@harrylabsj/kiwi-merchant-cloud 0.12.0

package/app/merchant-admin/pending-page.js

@@ -0,0 +1,89 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** 从 merchant-core 构造管理面（确认通道 = core 的命令日志）。 */
+export function merchantAdminSurface(core) {
+    return {
+        listExactProducts: () => core.listExactProducts(),
+        getExactProduct: (sku) => core.getExactProduct(sku),
+        listA2aNegotiations: (limit) => core.listA2aNegotiations(limit),
+        getA2aNegotiation: (negotiationId) => core.getA2aNegotiation(negotiationId),
+        listPending: () => core.listPendingCommands(),
+        executeApproved: (id, principalId, token) => core.commands.executeApproved(id, principalId, token),
+        rejectCandidate: (id, principalId, token) => core.commands.reject(id, principalId, token),
+        executeCommittedDecision: (input, verifier) => core.executeCommittedDecision(input, verifier),
+        getCandidate: (id) => core.getCommand(id),
+        candidateExecutionWasClaimed: (id) => core.commandExecutionWasClaimed(id),
+        queryCommittedDecisionOutcome: (input) => core.queryCommittedDecisionOutcome(input),
+        prepareInventoryUpdate: (input) => core.prepareInventoryUpdate(input),
+        prepareListingChange: (input) => core.prepareListingChange(input),
+        prepareExactProductCreate: (input) => core.prepareExactProductCreate(input),
+        prepareExactProductMoneyUpdate: (input) => core.prepareExactProductMoneyUpdate(input),
+        prepareServiceResume: (input) => core.prepareServiceResume(input),
+        prepareBroadcastPublish: (input) => core.prepareBroadcastPublish(input),
+        prepareBroadcastRevise: (input) => core.prepareBroadcastRevise(input),
+        prepareBroadcastWithdraw: (input) => core.prepareBroadcastWithdraw(input),
+        prepareGrantCreate: (input) => core.prepareGrantCreate(input),
+        prepareGrantRevoke: (input) => core.prepareGrantRevoke(input),
+        preparePromotionPublish: (input) => core.preparePromotionPublish(input),
+        preparePromotionWithdraw: (input) => core.preparePromotionWithdraw(input),
+    };
+}
+function escapeHtml(text) {
+    return text
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}
+/** 待批准命令页（最小可用；与 OAuth 授权页同风格）。 */
+export function renderPendingPage(merchantName, commands, tokenFor) {
+    const rows = commands
+        .map((c) => `<tr>
+  <td>${escapeHtml(c.candidate_id)}</td>
+  <td>${escapeHtml(c.tool)}</td>
+  <td><pre>${escapeHtml(JSON.stringify(c.arguments, null, 2))}</pre></td>
+  <td><pre>${escapeHtml(JSON.stringify(c.preconditions, null, 2))}</pre></td>
+  <td>${escapeHtml(c.expires_at)}</td>
+  <td>
+    <form method="post" action="/admin/decision" style="display:inline">
+      <input type="hidden" name="command_id" value="${escapeHtml(c.candidate_id)}">
+      <input type="hidden" name="confirmation" value="${escapeHtml(tokenFor?.(c.candidate_id, "approve") ?? "")}">
+      <button type="submit" name="decision" value="approve">批准并执行</button>
+    </form>
+    <form method="post" action="/admin/decision" style="display:inline">
+      <input type="hidden" name="command_id" value="${escapeHtml(c.candidate_id)}">
+      <input type="hidden" name="confirmation" value="${escapeHtml(tokenFor?.(c.candidate_id, "reject") ?? "")}">
+      <button type="submit" name="decision" value="reject">拒绝</button>
+    </form>
+  </td>
+</tr>`)
+        .join("\n");
+    return `<!doctype html>
+<html lang="zh-CN">
+<head><meta charset="utf-8"><title>待批准命令 — ${escapeHtml(merchantName)}</title></head>
+<body>
+  <h1>${escapeHtml(merchantName)}：待批准命令</h1>
+  <p>展示预览 ≠ 批准；批准 ≠ 执行成功（执行前重校验前置版本与硬策略）。</p>
+  ${commands.length === 0
+        ? "<p>当前没有待批准命令。</p>"
+        : `<table border="1" cellpadding="6">
+<tr><th>command_id</th><th>工具</th><th>参数</th><th>前置版本</th><th>有效期至</th><th>操作</th></tr>
+${rows}
+</table>`}
+</body>
+</html>`;
+}
+//# sourceMappingURL=pending-page.js.map

package/app/merchant-admin/pending-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-page.js","sourceRoot":"","sources":["../../src/merchant-admin/pending-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA2IH,gDAAgD;AAChD,MAAM,UAAU,oBAAoB,CAAC,IAAyB;IAC5D,OAAO;QACL,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE;QACjD,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QACnD,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAC/D,iBAAiB,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;QAC3E,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE;QAC7C,eAAe,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAC1C,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC;QACvD,eAAe,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC;QACzF,wBAAwB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC7F,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,4BAA4B,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACzE,6BAA6B,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;QACnF,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;QACrE,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;QACjE,yBAAyB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;QAC3E,8BAA8B,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC;QACrF,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;QACjE,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACvE,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;QACrE,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;QACzE,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAC7D,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAC7D,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACvE,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,QAAkC,EAClC,QAAwE;IAExE,MAAM,IAAI,GAAG,QAAQ;SAClB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CAAC;QACL,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;QAC1B,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;aACb,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;aAChD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;;;sDAGsB,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;wDACxB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;;;;sDAIzD,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;wDACxB,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;;;;MAIxG,CACD;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;6CAEoC,UAAU,CAAC,YAAY,CAAC;;QAE7D,UAAU,CAAC,YAAY,CAAC;;IAG5B,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC;;EAEN,IAAI;SAEJ;;QAEM,CAAC;AACT,CAAC"}

package/app/merchant-admin/rfq-page.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * RFQ 管理页（设计 v0.1.1 §9.4、§11.4、§14.1）。
+ *
+ *   - 批准/拒绝只在认证的管理页 HTTP 路由执行，绝不作为模型可调用的
+ *     RFQ MCP 工具；GET 无副作用；POST 需会话；发布类 POST 另需一次性
+ *     确认凭证（复用 oauth.sqlite 确认凭证，与 /admin/pending 同机制）。
+ *   - 认证主体的成功产物下载（摘要校验通过）是 EXPORTED 的唯一触发通道；
+ *     MCP 资源读取不经过本面。
+ *   - 具名 SKU 确认（独立表单写入）与 case 取消/关闭的管理页入口。
+ */
+import type { MerchantCoreService } from "../merchant-core/service.js";
+import type { RfqCaseView } from "../merchant-core/rfq/service.js";
+import type { PublicQuoteView } from "../merchant-core/rfq/types.js";
+export interface RfqAdminReleaseDetail {
+    release_id: string;
+    status: string;
+    candidate_id: string;
+    quote_id: string;
+    quote_revision: number;
+    recipient_ref: string;
+    artifact_id: string;
+    artifact_sha256: string;
+    case_id: string | null;
+    quote_status: string | null;
+    projection: PublicQuoteView | null;
+}
+export interface RfqAdminSurface {
+    listCases(principalId: string, limit?: number): RfqCaseView[];
+    getCase(caseId: string, principalId: string): RfqCaseView;
+    confirmLines(input: {
+        caseId: string;
+        expectedRevision: number;
+        selections: Array<{
+            line_id: string;
+            sku: string;
+            quantity?: number;
+            unit?: string;
+        }>;
+        principalId: string;
+    }): {
+        case_id: string;
+        revision: number;
+        stage: string;
+        blockers: Array<{
+            field: string;
+            reason: string;
+        }>;
+    };
+    closeCase(input: {
+        caseId: string;
+        expectedRevision: number;
+        outcome: "CANCELLED" | "CLOSED";
+        principalId: string;
+    }): {
+        case_id: string;
+        stage: string;
+    };
+    releaseDetail(releaseId: string, principalId: string): RfqAdminReleaseDetail;
+    approveRelease(commandId: string, principalId: string, confirmationToken?: string): Promise<unknown>;
+    rejectRelease(commandId: string, principalId: string, confirmationToken?: string): Promise<unknown>;
+    candidateFor(candidateId: string): {
+        candidate_id: string;
+        arguments: Record<string, unknown>;
+        preconditions: Record<string, unknown>;
+    } | undefined;
+    downloadArtifact(artifactId: string, principalId: string): {
+        content: string;
+        content_type: string;
+        filename: string;
+    };
+    markHandoffOwnerRecorded(handoffId: string, principalId: string): unknown;
+}
+/** 构造 RFQ 管理面（core 未配置 RFQ 子服务时各方法 fail-closed）。 */
+export declare function rfqAdminSurface(core: MerchantCoreService): RfqAdminSurface;
+/** 仪表盘行（渲染只依赖这几个字段；完整 RfqCaseView 可直接传入）。 */
+export interface RfqDashboardRow {
+    case: {
+        case_id: string;
+        stage: string;
+        current_quote_id?: string | null;
+    };
+    revision: number;
+    blockers?: Array<{
+        field: string;
+        reason: string;
+    }>;
+}
+export declare function renderRfqDashboard(merchantName: string, cases: RfqDashboardRow[]): string;
+export declare function renderRfqCasePage(merchantName: string, view: RfqCaseView): string;
+export declare function renderRfqReleasePage(merchantName: string, detail: RfqAdminReleaseDetail, tokenFor: (candidateId: string, action: "approve" | "reject") => string): string;

package/app/merchant-admin/rfq-page.js

@@ -0,0 +1,176 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { RfqError } from "../merchant-core/rfq/types.js";
+/** 构造 RFQ 管理面（core 未配置 RFQ 子服务时各方法 fail-closed）。 */
+export function rfqAdminSurface(core) {
+    const rfq = () => {
+        const service = core.rfqService;
+        if (service === undefined) {
+            throw new RfqError("unavailable", "询报价工作台未配置（rfq_core 未启用）；不可得");
+        }
+        return service;
+    };
+    const ctx = (principalId) => ({
+        principalId,
+        actor: principalId,
+        traceId: `admin-${principalId}-${Date.now()}`,
+    });
+    return {
+        listCases: (principalId, limit) => rfq().listCases(ctx(principalId), limit),
+        getCase: (caseId, principalId) => rfq().getCase(ctx(principalId), caseId),
+        confirmLines: (input) => rfq().confirmLines(ctx(input.principalId), {
+            caseId: input.caseId,
+            expectedRevision: input.expectedRevision,
+            selections: input.selections,
+        }),
+        closeCase: (input) => rfq().closeCase(ctx(input.principalId), {
+            caseId: input.caseId,
+            expectedRevision: input.expectedRevision,
+            outcome: input.outcome,
+            idempotencyKey: `admin-close-${input.caseId}-${input.expectedRevision}-${input.outcome}`,
+        }),
+        releaseDetail: (releaseId, principalId) => {
+            const detail = rfq().adminReleaseDetail(ctx(principalId), releaseId);
+            return {
+                release_id: detail.release.release_id,
+                status: detail.release.status,
+                candidate_id: detail.release.candidate_id,
+                quote_id: detail.release.quote_id,
+                quote_revision: detail.release.quote_revision,
+                recipient_ref: detail.release.recipient_ref,
+                artifact_id: detail.release.artifact_id,
+                artifact_sha256: detail.release.artifact_sha256,
+                case_id: detail.quote?.case_id ?? null,
+                quote_status: detail.quote?.status ?? null,
+                projection: detail.quote?.projection ?? null,
+            };
+        },
+        approveRelease: (commandId, principalId, token) => core.commands.executeApproved(commandId, principalId, token),
+        rejectRelease: (commandId, principalId, token) => core.commands.reject(commandId, principalId, token),
+        candidateFor: (candidateId) => {
+            const candidate = core.listPendingCommands().find((c) => c.candidate_id === candidateId);
+            return candidate === undefined
+                ? undefined
+                : {
+                    candidate_id: candidate.candidate_id,
+                    arguments: candidate.arguments,
+                    preconditions: candidate.preconditions,
+                };
+        },
+        downloadArtifact: (artifactId, principalId) => rfq().downloadArtifact(ctx(principalId), artifactId),
+        markHandoffOwnerRecorded: (handoffId, principalId) => rfq().markHandoffOwnerRecorded(ctx(principalId), handoffId),
+    };
+}
+// ---------------------------------------------------------------------------
+// HTML 渲染（与 renderPendingPage 同风格：转义全部外部内容；表单 POST）
+// ---------------------------------------------------------------------------
+function escapeHtml(text) {
+    return text
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}
+export function renderRfqDashboard(merchantName, cases) {
+    const rows = cases.length
+        ? cases
+            .map((v) => `<tr><td>${escapeHtml(v.case.case_id)}</td><td>${escapeHtml(v.case.stage)}</td><td>v${v.revision}</td><td>${v.blockers?.length ?? 0}</td><td>${escapeHtml(v.case.current_quote_id ?? "—")}</td><td><a href="/admin/rfq/cases/${encodeURIComponent(v.case.case_id)}">查看</a></td></tr>`)
+            .join("\n")
+        : "<tr><td colspan=\"6\">当前没有询盘。</td></tr>";
+    return `<!doctype html>
+<html lang="zh-CN"><head><meta charset="utf-8"><title>询报价工作台 — ${escapeHtml(merchantName)}</title></head>
+<body>
+<h1>${escapeHtml(merchantName)}：询报价工作台</h1>
+<p>确认/批准只在可信管理页执行；导出状态 ≠ 发送状态。待批准命令见 <a href="/admin/pending">待批准列表</a>。</p>
+<table border="1" cellpadding="6">
+<tr><th>case_id</th><th>阶段</th><th>需求版本</th><th>阻断项</th><th>当前报价</th><th>操作</th></tr>
+${rows}
+</table>
+</body></html>`;
+}
+export function renderRfqCasePage(merchantName, view) {
+    const lines = view.fields.lines
+        .map((l) => `<tr>
+  <td>${escapeHtml(l.line_id)}</td>
+  <td><pre>${escapeHtml(l.query.slice(0, 200))}</pre></td>
+  <td>${escapeHtml(l.sku ?? "—")}</td>
+  <td>${escapeHtml(String(l.quantity ?? "—"))}</td>
+  <td>${escapeHtml(l.unit ?? "—")}</td>
+  <td>${escapeHtml(l.confirmation)}</td>
+  <td><form method="post" action="/admin/rfq/cases/${encodeURIComponent(view.case.case_id)}/confirm" style="display:inline">
+    <input type="hidden" name="line_id" value="${escapeHtml(l.line_id)}">
+    <input type="hidden" name="sku" value="${escapeHtml(l.sku ?? "")}">
+    <input type="hidden" name="expected_revision" value="${view.revision}">
+    <button type="submit">确认该行</button>
+  </form></td>
+</tr>`)
+        .join("\n");
+    const quoteRows = view.quotes
+        .map((q) => `<tr><td>${escapeHtml(q.quote_id)}</td><td>v${q.revision}</td><td>${escapeHtml(q.status)}</td><td>${escapeHtml(q.invalid_reason ?? "")}</td></tr>`)
+        .join("\n");
+    return `<!doctype html>
+<html lang="zh-CN"><head><meta charset="utf-8"><title>询盘 ${escapeHtml(view.case.case_id)} — ${escapeHtml(merchantName)}</title></head>
+<body>
+<h1>询盘 ${escapeHtml(view.case.case_id)}（阶段 ${escapeHtml(view.case.stage)}，需求 v${view.revision}）</h1>
+<p><a href="/admin/rfq">返回总览</a></p>
+<h2>需求行（确认 = 商家具名动作；模型自报确认不作数）</h2>
+<table border="1" cellpadding="6">
+<tr><th>行</th><th>需求</th><th>SKU</th><th>数量</th><th>单位</th><th>确认状态</th><th>操作</th></tr>
+${lines}
+</table>
+<h2>阻断项（${view.blockers.length}）</h2>
+<ul>${view.blockers.map((b) => `<li>${escapeHtml(b.field)}：${escapeHtml(b.reason)}</li>`).join("")}</ul>
+<h2>报价版本</h2>
+<table border="1" cellpadding="6"><tr><th>quote</th><th>版本</th><th>状态</th><th>说明</th></tr>${quoteRows}</table>
+<h2>关闭（操作者显式；终态后拒绝新计价与发布）</h2>
+<form method="post" action="/admin/rfq/cases/${encodeURIComponent(view.case.case_id)}/close">
+  <input type="hidden" name="expected_revision" value="${view.case.version}">
+  <button type="submit" name="outcome" value="CANCELLED">取消询盘</button>
+  <button type="submit" name="outcome" value="CLOSED">正常关闭</button>
+</form>
+</body></html>`;
+}
+export function renderRfqReleasePage(merchantName, detail, tokenFor) {
+    const projectionText = detail.projection === null
+        ? "（投影不可得）"
+        : JSON.stringify(detail.projection, null, 2);
+    const buttons = detail.status !== "PENDING_APPROVAL"
+        ? `<p>当前状态：${escapeHtml(detail.status)}（非待批准；不可重复批准）</p>`
+        : `<form method="post" action="/admin/rfq/releases/${encodeURIComponent(detail.release_id)}/approve" style="display:inline">
+    <input type="hidden" name="confirmation" value="${escapeHtml(tokenFor(detail.candidate_id, "approve"))}">
+    <button type="submit">批准并激活发布</button>
+  </form>
+  <form method="post" action="/admin/rfq/releases/${encodeURIComponent(detail.release_id)}/reject" style="display:inline">
+    <input type="hidden" name="confirmation" value="${escapeHtml(tokenFor(detail.candidate_id, "reject"))}">
+    <button type="submit">拒绝</button>
+  </form>
+  <p>批准 = 消费一次性确认凭证 + 前置重验（事实指纹/策略版本/需求 revision）+ 原子激活。</p>`;
+    const download = detail.status === "APPROVED"
+        ? `<p><a href="/admin/rfq/artifacts/${encodeURIComponent(detail.artifact_id)}">下载正式文件（成功取走即记 EXPORTED）</a></p>`
+        : "";
+    return `<!doctype html>
+<html lang="zh-CN"><head><meta charset="utf-8"><title>发布 ${escapeHtml(detail.release_id)} — ${escapeHtml(merchantName)}</title></head>
+<body>
+<h1>发布 ${escapeHtml(detail.release_id)}（状态 ${escapeHtml(detail.status)}）</h1>
+<p><a href="/admin/pending">返回待批准列表</a> ｜ <a href="/admin/rfq">询报价总览</a></p>
+<h2>即将导出的固定内容（客户投影）</h2>
+<pre>${escapeHtml(projectionText)}</pre>
+<p>产物摘要：${escapeHtml(detail.artifact_sha256)} ｜ 收件对象：${escapeHtml(detail.recipient_ref)}</p>
+${buttons}
+${download}
+</body></html>`;
+}
+//# sourceMappingURL=rfq-page.js.map

package/app/merchant-admin/rfq-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfq-page.js","sourceRoot":"","sources":["../../src/merchant-admin/rfq-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAcH,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAyCzD,oDAAoD;AACpD,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,MAAM,GAAG,GAAG,GAAmD,EAAE;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,WAAmB,EAAkB,EAAE,CAAC,CAAC;QACpD,WAAW;QACX,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,SAAS,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;KAC9C,CAAC,CAAC;IACH,OAAO;QACL,SAAS,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;QAC3E,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QACzE,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CACtB,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;YACzC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;QACJ,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,eAAe,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,EAAE;SACzF,CAAC;QACJ,aAAa,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE;YACxC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;YACrE,OAAO;gBACL,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;gBACrC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;gBAC7B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;gBACzC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;gBACjC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc;gBAC7C,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;gBAC3C,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;gBACvC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe;gBAC/C,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI;gBACtC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI;gBAC1C,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,IAAI,IAAI;aAC7C,CAAC;QACJ,CAAC;QACD,cAAc,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAChD,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;QAC9D,aAAa,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAC/C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;QACrD,YAAY,EAAE,CAAC,WAAW,EAAE,EAAE;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC;YACzF,OAAO,SAAS,KAAK,SAAS;gBAC5B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,YAAY,EAAE,SAAS,CAAC,YAAY;oBACpC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,aAAa,EAAE,SAAS,CAAC,aAAa;iBACvC,CAAC;QACR,CAAC;QACD,gBAAgB,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE,CAC5C,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC;QACtD,wBAAwB,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,CACnD,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,8EAA8E;AAE9E,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AASD,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,KAAwB;IAExB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM;QACvB,CAAC,CAAC,KAAK;aACF,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,YAAY,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC,sCAAsC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CACxR;aACA,IAAI,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,yCAAyC,CAAC;IAC9C,OAAO;iEACwD,UAAU,CAAC,YAAY,CAAC;;MAEnF,UAAU,CAAC,YAAY,CAAC;;;;EAI5B,IAAI;;eAES,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,IAAiB;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;SAC5B,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CAAC;QACL,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAChB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;QACxB,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;QACrC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;QACzB,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;qDACmB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;iDACzC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;6CACzB,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;2DACT,IAAI,CAAC,QAAQ;;;MAGlE,CACD;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM;SAC1B,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,WAAW,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,YAAY,CACrJ;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;2DACkD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC;;SAE7G,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,QAAQ;;;;;EAK3F,KAAK;;UAEG,IAAI,CAAC,QAAQ,CAAC,MAAM;MACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;;4FAEN,SAAS;;+CAEtD,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;yDAC3B,IAAI,CAAC,IAAI,CAAC,OAAO;;;;eAI3D,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,MAA6B,EAC7B,QAAuE;IAEvE,MAAM,cAAc,GAClB,MAAM,CAAC,UAAU,KAAK,IAAI;QACxB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,kBAAkB;QAClC,CAAC,CAAC,WAAW,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB;QACzD,CAAC,CAAC,mDAAmD,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC;sDAC1C,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;;;oDAGtD,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC;sDACnC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;;;6DAG5C,CAAC;IAC5D,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,KAAK,UAAU;QAC1B,CAAC,CAAC,oCAAoC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,mCAAmC;QAC/G,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;2DACkD,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC;;SAE7G,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;;;OAG/D,UAAU,CAAC,cAAc,CAAC;UACvB,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC;EACrF,OAAO;EACP,QAAQ;eACK,CAAC;AAChB,CAAC"}

package/app/merchant-core/commands.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * 持久命令记录与执行闭环（V2 阶段三：src/merchant-core/commands.ts）。
+ *
+ * 命令记录复用 `WriteApprovalCandidateStore`（state.sqlite 单 owner 写；
+ * 字段即命令记录：tool、arguments（含 hash）、preconditions（含 hash）、
+ * risk、principal_id、expires_at、状态机
+ * prepared→approved→executed / rejected / superseded / expired——store 里
+ * pending_approval 即 prepared）。单次用途：executed 后不可再执行。
+ *
+ * 写链路时序：
+ *   prepare（登记候选 + 前置版本快照 + 预览）→ 可信确认通道写入 approved
+ *   （模型自报「已批准」不作证据——只能经 executeApproved 由已认证主体触发）→
+ *   执行器校验（授权主体一致 / 前置版本重读重哈希 / 有效期 / 硬策略）→
+ *   幂等执行（executed 后重放返回 not_approvable，绝不二次执行）→ 回读校验 →
+ *   审计（store 状态流转 + content hash 即审计记录）。
+ *
+ * 恢复：进程重启后 recoverPending() 从命令记录恢复全部已注册工具的 pending
+ * 命令——钩子由固定执行器注册表按存储的 tool/arguments 确定性重建；未注册
+ * tool 的命令 fail-closed 标 expired（不展示成仍可批准）。V1 的
+ * recoverPendingDrafts 语义被本机制覆盖并推广到全部写工具。
+ */
+import type { AgentProfile } from "../config/profile.js";
+import type { AgentMode } from "../agent/mode.js";
+import { WriteApprovalCandidateError, type ApprovalExecutionResult, type WriteApprovalCandidate, type WriteApprovalCandidateStore } from "../agent/merchant/action-candidate.js";
+import { type WriteGateResult } from "../agent/write-gate.js";
+import type { MerchantOAuthStore } from "../auth/merchant-oauth.js";
+import type { ExecutorContext, MerchantExecutorRegistry } from "./executor.js";
+export interface MerchantCommandLogDeps {
+    store: WriteApprovalCandidateStore;
+    executors: MerchantExecutorRegistry;
+    executorContext: ExecutorContext;
+    profile: AgentProfile;
+    mode: () => AgentMode;
+    now: () => string;
+    /** 批准动作的调用主体（确认通道认证身份；必须等于命令记录主体）。 */
+    principalId: string;
+    /**
+     * 一次性确认凭证存储（BUG-02）：配置后 execute/reject 必须携带有效确认
+     * 凭证（绑定候选内容摘要 + 主体 + 商家 + 动作，单次用途，过期/重复/不
+     * 匹配拒绝）——没有可信用户确认记录时，写操作无法执行。
+     */
+    confirmations?: MerchantOAuthStore;
+}
+export interface PreparedCommand {
+    candidate: WriteApprovalCandidate;
+    /** 预览（具体改动对照；prepare 只产生候选与预览，不改业务状态）。 */
+    preview: Record<string, unknown>;
+    outcome: WriteGateResult;
+}
+export interface CommittedDecisionProof {
+    operationId: string;
+    candidateId: string;
+    actorId: string;
+    decision: "approve" | "reject";
+    actionDigest: string;
+}
+export interface CommittedDecisionVerifier {
+    verifyCommittedDecision(input: CommittedDecisionProof): boolean;
+}
+export declare class MerchantCommandLog {
+    private readonly deps;
+    constructor(deps: MerchantCommandLogDeps);
+    /**
+     * 登记写命令（prepare）：校验工具已注册 → 执行器重读前置版本 → 写门
+     * force_pending 产候选（任何模式都不自动执行）。
+     */
+    prepare(input: {
+        tool: string;
+        arguments: Record<string, unknown>;
+        reason?: string;
+    }): Promise<PreparedCommand>;
+    /**
+     * 批准并执行（确认通道；管理页面调用）。
+     * 授权主体一致性：调用主体必须等于命令记录主体（store 按 principal 绑定）。
+     * 配置了确认凭证存储时，必须携带与该候选内容/主体/动作匹配的一次性凭证。
+     */
+    executeApproved(commandId: string, callerPrincipalId: string, confirmationToken?: string): Promise<ApprovalExecutionResult>;
+    /**
+     * Execute a decision already committed by the Workbench WebAuthn transaction.
+     * No legacy confirmation token is minted: the verifier must match operation, candidate,
+     * actor, decision and the freshly recomputed immutable candidate digest.
+     */
+    executeCommittedDecision(input: Omit<CommittedDecisionProof, "actionDigest">, verifier: CommittedDecisionVerifier): Promise<ApprovalExecutionResult | WriteApprovalCandidate>;
+    getCandidate(commandId: string): WriteApprovalCandidate | undefined;
+    executionWasClaimed(commandId: string): boolean | undefined;
+    queryCommittedDecisionOutcome(input: Omit<CommittedDecisionProof, "actionDigest">): Promise<{
+        status: "succeeded";
+    } | {
+        status: "failed";
+        error: string;
+    } | {
+        status: "unknown";
+        error: string;
+    }>;
+    /** 拒绝候选（确认通道；同样需确认凭证）。 */
+    reject(commandId: string, callerPrincipalId: string, confirmationToken?: string): Promise<WriteApprovalCandidate>;
+    /**
+     * 重启恢复：从命令记录恢复全部已注册工具的 pending 命令（钩子按存储
+     * 参数经注册表确定性重建）；未注册 tool 的命令 fail-closed 标 expired。
+     * 崩溃时停留在 executing 的候选一律 superseded（外部副作用不可判定，
+     * 绝不放行二次执行）。返回 { recovered, expiredUnknown, supersededExecuting }。
+     */
+    recoverPending(): {
+        recovered: number;
+        expiredUnknown: number;
+        supersededExecuting: number;
+    };
+    listPending(): WriteApprovalCandidate[];
+    get(commandId: string): WriteApprovalCandidate | undefined;
+}
+export { WriteApprovalCandidateError };