Store

docs/产品设计文档.md §三 t_store; docs/架构决策-门店开通与员工邀请-2026-08-02.md

invite_code 仅保留数据库兼容，不再返回客户端或作为注册凭证


User

docs/产品设计文档.md §三 t_user; docs/.agents/common-context.md 术语规则


Appointment

docs/产品设计文档.md §三 t_appointment §5.2; docs/架构决策-真实预约容量模型-2026-08-01.md

AppointmentServiceTest; BookingCapacityServiceTest; AppointmentControllerDetailTest; AppointmentControllerIdentityTest; BookingCapacityMigrationTest


Report

Report Media Backend
Store Miniapp FE
Store Admin FE

docs/产品设计文档.md §三 t_report §5.3; docs/架构决策-报告确认发送状态-2026-08-02.md


ReportLead

docs/本期主线-下一步产品优化点.md §C 留资


BusinessEvent

Backend Core
Report Media Backend
Store Admin FE


updateStore

PUT /api/store/update
StoreController#update
StoreService#update


wxPhoneLogin

POST /api/user/wx-phone-login
UserController#wxPhoneLogin
UserService#loginByVerifiedPhone


createAppointment

petName petType serviceType appointmentTime storeId remark petId customerUserId customerPhone customerName followUpTaskId

POST /api/appointment/create
AppointmentController#create
AppointmentService#createBooking

AppointmentControllerIdentityTest; AppointmentServiceTest; FollowUpTaskServiceTest; StoreCustomerServiceTest; BusinessEventServiceTest


startService

POST /api/appointment/start
AppointmentController#start
AppointmentService#startService


transitionAppointmentStatus

PUT /api/appointment/status
AppointmentController#updateStatus
AppointmentService#transitionStatus


submitReport

POST /api/report/create
ReportController#create
ReportService#create


confirmReportSent

POST /api/report/confirm-sent
ReportController#confirmSent
ReportService#confirmSent

ReportControllerTest; ReportServiceTest; BusinessEventServiceTest; ReportSendMigrationTest

复制链接、二维码和预览不算发送；首次确认不可覆盖，重复确认幂等成功


submitLead

POST /api/report/{token}/reminder
ReportLeadController#submitReminder
ReportLeadService#submit

ReportLeadControllerTest; ReportLeadServiceStoreCustomerTest; FollowUpTaskServiceTest; StoreCustomerServiceTest; BusinessEventServiceTest


StoreRegistered

持久化 BusinessEvent 与 AuditLog，均不含手机号或 legacy inviteCode


SessionIssued

exp 为必填未来 Unix 秒时间戳；缺失、非法、非正或到期均拒绝


AppointmentCreated

storeId storeCustomerId aggregateId actorUserId actorRole bookingOrigin durationMinutes occurredAt


AppointmentStatusChanged

storeId storeCustomerId aggregateId fromStatus toStatus actorUserId actorRole occurredAt


ServiceStarted

storeId storeCustomerId appointmentId actorUserId actorRole occurredAt


ReportSubmitted

storeId storeCustomerId reportId actorUserId actorRole occurredAt


ReportSent

storeId storeCustomerId reportId actorUserId actorRole channel occurredAt


ReportOpened

storeId storeCustomerId reportId visitType occurredAt

docs/本期主线-下一步产品优化点.md 埋点事件 schema


ReportReopened

docs/本期主线-下一步产品优化点.md 埋点事件 schema


LeadSubmitted

storeId storeCustomerId leadId repeatSubmit occurredAt

docs/本期主线-下一步产品优化点.md 埋点事件 schema


HMAC session token + 活跃账号范围鉴权

exp 必须是未来 Unix 秒且非法时 fail-closed；production TTL 为 300～2592000 秒；签名后仍校验活跃账号、role/storeId 和有效门店


微信出站敏感日志边界

异常日志只记 HTTP 状态/微信错误码/异常类型；不记录响应体、手机号、access_token、AppSecret、一次性 code、带 query URL、外部错误文案或完整异常


legacy 永久邀请码禁用

legacy invite_code 保留数据库兼容，不返回客户端、不再作为注册凭证


真实预约容量：服务时长快照 + 跨桶容量 + 同店并发锁

docs/产品设计文档.md §5.2; docs/架构决策-真实预约容量模型-2026-08-01.md


报告前后照片必填

docs/产品设计文档.md §5.3 报告提交必填项


门店客户主档唯一性与合并

被吸收投影软删除并指向同店 canonical；既有 BusinessEvent 不改写


业务事件不可变幂等与低敏

BusinessEventServiceTest; BusinessEventMigrationTest; AdminBusinessEventControllerTest; FollowUpTaskServiceTest


entity:store


entity:user


entity:appointment


entity:report


entity:report_lead


action:register_boss


action:login


action:wx_phone_login


action:create_appointment


action:start_service


action:transition_appointment_status


action:submit_report


action:confirm_report_sent


entity:store_customer


action:track_report_open


action:submit_lead


ServiceType

docs/产品设计文档.md §三 t_service_type §5.2; docs/架构决策-真实预约容量模型-2026-08-01.md


ScheduleBlock

docs/产品设计文档.md §5.2 预约时段占用; docs/架构决策-真实预约容量模型-2026-08-01.md


HighlightVideo

docs/API-报告成片字段契约.md; docs/洗美报告短视频成片方案.md


createPet

POST /api/pet/create
PetController#create
PetService#create


updatePet

PUT /api/pet/update
PetController#update
PetService#update


deletePet

DELETE /api/pet/delete
PetController#delete
PetService#delete


getPetHistory

GET /api/pet/history
PetController#history
PetService#getServiceHistory


createServiceType

POST /api/service-type/create
ServiceTypeController#create
ServiceTypeService#create


dayAgenda

GET /api/schedule/day
ScheduleController#day
ScheduleService#dayAgenda


createScheduleBlock

slotStart durationMinutes blockType note

POST /api/schedule/block
ScheduleController#createBlock
ScheduleService#createBlock


deleteScheduleBlock

DELETE /api/schedule/block
ScheduleController#deleteBlock
ScheduleService#deleteBlock


generateHighlight

docs/洗美报告短视频成片方案.md


updateUser

PUT /api/user/update
UserController#updateUser
UserService#updateUser


HighlightSucceeded

reportTokenHash appointmentId durationSec composeMode ts

docs/本期主线-下一步产品优化点.md 埋点事件 schema


HighlightFailed

reportTokenHash appointmentId failReason ts

docs/本期主线-下一步产品优化点.md 埋点事件 schema


VideoPlay

docs/本期主线-下一步产品优化点.md 埋点事件 schema


VideoSave

docs/本期主线-下一步产品优化点.md 埋点事件 schema


ScheduleBlockCreated

blockId storeId slotStart blockType createdByUserId


StaffInvitationAccepted

storeId staffUserId invitationId verificationMethod occurredAt

以 AuditLog 持久化，不含手机号、token、openid 或 unionid


成片三态 + composeMode

docs/洗美报告短视频成片方案.md; docs/API-报告成片字段契约.md


员工管理与邀请仅 boss + 同店

门店成员可看成员列表；仅 boss 可创建/查看/撤销邀请和删除本店 staff，不能删除 boss


production profile 强制只读 schema 安全配置

backend/README.md production profile; docs/架构决策-全局CORS单一策略-2026-08-02.md; docs/架构决策-SessionToken严格过期边界-2026-08-02.md

生产禁用自动建表/show-sql/SMS 万能码/默认数据初始化，并拒绝弱密钥、越界 session TTL、占位域名和宽 CORS；全局 CorsFilter 是唯一策略，Controller 禁止局部 @CrossOrigin


生产发布只读门禁

备份并执行目标版本全部迁移后运行 schema validate + 31 项只读不变量；readiness 覆盖 DB/磁盘/上传/FFmpeg；自动 smoke 只读并验证 CORS allow/deny


entity:user


entity:pet


entity:store


entity:report


action:generate_highlight


action:upload_image


action:create_schedule_block


action:delete_schedule_block


action:create_service_type


action:delete_service_type


action:create_pet


action:accept_staff_invitation


action:update_user


action:bind_wechat


registerStaff

永久邀请码员工注册（停用）


entity:report_testimonial


entity:service_interval


action:submit_testimonial


Membership

Phase A 门店后台明确不做；对标宠老板会员卡/升降级。仅 roadmap 占位。


StoredValue

Phase A 明确不做；依赖收银流水。


ServicePackage

Phase A 明确不做；次卡/套餐属 C 期。


ReportHistory

P2 方向库占位，不展开字段


AnalyticsDashboard

B 期经营看板；A 期工作台仅轻量指标卡，不展开本实体。


userSensitiveFieldsJsonIgnore

User 敏感字段不序列化


publicStoreFieldTrim

公开 get/list 经 toPublicStoreView 裁剪，不含 ownerId/inviteCode/deleted


oneReportOneTestimonial

一报告一寄语（重复提交更新）


serviceIntervalSuggestion

服务建议周期推算下次日期


trackVideoPlay

frontend reportView / videoPlayer (client-emitted)

docs/本期主线-下一步产品优化点.md 埋点事件 schema

前端客户端事件；上报与统计落地 gap


trackVideoSave

docs/本期主线-下一步产品优化点.md 埋点事件 schema

前端客户端事件；上报与统计落地 gap


logout

当前仅有签发无服务端吊销；前端清本地 token


testimonialSaved

reportTokenHash testimonialId isPublic ts

代码已写库；独立事件上报/统计未落地


entity:highlight_video

Report.highlight_fail_reason 使用 HighlightFailReason 归类


entity:session_token

AuthInterceptor 解析 token → CurrentUserContext


action:track_video_play


action:track_video_save


action:logout


rule:BR-USER-003

同样适用于 login/register/list_staff 等返回 User 的动作


rule:BR-TST-001


rule:BR-UNSUB-001


rule:BR-INT-001


rule:BR-STORE-003


AdminConsole

Phase A 产品预录入；独立 Web 端，与 uni-app 小程序并存。对标宠老板「店铺概况」入口，不做收银/库存。详见 docs/门店管理后台升级方案-对标宠老板.md


Workbench

todayAppointmentCount todayDoneCount overdueAppointmentCount inServiceCount upcomingTodayCount highlightAnomalyCount unsentReportCount dueFollowUpCount actionGroups reportFunnel

Store Admin FE
Backend Core
Report Media Backend

服务端按完整本店数据准确聚合行动；回访待办来自 FollowUpTask；每组最多 3 条低敏预览；报告发送和回访后真实再次预约均来自持久事件。


WorkbenchTodoItem

kind urgency count items drilldownAction filter

kind: overdue_appointment | in_service | upcoming_today | highlight_anomaly | unsent_report | follow_up_due；items 不含手机号/token/媒体 URL


StoreCustomer

门店与客户的稳定关系实体；被吸收投影以同店 canonical 指针保留不可变事件连续性；不含余额/次卡/积分。


adminRoleGate

门店后台角色门禁（boss/staff 可读写）

boss 与 staff 均可进入 admin_console 并编辑本店数据；customer 禁止。删店/部分设置仍仅 boss（BR-STORE-001/BR-USER-001）。产品决策 2026-07-10。


adminStoreScope

后台数据仅本店 storeId

所有后台查询/写操作强制 current.storeId；忽略跨店请求参数。连锁同步不在 Phase A。


adminInternalFieldsAllowed

后台内部字段按用途最小返回

后台可返回报告内部状态；legacy inviteCode 不再返回。员工邀请列表仅返回脱敏手机号且不返回 token/hash，原始 token 仅创建响应返回一次。


adminPhaseAOutOfScope

Phase A 后台范围闸门

禁止将 membership/stored_value/service_package/收银/库存/寄养/押金/点餐/支付宝渠道 写入 Phase A 后台范围或设计稿。上述保持 evidence=gap。


viewWorkbench

GET /api/admin/workbench/actions
GET /api/admin/workbench/report-funnel
Admin UI /workbench

按会话 storeId 聚合完整本店行动与低敏预览；事件漏斗按日期汇总。


drilldownWorkbenchTodo

按 kind 跳转 appointments/reports/leads 并带筛选；预约预览可按受保护 ID 详情打开。


adminListAppointments

status dateFrom dateTo assignedUserId page pageSize

Admin UI /appointments (planned)
reuses GET /api/appointment/list

Web 列表增强筛选；业务规则复用现有 Appointment*，不另造状态机。；Web 允许调用 start_service（产品决策 2026-07-10）


adminListReports

dateFrom dateTo highlightStatus page pageSize

Admin UI /reports (planned)
reuses GET /api/report/list

含成片三态、复制公开链接、触发重生成（复用 generate_highlight）。


adminListLeads

GET /api/admin/follow-up-tasks
AdminFollowUpTaskController#list
Admin UI /leads


adminListServiceCustomers

source hasPendingLead lastVisitFrom lastVisitTo q page pageSize

GET /api/admin/service-customers
Admin UI /customers

以 t_store_customer 稳定主档为入口，动态聚合宠物/到店/报告/留资；返回 storeCustomerId 和脱敏手机号。


adminUpdateSettings

GET /api/admin/store
Admin UI /settings
PUT /api/store/update

后台不再读取 legacy inviteCode；写资料复用 PUT /api/store/update 并写低敏审计；员工改走限时邀请。


adminManageSchedule

Admin UI /schedule
GET /api/schedule/day
POST /api/schedule/block
DELETE /api/schedule/block

Web 排班日视图展示容量占用；增删带时长占用复用 ScheduleController。


workbenchViewed

可选埋点；A 期可不实现上报。


entity:admin_console


entity:workbench


entity:workbench

报告提交/打开/留资去重漏斗


entity:store


entity:store_customer


action:view_workbench


rule:BR-ADMIN-001


rule:BR-ADMIN-002


rule:BR-ADMIN-004


action:admin_list_appointments


action:admin_list_reports


action:admin_list_leads


action:admin_list_service_customers


action:drilldown_workbench_todo


StaffInvitation

Backend Core
Store Miniapp FE
Store Admin FE

原始 token 只在创建响应返回一次；库内仅 SHA-256；列表/预览只返回 maskedPhone


getStoreOnboarding

GET /api/admin/onboarding
AdminOnboardingController#status
StoreOnboardingService#getStatus


completeStoreOnboarding

POST /api/admin/onboarding/complete
AdminOnboardingController#complete
StoreOnboardingService#complete


createStaffInvitation

name phone validDays entity:current_user

POST /api/admin/staff-invitations
StaffInvitationController#create
StaffInvitationService#create

inviteToken 仅当前创建响应出现一次


listStaffInvitations

GET /api/admin/staff-invitations
StaffInvitationController#list
StaffInvitationService#list


revokeStaffInvitation

DELETE /api/admin/staff-invitations
StaffInvitationController#revoke
StaffInvitationService#revoke


previewStaffInvitation

GET /api/staff-invitations/preview
StaffInvitationController#preview
StaffInvitationService#preview


acceptStaffInvitation

POST /api/staff-invitations/accept
StaffInvitationController#accept
StaffInvitationService#acceptVerified


verifiedMerchantOnboarding

新老板手机号由微信核验；完成开通要求门店资料、预约容量、至少一个服务项目，邀请员工为选填；历史状态 unknown 不推断


oneTimeStaffInvitation

256-bit token 原文只返回一次，库内 SHA-256；手机号绑定且由微信核验；1-30 天、一次使用、可撤销；账号/微信冲突拒绝，不升级 customer 角色


immutableLowSensitivityAudit

只追加；metadata 仅服务端白名单标量且禁止 PII、凭证、地址坐标和原始请求


entity:store


action:accept_staff_invitation

仅微信核验手机号匹配且无账号冲突时创建 staff


CustomerTimeline

由 BusinessEvent 只读投影；FollowUpTask 仅低敏摘要；不返回手机号原文、备注、媒体、token 或原始 metadata


viewStoreCustomerTimeline

storeCustomerId page pageSize entity:current_user


客户时间线同店低敏事实投影

以 current.storeId 校验并解析 canonical + 同店别名；BusinessEvent 按 occurredAt/id 稳定倒序分页；仅白名单摘要，不返回原始 metadata/PII/凭证/备注/媒体


entity:store_customer


entity:business_event


action:view_store_customer_timeline


FollowUpTask

ReportLead 保留同意与来源事实；本实体承载领取、改期、终态和真实预约引用；同一 sourceLeadId 至多一个开放任务


rescheduleFollowUpTask

taskId reason dueDate entity:current_user


FollowUpCreated

storeId storeCustomerId aggregateId dueDate occurredAt


FollowUpStarted

storeId storeCustomerId aggregateId actorUserId actorRole occurredAt


FollowUpRescheduled

storeId storeCustomerId aggregateId attemptOutcome attemptCount dueDate occurredAt


FollowUpCompleted

storeId storeCustomerId aggregateId outcome attemptCount occurredAt


FollowUpCanceled

storeId storeCustomerId aggregateId outcome occurredAt


RebookCreated

回访后真实再次预约已创建

storeId storeCustomerId aggregateId bookingOrigin occurredAt


followUpTaskStateAndOwnership

回访任务状态机与同店领取权

pending 无领取人；in_progress 必须有且仅领取人可操作；终态不回退；退订不增加联系次数；跨店 404


realRebookAttribution

rebooked 不可手工选择；仅同店同 canonical 客户的真实预约保存成功后同事务闭环；容量失败不闭环


entity:report_lead

同一留资可有多个终结轮次，但至多一个开放任务


entity:store_customer

FollowUpTask.store_customer_id 指向同店 canonical 主档


entity:follow_up_task


action:submit_lead

开放任务存在时复用；前序终态后创建新轮次


action:submit_lead


action:start_follow_up_task


action:reschedule_follow_up_task


action:close_follow_up_task


action:unsubscribe


action:create_appointment

仅携带已领取任务且预约保存成功


action:create_appointment


rule:BR-FU-001


rule:BR-FU-002


BookingAgentSession

M0 短期结构化草稿；不保存原文/音频/模型响应，不关联 Appointment


BookingAgentStarted

storeId aggregateType aggregateId actorUserId actorRole source entrySource occurredAt


BookingAgentDraftReady

storeId aggregateType aggregateId actorUserId actorRole source inputModality occurredAt


BookingAgentFallback

storeId aggregateType aggregateId actorUserId actorRole source reason occurredAt


bookingAgentCustomerStoreBoundary

智能预约 customer 与门店边界


bookingAgentStateVersionTtlNoWrite

会话状态版本 TTL 与无写路径


entity:user


entity:store


action:create_booking_agent_session


action:submit_booking_agent_message


action:transcribe_booking_agent_audio


action:handoff_booking_agent_draft


action:cancel_booking_agent_session