diff --git a/.serena/.gitignore b/.serena/.gitignore
new file mode 100644
index 0000000..14d86ad
--- /dev/null
+++ b/.serena/.gitignore
@@ -0,0 +1 @@
+/cache
diff --git a/.serena/memories/done_checklist.md b/.serena/memories/done_checklist.md
new file mode 100644
index 0000000..a22d98b
--- /dev/null
+++ b/.serena/memories/done_checklist.md
@@ -0,0 +1,7 @@
+# 任务完成检查单
+1. 本地跑通 `npm test`（或至少相关模块的 Jest 套件），并根据修改范围补充端到端 HTML 测试页或手动流程。
+2. 若涉及前端逻辑或样式，执行 `npm run build` 确认 PostCSS/webpack 成功，必要时运行 `npm run build:css` / `npm run build:js` 独立定位错误。
+3. 有网络/API 交互改动时，用 `npm start` 或 `npm run netlify-dev` 回归关键 eSIM 流程（Giffgaff OAuth+短信、Simyo 登录+设备更换），观察控制台和 Network。
+4. 涉及静态资源或脚本体积变化时，运行 `npm run optimize-images` / `npm run compress` 并检查 `dist/` 输出及 `sw.js` 预缓存列表。
+5. 进行 `npm run security-check` 确保 CSP/依赖未被破坏，确认 `.env` 示例与文档同步，必要时更新 `docs/` 指南。
+6. 提交前更新相关文档（README/docs）与配置（如 `netlify.toml`, `manifest.webmanifest`），并记录变更影响。
\ No newline at end of file
diff --git a/.serena/memories/project_overview.md b/.serena/memories/project_overview.md
new file mode 100644
index 0000000..3389380
--- /dev/null
+++ b/.serena/memories/project_overview.md
@@ -0,0 +1,6 @@
+# eSIM-Tools 项目概览
+- 目标：为 Giffgaff（英国）与 Simyo（荷兰）用户提供一站式 eSIM 申请、激活、二维码交付流程，涵盖 OAuth PKCE、MFA、短信激活与 GraphQL API 交互。
+- 前端：原生 JavaScript（ES6+ 模块）、Bootstrap 5、PostCSS/Autoprefixer、Service Worker + Workbox 提供 PWA 与离线能力，资源通过 Webpack/Terser/Compression 插件优化。
+- 后端：本地用 Node.js/Express（`server.js`）模拟 Netlify Functions、代理 Simyo API；正式环境托管在 Netlify（静态+Functions），并提供 Cloudflare Turnstile、CSP、CORS 收敛。
+- 目录：`src/` 含 giffgaff、simyo、js 模块（utilities、API service、middleware、performance）；`netlify/functions/` 为后端逻辑；`scripts/` 包含图像压缩、安全审计等 Node 工具；`docs/` 提供架构、指南、故障排查；`tests/` 含 Jest 配置与浏览器端测试页。
+- 关键功能：自动 Cookie 登录、短信验证码激活、二维码生成、Simyo 设备更换支持、性能监控仪表盘、资源提示工具等。
\ No newline at end of file
diff --git a/.serena/memories/style_and_conventions.md b/.serena/memories/style_and_conventions.md
new file mode 100644
index 0000000..f1db6b2
--- /dev/null
+++ b/.serena/memories/style_and_conventions.md
@@ -0,0 +1,8 @@
+# 代码风格与约定
+- JavaScript 采用 ES6+ 模块化与 Webpack alias（`@modules`, `@utils` 等），入口 `src/js/main.js` 注重单一职责；公用逻辑放在 `src/js/modules/` 与 `middleware/`，优先复用 debounce/throttle、API service、performance monitor 等工具以符合 DRY。
+- 所有网络调用必须经过封装的 API service（含重试、缓存、去重）或 Netlify Function 代理，禁止在 UI 组件内直接写裸 `fetch`；Simyo 代理需保留必要头部与日志。
+- UI 主要基于 Bootstrap 5 + 自定义 CSS（`src/styles/`），遵循响应式与 mobile-first 设计；懒加载图片以 `data-src` 搭配 `performance.js` 的 Intersection Observer。
+- 安全默认开启：严格 CSP、Cloudflare Turnstile token、输入验证（手机号/验证码/ Cookie）、中间件限流与 XSS 清理；新增逻辑需沿用 `src/js/middleware` 的校验与错误边界。
+- Service Worker + Workbox 负责缓存策略，新增资源需更新 `sw.js` 预缓存清单并维持 500KB bundle 预算；脚本中使用 `console` 需守护日志噪音（已有 performance dashboard，可复用）。
+- Node/Netlify Functions 暴露 `handler` 并保持纯函数式输入/输出；Express 本地服务器使用 `wrapNetlifyFunction` 包装，新增函数需注册路由且遵循 30s timeout、统一错误响应结构。
+- 注释倾向解释意图（为何这样设计），避免冗余；命名沿用 provider + action 语义（如 `giffgaffSmsActivate`, `simyoDeviceFlow`）。
\ No newline at end of file
diff --git a/.serena/memories/suggested_commands.md b/.serena/memories/suggested_commands.md
new file mode 100644
index 0000000..c4fe7cf
--- /dev/null
+++ b/.serena/memories/suggested_commands.md
@@ -0,0 +1,12 @@
+# 常用命令
+- `npm install`：安装依赖（Node >= 18, npm >= 8）。
+- `npm start` / `npm run dev`：启动本地 Express 服务器（含 Netlify Function 模拟与 Simyo 代理）。
+- `npm run build`：运行 `build:css` + `build:js`（PostCSS 输出到 `dist/css`，Webpack 生产构建、含压缩与 SW 更新）。
+- `npm run build:css` / `npm run build:js`：单独构建样式或脚本；`build:js` 需要 `NODE_OPTIONS=--max-old-space-size=1536`。
+- `npm test` / `npm run test:watch` / `npm run test:coverage`：Jest + jsdom 单元/集成测试。
+- `npm run netlify-dev`：使用最新 `netlify-cli` 在本地模拟 Functions + 重定向。
+- `npm run deploy`：先构建、再通过 `netlify-cli` 生产部署。
+- `npm run optimize-images` / `npm run compress`：Node 工具批量优化图片与生成 Brotli/Gzip 资产。
+- `npm run security-check`：执行脚本 `scripts/security-check.js` 做依赖和配置审计。
+- `npm run deploy-prepare` / `npm run deploy-analyze` / `npm run deploy-test`：部署前检查及配置验证。
+- 浏览器端手动测试：`open tests/test_giffgaff_esim.html`、`open tests/test_simyo_esim.html`。
\ No newline at end of file
diff --git a/.serena/project.yml b/.serena/project.yml
new file mode 100644
index 0000000..cb90d1f
--- /dev/null
+++ b/.serena/project.yml
@@ -0,0 +1,84 @@
+# list of languages for which language servers are started; choose from:
+#   al               bash             clojure          cpp              csharp           csharp_omnisharp
+#   dart             elixir           elm              erlang           fortran          go
+#   haskell          java             julia            kotlin           lua              markdown
+#   nix              perl             php              python           python_jedi      r
+#   rego             ruby             ruby_solargraph  rust             scala            swift
+#   terraform        typescript       typescript_vts   yaml             zig
+# Note:
+#   - For C, use cpp
+#   - For JavaScript, use typescript
+# Special requirements:
+#   - csharp: Requires the presence of a .sln file in the project folder.
+# When using multiple languages, the first language server that supports a given file will be used for that file.
+# The first language is the default language and the respective language server will be used as a fallback.
+# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
+languages:
+- typescript
+
+# the encoding used by text files in the project
+# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
+encoding: "utf-8"
+
+# whether to use the project's gitignore file to ignore files
+# Added on 2025-04-07
+ignore_all_files_in_gitignore: true
+
+# list of additional paths to ignore
+# same syntax as gitignore, so you can use * and **
+# Was previously called `ignored_dirs`, please update your config if you are using that.
+# Added (renamed) on 2025-04-07
+ignored_paths: []
+
+# whether the project is in read-only mode
+# If set to true, all editing tools will be disabled and attempts to use them will result in an error
+# Added on 2025-04-18
+read_only: false
+
+# list of tool names to exclude. We recommend not excluding any tools, see the readme for more details.
+# Below is the complete list of tools for convenience.
+# To make sure you have the latest list of tools, and to view their descriptions, 
+# execute `uv run scripts/print_tool_overview.py`.
+#
+#  * `activate_project`: Activates a project by name.
+#  * `check_onboarding_performed`: Checks whether project onboarding was already performed.
+#  * `create_text_file`: Creates/overwrites a file in the project directory.
+#  * `delete_lines`: Deletes a range of lines within a file.
+#  * `delete_memory`: Deletes a memory from Serena's project-specific memory store.
+#  * `execute_shell_command`: Executes a shell command.
+#  * `find_referencing_code_snippets`: Finds code snippets in which the symbol at the given location is referenced.
+#  * `find_referencing_symbols`: Finds symbols that reference the symbol at the given location (optionally filtered by type).
+#  * `find_symbol`: Performs a global (or local) search for symbols with/containing a given name/substring (optionally filtered by type).
+#  * `get_current_config`: Prints the current configuration of the agent, including the active and available projects, tools, contexts, and modes.
+#  * `get_symbols_overview`: Gets an overview of the top-level symbols defined in a given file.
+#  * `initial_instructions`: Gets the initial instructions for the current project.
+#     Should only be used in settings where the system prompt cannot be set,
+#     e.g. in clients you have no control over, like Claude Desktop.
+#  * `insert_after_symbol`: Inserts content after the end of the definition of a given symbol.
+#  * `insert_at_line`: Inserts content at a given line in a file.
+#  * `insert_before_symbol`: Inserts content before the beginning of the definition of a given symbol.
+#  * `list_dir`: Lists files and directories in the given directory (optionally with recursion).
+#  * `list_memories`: Lists memories in Serena's project-specific memory store.
+#  * `onboarding`: Performs onboarding (identifying the project structure and essential tasks, e.g. for testing or building).
+#  * `prepare_for_new_conversation`: Provides instructions for preparing for a new conversation (in order to continue with the necessary context).
+#  * `read_file`: Reads a file within the project directory.
+#  * `read_memory`: Reads the memory with the given name from Serena's project-specific memory store.
+#  * `remove_project`: Removes a project from the Serena configuration.
+#  * `replace_lines`: Replaces a range of lines within a file with new content.
+#  * `replace_symbol_body`: Replaces the full definition of a symbol.
+#  * `restart_language_server`: Restarts the language server, may be necessary when edits not through Serena happen.
+#  * `search_for_pattern`: Performs a search for a pattern in the project.
+#  * `summarize_changes`: Provides instructions for summarizing the changes made to the codebase.
+#  * `switch_modes`: Activates modes by providing a list of their names
+#  * `think_about_collected_information`: Thinking tool for pondering the completeness of collected information.
+#  * `think_about_task_adherence`: Thinking tool for determining whether the agent is still on track with the current task.
+#  * `think_about_whether_you_are_done`: Thinking tool for determining whether the task is truly completed.
+#  * `write_memory`: Writes a named memory (for future reference) to Serena's project-specific memory store.
+excluded_tools: []
+
+# initial prompt for the project. It will always be given to the LLM upon activating the project
+# (contrary to the memories, which are loaded on demand).
+initial_prompt: ""
+
+project_name: "eSIM-Tools"
+included_optional_tools: []
diff --git a/env.example b/env.example
index 2032d52..3ec352a 100644
--- a/env.example
+++ b/env.example
@@ -20,7 +20,7 @@ ALLOWED_ORIGIN=https://esim.cosr.eu.org
 # 安全配置
 COOKIE_SECRET=your-secret-key-here
 # 受保护函数访问密钥（要求调用方在 Header x-esim-key 或 body.authKey / ?authKey 携带匹配值）
-ACCESS_KEY=please_change_me
+ACCESS_KEY=please_change_me # 必填：Server 与 Functions/BFF 共享的访问密钥
 
 # 可选：自定义API超时时间（毫秒）
-API_TIMEOUT=30000
\ No newline at end of file
+API_TIMEOUT=30000
diff --git a/index.html b/index.html
index 41bcce7..ee52163 100644
--- a/index.html
+++ b/index.html
@@ -32,8 +32,6 @@
     <link rel="preload" href="/src/styles/animations.css" as="style" onload="this.rel='stylesheet'">
     <link rel="stylesheet" href="/src/styles/fa-local.css">
     
-    <!-- 提供 SW 路径与版本给 performance.js 使用（避免旧 SW 404） -->
-    <meta name="sw-path" content="/sw.js">
     <meta name="build-rev" content="v1">
 
     <style>
diff --git a/netlify.toml b/netlify.toml
index b978eac..525090b 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -1,8 +1,8 @@
 [build]
   # 构建命令
   command = "npm run build --silent"
-  # 发布目录：使用项目根目录，直接提供现有 HTML（避免 dist 无 index.html 导致 404）
-  publish = "."
+  # 发布目录：仅暴露构建后的 dist 输出
+  publish = "dist"
   # Functions目录
   functions = "netlify/functions"
   # Edge Functions 目录
@@ -132,4 +132,4 @@
 [[headers]]
   for = "/manifest.webmanifest"
   [headers.values]
-    Content-Type = "application/manifest+json; charset=utf-8"
\ No newline at end of file
+    Content-Type = "application/manifest+json; charset=utf-8"
diff --git a/netlify/edge-functions/bff-proxy.js b/netlify/edge-functions/bff-proxy.js
index 3757338..2540b07 100644
--- a/netlify/edge-functions/bff-proxy.js
+++ b/netlify/edge-functions/bff-proxy.js
@@ -24,6 +24,12 @@ export default async (request, context) => {
   // 从 Edge 运行时环境读取密钥
   // Netlify Edge 使用 Deno 运行时
   const accessKey = (typeof Deno !== 'undefined' && Deno.env && (Deno.env.get('ACCESS_KEY') || Deno.env.get('ESIM_ACCESS_KEY'))) || '';
+  if (!accessKey) {
+    return new Response(JSON.stringify({ error: 'Server Misconfigured', message: 'ACCESS_KEY not configured' }), {
+      status: 500,
+      headers: { 'Content-Type': 'application/json' }
+    });
+  }
 
   // Turnstile 校验（可选，若配置了 TURNSTILE_SECRET_KEY 则启用）
   const turnstileSecret = (typeof Deno !== 'undefined' && Deno.env && Deno.env.get('TURNSTILE_SECRET_KEY')) || '';
@@ -114,4 +120,3 @@ export default async (request, context) => {
   return response;
 };
 
-
diff --git a/netlify/functions/auto-activate-esim.js b/netlify/functions/auto-activate-esim.js
index be246e2..d0f2b64 100644
--- a/netlify/functions/auto-activate-esim.js
+++ b/netlify/functions/auto-activate-esim.js
@@ -9,7 +9,7 @@ exports.handler = async (event, context) => {
     const ALLOWED_ORIGIN = process.env.ALLOWED_ORIGIN || 'https://esim.cosr.eu.org';
     const lower = Object.fromEntries(Object.entries(event.headers || {}).map(([k, v]) => [String(k).toLowerCase(), v]));
     const requestOrigin = lower['origin'];
-    const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY || '';
+    const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY;
     const getProvidedKey = () => {
         const fromHeader = lower['x-esim-key'] || lower['x-app-key'] || '';
         if (fromHeader) return fromHeader;
@@ -54,12 +54,12 @@ exports.handler = async (event, context) => {
         return { statusCode: 403, headers, body: JSON.stringify({ error: 'Forbidden', message: 'Origin not allowed' }) };
     }
 
-    // 鉴权参数校验（要求在 Header x-esim-key，或 body.authKey / ?authKey）
-    if (ACCESS_KEY) {
-        const provided = getProvidedKey();
-        if (!provided || provided !== ACCESS_KEY) {
-            return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
-        }
+    if (!ACCESS_KEY) {
+        return { statusCode: 500, headers, body: JSON.stringify({ error: 'Server Misconfigured', message: 'ACCESS_KEY not configured' }) };
+    }
+    const provided = getProvidedKey();
+    if (!provided || provided !== ACCESS_KEY) {
+        return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
     }
 
     try {
@@ -265,4 +265,4 @@ async function callGiffgaffActivationAPI(activationCode, cookieString, bearerTok
             };
         }
     }
-} 
\ No newline at end of file
+} 
diff --git a/netlify/functions/giffgaff-graphql.js b/netlify/functions/giffgaff-graphql.js
index ee61ccb..76161a3 100644
--- a/netlify/functions/giffgaff-graphql.js
+++ b/netlify/functions/giffgaff-graphql.js
@@ -11,7 +11,7 @@ exports.handler = async (event, context) => {
     const lower = Object.fromEntries(Object.entries(event.headers || {}).map(([k, v]) => [String(k).toLowerCase(), v]));
     const requestOrigin = lower['origin'];
 
-    const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY || '';
+    const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY;
     const getProvidedKey = () => {
         const fromHeader = lower['x-esim-key'] || lower['x-app-key'] || '';
         if (fromHeader) return fromHeader;
@@ -46,12 +46,12 @@ exports.handler = async (event, context) => {
         return { statusCode: 403, headers, body: JSON.stringify({ error: 'Forbidden', message: 'Origin not allowed' }) };
     }
 
-    // 鉴权参数校验（若配置了 ACCESS_KEY 则要求提供）
-    if (ACCESS_KEY) {
-        const provided = getProvidedKey();
-        if (!provided || provided !== ACCESS_KEY) {
-            return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
-        }
+    if (!ACCESS_KEY) {
+        return { statusCode: 500, headers, body: JSON.stringify({ error: 'Server Misconfigured', message: 'ACCESS_KEY not configured' }) };
+    }
+    const provided = getProvidedKey();
+    if (!provided || provided !== ACCESS_KEY) {
+        return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
     }
 
     // 只允许POST请求
@@ -274,4 +274,4 @@ exports.handler = async (event, context) => {
             })
         };
     }
-};
\ No newline at end of file
+};
diff --git a/netlify/functions/giffgaff-mfa-challenge.js b/netlify/functions/giffgaff-mfa-challenge.js
index a3df8fc..6e4df51 100644
--- a/netlify/functions/giffgaff-mfa-challenge.js
+++ b/netlify/functions/giffgaff-mfa-challenge.js
@@ -13,7 +13,7 @@ exports.handler = async (event, context) => {
     );
     const requestOrigin = lowerCaseHeaders['origin'];
 
-    const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY || '';
+    const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY;
     const getProvidedKey = () => {
         const fromHeader = lowerCaseHeaders['x-esim-key'] || lowerCaseHeaders['x-app-key'] || '';
         if (fromHeader) return fromHeader;
@@ -47,11 +47,12 @@ exports.handler = async (event, context) => {
         return { statusCode: 403, headers, body: JSON.stringify({ error: 'Forbidden', message: 'Origin not allowed' }) };
     }
 
-    if (ACCESS_KEY) {
-        const provided = getProvidedKey();
-        if (!provided || provided !== ACCESS_KEY) {
-            return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
-        }
+    if (!ACCESS_KEY) {
+        return { statusCode: 500, headers, body: JSON.stringify({ error: 'Server Misconfigured', message: 'ACCESS_KEY not configured' }) };
+    }
+    const provided = getProvidedKey();
+    if (!provided || provided !== ACCESS_KEY) {
+        return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
     }
 
     // 只允许POST请求
@@ -340,4 +341,4 @@ function mergeSetCookies(originalCookieHeader, setCookieArray) {
         }
     }
     return Array.from(jar.entries()).map(([k, v]) => `${k}=${v}`).join('; ');
-}
\ No newline at end of file
+}
diff --git a/netlify/functions/giffgaff-mfa-validation.js b/netlify/functions/giffgaff-mfa-validation.js
index 06eac48..d7cfb6f 100644
--- a/netlify/functions/giffgaff-mfa-validation.js
+++ b/netlify/functions/giffgaff-mfa-validation.js
@@ -11,7 +11,7 @@ exports.handler = async (event, context) => {
         Object.entries(event.headers || {}).map(([k, v]) => [String(k).toLowerCase(), v])
     );
     const requestOrigin = lowerCaseHeaders['origin'];
-    const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY || '';
+    const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY;
     const getProvidedKey = () => {
         const fromHeader = lowerCaseHeaders['x-esim-key'] || lowerCaseHeaders['x-app-key'] || '';
         if (fromHeader) return fromHeader;
@@ -45,11 +45,12 @@ exports.handler = async (event, context) => {
         return { statusCode: 403, headers, body: JSON.stringify({ error: 'Forbidden', message: 'Origin not allowed' }) };
     }
 
-    if (ACCESS_KEY) {
-        const provided = getProvidedKey();
-        if (!provided || provided !== ACCESS_KEY) {
-            return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
-        }
+    if (!ACCESS_KEY) {
+        return { statusCode: 500, headers, body: JSON.stringify({ error: 'Server Misconfigured', message: 'ACCESS_KEY not configured' }) };
+    }
+    const provided = getProvidedKey();
+    if (!provided || provided !== ACCESS_KEY) {
+        return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
     }
 
     // 只允许POST请求
@@ -217,4 +218,4 @@ exports.handler = async (event, context) => {
             })
         };
     }
-};
\ No newline at end of file
+};
diff --git a/netlify/functions/giffgaff-sms-activate.js b/netlify/functions/giffgaff-sms-activate.js
index f44b83f..ba633fe 100644
--- a/netlify/functions/giffgaff-sms-activate.js
+++ b/netlify/functions/giffgaff-sms-activate.js
@@ -9,7 +9,7 @@ exports.handler = async (event, context) => {
   const ALLOWED_ORIGIN = process.env.ALLOWED_ORIGIN || 'https://esim.cosr.eu.org';
   const lower = Object.fromEntries(Object.entries(event.headers || {}).map(([k, v]) => [String(k).toLowerCase(), v]));
   const requestOrigin = lower['origin'];
-  const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY || '';
+  const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY;
   const getProvidedKey = () => {
     const fromHeader = lower['x-esim-key'] || lower['x-app-key'] || '';
     if (fromHeader) return fromHeader;
@@ -44,11 +44,12 @@ exports.handler = async (event, context) => {
   }
 
   // 鉴权参数校验
-  if (ACCESS_KEY) {
-    const provided = getProvidedKey();
-    if (!provided || provided !== ACCESS_KEY) {
-      return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
-    }
+  if (!ACCESS_KEY) {
+    return { statusCode: 500, headers, body: JSON.stringify({ error: 'Server Misconfigured', message: 'ACCESS_KEY not configured' }) };
+  }
+  const provided = getProvidedKey();
+  if (!provided || provided !== ACCESS_KEY) {
+    return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
   }
 
   try {
@@ -286,4 +287,3 @@ exports.handler = async (event, context) => {
   }
 };
 
-
diff --git a/netlify/functions/giffgaff-token-exchange.js b/netlify/functions/giffgaff-token-exchange.js
index aa50bb4..3894422 100644
--- a/netlify/functions/giffgaff-token-exchange.js
+++ b/netlify/functions/giffgaff-token-exchange.js
@@ -10,7 +10,7 @@ exports.handler = async (event) => {
   const ALLOWED_ORIGIN = process.env.ALLOWED_ORIGIN || 'https://esim.cosr.eu.org';
   const lower = Object.fromEntries(Object.entries(event.headers || {}).map(([k, v]) => [String(k).toLowerCase(), v]));
   const requestOrigin = lower['origin'];
-  const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY || '';
+  const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY;
   const getProvidedKey = () => {
     const fromHeader = lower['x-esim-key'] || lower['x-app-key'] || '';
     if (fromHeader) return fromHeader;
@@ -50,11 +50,12 @@ exports.handler = async (event) => {
     return { statusCode: 403, headers, body: JSON.stringify({ error: 'Forbidden', message: 'Origin not allowed' }) };
   }
 
-  if (ACCESS_KEY) {
-    const provided = getProvidedKey();
-    if (!provided || provided !== ACCESS_KEY) {
-      return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
-    }
+  if (!ACCESS_KEY) {
+    return { statusCode: 500, headers, body: JSON.stringify({ error: 'Server Misconfigured', message: 'ACCESS_KEY not configured' }) };
+  }
+  const provided = getProvidedKey();
+  if (!provided || provided !== ACCESS_KEY) {
+    return { statusCode: 401, headers, body: JSON.stringify({ error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
   }
 
   try {
@@ -177,4 +178,4 @@ const response = await axios.post(tokenUrl, formWithCredentials, {
       body: JSON.stringify({ error: 'Token Exchange Failed', details: data })
     };
   }
-};
\ No newline at end of file
+};
diff --git a/netlify/functions/verify-cookie.js b/netlify/functions/verify-cookie.js
index 4715f84..95bd3ba 100644
--- a/netlify/functions/verify-cookie.js
+++ b/netlify/functions/verify-cookie.js
@@ -24,7 +24,7 @@ exports.handler = async (event, context) => {
     const ALLOWED_ORIGIN = process.env.ALLOWED_ORIGIN || 'https://esim.cosr.eu.org';
     const lower = Object.fromEntries(Object.entries(event.headers || {}).map(([k, v]) => [String(k).toLowerCase(), v]));
     const requestOrigin = lower['origin'];
-    const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY || '';
+    const ACCESS_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY;
     const getProvidedKey = () => {
         const fromHeader = lower['x-esim-key'] || lower['x-app-key'] || '';
         if (fromHeader) return fromHeader;
@@ -59,11 +59,12 @@ exports.handler = async (event, context) => {
         return { statusCode: 403, headers, body: JSON.stringify({ error: 'Forbidden', message: 'Origin not allowed' }) };
     }
 
-    if (ACCESS_KEY) {
-        const provided = getProvidedKey();
-        if (!provided || provided !== ACCESS_KEY) {
-            return { statusCode: 401, headers, body: JSON.stringify({ success: false, error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
-        }
+    if (!ACCESS_KEY) {
+        return { statusCode: 500, headers, body: JSON.stringify({ success: false, error: 'Server Misconfigured', message: 'ACCESS_KEY not configured' }) };
+    }
+    const provided = getProvidedKey();
+    if (!provided || provided !== ACCESS_KEY) {
+        return { statusCode: 401, headers, body: JSON.stringify({ success: false, error: 'Unauthorized', message: 'Missing or invalid auth key' }) };
     }
 
     // 只允许POST请求
@@ -378,4 +379,4 @@ function mergeSetCookies(originalCookieHeader, setCookieArray) {
     }
     return Array.from(jar.entries()).map(([k, v]) => `${k}=${v}`).join('; ');
 }
-}
\ No newline at end of file
+}
diff --git a/package.json b/package.json
index cecd8b6..e01dd0d 100644
--- a/package.json
+++ b/package.json
@@ -4,12 +4,13 @@
   "description": "专为Giffgaff和Simyo用户设计的eSIM管理工具集",
   "main": "index.js",
   "scripts": {
+    "prestart": "npm run build",
+    "predev": "npm run build",
+    "prenetlify-dev": "npm run build",
     "start": "node server.js",
     "dev": "nodemon server.js",
-    "build": "npm run build:css && npm run build:js",
-    "build:css": "postcss src/styles/*.css -d dist/css",
-    "build:js": "NODE_OPTIONS=--max-old-space-size=1536 webpack --mode production",
-    "build:dev": "npm run build:css && npm run build:js",
+    "build": "npm run build:static",
+    "build:static": "node scripts/build-static.js",
     "test": "jest",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage",
@@ -19,7 +20,7 @@
     "compress": "node scripts/compress.js",
     "security-check": "node scripts/security-check.js",
     "deploy-prepare": "node scripts/deploy-prepare.js",
-    "deploy-analyze": "node scripts/deploy-prepare.js",
+    "deploy-analyze": "node scripts/deploy-analyze.js",
     "deploy-test": "node scripts/test-deploy-config.js"
   },
   "keywords": [
diff --git a/scripts/build-static.js b/scripts/build-static.js
new file mode 100755
index 0000000..c71bade
--- /dev/null
+++ b/scripts/build-static.js
@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+
+const projectRoot = path.join(__dirname, '..');
+const distDir = path.join(projectRoot, 'dist');
+const entries = [
+  'index.html',
+  'manifest.webmanifest',
+  'src'
+];
+
+async function removeDist() {
+  await fs.promises.rm(distDir, { recursive: true, force: true });
+}
+
+async function copyEntry(entry) {
+  const from = path.join(projectRoot, entry);
+  const to = path.join(distDir, entry);
+  if (!fs.existsSync(from)) {
+    console.warn(`⚠️  跳过不存在的入口: ${entry}`);
+    return;
+  }
+  try {
+    const stats = await fs.promises.stat(from);
+    if (stats.isDirectory()) {
+      await copyDirectory(from, to);
+    } else {
+      await fs.promises.mkdir(path.dirname(to), { recursive: true });
+      await fs.promises.copyFile(from, to);
+    }
+  } catch (err) {
+    console.error(`❌ 复制失败 ${entry}:`, err.message);
+    throw err;
+  }
+}
+
+async function copyDirectory(source, destination) {
+  try {
+    await fs.promises.mkdir(destination, { recursive: true });
+    const entries = await fs.promises.readdir(source, { withFileTypes: true });
+
+    for (const entry of entries) {
+      const srcPath = path.join(source, entry.name);
+      const destPath = path.join(destination, entry.name);
+
+      try {
+        if (entry.isDirectory()) {
+          await copyDirectory(srcPath, destPath);
+        } else if (entry.isFile()) {
+          await fs.promises.copyFile(srcPath, destPath);
+        }
+      } catch (fileErr) {
+        console.warn(`⚠️  跳过文件 ${entry.name}:`, fileErr.message);
+        // 继续处理其他文件
+      }
+    }
+  } catch (err) {
+    throw new Error(`复制目录失败 ${source}: ${err.message}`);
+  }
+}
+
+(async () => {
+  console.log('🧹 清理 dist 目录...');
+  await removeDist();
+  await fs.promises.mkdir(distDir, { recursive: true });
+
+  for (const entry of entries) {
+    console.log(`📦 复制 ${entry} -> dist/${entry}`);
+    await copyEntry(entry);
+  }
+
+  console.log('✅ 静态资源构建完成，输出目录 dist/');
+})().catch(err => {
+  console.error('构建静态资源失败:', err);
+  process.exitCode = 1;
+});
diff --git a/scripts/deploy-analyze.js b/scripts/deploy-analyze.js
new file mode 100755
index 0000000..1b8d33a
--- /dev/null
+++ b/scripts/deploy-analyze.js
@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+
+const distDir = path.join(__dirname, '..', 'dist');
+
+function listFiles(dir, base = dir) {
+  const output = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      output.push(...listFiles(full, base));
+    } else {
+      const rel = path.relative(base, full);
+      const size = fs.statSync(full).size;
+      output.push({ rel, size });
+    }
+  }
+  return output;
+}
+
+(function main() {
+  if (!fs.existsSync(distDir)) {
+    console.error('dist 不存在，请先运行 npm run build');
+    process.exit(1);
+  }
+  const files = listFiles(distDir);
+  console.log('📦 dist 构建分析：');
+  files.sort((a, b) => b.size - a.size);
+  files.slice(0, 10).forEach(file => {
+    console.log(`${file.rel.padEnd(50)} ${(file.size / 1024).toFixed(1)} KB`);
+  });
+  console.log(`合计文件 ${files.length} 个，总大小 ${(files.reduce((sum, f) => sum + f.size, 0) / 1024).toFixed(1)} KB`);
+})();
diff --git a/scripts/deploy-prepare.js b/scripts/deploy-prepare.js
new file mode 100755
index 0000000..821e300
--- /dev/null
+++ b/scripts/deploy-prepare.js
@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+
+const projectRoot = path.join(__dirname, '..');
+const distDir = path.join(projectRoot, 'dist');
+
+function ensureAccessKey() {
+  const key = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY;
+  if (!key) {
+    throw new Error('ACCESS_KEY/ESIM_ACCESS_KEY 未配置，无法保护 Functions。');
+  }
+}
+
+function ensureDist() {
+  const indexPath = path.join(distDir, 'index.html');
+  if (!fs.existsSync(indexPath)) {
+    throw new Error('dist 目录缺少 index.html，请先运行 npm run build。');
+  }
+}
+
+(function main() {
+  console.log('🔧 检查部署前置条件...');
+  ensureAccessKey();
+  ensureDist();
+  console.log('✅ 部署前检查通过，可继续执行部署流程');
+})();
diff --git a/scripts/test-deploy-config.js b/scripts/test-deploy-config.js
new file mode 100755
index 0000000..9fca0f5
--- /dev/null
+++ b/scripts/test-deploy-config.js
@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+
+const netlifyToml = path.join(__dirname, '..', 'netlify.toml');
+
+(function main() {
+  if (!fs.existsSync(netlifyToml)) {
+    console.error('netlify.toml 不存在');
+    process.exit(1);
+  }
+  const content = fs.readFileSync(netlifyToml, 'utf8');
+  if (!/publish\s*=\s*"dist"/.test(content)) {
+    console.error('netlify.toml 未将 publish 指向 dist');
+    process.exit(1);
+  }
+  console.log('✅ Netlify 配置检查通过 (publish=dist)');
+})();
diff --git a/server.js b/server.js
index fb2410d..45bc59f 100644
--- a/server.js
+++ b/server.js
@@ -6,12 +6,27 @@
 const express = require('express');
 const cors = require('cors');
 const path = require('path');
+const fs = require('fs');
 const helmet = require('helmet');
 const morgan = require('morgan');
 require('dotenv').config();
 
 const app = express();
 const PORT = process.env.PORT || 3000;
+const STATIC_ROOT = path.join(__dirname, process.env.STATIC_ROOT || 'dist');
+const INTERNAL_FUNCTION_KEY = process.env.ACCESS_KEY || process.env.ESIM_ACCESS_KEY || '';
+
+// 启动时环境检查
+if (!INTERNAL_FUNCTION_KEY) {
+    console.error('❌ ACCESS_KEY 或 ESIM_ACCESS_KEY 未配置');
+    console.error('💡 请在 .env 文件或环境变量中设置 ACCESS_KEY');
+    console.error('⚠️  Netlify Functions 将无法正常工作，请修复后重启');
+}
+
+if (!fs.existsSync(STATIC_ROOT)) {
+    console.warn(`⚠️  静态目录 ${STATIC_ROOT} 不存在，请先运行 npm run build`);
+    console.warn('💡 运行: npm run build');
+}
 
 // 中间件配置
 app.use(helmet({
@@ -41,8 +56,16 @@ app.use(morgan('combined'));
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 
-// 静态文件服务
-app.use(express.static('.'));
+const staticMiddleware = express.static(STATIC_ROOT, { fallthrough: true, index: false });
+app.use((req, res, next) => {
+    if (!['GET', 'HEAD'].includes(req.method)) {
+        return next();
+    }
+    if (/\.html?$/i.test(req.path)) {
+        return next();
+    }
+    return staticMiddleware(req, res, next);
+});
 
 // API路由 - 模拟Netlify Functions
 const giffgaffMfaChallenge = require('./netlify/functions/giffgaff-mfa-challenge');
@@ -56,9 +79,14 @@ const giffgaffSmsActivate = require('./netlify/functions/giffgaff-sms-activate')
 function wrapNetlifyFunction(handler) {
     return async (req, res) => {
         try {
+            const headers = Object.assign({}, req.headers);
+            // 仅在客户端未提供密钥时注入内部密钥（避免覆盖）
+            if (INTERNAL_FUNCTION_KEY && !headers['x-esim-key'] && !headers['x-app-key']) {
+                headers['x-esim-key'] = INTERNAL_FUNCTION_KEY;
+            }
             const event = {
                 httpMethod: req.method,
-                headers: req.headers,
+                headers,
                 body: JSON.stringify(req.body),
                 queryStringParameters: req.query
             };
@@ -145,30 +173,25 @@ app.use('/api/simyo/*', (req, res) => {
 });
 
 // 路由配置
-app.get('/giffgaff', (req, res) => {
-    res.sendFile(path.join(__dirname, 'src/giffgaff/giffgaff_modular.html'));
-});
+const htmlRoutes = [
+    { url: '/giffgaff', file: 'src/giffgaff/giffgaff_modular.html' },
+    { url: '/giffgaff-legacy', file: 'src/giffgaff/giffgaff_complete_esim.html' },
+    { url: '/simyo', file: 'src/simyo/simyo_modular.html' },
+    { url: '/simyo-legacy', file: 'src/simyo/simyo_complete_esim.html' },
+    { url: '/simyo-static', file: 'src/simyo/simyo_static.html' },
+    // 兼容静态路径访问（与 Netlify 重写保持一致）
+    { url: '/src/giffgaff/giffgaff_modular.html', file: 'src/giffgaff/giffgaff_modular.html' },
+    { url: '/src/giffgaff/giffgaff_complete_esim.html', file: 'src/giffgaff/giffgaff_complete_esim.html' },
+    { url: '/src/simyo/simyo_modular.html', file: 'src/simyo/simyo_modular.html' },
+    { url: '/src/simyo/simyo_complete_esim.html', file: 'src/simyo/simyo_complete_esim.html' },
+    { url: '/src/simyo/simyo_static.html', file: 'src/simyo/simyo_static.html' },
+    { url: '/', file: 'index.html' }
+];
 
-// 原始版本备份路由
-app.get('/giffgaff-legacy', (req, res) => {
-    res.sendFile(path.join(__dirname, 'src/giffgaff/giffgaff_complete_esim.html'));
-});
-
-app.get('/simyo', (req, res) => {
-    res.sendFile(path.join(__dirname, 'src/simyo/simyo_modular.html'));
-});
-
-// 原始版本备份路由
-app.get('/simyo-legacy', (req, res) => {
-    res.sendFile(path.join(__dirname, 'src/simyo/simyo_complete_esim.html'));
-});
-
-app.get('/simyo-static', (req, res) => {
-    res.sendFile(path.join(__dirname, 'src/simyo/simyo_static.html'));
-});
-
-app.get('/', (req, res) => {
-    res.sendFile(path.join(__dirname, 'index.html'));
+htmlRoutes.forEach(({ url, file }) => {
+    app.get(url, (req, res) => {
+        res.sendFile(path.join(STATIC_ROOT, file));
+    });
 });
 
 // 错误处理
@@ -182,6 +205,13 @@ app.use((err, req, res, next) => {
 
 // 404处理
 app.use((req, res) => {
+    // 优先返回 HTML 404 页面（如果存在）
+    const html404Path = path.join(STATIC_ROOT, '404.html');
+    if (fs.existsSync(html404Path) && req.accepts('html')) {
+        return res.status(404).sendFile(html404Path);
+    }
+
+    // API 请求或无 404 页面时返回 JSON
     res.status(404).json({
         error: 'Not Found',
         message: '请求的资源不存在'
@@ -197,4 +227,4 @@ app.listen(PORT, () => {
     console.log(`🌐 环境: ${process.env.NODE_ENV || 'development'}`);
 });
 
-module.exports = app;
\ No newline at end of file
+module.exports = app;
diff --git a/src/giffgaff/giffgaff_complete_esim.html b/src/giffgaff/giffgaff_complete_esim.html
index 0b8868c..6c3b7e1 100644
--- a/src/giffgaff/giffgaff_complete_esim.html
+++ b/src/giffgaff/giffgaff_complete_esim.html
@@ -24,17 +24,6 @@
     <noscript><link rel="stylesheet" href="/src/styles/design-system.css"></noscript>
     <noscript><link rel="stylesheet" href="/src/styles/animations.css"></noscript>
     
-    <!-- Service Worker 注册 -->
-    <script>
-        if ('serviceWorker' in navigator) {
-            window.addEventListener('load', () => {
-                navigator.serviceWorker.register('/sw.js')
-                    .then(registration => console.log('SW registered'))
-                    .catch(error => console.log('SW registration failed'));
-            });
-        }
-    </script>
-    
     <style>
         :root {
             --primary: #ffcc00;
@@ -4212,4 +4201,4 @@
     
     <script type="module" src="/src/js/bootstrap-footer.js"></script>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/src/giffgaff/giffgaff_modular.html b/src/giffgaff/giffgaff_modular.html
index 9267669..ce2abd7 100644
--- a/src/giffgaff/giffgaff_modular.html
+++ b/src/giffgaff/giffgaff_modular.html
@@ -41,16 +41,6 @@
     <link rel="stylesheet" href="/src/giffgaff/styles/giffgaff-animations.css">
     <link rel="stylesheet" href="/src/giffgaff/styles/giffgaff-responsive.css">
     
-    <!-- Service Worker 注册 -->
-    <script>
-        if ('serviceWorker' in navigator) {
-            window.addEventListener('load', () => {
-                navigator.serviceWorker.register('/sw.js')
-                    .then(registration => console.log('SW registered'))
-                    .catch(error => console.log('SW registration failed'));
-            });
-        }
-    </script>
 </head>
 <body aria-label="Giffgaff eSIM 工具">
     <div class="container main-container">
diff --git a/src/js/performance.js b/src/js/performance.js
index 72399d3..fbdb77b 100644
--- a/src/js/performance.js
+++ b/src/js/performance.js
@@ -7,8 +7,6 @@ class PerformanceOptimizer {
   }
 
   init() {
-    // Delay SW registration to avoid blocking main thread
-    setTimeout(() => this.registerServiceWorker(), 2000);
     this.setupNetworkListeners();
     this.optimizeImages();
     this.setupScrollOptimization();
@@ -25,51 +23,7 @@ class PerformanceOptimizer {
     this.observers.clear();
   }
 
-  // 注册Service Worker
-  async registerServiceWorker() {
-    if ('serviceWorker' in navigator) {
-      try {
-        // 允许通过 meta 配置路径（发布在根目录或 dist）
-        const swMeta = document.querySelector('meta[name="sw-path"]');
-        const swPath = swMeta?.getAttribute('content') || '/sw.js';
-               const registration = await navigator.serviceWorker.register(swPath);
-               // 注册成功
-        
-        // 检查更新
-        registration.addEventListener('updatefound', () => {
-          const newWorker = registration.installing;
-          newWorker.addEventListener('statechange', () => {
-            if (newWorker.state === 'installed' && navigator.serviceWorker.controller) {
-              this.showUpdateNotification();
-            }
-          });
-        });
-            } catch (error) {
-              console.error('Service Worker registration failed:', error);
-      }
-    }
-  }
-
-  // 显示更新通知
-  showUpdateNotification() {
-    const notification = document.createElement('div');
-    notification.className = 'update-notification fade-in';
-    notification.innerHTML = `
-      <div class="notification-content">
-        <i class="fas fa-download me-2"></i>
-        新版本可用，点击刷新页面
-        <button class="btn btn-sm btn-primary ms-2" onclick="location.reload()">
-          刷新
-        </button>
-      </div>
-    `;
-    
-    document.body.appendChild(notification);
-    
-    setTimeout(() => {
-      notification.remove();
-    }, 10000);
-  }
+  // （Service Worker 已停用）
 
   // 设置网络监听器
   setupNetworkListeners() {
@@ -346,4 +300,4 @@ class PerformanceOptimizer {
 const performanceOptimizer = new PerformanceOptimizer();
 
 // 导出供其他模块使用
-window.PerformanceOptimizer = PerformanceOptimizer; 
\ No newline at end of file
+window.PerformanceOptimizer = PerformanceOptimizer; 
diff --git a/sw.js b/sw.js
deleted file mode 100644
index 7bf214b..0000000
--- a/sw.js
+++ /dev/null
@@ -1,2 +0,0 @@
-if(!self.define){let e,s={};const n=(n,i)=>(n=new URL(n+".js",i).href,s[n]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=s,document.head.appendChild(e)}else e=n,importScripts(n),s()}).then(()=>{let e=s[n];if(!e)throw new Error(`Module ${n} didn't register its module`);return e}));self.define=(i,r)=>{const o=e||("document"in self?document.currentScript.src:"")||location.href;if(s[o])return;let t={};const l=e=>n(e,o),c={module:{uri:o},exports:t,require:l};s[o]=Promise.all(i.map(e=>c[e]||l(e))).then(e=>(r(...e),t))}}define(["./workbox-fd2bad41"],function(e){"use strict";self.skipWaiting(),e.clientsClaim(),e.precacheAndRoute([{url:"js/191.e78c2286e6f676ec9974.js",revision:null},{url:"js/giffgaff.09aa929bc531dbada502.js",revision:null},{url:"js/main.aeb2d5e815e33169d355.js",revision:null},{url:"js/simyo.840d391554c2e48b3038.js",revision:null},{url:"js/vendors.0b4e54190542392138ff.js",revision:null},{url:"js/vendors.0b4e54190542392138ff.js.LICENSE.txt",revision:"617fd376435e7230f7d7a2c482065b3f"}],{}),e.registerRoute(/^https:\/\/api\.qrserver\.com/,new e.CacheFirst({cacheName:"qr-cache",plugins:[new e.ExpirationPlugin({maxEntries:50,maxAgeSeconds:86400})]}),"GET"),e.registerRoute(/^https:\/\/api\.giffgaff\.com/,new e.NetworkFirst({cacheName:"giffgaff-api",plugins:[new e.ExpirationPlugin({maxEntries:100,maxAgeSeconds:300})]}),"GET"),e.registerRoute(/^https:\/\/appapi\.simyo\.nl/,new e.NetworkFirst({cacheName:"simyo-api",plugins:[new e.ExpirationPlugin({maxEntries:100,maxAgeSeconds:300})]}),"GET")});
-//# sourceMappingURL=sw.js.map
\ No newline at end of file