaoStoreDiaryPage;
+import com.imyeyu.api.modules.user.entity.User;
+import com.imyeyu.api.modules.user.service.UserLoginService;
+import com.imyeyu.api.modules.user.service.UserService;
+import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiException;
+import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequestRateLimit;
+import com.imyeyu.spring.bean.PageResult;
+import com.imyeyu.spring.util.ResponseView;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.Map;
+
+/// GAO 门店日记接口
+///
+/// @author Codex
+/// @since 2026-08-31
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/gao/store/diary")
+public class GaoStoreDiaryController {
+
+	private final GaoStoreDiaryService service;
+	private final GaoStoreScopeService storeScopeService;
+	private final UserLoginService userLoginService;
+	private final UserService userService;
+	private final AttachmentService attachmentService;
+
+	/// 分页查询门店日记
+	///
+	/// @param page 分页查询条件
+	/// @return 门店日记分页结果
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STORE_DIARY_READ)
+	@PostMapping("/list")
+	@JsonView(ResponseView.Public.class)
+	public PageResult<Article> list(@RequestBody GaoStoreDiaryPage page) {
+		TimiException.required(page, "未找到分页参数");
+		TimiException.required(page.getBeginCreatedAt(), "未找到门店日记开始时间");
+		TimiException.required(page.getEndCreatedAt(), "未找到门店日记结束时间");
+		TimiException.requiredTrue(page.getBeginCreatedAt() < page.getEndCreatedAt(), "门店日记时间范围无效");
+		page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId()));
+		PageResult<Article> result = service.page(page);
+		{
+			List<String> articleIdList = result.getList().stream().map(Article::getId).toList();
+			Map<String, Attachment> attachMap = attachmentService.mapFirstImageByIdList(Attachment.BizType.ARTICLE, articleIdList);
+			for (Article article : result.getList()) {
+				Attachment attachment = attachMap.get(article.getId());
+				article.setAttachmentList(TimiJava.ofList(attachment));
+			}
+		}
+		return result;
+	}
+
+	/// 查询门店日记详情
+	///
+	/// @param id 日记 ID
+	/// @return 门店日记
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STORE_DIARY_READ)
+	@PostMapping("/detail")
+	@JsonView(ResponseView.Public.class)
+	public Article detail(@RequestParam String id) {
+		Article article = service.get(id);
+		storeScopeService.checkStoreId(article.getBizId());
+		article.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.ARTICLE, article.getId()));
+		if (TimiJava.isNotEmpty(article.getUpdatedBy())) {
+			User updater = userService.get(article.getUpdatedBy());
+			if (updater != null) {
+				updater.setAttachmentList(attachmentService.listByBizId(
+					Attachment.BizType.USER,
+					updater.getId(),
+					User.AttachType.AVATAR.toString()
+				));
+			}
+			article.setUpdater(updater);
+		}
+		return article;
+	}
+
+	/// 创建门店日记
+	///
+	/// @param article 门店日记
+	/// @return 日记 ID
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STORE_DIARY_CREATE)
+	@PostMapping("/create")
+	public String create(@RequestBody Article article) {
+		article.setBizId(storeScopeService.resolveStoreId(article.getBizId()));
+		service.create(article, userLoginService.getRequireLoginUserId());
+		return article.getId();
+	}
+
+	/// 修改门店日记
+	///
+	/// @param article 门店日记
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STORE_DIARY_UPDATE)
+	@PostMapping("/update")
+	public void update(@RequestBody Article article) {
+		TimiException.required(article, "未找到门店日记");
+		TimiException.required(article.getId(), "未找到门店日记 ID");
+		Article dbArticle = service.get(article.getId());
+		storeScopeService.checkStoreId(dbArticle.getBizId());
+		service.update(article, userLoginService.getRequireLoginUserId());
+	}
+
+	/// 删除门店日记
+	///
+	/// @param id 日记 ID
+	@AOPLog
+	@RequestRateLimit
+	@RequireGaoPermission(GaoPermissionCode.STORE_DIARY_DELETE)
+	@PostMapping("/delete")
+	public void delete(@RequestParam String id) {
+		Article article = service.get(id);
+		storeScopeService.checkStoreId(article.getBizId());
+		service.delete(article.getId());
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/controller/GaoUserController.java

@@ -6,9 +6,8 @@ import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.service.AttachmentService;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
-import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.gao.entity.GaoUser;
-import com.imyeyu.api.modules.gao.service.GaoStoreService;
+import com.imyeyu.api.modules.gao.service.GaoStoreScopeService;
 import com.imyeyu.api.modules.gao.service.GaoUserInviteService;
 import com.imyeyu.api.modules.gao.service.GaoUserService;
 import com.imyeyu.api.modules.gao.vo.GaoUserInviteCreateRequest;
@@ -19,15 +18,14 @@ import com.imyeyu.api.modules.gao.vo.GaoUserInviteValidateRequest;
 import com.imyeyu.api.modules.gao.vo.GaoUserInviteValidateResponse;
 import com.imyeyu.api.modules.user.entity.Role;
 import com.imyeyu.api.modules.user.entity.User;
-import com.imyeyu.api.modules.user.service.RoleChecker;
+import com.imyeyu.api.modules.user.service.AuthorizationScopeService;
-import com.imyeyu.api.modules.user.service.RoleService;
 import com.imyeyu.api.modules.user.service.UserLoginService;
 import com.imyeyu.api.modules.user.service.UserRoleService;
 import com.imyeyu.api.modules.user.service.UserService;
 import com.imyeyu.api.modules.user.vo.LoginResponse;
 import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.spring.annotation.AOPLog;
-import com.imyeyu.spring.annotation.CaptchaValid;
 import com.imyeyu.spring.annotation.RequestRateLimit;
 import com.imyeyu.spring.bean.Page;
 import com.imyeyu.spring.bean.PageResult;
@@ -54,12 +52,11 @@ import java.util.UUID;
 public class GaoUserController {
 
 	private final UserService userService;
-	private final RoleService roleService;
+	private final AuthorizationScopeService authorizationScopeService;
-	private final RoleChecker roleChecker;
 	private final GaoUserService service;
 	private final GaoUserInviteService inviteService;
 	private final UserRoleService userRoleService;
-	private final GaoStoreService gaoStoreService;
+	private final GaoStoreScopeService storeScopeService;
 	private final UserLoginService userLoginService;
 	private final AttachmentService attachmentService;
 
@@ -80,12 +77,11 @@ public class GaoUserController {
 
 	@AOPLog
 	@JsonView(ResponseView.Public.class)
-	@CaptchaValid
 	@RequestRateLimit(value = 5, inSeconds = 60)
 	@PostMapping("/invite/register")
 	public LoginResponse registerByInvite(@RequestBody @Valid GaoUserInviteRegisterRequest req) {
 		GaoUserInviteRegisterData data = req.getData();
-		String userId = inviteService.register(data);
+		String userId = inviteService.register(data, req.getDetailId(), req.getCaptcha());
 		return userLoginService.login(UUID.randomUUID().toString(), userId);
 	}
 
@@ -95,10 +91,11 @@ public class GaoUserController {
 	@PostMapping("/list")
 	@JsonView(ResponseView.Public.class)
 	public PageResult<GaoUser> list(@RequestBody Page<GaoUser> page) {
-		if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+		TimiException.required(page, "not found page");
+		if (!storeScopeService.hasGlobalScope()) {
 			// 非全局管理只能看所在店用户
 			page.setEqualsExample(TimiJava.defaultIfNull(page.getEqualsExample(), new GaoUser()));
-			page.getEqualsExample().setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId());
+			page.getEqualsExample().setStoreId(storeScopeService.resolveStoreId(page.getEqualsExample().getStoreId()));
 		}
 		PageResult<GaoUser> result = service.page(page);
 		{
@@ -120,6 +117,8 @@ public class GaoUserController {
 	@JsonView(ResponseView.Public.class)
 	public GaoUser detail(@RequestParam String id) {
 		GaoUser result = service.get(id);
+		TimiException.required(result, "not found gao user");
+		storeScopeService.checkStoreId(result.getStoreId());
 		{
 			User user = userService.get(result.getUserId());
 			user.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.USER, user.getId()));
@@ -137,9 +136,7 @@ public class GaoUserController {
 	@PostMapping("/create")
 	@JsonView(ResponseView.Public.class)
 	public GaoUser create(@RequestBody GaoUser gaoUser) {
-		if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) {
+		gaoUser.setStoreId(storeScopeService.resolveStoreId(gaoUser.getStoreId()));
-			gaoUser.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId());
-		}
 		service.create(gaoUser);
 		return service.get(gaoUser.getId());
 	}
@@ -150,6 +147,12 @@ public class GaoUserController {
 	@PostMapping("/update")
 	@JsonView(ResponseView.Public.class)
 	public GaoUser update(@RequestBody GaoUser gaoUser) {
+		TimiException.required(gaoUser, "not found gao user");
+		TimiException.required(gaoUser.getId(), "not found gao user.id");
+		GaoUser dbGaoUser = service.get(gaoUser.getId());
+		TimiException.required(dbGaoUser, "not found gao user");
+		storeScopeService.checkStoreId(dbGaoUser.getStoreId());
+		gaoUser.setStoreId(dbGaoUser.getStoreId());
 		service.update(gaoUser);
 		return service.get(gaoUser.getId());
 	}
@@ -160,6 +163,12 @@ public class GaoUserController {
 	@PostMapping("/transfer/store")
 	@JsonView(ResponseView.Public.class)
 	public GaoUser transferStore(@RequestBody GaoUser gaoUser) {
+		TimiException.required(gaoUser, "not found gao user");
+		TimiException.required(gaoUser.getId(), "not found gao user.id");
+		GaoUser dbGaoUser = service.get(gaoUser.getId());
+		TimiException.required(dbGaoUser, "not found gao user");
+		storeScopeService.checkStoreId(dbGaoUser.getStoreId());
+		gaoUser.setStoreId(storeScopeService.resolveStoreId(gaoUser.getStoreId()));
 		service.transferStore(gaoUser);
 		return service.get(gaoUser.getId());
 	}
@@ -169,6 +178,9 @@ public class GaoUserController {
 	@RequireGaoPermission(GaoPermissionCode.USER_DELETE)
 	@PostMapping("/delete")
 	public void delete(@RequestParam String id) {
+		GaoUser gaoUser = service.get(id);
+		TimiException.required(gaoUser, "not found gao user");
+		storeScopeService.checkStoreId(gaoUser.getStoreId());
 		service.delete(id);
 	}
 
@@ -177,7 +189,6 @@ public class GaoUserController {
 	@RequireGaoPermission(GaoPermissionCode.USER_READ)
 	@PostMapping("/role/list")
 	public List<Role> roleList() {
-		// TODO 此接口获取本模块所有角色，需要限制角色
+		return authorizationScopeService.listGrantableRole(userLoginService.getRequireLoginUserId(), ModuleCode.GAO);
-		return roleService.listByModuleCode(ModuleCode.GAO);
 	}
 }

src/main/java/com/imyeyu/api/modules/gao/entity/GaoCustomer.java

@@ -6,7 +6,6 @@ import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.entity.TagApply;
 import com.imyeyu.api.modules.user.bean.Gender;
 import com.imyeyu.api.modules.user.entity.User;
-import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.imyeyu.java.TimiJava;
 import com.imyeyu.spring.annotation.table.Column;
 import com.imyeyu.spring.annotation.table.Transient;
@@ -61,16 +60,13 @@ public class GaoCustomer extends UUIDEntity {
 	/// 姓名
 	private String name;
 
-	@Column("zh_cn_pinyin_full")
+	@Column("name_pinyin_full")
-	@JsonIgnore
 	private String namePinyinFull;
 
-	@Column("zh_cn_pinyin_initial")
+	@Column("name_pinyin_initial")
-	@JsonIgnore
 	private String namePinyinInitial;
 
-	@Column("zh_cn_pinyin_mixed")
+	@Column("name_pinyin_mixed")
-	@JsonIgnore
 	private String namePinyinMixed;
 
 	/// 性别

src/main/java/com/imyeyu/api/modules/gao/entity/GaoCustomerConsumptionRecord.java

@@ -0,0 +1,49 @@
+package com.imyeyu.api.modules.gao.entity;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.imyeyu.spring.annotation.table.Transient;
+import com.imyeyu.spring.entity.UUIDEntity;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+/// GAO 客户有效消费事实
+///
+/// @author Codex
+/// @since 2026-09-04
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class GaoCustomerConsumptionRecord extends UUIDEntity {
+
+	/// 消费来源类型
+	public enum SourceType {
+		/// 迁移的旧消费事件
+		LEGACY_EVENT,
+		/// 销售订单全额实收
+		SALES_ORDER
+	}
+
+	/// 消费事实状态
+	public enum Status {
+		/// 有效并参与累计
+		ACTIVE,
+		/// 已失效，不参与累计
+		REVOKED
+	}
+
+	private String storeId;
+	private String customerId;
+	private SourceType sourceType;
+	private String sourceId;
+	private String salesOrderId;
+	private GaoSalesOrder.OrderType orderType;
+	private Long amount;
+	private Long effectiveAt;
+	private Status status;
+	private Long revokedAt;
+	private String revokeReason;
+	private JsonNode sourcePayload;
+
+	/// 客户
+	@Transient
+	private GaoCustomer customer;
+}

src/main/java/com/imyeyu/api/modules/gao/entity/GaoCustomerPackage.java

@@ -0,0 +1,75 @@
+package com.imyeyu.api.modules.gao.entity;
+
+import com.imyeyu.api.modules.user.entity.User;
+import com.imyeyu.spring.annotation.table.Transient;
+import com.imyeyu.spring.entity.UUIDEntity;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+import java.util.List;
+
+/// GAO 客户实际购买的套餐
+///
+/// @author Codex
+/// @since 2026-08-31
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class GaoCustomerPackage extends UUIDEntity {
+
+	/// 门店 ID
+	private String storeId;
+
+	/// 销售订单 ID
+	private String salesOrderId;
+
+	/// 客户 ID
+	private String customerId;
+
+	/// 来源套餐配置 ID
+	private String packageConfigId;
+
+	/// 套餐名称快照
+	private String packageNameSnapshot;
+
+	/// 标准价快照，单位分
+	private Long standardAmountSnapshot;
+
+	/// 订单投影状态
+	@Transient
+	private GaoSalesOrder.Status status;
+
+	/// 订单投影取消时间
+	@Transient
+	private Long cancelledAt;
+
+	/// 订单投影取消操作人 ID
+	@Transient
+	private String cancelOperatorUserId;
+
+	/// 订单投影取消原因
+	@Transient
+	private String cancelReason;
+
+	/// 备注
+	private String remark;
+
+	/// 客户
+	@Transient
+	private GaoCustomer customer;
+
+	/// 取消操作人
+	@Transient
+	private User cancelOperator;
+
+	/// 关联销售订单
+	@Transient
+	private GaoSalesOrder salesOrder;
+
+	/// 关联订单可履约明细投影
+	@Transient
+	private List<GaoSalesOrderItem> itemList;
+
+	/// 统一履约历史
+	@Transient
+	private List<GaoOrderFulfillment> fulfillmentList;
+}

src/main/java/com/imyeyu/api/modules/gao/entity/GaoEvent.java

@@ -18,6 +18,19 @@ import java.util.List;
 @EqualsAndHashCode(callSuper = true)
 public class GaoEvent extends UUIDEntity {
 
+	/// 事件业务类型
+	public enum BizType {
+
+		/// 普通登记事件
+		GENERAL,
+
+		/// 购买产品套餐
+		PACKAGE_PURCHASE,
+
+		/// 已退役的历史消费事件，仅保留归档和溯源
+		LEGACY_CONSUMPTION
+	}
+
 	///
 	/// 登记事件状态
 	///
@@ -93,6 +106,16 @@ public class GaoEvent extends UUIDEntity {
 	/// 统计图表颜色
 	private String color;
 
+	/// 业务类型
+	private BizType bizType;
+
+	/// 购买套餐事件绑定的套餐配置 ID
+	private String packageConfigId;
+
+	/// 购买套餐事件绑定的套餐配置
+	@Transient
+	private GaoPackageConfig packageConfig;
+
 	/// 登记事件名称
 	private String name;
 
@@ -117,6 +140,9 @@ public class GaoEvent extends UUIDEntity {
 	/// true 为登记时要求拍照
 	private Boolean requirePhoto;
 
+	/// true 为登记记录需要核销
+	private Boolean requireVerification;
+
 	/// 登记限制类型
 	private LimitType limitType;
 
@@ -135,4 +161,8 @@ public class GaoEvent extends UUIDEntity {
 	/// 可登记角色代码列表
 	@Transient
 	private List<String> roleCodeList;
+
+	/// 登记事件选项组列表
+	@Transient
+	private List<GaoEventOptionGroup> optionGroupList;
 }

src/main/java/com/imyeyu/api/modules/gao/entity/GaoEventOption.java

@@ -0,0 +1,23 @@
+package com.imyeyu.api.modules.gao.entity;
+
+import com.imyeyu.spring.entity.UUIDEntity;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+/// 登记事件选项
+///
+/// @author Codex
+/// @since 2026-08-30
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class GaoEventOption extends UUIDEntity {
+
+	/// 选项组 ID
+	private String groupId;
+
+	/// 选项名称
+	private String label;
+
+	/// 排序值
+	private Integer sort;
+}

src/main/java/com/imyeyu/api/modules/gao/entity/GaoEventOptionGroup.java

@@ -0,0 +1,46 @@
+package com.imyeyu.api.modules.gao.entity;
+
+import com.imyeyu.spring.annotation.table.Transient;
+import com.imyeyu.spring.entity.UUIDEntity;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+import java.util.List;
+
+/// 登记事件选项组
+///
+/// @author Codex
+/// @since 2026-08-30
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class GaoEventOptionGroup extends UUIDEntity {
+
+	/// 选项选择模式
+	public enum SelectionMode {
+
+		/// 只能选择一个选项
+		SINGLE,
+
+		/// 可以选择多个选项
+		MULTIPLE
+	}
+
+	/// 登记事件 ID
+	private String eventId;
+
+	/// 选项组名称
+	private String name;
+
+	/// 选择模式
+	private SelectionMode selectionMode;
+
+	/// true 为登记时必须选择至少一个选项
+	private Boolean required;
+
+	/// 排序值
+	private Integer sort;
+
+	/// 选项列表
+	@Transient
+	private List<GaoEventOption> optionList;
+}

src/main/java/com/imyeyu/api/modules/gao/entity/GaoEventRecord.java

@@ -18,6 +18,23 @@ import java.util.List;
 @EqualsAndHashCode(callSuper = true)
 public class GaoEventRecord extends UUIDEntity {
 
+	///
+	/// 登记记录核销状态
+	///
+	/// @author Codex
+	/// @since 2026-08-29
+	public enum VerificationStatus {
+
+		/// 该事件不需要核销
+		NOT_REQUIRED,
+
+		/// 等待核销
+		PENDING,
+
+		/// 已核销
+		VERIFIED
+	}
+
 	///
 	/// 登记事件记录附件类型
 	///
@@ -49,6 +66,15 @@ public class GaoEventRecord extends UUIDEntity {
 	/// 本次登记提交的整数业务数值
 	private Long numberValue;
 
+	/// 核销状态
+	private VerificationStatus verificationStatus;
+
+	/// 核销用户 ID
+	private String verifierUserId;
+
+	/// 核销时间
+	private Long verifiedAt;
+
 	/// 备注
 	private String remark;
 
@@ -61,6 +87,9 @@ public class GaoEventRecord extends UUIDEntity {
 	/// 营业日递增序号
 	private Long businessDayNo;
 
+	/// 最后修改用户 ID
+	private String updatedBy;
+
 	@Transient
 	private GaoCustomer customer;
 
@@ -70,10 +99,21 @@ public class GaoEventRecord extends UUIDEntity {
 	@Transient
 	private User operator;
 
+	@Transient
+	private User verifier;
+
+	/// 最后修改用户
+	@Transient
+	private User updater;
+
 	@Transient
 	private List<Attachment> attachmentList;
 
 	/// 客户 ID 列表，批量登记时使用
 	@Transient
 	private List<String> customerIdList;
+
+	/// 登记记录已选择的选项组列表
+	@Transient
+	private List<GaoEventRecordOptionGroup> selectedOptionGroupList;
 }

src/main/java/com/imyeyu/api/modules/gao/entity/GaoEventRecordOption.java

@@ -0,0 +1,35 @@
+package com.imyeyu.api.modules.gao.entity;
+
+import com.imyeyu.spring.entity.UUIDEntity;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+/// 登记事件记录选项关系
+///
+/// @author Codex
+/// @since 2026-08-30
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class GaoEventRecordOption extends UUIDEntity {
+
+	/// 登记事件记录 ID
+	private String eventRecordId;
+
+	/// 选项组 ID
+	private String groupId;
+
+	/// 选项 ID
+	private String optionId;
+
+	/// 选项组排序快照
+	private Integer groupSort;
+
+	/// 选项排序快照
+	private Integer optionSort;
+
+	/// 选项组名称快照
+	private String groupNameSnapshot;
+
+	/// 选项名称快照
+	private String optionLabelSnapshot;
+}

src/main/java/com/imyeyu/api/modules/gao/entity/GaoEventRecordOptionGroup.java

@@ -0,0 +1,22 @@
+package com.imyeyu.api.modules.gao.entity;
+
+import lombok.Data;
+
+import java.util.List;
+
+/// 登记事件记录选项组视图
+///
+/// @author Codex
+/// @since 2026-08-30
+@Data
+public class GaoEventRecordOptionGroup {
+
+	/// 选项组 ID
+	private String groupId;
+
+	/// 选项组名称
+	private String groupName;
+
+	/// 已选择的选项列表
+	private List<GaoEventOption> selectedOptionList;
+}

src/main/java/com/imyeyu/api/modules/gao/entity/GaoFundRecord.java

@@ -0,0 +1,126 @@
+package com.imyeyu.api.modules.gao.entity;
+
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.user.entity.User;
+import com.imyeyu.spring.annotation.table.Transient;
+import com.imyeyu.spring.entity.UUIDEntity;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+import java.util.List;
+
+/// GAO 销售订单资金操作流水
+///
+/// @author Codex
+/// @since 2026-08-31
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class GaoFundRecord extends UUIDEntity {
+
+	/// 资金业务类型
+	public enum BizType {
+
+		/// 销售订单
+		SALES_ORDER
+	}
+
+	/// 资金操作类型
+	public enum OperationType {
+
+		/// 线下收款
+		RECEIVE,
+
+		/// 退款
+		REFUND,
+
+		/// 确认无需退款
+		CONFIRM_NO_REFUND,
+
+		/// 资金操作冲正
+		REVOKE
+	}
+
+	/// 资金操作状态
+	public enum Status {
+
+		/// 待店长核销
+		PENDING,
+
+		/// 已生效
+		VERIFIED,
+
+		/// 店长已拒绝
+		REJECTED,
+
+		/// 提交人已撤销
+		CANCELLED
+	}
+
+	/// 门店 ID
+	private String storeId;
+
+	/// 客户 ID
+	private String customerId;
+
+	/// 资金业务类型
+	private BizType bizType;
+
+	/// 业务对象 ID
+	private String bizId;
+
+	/// 操作类型
+	private OperationType operationType;
+
+	/// 操作状态
+	private Status status;
+
+	/// 金额，单位分
+	private Long amount;
+
+	/// 冲正时关联原资金记录
+	private String sourceRecordId;
+
+	/// 幂等请求号
+	private String requestNo;
+
+	/// 提交操作的用户 ID
+	private String operatorUserId;
+
+	/// 收款核销用户 ID
+	private String verifierUserId;
+
+	/// 收款核销时间
+	private Long verifiedAt;
+
+	/// 线下操作发生时间
+	private Long occurredAt;
+
+	/// 原因
+	private String reason;
+
+	/// 备注
+	private String remark;
+
+	/// 关联的冲正流水 ID
+	@Transient
+	private String revokeRecordId;
+
+	/// 关联销售订单总价，单位分
+	@Transient
+	private Long salesOrderAmount;
+
+	/// 流水发生时关联销售订单剩余待收款金额快照，单位分
+	private Long salesOrderUnpaidAmountSnapshot;
+
+	/// 操作人
+	@Transient
+	private User operator;
+
+	/// 核销人
+	@Transient
+	private User verifier;
+
+	/// 附件
+	@Transient
+	private List<Attachment> attachmentList;
+}

src/main/java/com/imyeyu/api/modules/gao/entity/GaoOrderFulfillment.java

@@ -0,0 +1,115 @@
+package com.imyeyu.api.modules.gao.entity;
+
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.api.modules.user.entity.User;
+import com.imyeyu.spring.annotation.table.AutoUUID;
+import com.imyeyu.spring.annotation.table.Id;
+import com.imyeyu.spring.annotation.table.Transient;
+import com.imyeyu.spring.entity.Creatable;
+import com.imyeyu.spring.entity.IDEntity;
+import com.imyeyu.spring.entity.Updatable;
+import lombok.Data;
+
+import java.util.List;
+
+/// GAO 统一履约单
+///
+/// @author Codex
+/// @since 2026-09-02
+@Data
+public class GaoOrderFulfillment implements IDEntity<String>, Creatable, Updatable {
+
+	/// 履约状态
+	public enum Status {
+
+		/// 等待库存
+		WAITING_STOCK,
+
+		/// 待核销
+		PENDING,
+
+		/// 已核销
+		VERIFIED,
+
+		/// 店长已拒绝
+		REJECTED,
+
+		/// 提交人已撤销
+		CANCELLED,
+
+		/// 已核销后冲正
+		REVOKED
+	}
+
+	@Id
+	@AutoUUID
+	private String id;
+
+	/// 销售订单 ID
+	private String salesOrderId;
+
+	/// 门店 ID
+	private String storeId;
+
+	/// 客户 ID
+	private String customerId;
+
+	/// 履约状态
+	private Status status;
+
+	/// 客户端幂等请求号
+	private String requestNo;
+
+	/// 提交人
+	private String operatorUserId;
+
+	/// 实际履约时间
+	private Long deliveredAt;
+
+	/// 核销或拒绝操作人
+	private String verifierUserId;
+
+	/// 核销或拒绝时间
+	private Long verifiedAt;
+
+	/// 冲正单指向原履约单
+	private String sourceFulfillmentId;
+
+	/// 拒绝、撤销或冲正原因
+	private String reason;
+
+	/// 备注
+	private String remark;
+
+	private Long createdAt;
+
+	private Long updatedAt;
+
+	/// 提交人
+	@Transient
+	private User operator;
+
+	/// 客户
+	@Transient
+	private GaoCustomer customer;
+
+	/// 核销或拒绝操作人
+	@Transient
+	private User verifier;
+
+	/// 原履约单
+	@Transient
+	private GaoOrderFulfillment sourceFulfillment;
+
+	/// 履约明细
+	@Transient
+	private List<GaoOrderFulfillmentItem> itemList;
+
+	/// 库存处理流水
+	@Transient
+	private List<GaoProductStockRecord> stockRecordList;
+
+	/// 附件
+	@Transient
+	private List<Attachment> attachmentList;
+}

src/main/java/com/imyeyu/api/modules/gao/entity/GaoOrderFulfillmentItem.java

@@ -0,0 +1,85 @@
+package com.imyeyu.api.modules.gao.entity;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.imyeyu.api.modules.common.entity.Attachment;
+import com.imyeyu.spring.annotation.table.AutoUUID;
+import com.imyeyu.spring.annotation.table.Id;
+import com.imyeyu.spring.annotation.table.Transient;
+import com.imyeyu.spring.entity.Creatable;
+import com.imyeyu.spring.entity.IDEntity;
+import lombok.Data;
+
+import java.math.BigDecimal;
+import java.util.List;
+
+/// GAO 统一履约明细
+///
+/// @author Codex
+/// @since 2026-09-02
+@Data
+public class GaoOrderFulfillmentItem implements IDEntity<String>, Creatable {
+
+	@Id
+	@AutoUUID
+	private String id;
+
+	/// 履约单 ID
+	private String fulfillmentId;
+
+	/// SKU ID
+	private String skuId;
+
+	/// 本次实际履约 SKU 单位 ID
+	private String skuUnitId;
+
+	/// 产品图片附件
+	@Transient
+	private List<Attachment> attachmentList;
+
+	/// 来源销售订单明细 ID
+	private String sourceOrderItemId;
+
+	/// 本次履约数量
+	private BigDecimal quantity;
+
+	/// 基础单位数量
+	private BigDecimal baseQuantity;
+
+	/// 操作前待履约基础单位数量
+	private BigDecimal reservedBaseBefore;
+
+	/// 操作后待履约基础单位数量
+	private BigDecimal reservedBaseAfter;
+
+	/// 操作前已履约基础单位数量
+	private BigDecimal fulfilledBaseBefore;
+
+	/// 操作后已履约基础单位数量
+	private BigDecimal fulfilledBaseAfter;
+
+	/// 产品名称快照
+	private String productNameSnapshot;
+
+	/// 产品 ID 快照
+	private String productIdSnapshot;
+
+	/// SKU 编码快照
+	private String skuCodeSnapshot;
+
+	/// SKU 名称快照
+	private String skuNameSnapshot;
+
+	/// 规格摘要快照
+	private String specSummarySnapshot;
+
+	/// SKU 规格结构快照，数组元素包含 specId、specName、specValueId、specValueName
+	private JsonNode skuSpecSnapshot;
+
+	/// 单位快照
+	private String unitSnapshot;
+
+	/// 基础单位数量系数快照
+	private BigDecimal baseQuantityPerUnitSnapshot;
+
+	private Long createdAt;
+}