chore: release client-v1.0.79

入库/出库单搜索框升级：搜索后关键词转为框内 chip 标签 + 一键清除（✕），仅保留单个搜索词；新增 SearchChip 组件 + provider currentKeyword getter 进屏同步。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx

.gitea/workflows/deploy-client.yml

@@ -180,7 +180,7 @@ jobs:
           GITEA_REPOSITORY: ${{ gitea.repository }}
         run: sh scripts/ci/release-client.sh "${{ gitea.ref_name }}"
 
-      - name: Deploy
+      - name: Deploy → EC2
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
@@ -190,6 +190,19 @@ jobs:
           EC2_USER: ${{ secrets.EC2_USER }}
         run: sh scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
 
+      # 迁移期影子目标：同步 Flutter web + version.yaml + 安装包到阿里机。失败不挡 EC2。
+      - name: Deploy → Ali (migration shadow)
+        if: always()
+        continue-on-error: true
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
+          DEPLOY_HOST: ${{ secrets.ALI_HOST }}
+          DEPLOY_USER: ${{ secrets.ALI_USER }}
+        run: sh scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
+
       - name: Notify
         if: always()
         env:

.gitea/workflows/deploy-server.yml

@@ -36,16 +36,32 @@ jobs:
           GITEA_REPOSITORY: ${{ gitea.repository }}
         run: sh scripts/ci/release-server.sh "${{ gitea.ref_name }}"
 
-      - name: Deploy
+      - name: Deploy → EC2
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
+          DEPLOY_TARGET: ec2
           EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
           EC2_HOST: ${{ secrets.EC2_HOST }}
           EC2_USER: ${{ secrets.EC2_USER }}
         run: sh scripts/ci/deploy-server.sh "${{ gitea.ref_name }}"
 
+      # 迁移期影子目标：部署到阿里机（只换二进制 + reload 独立 nginx，jiu 保持 stopped）。
+      # if: always() → EC2 失败也照样尝试；continue-on-error → 阿里失败不让流水线变红。
+      - name: Deploy → Ali (migration shadow)
+        if: always()
+        continue-on-error: true
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          DEPLOY_TARGET: ali
+          DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
+          DEPLOY_HOST: ${{ secrets.ALI_HOST }}
+          DEPLOY_USER: ${{ secrets.ALI_USER }}
+        run: sh scripts/ci/deploy-server.sh "${{ gitea.ref_name }}"
+
       - name: Notify
         if: always()
         env:

.gitea/workflows/deploy-site.yml

@@ -32,7 +32,7 @@ jobs:
           GITEA_REPOSITORY: ${{ gitea.repository }}
         run: sh scripts/ci/release-site.sh "${{ gitea.ref_name }}"
 
-      - name: Deploy
+      - name: Deploy → EC2
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
@@ -42,6 +42,19 @@ jobs:
           EC2_USER: ${{ secrets.EC2_USER }}
         run: sh scripts/ci/deploy-site.sh "${{ gitea.ref_name }}"
 
+      # 迁移期影子目标：同步官网到阿里机。失败不挡 EC2。
+      - name: Deploy → Ali (migration shadow)
+        if: always()
+        continue-on-error: true
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
+          DEPLOY_HOST: ${{ secrets.ALI_HOST }}
+          DEPLOY_USER: ${{ secrets.ALI_USER }}
+        run: sh scripts/ci/deploy-site.sh "${{ gitea.ref_name }}"
+
       - name: Notify
         if: always()
         env:

CHANGELOG-client.md

@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.79] - 2026-06-24
+
+### 改进
+- 入库单 / 出库单搜索框升级：搜索后关键词以标签形式显示在搜索框内，带一键清除（✕）按钮，输入框自动清空便于继续输入；当前仅支持单个搜索词。
+
+## [1.0.78] - 2026-06-24
+
+### 改进
+- 维护性发布：发布与部署流程修复，应用功能无变更。
+
+## [1.0.77] - 2026-06-24
+
+### 新功能
+- 入库 / 出库列表的搜索框支持按「酒名（商品名）」搜索（支持汉字、全拼、首字母），输入时带防抖限流，输入更顺畅。
+
+### 改进
+- 入库录入单价允许留空或填 0（待定价）：不再强制单价大于 0，便于先入库、后用「确认进价」补填真实进价。
+
 ## [1.0.76] - 2026-06-23
 
 ### 新功能

CHANGELOG-server.md

@@ -5,6 +5,26 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.81] - 2026-06-24
+
+### 修复
+- 入库单 / 出库单按商品名搜索：历史导入的单据现在也能按商品名搜到（此前明细统一挂占位商品，搜索被占位名顶替，只能搜到新建单据）。
+
+## [1.0.80] - 2026-06-24
+
+### 改进
+- 运维（不影响线上功能）：修复迁移期 CI 影子部署链路——部署私钥写入时补齐结尾换行，解决阿里机 ed25519 部署密钥被判「invalid format」导致 Deploy → Ali 步骤每次失败的问题。
+
+## [1.0.79] - 2026-06-24
+
+### 改进
+- 入库单 / 出库单列表的关键词搜索支持按「酒名（商品名）」模糊反查：除单号、往来单位外，输入商品名（含拼音/首字母）即可筛出含该商品的单据。
+
+## [1.0.78] - 2026-06-23
+
+### 新功能
+- 入库单新增「确认进价」接口：以 0 价（暂估）入库并已审核/出库的调货单据，价格确定后可补填真实进价。系统在一个事务内前向补偿——回填库存批次成本与已出库明细的成本快照、按差额补一条对供应商的应付流水、重算入库单合计，售价与应收不受影响；仅管理员可操作，支持多次按差额修正。
+
 ## [1.0.77] - 2026-06-22
 
 ### 新功能

backend/internal/handler/stock_in.go

@@ -52,9 +52,19 @@ func (h *StockInHandler) List(c *gin.Context) {
 	}
 	if kw := strings.TrimSpace(c.Query("keyword")); kw != "" {
 		like := "%" + kw + "%"
+		// keyword 同时命中：单号 / 往来单位 / 酒名（含全拼+首字母，反查含该酒明细的单据）。
+		// 酒名「product 主数据名 OR 明细快照名」任一命中——不能用 COALESCE 二选一：历史导入单的
+		// 明细 product_id 统一指向占位商品「历史导入占位」（p.name 非空），COALESCE 会被占位名劫持，
+		// 永远取不到真实快照 product_name，导致导入单按真实酒名搜不到。拼音只在 products 上（快照无拼音列）。
 		query = query.Where(
-			"order_no LIKE ? OR partner_id IN (SELECT id FROM partners WHERE shop_id = ? AND name LIKE ?)",
-			like, shopID, like,
+			"order_no LIKE ?"+
+				" OR partner_id IN (SELECT id FROM partners WHERE shop_id = ? AND name LIKE ?)"+
+				" OR id IN (SELECT it.order_id FROM stock_in_items it"+
+				"   LEFT JOIN products p ON p.id = it.product_id AND p.shop_id = it.shop_id"+
+				"   WHERE it.shop_id = ? AND it.deleted_at IS NULL"+
+				"     AND (p.name LIKE ? OR it.product_name LIKE ?"+
+				"          OR p.name_pinyin LIKE ? OR p.name_initials LIKE ?))",
+			like, shopID, like, shopID, like, like, like, like,
 		)
 	}
 

backend/internal/handler/stock_in_test.go

@@ -263,7 +263,7 @@ func TestStockInHandler_TotalAmount(t *testing.T) {
 		"warehouse_id": warehouse.ID,
 		"order_date":   time.Now().Format(time.RFC3339),
 		"items": []map[string]interface{}{
-			{"product_id": product1.ID, "quantity": 10.0, "unit_price": 5.0},  // 50
+			{"product_id": product1.ID, "quantity": 10.0, "unit_price": 5.0}, // 50
 			{"product_id": product2.ID, "quantity": 3.0, "unit_price": 20.0}, // 60
 		},
 	})
@@ -451,6 +451,149 @@ func TestStockInHandler_List_FilterByKeyword(t *testing.T) {
 	assert.Equal(t, float64(2), parseResponse(w)["total"].(float64))
 }
 
+func TestStockInHandler_List_FilterByProductName(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "SI012")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	// 单据1：明细酒名「飞天茅台」（入库按 product_name 新建独立 product）
+	w := makeRequest(r, "POST", "/api/v1/stock-in/orders", token, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items":        []map[string]interface{}{{"product_name": "飞天茅台", "quantity": 5.0}},
+	})
+	require.Equal(t, http.StatusCreated, w.Code)
+
+	// 单据2：明细酒名「拉菲红酒」
+	w = makeRequest(r, "POST", "/api/v1/stock-in/orders", token, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items":        []map[string]interface{}{{"product_name": "拉菲红酒", "quantity": 3.0}},
+	})
+	require.Equal(t, http.StatusCreated, w.Code)
+
+	// 按酒名模糊反查 → 各命中 1 单
+	w = makeRequest(r, "GET", "/api/v1/stock-in/orders?keyword=茅台", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	w = makeRequest(r, "GET", "/api/v1/stock-in/orders?keyword=红酒", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	// 无关键词 → 两单都在
+	w = makeRequest(r, "GET", "/api/v1/stock-in/orders", token, nil)
+	assert.Equal(t, float64(2), parseResponse(w)["total"].(float64))
+}
+
+// 回归：历史导入单的明细 product_id 统一指向占位商品「历史导入占位」（p.name 非空），
+// 真实酒名只在快照列 product_name。修复前搜索用 COALESCE(NULLIF(p.name,”), product_name)
+// 被占位名劫持，导入单按真实酒名搜不到；修复后「p.name OR product_name」任一命中。
+func TestStockInHandler_List_FilterByImportedSnapshotName(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "SI012B")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	// 占位商品：名「历史导入占位」，编码 HIST-PLACEHOLDER（模拟 import-history）
+	placeholder := &model.Product{
+		TenantBase: model.TenantBase{ShopID: shop.ID},
+		Name:       "历史导入占位",
+		Code:       "HIST-PLACEHOLDER",
+	}
+	require.NoError(t, db.Create(placeholder).Error)
+
+	// 导入单：明细 product_id 指向占位商品，真实酒名「飞天茅台」仅在快照 product_name
+	order := &model.StockInOrder{
+		TenantBase:  model.TenantBase{ShopID: shop.ID},
+		OrderNo:     "RK-IMPORT-001",
+		WarehouseID: warehouse.ID,
+		OperatorID:  user.ID,
+		Status:      "approved",
+		OrderDate:   model.Date{Time: time.Now()},
+	}
+	require.NoError(t, db.Create(order).Error)
+	require.NoError(t, db.Create(&model.StockInItem{
+		OrderID:     order.ID,
+		ShopID:      shop.ID,
+		ProductID:   placeholder.ID,
+		ProductCode: "ZXZ000010",
+		ProductName: "飞天茅台",
+		Quantity:    5.0,
+	}).Error)
+
+	// 按真实酒名搜 → 命中导入单（修复前为 0）
+	w := makeRequest(r, "GET", "/api/v1/stock-in/orders?keyword=茅台", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+}
+
+func TestStockInHandler_List_FilterByProductPinyin(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "SI013")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	// 入库按 product_name 新建独立 product，会自动写入拼音列（name_pinyin/name_initials）
+	w := makeRequest(r, "POST", "/api/v1/stock-in/orders", token, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items":        []map[string]interface{}{{"product_name": "飞天茅台", "quantity": 5.0}},
+	})
+	require.Equal(t, http.StatusCreated, w.Code)
+
+	// 全拼命中（feitianmaotai）
+	w = makeRequest(r, "GET", "/api/v1/stock-in/orders?keyword=feitian", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	// 首字母命中（ftmt）
+	w = makeRequest(r, "GET", "/api/v1/stock-in/orders?keyword=ftmt", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	// 不相关拼音不命中
+	w = makeRequest(r, "GET", "/api/v1/stock-in/orders?keyword=wuliangye", token, nil)
+	assert.Equal(t, float64(0), parseResponse(w)["total"].(float64))
+}
+
+func TestStockInHandler_List_FilterByProductName_TenantIsolation(t *testing.T) {
+	db := testutil.SetupTestDB()
+	r := setupProtectedRouter(db)
+
+	// 店A、店B 各建一张含「茅台」明细的入库单
+	shopA := testutil.CreateTestShop(db, "SI014A")
+	userA := testutil.CreateTestUser(db, shopA.ID, "adminA", "pass", "admin")
+	whA := testutil.CreateTestWarehouse(db, shopA.ID, "WA")
+	tokenA := getAuthToken(userA.ID, shopA.ID, "admin")
+
+	shopB := testutil.CreateTestShop(db, "SI014B")
+	userB := testutil.CreateTestUser(db, shopB.ID, "adminB", "pass", "admin")
+	whB := testutil.CreateTestWarehouse(db, shopB.ID, "WB")
+	tokenB := getAuthToken(userB.ID, shopB.ID, "admin")
+
+	for _, tc := range []struct {
+		token string
+		wh    uint64
+	}{{tokenA, whA.ID}, {tokenB, whB.ID}} {
+		w := makeRequest(r, "POST", "/api/v1/stock-in/orders", tc.token, map[string]interface{}{
+			"warehouse_id": tc.wh,
+			"order_date":   time.Now().Format(time.RFC3339),
+			"items":        []map[string]interface{}{{"product_name": "飞天茅台", "quantity": 1.0}},
+		})
+		require.Equal(t, http.StatusCreated, w.Code)
+	}
+
+	// 店A 搜茅台只看到自己的 1 单，绝不串到店B
+	w := makeRequest(r, "GET", "/api/v1/stock-in/orders?keyword=茅台", tokenA, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	w = makeRequest(r, "GET", "/api/v1/stock-in/orders?keyword=茅台", tokenB, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+}
+
 func TestStockInHandler_List_FilterByStatus(t *testing.T) {
 	db := testutil.SetupTestDB()
 	shop := testutil.CreateTestShop(db, "SI010")

backend/internal/handler/stock_out.go

@@ -45,9 +45,19 @@ func (h *StockOutHandler) List(c *gin.Context) {
 	}
 	if kw := strings.TrimSpace(c.Query("keyword")); kw != "" {
 		like := "%" + kw + "%"
+		// keyword 同时命中：单号 / 往来单位 / 酒名（含全拼+首字母，反查含该酒明细的单据）。
+		// 酒名「product 主数据名 OR 明细快照名」任一命中——不能用 COALESCE 二选一：历史导入单的
+		// 明细 product_id 统一指向占位商品「历史导入占位」（p.name 非空），COALESCE 会被占位名劫持，
+		// 永远取不到真实快照 product_name，导致导入单按真实酒名搜不到。拼音只在 products 上（快照无拼音列）。
 		query = query.Where(
-			"order_no LIKE ? OR partner_id IN (SELECT id FROM partners WHERE shop_id = ? AND name LIKE ?)",
-			like, shopID, like,
+			"order_no LIKE ?"+
+				" OR partner_id IN (SELECT id FROM partners WHERE shop_id = ? AND name LIKE ?)"+
+				" OR id IN (SELECT it.order_id FROM stock_out_items it"+
+				"   LEFT JOIN products p ON p.id = it.product_id AND p.shop_id = it.shop_id"+
+				"   WHERE it.shop_id = ? AND it.deleted_at IS NULL"+
+				"     AND (p.name LIKE ? OR it.product_name LIKE ?"+
+				"          OR p.name_pinyin LIKE ? OR p.name_initials LIKE ?))",
+			like, shopID, like, shopID, like, like, like, like,
 		)
 	}
 	// 按商品编码反查单据：精确匹配，走 idx_so_items_shop_code(shop_id, product_code) 索引

backend/internal/handler/stock_out_test.go

@@ -212,6 +212,82 @@ func TestStockOutHandler_List_FilterByKeyword(t *testing.T) {
 	assert.Equal(t, float64(2), parseResponse(w)["total"].(float64))
 }
 
+func TestStockOutHandler_List_FilterByProductName(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "SO012")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	maotai := testutil.CreateTestProduct(db, shop.ID, "飞天茅台")
+	lafei := testutil.CreateTestProduct(db, shop.ID, "拉菲红酒")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	w := makeRequest(r, "POST", "/api/v1/stock-out/orders", token, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items":        []map[string]interface{}{{"product_id": maotai.ID, "quantity": 1.0}},
+	})
+	require.Equal(t, http.StatusCreated, w.Code)
+
+	w = makeRequest(r, "POST", "/api/v1/stock-out/orders", token, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items":        []map[string]interface{}{{"product_id": lafei.ID, "quantity": 1.0}},
+	})
+	require.Equal(t, http.StatusCreated, w.Code)
+
+	// 按酒名模糊反查 → 各命中 1 单
+	w = makeRequest(r, "GET", "/api/v1/stock-out/orders?keyword=茅台", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	w = makeRequest(r, "GET", "/api/v1/stock-out/orders?keyword=红酒", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	// 无关键词 → 两单都在
+	w = makeRequest(r, "GET", "/api/v1/stock-out/orders", token, nil)
+	assert.Equal(t, float64(2), parseResponse(w)["total"].(float64))
+}
+
+// 回归：历史导入出库单的明细 product_id 指向占位商品「历史导入占位」，真实酒名只在快照列。
+// 修复前 COALESCE 被占位名劫持搜不到，修复后「p.name OR product_name」任一命中。
+func TestStockOutHandler_List_FilterByImportedSnapshotName(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "SO012B")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	placeholder := &model.Product{
+		TenantBase: model.TenantBase{ShopID: shop.ID},
+		Name:       "历史导入占位",
+		Code:       "HIST-PLACEHOLDER",
+	}
+	require.NoError(t, db.Create(placeholder).Error)
+
+	order := &model.StockOutOrder{
+		TenantBase:  model.TenantBase{ShopID: shop.ID},
+		OrderNo:     "CK-IMPORT-001",
+		WarehouseID: warehouse.ID,
+		OperatorID:  user.ID,
+		Status:      "approved",
+		OrderDate:   model.Date{Time: time.Now()},
+	}
+	require.NoError(t, db.Create(order).Error)
+	require.NoError(t, db.Create(&model.StockOutItem{
+		OrderID:     order.ID,
+		ShopID:      shop.ID,
+		ProductID:   placeholder.ID,
+		ProductCode: "ZXZ000010",
+		ProductName: "飞天茅台",
+		Quantity:    5.0,
+	}).Error)
+
+	// 按真实酒名搜 → 命中导入单（修复前为 0）
+	w := makeRequest(r, "GET", "/api/v1/stock-out/orders?keyword=茅台", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+}
+
 func TestStockOutHandler_Reject(t *testing.T) {
 	db := testutil.SetupTestDB()
 	shop := testutil.CreateTestShop(db, "SO004")

client/lib/providers/stock_in_provider.dart

@@ -1,3 +1,5 @@
+import 'dart:async';
+
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import '../core/api/api_client.dart';
 import '../core/auth/auth_state.dart';
@@ -25,9 +27,11 @@ class StockInListNotifier extends AsyncNotifier<PageResult<StockInOrder>> {
   String? _endDate;
   String _keyword = '';
   PageResult<StockInOrder>? _cache;
+  Timer? _searchDebounce;
 
   @override
   Future<PageResult<StockInOrder>> build() async {
+    ref.onDispose(() => _searchDebounce?.cancel());
     ref.watch(authStateProvider.select((s) => s.user?.shopId));
     ref.watch(networkRecoveryCountProvider);
     try {
@@ -65,6 +69,8 @@ class StockInListNotifier extends AsyncNotifier<PageResult<StockInOrder>> {
   /// 当前服务端状态过滤值（供页面进入时对齐标签/下拉，避免重复拉取）
   String get currentStatus => _status;
 
+  String get currentKeyword => _keyword;
+
   void setStatus(String status) {
     _status = status;
     _page = 1;
@@ -78,10 +84,17 @@ class StockInListNotifier extends AsyncNotifier<PageResult<StockInOrder>> {
     reload();
   }
 
+  /// 关键词搜索（含酒名模糊反查，单次约 55ms 的明细扫描）。
+  /// 去重 + 防抖限流：同词不重查；连发回车/狂点合并取最后一次，避免昂贵查询被刷。
   void setKeyword(String keyword) {
-    _keyword = keyword;
-    _page = 1;
-    reload();
+    final kw = keyword.trim();
+    if (kw == _keyword) return;
+    _searchDebounce?.cancel();
+    _searchDebounce = Timer(const Duration(milliseconds: 350), () {
+      _keyword = kw;
+      _page = 1;
+      reload();
+    });
   }
 
   void reload() {

client/lib/providers/stock_out_provider.dart

@@ -1,3 +1,5 @@
+import 'dart:async';
+
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import '../core/api/api_client.dart';
 import '../core/auth/auth_state.dart';
@@ -26,9 +28,11 @@ class StockOutListNotifier extends AsyncNotifier<PageResult<StockOutOrder>> {
   String _keyword = '';
   String _productCode = '';
   PageResult<StockOutOrder>? _cache;
+  Timer? _searchDebounce;
 
   @override
   Future<PageResult<StockOutOrder>> build() async {
+    ref.onDispose(() => _searchDebounce?.cancel());
     ref.watch(authStateProvider.select((s) => s.user?.shopId));
     ref.watch(networkRecoveryCountProvider);
     try {
@@ -67,6 +71,8 @@ class StockOutListNotifier extends AsyncNotifier<PageResult<StockOutOrder>> {
   /// 当前服务端状态过滤值（供页面进入时对齐标签/下拉，避免重复拉取）
   String get currentStatus => _status;
 
+  String get currentKeyword => _keyword;
+
   void setStatus(String status) {
     _status = status;
     _page = 1;
@@ -80,10 +86,17 @@ class StockOutListNotifier extends AsyncNotifier<PageResult<StockOutOrder>> {
     reload();
   }
 
+  /// 关键词搜索（含酒名模糊反查，单次约 55ms 的明细扫描）。
+  /// 去重 + 防抖限流：同词不重查；连发回车/狂点合并取最后一次，避免昂贵查询被刷。
   void setKeyword(String keyword) {
-    _keyword = keyword;
-    _page = 1;
-    reload();
+    final kw = keyword.trim();
+    if (kw == _keyword) return;
+    _searchDebounce?.cancel();
+    _searchDebounce = Timer(const Duration(milliseconds: 350), () {
+      _keyword = kw;
+      _page = 1;
+      reload();
+    });
   }
 
   /// 按商品编码精确反查（独立于 keyword）

client/lib/screens/stock_in/stock_in_form_screen.dart

@@ -868,11 +868,8 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
         FilteringTextInputFormatter.allow(RegExp(r'^\d+\.?\d{0,2}'))
       ],
       onChanged: (_) => setState(() {}),
-      validator: (v) {
-        if (v == null || v.isEmpty) return '不能为空';
-        if ((double.tryParse(v) ?? 0) <= 0) return '>0';
-        return null;
-      },
+      // 单价允许为空或 0：表示「待定价」，入库审核后可在单据详情「确认进价」补填真实进价
+      validator: (_) => null,
     );
   }
 
@@ -976,15 +973,6 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
     );
   }
 
-  String _productCodeOf(_ItemRow item) =>
-      ref
-          .read(productNameListProvider)
-          .valueOrNull
-          ?.where((o) => o.id == item.selectedNameId)
-          .firstOrNull
-          ?.code ??
-      '';
-
   // ── 桌面表格：表头行 ──────────────────────────────────────────────────────
   Widget _buildItemTableHeader() {
     Widget th(String s) => Padding(
@@ -1019,7 +1007,6 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
     final qty = double.tryParse(item.qtyCtrl.text) ?? 0;
     final price = double.tryParse(item.priceCtrl.text) ?? 0;
     final amount = qty * price;
-    final productCode = _productCodeOf(item);
 
     Widget tc(String s, {Color? color, FontWeight? weight}) => Padding(
           padding: const EdgeInsets.symmetric(horizontal: 8, vertical: 12),
@@ -1166,7 +1153,6 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
     final qty = double.tryParse(item.qtyCtrl.text) ?? 0;
     final price = double.tryParse(item.priceCtrl.text) ?? 0;
     final amount = qty * price;
-    final productCode = _productCodeOf(item);
 
     return MobileListCard(
       title: Text('商品 ${index + 1}'),

client/lib/screens/stock_in/stock_in_list_screen.dart

@@ -17,6 +17,7 @@ import '../../widgets/multi_select_dropdown.dart' show ColDef, ColumnToggleButto
 import '../../core/storage/column_prefs.dart';
 import '../../widgets/page_scaffold.dart';
 import '../../widgets/status_badge.dart';
+import '../../widgets/search_chip.dart';
 import '../../core/utils/export_util.dart';
 import '../../providers/inventory_provider.dart';
 import '../../providers/tab_state_provider.dart';
@@ -44,6 +45,7 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
   Set<String> _filterSupplier = {};
   Set<String>? _hiddenCols; // null = 尚未载入本地存档（回退到 minWidth 首次默认）
   final _searchCtrl = TextEditingController();
+  String _appliedKw = ''; // 已生效的搜索词（框内 chip 标签展示）
 
   static const _screenId = 'stock_in_list';
 
@@ -72,6 +74,10 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
       final want = tab == 1 ? 'pending,draft' : _statusFilter;
       final notifier = ref.read(stockInListProvider.notifier);
       if (notifier.currentStatus != want) notifier.setStatus(want);
+      // 同步已生效的搜索词到框内 chip（provider 持久化，切走再回来不丢）
+      if (notifier.currentKeyword != _appliedKw) {
+        setState(() => _appliedKw = notifier.currentKeyword);
+      }
     });
   }
 
@@ -81,8 +87,19 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
     super.dispose();
   }
 
-  void _triggerSearch() =>
-      ref.read(stockInListProvider.notifier).setKeyword(_searchCtrl.text.trim());
+  void _triggerSearch() {
+    final kw = _searchCtrl.text.trim();
+    ref.read(stockInListProvider.notifier).setKeyword(kw);
+    // 仅支持单个搜索词：生效后输入框清空，搜索词转为框内 chip 标签
+    setState(() => _appliedKw = kw);
+    if (kw.isNotEmpty) _searchCtrl.clear();
+  }
+
+  void _clearSearch() {
+    _searchCtrl.clear();
+    setState(() => _appliedKw = '');
+    ref.read(stockInListProvider.notifier).setKeyword('');
+  }
 
   String? get _startDate => _dateRange != null
       ? '${_dateRange!.start.year}-${_dateRange!.start.month.toString().padLeft(2, '0')}-${_dateRange!.start.day.toString().padLeft(2, '0')}'
@@ -363,12 +380,29 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
               )
             : null;
 
+        final hasKw = _appliedKw.isNotEmpty;
         final searchField = TextField(
           controller: _searchCtrl,
           decoration: InputDecoration(
-            hintText: '单号/往来单位，回车搜索',
-            prefixIcon: const Icon(Icons.search, size: 16),
+            hintText: hasKw ? '继续输入新关键词…' : '单号/往来单位/酒名，回车搜索',
             hintStyle: const TextStyle(fontSize: 12),
+            // 搜索图标 +（已生效时）框内 chip 标签，仅一个词；✕ 删除即清除搜索。
+            // 用 prefixIcon 而非 prefix：后者仅在聚焦/有文字时才显示，搜索后输入框为空会被隐藏。
+            prefixIconConstraints:
+                const BoxConstraints(minWidth: 0, minHeight: 0),
+            prefixIcon: Padding(
+              padding: const EdgeInsets.only(left: 8, right: 6),
+              child: Row(
+                mainAxisSize: MainAxisSize.min,
+                children: [
+                  const Icon(Icons.search, size: 16),
+                  if (hasKw) ...[
+                    const SizedBox(width: 6),
+                    SearchChip(label: _appliedKw, onDeleted: _clearSearch),
+                  ],
+                ],
+              ),
+            ),
             suffixIcon: IconButton(
               icon: const Icon(Icons.search, size: 16),
               tooltip: '搜索',

client/lib/screens/stock_out/stock_out_list_screen.dart

@@ -15,6 +15,7 @@ import '../../widgets/multi_select_dropdown.dart' show ColDef, ColumnToggleButto
 import '../../core/storage/column_prefs.dart';
 import '../../widgets/page_scaffold.dart';
 import '../../widgets/status_badge.dart';
+import '../../widgets/search_chip.dart';
 import '../../core/utils/export_util.dart';
 import '../../core/utils/print_util.dart';
 import '../../providers/inventory_provider.dart';
@@ -43,6 +44,7 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
   Set<String>? _hiddenCols; // null = 尚未载入本地存档（回退到 minWidth 首次默认）
   final _searchCtrl = TextEditingController();
   final _codeSearchCtrl = TextEditingController();
+  String _appliedKw = ''; // 已生效的搜索词（框内 chip 标签展示）
 
   static const _screenId = 'stock_out_list';
 
@@ -59,6 +61,10 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
       final want = tab == 1 ? 'pending,draft' : _statusFilter;
       final notifier = ref.read(stockOutListProvider.notifier);
       if (notifier.currentStatus != want) notifier.setStatus(want);
+      // 同步已生效的搜索词到框内 chip（provider 持久化，切走再回来不丢）
+      if (notifier.currentKeyword != _appliedKw) {
+        setState(() => _appliedKw = notifier.currentKeyword);
+      }
     });
   }
 
@@ -82,9 +88,19 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
     super.dispose();
   }
 
-  void _triggerSearch() => ref
-      .read(stockOutListProvider.notifier)
-      .setKeyword(_searchCtrl.text.trim());
+  void _triggerSearch() {
+    final kw = _searchCtrl.text.trim();
+    ref.read(stockOutListProvider.notifier).setKeyword(kw);
+    // 仅支持单个搜索词：生效后输入框清空，搜索词转为框内 chip 标签
+    setState(() => _appliedKw = kw);
+    if (kw.isNotEmpty) _searchCtrl.clear();
+  }
+
+  void _clearSearch() {
+    _searchCtrl.clear();
+    setState(() => _appliedKw = '');
+    ref.read(stockOutListProvider.notifier).setKeyword('');
+  }
 
   void _triggerCodeSearch() => ref
       .read(stockOutListProvider.notifier)
@@ -375,12 +391,29 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
               )
             : null;
 
+        final hasKw = _appliedKw.isNotEmpty;
         final searchField = TextField(
           controller: _searchCtrl,
           decoration: InputDecoration(
-            hintText: '单号/往来单位，回车搜索',
-            prefixIcon: const Icon(Icons.search, size: 16),
+            hintText: hasKw ? '继续输入新关键词…' : '单号/往来单位/酒名，回车搜索',
             hintStyle: const TextStyle(fontSize: 12),
+            // 搜索图标 +（已生效时）框内 chip 标签，仅一个词；✕ 删除即清除搜索。
+            // 用 prefixIcon 而非 prefix：后者仅在聚焦/有文字时才显示，搜索后输入框为空会被隐藏。
+            prefixIconConstraints:
+                const BoxConstraints(minWidth: 0, minHeight: 0),
+            prefixIcon: Padding(
+              padding: const EdgeInsets.only(left: 8, right: 6),
+              child: Row(
+                mainAxisSize: MainAxisSize.min,
+                children: [
+                  const Icon(Icons.search, size: 16),
+                  if (hasKw) ...[
+                    const SizedBox(width: 6),
+                    SearchChip(label: _appliedKw, onDeleted: _clearSearch),
+                  ],
+                ],
+              ),
+            ),
             suffixIcon: IconButton(
               icon: const Icon(Icons.search, size: 16),
               tooltip: '搜索',

client/lib/widgets/search_chip.dart

@@ -0,0 +1,52 @@
+import 'package:flutter/material.dart';
+
+/// 搜索框内嵌的「已生效搜索词」标签：紧凑圆角 chip + ✕ 删除按钮。
+///
+/// 用于列表屏搜索框 [InputDecoration.prefix]，仅展示单个搜索词；
+/// 点 ✕ 触发 [onDeleted] 清除搜索。
+class SearchChip extends StatelessWidget {
+  const SearchChip({super.key, required this.label, required this.onDeleted});
+
+  final String label;
+  final VoidCallback onDeleted;
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+    final bg = theme.colorScheme.primary.withValues(alpha: 0.12);
+    final fg = theme.colorScheme.primary;
+    return Container(
+      padding: const EdgeInsets.only(left: 8, right: 2, top: 2, bottom: 2),
+      decoration: BoxDecoration(
+        color: bg,
+        borderRadius: BorderRadius.circular(12),
+      ),
+      child: Row(
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          ConstrainedBox(
+            constraints: const BoxConstraints(maxWidth: 120),
+            child: Text(
+              label,
+              maxLines: 1,
+              overflow: TextOverflow.ellipsis,
+              style: TextStyle(
+                fontSize: 12,
+                color: fg,
+                fontWeight: FontWeight.w500,
+              ),
+            ),
+          ),
+          InkResponse(
+            onTap: onDeleted,
+            radius: 14,
+            child: Padding(
+              padding: const EdgeInsets.all(2),
+              child: Icon(Icons.close, size: 14, color: fg),
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+}

client/test/stock_in_search_debounce_test.dart

@@ -0,0 +1,82 @@
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:jiu_client/core/api/api_client.dart';
+import 'package:jiu_client/core/models/page_result.dart';
+import 'package:jiu_client/models/stock_in.dart';
+import 'package:jiu_client/providers/stock_in_provider.dart';
+import 'package:jiu_client/repositories/stock_in_repository.dart';
+
+/// 统计 list() 调用次数与最后一次关键词的假仓库，用于验证搜索限流。
+class _CountingStockInRepo extends StockInRepository {
+  int listCalls = 0;
+  String? lastKeyword;
+
+  _CountingStockInRepo() : super(ApiClient(token: 't'));
+
+  @override
+  Future<PageResult<StockInOrder>> list({
+    String? status,
+    String? startDate,
+    String? endDate,
+    String? keyword,
+    int page = 1,
+    int pageSize = 20,
+  }) async {
+    listCalls++;
+    lastKeyword = keyword;
+    return const PageResult<StockInOrder>(
+        data: [], total: 0, page: 1, pageSize: 20);
+  }
+}
+
+void main() {
+  test('setKeyword 防抖：350ms 内连发只触发最后一次', () async {
+    final repo = _CountingStockInRepo();
+    final container = ProviderContainer(
+      overrides: [stockInRepositoryProvider.overrideWithValue(repo)],
+    );
+    addTearDown(container.dispose);
+
+    // 初次 build 自动拉一次列表
+    await container.read(stockInListProvider.future);
+    expect(repo.listCalls, 1);
+
+    final notifier = container.read(stockInListProvider.notifier);
+
+    // 350ms 内连发三个不同关键词
+    notifier.setKeyword('茅');
+    notifier.setKeyword('茅台');
+    notifier.setKeyword('飞天茅台');
+
+    // 防抖窗口未到 → 不应有新请求
+    await Future<void>.delayed(const Duration(milliseconds: 120));
+    expect(repo.listCalls, 1);
+
+    // 过了防抖窗口 → 合并成 1 次，关键词取最后一个
+    await Future<void>.delayed(const Duration(milliseconds: 350));
+    expect(repo.listCalls, 2);
+    expect(repo.lastKeyword, '飞天茅台');
+  });
+
+  test('setKeyword 去重：相同关键词不重复查询', () async {
+    final repo = _CountingStockInRepo();
+    final container = ProviderContainer(
+      overrides: [stockInRepositoryProvider.overrideWithValue(repo)],
+    );
+    addTearDown(container.dispose);
+
+    await container.read(stockInListProvider.future);
+    final notifier = container.read(stockInListProvider.notifier);
+
+    // 首次搜索「茅台」
+    notifier.setKeyword('茅台');
+    await Future<void>.delayed(const Duration(milliseconds: 400));
+    expect(repo.listCalls, 2);
+    expect(repo.lastKeyword, '茅台');
+
+    // 再次搜索完全相同的关键词 → 直接 return，不发请求
+    notifier.setKeyword('茅台');
+    await Future<void>.delayed(const Duration(milliseconds: 400));
+    expect(repo.listCalls, 2);
+  });
+}

deploy/nginx-jiu-ali.conf

@@ -0,0 +1,103 @@
+# 阿里云独立 nginx 版（宿主机直接终结 TLS，不经 pangolin）。
+# 与 nginx-jiu.conf（EC2 pangolin 容器版，listen 127.0.0.1:8445）等价，
+# 仅入口监听改为对公网 443 直连。CI deploy-server.sh 的 ali 分支落到
+# /etc/nginx/conf.d/jiu.conf。
+limit_req_zone $binary_remote_addr zone=jiu_pub:10m rate=10r/s;
+limit_req_status 429;
+
+server {
+    listen 443 ssl http2;
+    server_name jiu.51yanmei.com;
+
+    ssl_certificate     /etc/letsencrypt/live/jiu.51yanmei.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/jiu.51yanmei.com/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+
+    client_max_body_size 20m;
+
+    # 商品图片静态文件
+    location ^~ /images/ {
+        alias /opt/jiu/images/;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # 文件导入接口（超时更长）
+    location ~ ^/api/v1/import/ {
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 300s;
+    }
+
+    # 未鉴权公开/登录接口：加最外层 per-IP 限流
+    location ~ ^/api/v1/(public|auth)/ {
+        limit_req          zone=jiu_pub burst=20 nodelay;
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # API 反向代理
+    location ~ ^/(api|health|version) {
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # Flutter 管理端（仅 /app/ 前缀）
+    location /app/ {
+        alias /opt/jiu/web/;
+        index index.html;
+        try_files $uri $uri/ /app/index.html;
+    }
+
+    location = /app/index.html {
+        alias /opt/jiu/web/index.html;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        expires 0;
+    }
+
+    # 公开商品详情页（扫码跳转）→ 后端注入 OG 标签
+    location ~ ^/product/ {
+        limit_req          zone=jiu_pub burst=20 nodelay;
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # Flutter base-href=/app/ 会把 /product/:id 重写为 /app/product/:id
+    location ~ ^/app/product/ {
+        limit_req          zone=jiu_pub burst=20 nodelay;
+        rewrite ^/app(/product/.+)$ $1 break;
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # 桌面客户端安装包下载
+    location /downloads/ {
+        alias /opt/jiu/downloads/;
+        add_header Content-Disposition "attachment";
+        add_header Cache-Control "no-cache";
+        autoindex off;
+    }
+
+    # 营销站点兜底
+    location / {
+        root /opt/jiu/marketing;
+        try_files $uri $uri.html $uri/index.html /index.html;
+    }
+}
+
+server {
+    listen 80;
+    server_name jiu.51yanmei.com;
+    return 301 https://$host$request_uri;
+}

scripts/ci/compile-backend.sh

@@ -26,6 +26,7 @@ mv backend/jiu-gencode dist/jiu-gencode
 # it belongs to the client pipeline.
 tar -czf dist/configs.tar.gz \
   deploy/nginx-jiu.conf \
+  deploy/nginx-jiu-ali.conf \
   deploy/jiu.service \
   deploy/production.env.template \
   deploy/setup-ec2.sh \

scripts/ci/deploy-client.sh

@@ -1,14 +1,17 @@
 #!/usr/bin/env bash
 # deploy-client.sh <tag>  —  deploy the Flutter web app, desktop/mobile installers,
-# and version.yaml to EC2. Does NOT restart the backend (version.yaml is read
-# per-request) nor touch nginx / the marketing site.
+# and version.yaml. Does NOT restart the backend (version.yaml is read
+# per-request) nor touch nginx / the marketing site. Target is EC2 by default;
+# set DEPLOY_HOST/DEPLOY_USER/DEPLOY_SSH_KEY to retarget the Ali box (migration).
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
 . "$(dirname "$0")/lib-forgejo.sh"
 
 TAG="$1"
-echo "==> deploy-client: tag=${TAG}"
+TARGET_HOST="${DEPLOY_HOST:-$EC2_HOST}"
+TARGET_USER="${DEPLOY_USER:-$EC2_USER}"
+echo "==> deploy-client: tag=${TAG} host=${TARGET_HOST}"
 
 if [ ! -f dist/web.tar.gz ] || [ ! -f dist/version.yaml ]; then
   download_release_assets "$TAG"
@@ -27,18 +30,18 @@ mkdir -p /tmp/jiu-web-new
 tar -xzf dist/web.tar.gz -C /tmp/jiu-web-new --strip-components=1
 
 setup_ssh
-echo "==> deploy-client: uploading files to EC2"
-${SCP} "$VERSION_YAML" "${EC2_USER}@${EC2_HOST}:/tmp/version.yaml"
+echo "==> deploy-client: uploading files to ${TARGET_HOST}"
+${SCP} "$VERSION_YAML" "${TARGET_USER}@${TARGET_HOST}:/tmp/version.yaml"
 rsync -avz --delete -e "ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no" \
-  /tmp/jiu-web-new/ "${EC2_USER}@${EC2_HOST}:/tmp/jiu-web-new/"
+  /tmp/jiu-web-new/ "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-web-new/"
 
 # Desktop / mobile installers (served from /downloads/ by nginx). Guarded —
 # may be absent in a partial manual deploy.
-[ -f dist/jiu-windows-x64-setup.exe ] && ${SCP} dist/jiu-windows-x64-setup.exe "${EC2_USER}@${EC2_HOST}:/tmp/jiu-windows-x64-setup.exe" || true
-[ -f dist/jiu-macos-x64.zip ] && ${SCP} dist/jiu-macos-x64.zip "${EC2_USER}@${EC2_HOST}:/tmp/jiu-macos-x64.zip" || true
-[ -f dist/jiu-android.apk ] && ${SCP} dist/jiu-android.apk "${EC2_USER}@${EC2_HOST}:/tmp/jiu-android.apk" || true
+[ -f dist/jiu-windows-x64-setup.exe ] && ${SCP} dist/jiu-windows-x64-setup.exe "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-windows-x64-setup.exe" || true
+[ -f dist/jiu-macos-x64.zip ] && ${SCP} dist/jiu-macos-x64.zip "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-macos-x64.zip" || true
+[ -f dist/jiu-android.apk ] && ${SCP} dist/jiu-android.apk "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-android.apk" || true
 
-${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
+${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
 set -e
 
 # Update version config (WorkingDirectory=/opt/jiu reads config/version.yaml).

scripts/ci/deploy-server.sh

@@ -1,15 +1,26 @@
 #!/usr/bin/env bash
-# deploy-server.sh <tag>  —  deploy the backend binary + nginx config to EC2.
-# Two modes: uses dist/ built in the same job, or downloads the release assets
-# by tag (manual rollback). Does NOT touch the web app, marketing site, or
-# version.yaml.
+# deploy-server.sh <tag>  —  deploy the backend binary + nginx config.
+# Two source modes: uses dist/ built in the same job, or downloads the release
+# assets by tag (manual rollback). Does NOT touch the web app, marketing site,
+# or version.yaml.
+#
+# Target is EC2 by default. During the EC2→Ali migration, set DEPLOY_TARGET=ali
+# plus DEPLOY_HOST/DEPLOY_USER/DEPLOY_SSH_KEY to deploy to the Alibaba Cloud box.
+#   - ec2 (default): stop jiu → swap binary → start jiu → health check →
+#                    reload nginx inside the pangolin-edge container.
+#   - ali: swap binary only (jiu.service stays stopped — the Ali DB is a
+#          read-only replica until cutover; backend is started at cutover) →
+#          reload the host nginx with the standalone (listen 443) config.
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
 . "$(dirname "$0")/lib-forgejo.sh"
 
 TAG="$1"
-echo "==> deploy-server: tag=${TAG}"
+DEPLOY_TARGET="${DEPLOY_TARGET:-ec2}"
+TARGET_HOST="${DEPLOY_HOST:-$EC2_HOST}"
+TARGET_USER="${DEPLOY_USER:-$EC2_USER}"
+echo "==> deploy-server: tag=${TAG} target=${DEPLOY_TARGET} host=${TARGET_HOST}"
 
 if [ ! -f dist/jiu-server ] || [ ! -f dist/configs.tar.gz ]; then
   download_release_assets "$TAG"
@@ -22,19 +33,54 @@ rm -rf /tmp/jiu-configs
 mkdir -p /tmp/jiu-configs
 tar -xzf dist/configs.tar.gz -C /tmp/jiu-configs
 
+# Pick the nginx config matching the target's reverse-proxy topology.
+if [ "$DEPLOY_TARGET" = "ali" ]; then
+  NGINX_SRC=/tmp/jiu-configs/deploy/nginx-jiu-ali.conf
+else
+  NGINX_SRC=/tmp/jiu-configs/deploy/nginx-jiu.conf
+fi
+
 setup_ssh
-echo "==> deploy-server: uploading files to EC2"
-${SCP} dist/jiu-server "${EC2_USER}@${EC2_HOST}:/tmp/jiu-server"
-${SCP} /tmp/jiu-configs/deploy/nginx-jiu.conf "${EC2_USER}@${EC2_HOST}:/tmp/nginx-jiu.conf"
+echo "==> deploy-server: uploading files to ${TARGET_HOST}"
+${SCP} dist/jiu-server "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-server"
+${SCP} "${NGINX_SRC}" "${TARGET_USER}@${TARGET_HOST}:/tmp/nginx-jiu.conf"
 
 # Platform code-minting CLI + wrapper (absent when rolling back to a pre-gencode
 # release — upload only when present).
 if [ -f dist/jiu-gencode ]; then
-  ${SCP} dist/jiu-gencode "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode"
-  ${SCP} /tmp/jiu-configs/deploy/jiu-gencode.sh "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode.sh"
+  ${SCP} dist/jiu-gencode "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-gencode"
+  ${SCP} /tmp/jiu-configs/deploy/jiu-gencode.sh "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-gencode.sh"
 fi
 
-${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
+if [ "$DEPLOY_TARGET" = "ali" ]; then
+  # --- Alibaba Cloud (shadow target, pre-cutover) ---
+  # Swap the binary but DO NOT start jiu: the Ali DB is a read-only replica, so
+  # the backend's startup AutoMigrate/backfill would fail. jiu.service is started
+  # only at cutover (after the replica is promoted to primary). Reload the host
+  # nginx with the standalone listen-443 config.
+  ${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
+set -e
+
+cp /tmp/jiu-server /opt/jiu/backend/jiu-server
+chmod +x /opt/jiu/backend/jiu-server
+
+if [ -f /tmp/jiu-gencode ]; then
+  cp /tmp/jiu-gencode /opt/jiu/backend/jiu-gencode
+  chmod +x /opt/jiu/backend/jiu-gencode
+  if [ -f /tmp/jiu-gencode.sh ]; then
+    cp /tmp/jiu-gencode.sh /opt/jiu/backend/jiu-gencode.sh
+    chmod +x /opt/jiu/backend/jiu-gencode.sh
+  fi
+fi
+
+cp /tmp/nginx-jiu.conf /etc/nginx/conf.d/jiu.conf
+nginx -t && systemctl reload nginx
+
+echo "Ali server staged (binary swapped, jiu.service left stopped, nginx reloaded)"
+ENDSSH
+else
+  # --- EC2 (live primary) ---
+  ${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
 set -e
 
 # Replace backend binary
@@ -72,7 +118,8 @@ docker exec pangolin-edge nginx -t && docker exec pangolin-edge nginx -s reload
 
 echo "Server deploy complete!"
 ENDSSH
+fi
 
 teardown_ssh
 rm -rf /tmp/jiu-configs
-echo "==> deploy-server: done"
+echo "==> deploy-server: done (target=${DEPLOY_TARGET})"

scripts/ci/deploy-site.sh

@@ -1,13 +1,16 @@
 #!/usr/bin/env bash
-# deploy-site.sh <tag>  —  deploy the Eleventy marketing site to EC2
-# (/opt/jiu/marketing). Does NOT restart the backend or touch nginx.
+# deploy-site.sh <tag>  —  deploy the Eleventy marketing site to /opt/jiu/marketing.
+# Does NOT restart the backend or touch nginx. Target is EC2 by default; set
+# DEPLOY_HOST/DEPLOY_USER/DEPLOY_SSH_KEY to retarget the Ali box (migration).
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
 . "$(dirname "$0")/lib-forgejo.sh"
 
 TAG="$1"
-echo "==> deploy-site: tag=${TAG}"
+TARGET_HOST="${DEPLOY_HOST:-$EC2_HOST}"
+TARGET_USER="${DEPLOY_USER:-$EC2_USER}"
+echo "==> deploy-site: tag=${TAG} host=${TARGET_HOST}"
 
 if [ ! -f dist/marketing.tar.gz ]; then
   download_release_assets "$TAG"
@@ -21,11 +24,11 @@ mkdir -p /tmp/jiu-marketing-new
 tar -xzf dist/marketing.tar.gz -C /tmp/jiu-marketing-new
 
 setup_ssh
-echo "==> deploy-site: uploading marketing site to EC2"
+echo "==> deploy-site: uploading marketing site to ${TARGET_HOST}"
 rsync -avz --delete -e "ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no" \
-  /tmp/jiu-marketing-new/ "${EC2_USER}@${EC2_HOST}:/tmp/jiu-marketing-new/"
+  /tmp/jiu-marketing-new/ "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-marketing-new/"
 
-${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
+${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
 set -e
 mkdir -p /opt/jiu/marketing
 rsync -a --delete /tmp/jiu-marketing-new/ /opt/jiu/marketing/

scripts/ci/lib-forgejo.sh

@@ -106,12 +106,21 @@ for a in rel.get('assets', []):
 PYEOF
 }
 
-# setup_ssh — write the EC2 deploy key and export SSH / SCP commands.
+# setup_ssh — write the deploy key and export SSH / SCP commands.
+# Target is the EC2 host by default; set DEPLOY_HOST / DEPLOY_USER / DEPLOY_SSH_KEY
+# to retarget another host (e.g. the Alibaba Cloud box during the EC2→Ali migration).
+# Backward-compatible: with no DEPLOY_* set, behaves exactly as before (EC2).
 setup_ssh() {
+  local host="${DEPLOY_HOST:-$EC2_HOST}"
+  local key="${DEPLOY_SSH_KEY:-$EC2_SSH_KEY}"
   mkdir -p ~/.ssh
-  printf '%s' "${EC2_SSH_KEY}" > ~/.ssh/ec2_deploy.pem
+  # `printf '%s\n'` 末尾补一个换行：Forgejo 存 secret 会去掉结尾换行，而
+  # OpenSSH 格式私钥（-----BEGIN OPENSSH PRIVATE KEY-----，如阿里 ed25519 部署 key）
+  # 缺结尾换行会被判为 "invalid format" 而拒绝加载，退化成无密钥 → Permission denied。
+  # 多补的换行对已含结尾换行的 PEM（如 EC2 key）无害。
+  printf '%s\n' "${key}" > ~/.ssh/ec2_deploy.pem
   chmod 600 ~/.ssh/ec2_deploy.pem
-  ssh-keyscan -H "${EC2_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
+  ssh-keyscan -H "${host}" >> ~/.ssh/known_hosts 2>/dev/null
   SSH="ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no"
   SCP="scp -O -i ~/.ssh/ec2_deploy.pem"
 }