优化

scripts/agents-index-contract.ps1

@@ -905,8 +905,12 @@ Assert-Contains $backendAgents '客户资金账户、充值、授信、冻结、
 Assert-Contains $lastlegAgents '海外业务资金指令与结果' 'Lastleg 跨区钱包入口'
 Assert-Contains $lastlegAgents '拆柜打托成本与客户应收分摊' 'Lastleg 拆柜打托费用入口'
 Assert-Contains $clientAgents '换标申请必须提交正数 CNY `chargeAmount`' 'Client 换标钱包金额边界'
-Assert-Contains $businessIndex '海外 Token 不携带角色或权限集' '根海外小 Token 边界'
-Assert-Contains $backendAgents '海外 Token 只携带稳定身份、客户/仓库范围和版本声明，不携带角色或权限集' '后端海外小 Token 边界'
+Assert-Contains $businessIndex '统一认证与服务通信契约.md' '根统一认证契约入口'
+Assert-Contains $backendAgents '各端共用 Gateway 和 Redis 会话' '后端统一认证目标'
+$unifiedCommunication = Read-RequiredText (Join-Path $workspaceRoot 'docs/统一认证与服务通信契约.md')
+Assert-Contains $unifiedCommunication 'JWT 不携带角色或权限集合' '统一 JWT 最小身份边界'
+Assert-Contains $unifiedCommunication '平台/客户/PDA' '统一认证访问域隔离'
+Assert-Contains $unifiedCommunication '整体迁移尚未完成' '认证目标与落地状态分离'
 Assert-Contains $financeEventConsumer 'envelope.payloadHash().equals(row.get("payload_hash"))' 'Finance 海外事件 Payload 哈希幂等'
 Assert-Contains $financeEventConsumer "cost_origin='BUSINESS_DIRECT_PAID'" 'Finance 海外直接已付成本投影'
 Assert-Contains $financePhase1Service "f.settlement_mode='ON_ACCOUNT'" 'Finance AP 只纳入账期应付'
@@ -973,7 +977,7 @@ $criticalPaths = @(
     'apps/admin-web/src/modules/iam/pages/InternalUsersView.vue',
     'apps/admin-web/src/modules/iam/api/platformIam.ts',
     'apps/admin-web/src/modules/unified-orders/api/unifiedOrders.ts',
-    'apps/client-web/src/api/overseasHttp.ts',
+    'apps/client-web/src/api/http.ts',
     'apps/client-web/src/modules/overseas-warehouse/routes.ts',
     'apps/client-web/src/modules/overseas-warehouse/api/warehouseServices.ts',
     'apps/client-web/src/modules/overseas-warehouse/views/WarehouseServiceView.vue',
@@ -1080,7 +1084,7 @@ $criticalPaths = @(
     'baiyue-firstleg/firstleg/scripts/analyze-firstleg-dependencies.mjs',
     'baiyue-firstleg/firstleg/scripts/analyze-firstleg-dependencies.test.mjs',
     'baiyue-firstleg/firstleg/src/test/resources/architecture/firstleg-slice-dependencies.json',
-    'baiyue-firstleg/auth/src/main/java/com/baiyue/auth/service/OverseasTokenService.java',
+    'baiyue-firstleg/auth/src/main/java/com/baiyue/auth/config/UnifiedJwtConfiguration.java',
     'baiyue-firstleg/auth/src/main/java/com/baiyue/auth/service/OverseasSessionValidationService.java',
     'baiyue-firstleg/iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java',
     'baiyue-firstleg/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxService.java',

scripts/gateway-route-contract.test.mjs

@@ -80,7 +80,6 @@ function verify(path, service, table, file) {
 }
 
 const domestic = routes(read('gateway/src/main/resources/application.yml'))
-const overseas = routes(read('gateway-overseas/src/main/resources/application-overseas.yml'))
 const modules = [...read('pom.xml').matchAll(/<module>([^<]+)<\/module>/g)].map(m => m[1])
 
 test('local regression and root CI require route checks before Maven/dispatch', () => {
@@ -101,8 +100,7 @@ test('Controller prefixes route to their owning service; internal prefixes stay
     if (!existsSync(resolve(root, app))) continue
     const service = read(app).match(/application:\s*\r?\n\s+name:\s*([\w-]+)/)?.[1]
     assert.ok(service, `Missing application name: ${module}`)
-    const tables = ['lastleg-service', 'warehouse-overseas-service'].includes(module)
-      ? [overseas] : ['file', 'print'].includes(module) ? [domestic, overseas] : [domestic]
+    const tables = [domestic]
     for (const file of javaFiles(resolve(root, module, 'src/main/java'))) {
       for (const path of controllerPaths(readFileSync(file, 'utf8'), file)) {
         // PDA release metadata lives in the domestic File control plane. Both