@seasonkoh/webaz 0.1.23 → 0.1.25

package/dist/pwa/routes/agent-governance.js

@@ -1,16 +1,17 @@
 import { computeAgentPassport } from '../../layer1-agent/L1-2-identity/agent-passport.js';
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerAgentGovernanceRoutes(app, deps) {
     const { db, generateId, auth, requireRootAdmin, invalidateAgentBlockedCache, requireHumanPresence, issueAgentStrike, custodianFingerprint, signPassport, issuerAddress } = deps;
     // /api/me/agents — 列出本账号所有 agent + declaration / strikes
-    app.get('/api/me/agents', (req, res) => {
+    app.get('/api/me/agents', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const keys = db.prepare(`SELECT api_key FROM users WHERE id = ? UNION SELECT api_key FROM agent_reputation WHERE user_id = ?`).all(user.id, user.id);
-        const items = keys.map(k => {
-            const decl = db.prepare(`SELECT operator_name, operator_contact, purpose, declared_scope, attestations, repo_url, revoked_at FROM agent_declarations WHERE api_key = ?`).get(k.api_key);
+        const keys = await dbAll(`SELECT api_key FROM users WHERE id = ? UNION SELECT api_key FROM agent_reputation WHERE user_id = ?`, [user.id, user.id]);
+        const items = await Promise.all(keys.map(async (k) => {
+            const decl = await dbOne(`SELECT operator_name, operator_contact, purpose, declared_scope, attestations, repo_url, revoked_at FROM agent_declarations WHERE api_key = ?`, [k.api_key]);
             // P1 fix 4.4：附 signals JSON
-            const rep = db.prepare(`SELECT trust_score, level, signals, last_calculated_at FROM agent_reputation WHERE api_key = ?`).get(k.api_key);
+            const rep = await dbOne(`SELECT trust_score, level, signals, last_calculated_at FROM agent_reputation WHERE api_key = ?`, [k.api_key]);
             if (rep && rep.signals) {
                 try {
                     rep.signals = JSON.parse(rep.signals);
@@ -19,9 +20,9 @@ export function registerAgentGovernanceRoutes(app, deps) {
                     rep.signals = null;
                 }
             }
-            const calls30d = db.prepare(`SELECT COUNT(*) as n FROM agent_call_log WHERE api_key = ? AND created_at > datetime('now', '-30 days')`).get(k.api_key).n;
-            const last = db.prepare(`SELECT endpoint, method, status_code, created_at FROM agent_call_log WHERE api_key = ? ORDER BY created_at DESC LIMIT 1`).get(k.api_key);
-            const strikes = db.prepare(`SELECT severity, reason_code, issued_at, expires_at, appeal_status FROM agent_strikes WHERE api_key = ? ORDER BY issued_at DESC LIMIT 5`).all(k.api_key);
+            const calls30d = (await dbOne(`SELECT COUNT(*) as n FROM agent_call_log WHERE api_key = ? AND created_at > datetime('now', '-30 days')`, [k.api_key])).n;
+            const last = await dbOne(`SELECT endpoint, method, status_code, created_at FROM agent_call_log WHERE api_key = ? ORDER BY created_at DESC LIMIT 1`, [k.api_key]);
+            const strikes = await dbAll(`SELECT severity, reason_code, issued_at, expires_at, appeal_status FROM agent_strikes WHERE api_key = ? ORDER BY issued_at DESC LIMIT 5`, [k.api_key]);
             let passport = null;
             try {
                 passport = computeAgentPassport(db, k.api_key, user.id, custodianFingerprint);
@@ -37,9 +38,9 @@ export function registerAgentGovernanceRoutes(app, deps) {
                 recent_strikes: strikes,
                 passport,
             };
-        });
+        }));
         // Phase 2 监护人总览(只读/软绑定):真人态 + 旗下 agent 聚合 + 连带
-        const hasPasskey = (db.prepare('SELECT COUNT(*) AS n FROM webauthn_credentials WHERE user_id = ?').get(user.id)?.n || 0) > 0;
+        const hasPasskey = ((await dbOne('SELECT COUNT(*) AS n FROM webauthn_credentials WHERE user_id = ?', [user.id]))?.n || 0) > 0;
         const pps = items.map(i => i.passport).filter(Boolean);
         const depthRank = { shallow: 0, medium: 1, deep: 2, profound: 3 };
         const deepest = pps.reduce((d, p) => (depthRank[p.engagement_depth] ?? 0) > (depthRank[d] ?? 0) ? p.engagement_depth : d, 'shallow');
@@ -65,7 +66,7 @@ export function registerAgentGovernanceRoutes(app, deps) {
         const prefix = String(req.params.apiKeyPrefix || '').replace('...', '');
         if (prefix.length < 6)
             return void res.status(400).json({ error: 'apiKeyPrefix 太短' });
-        const keys = db.prepare(`SELECT api_key FROM users WHERE id = ? UNION SELECT api_key FROM agent_reputation WHERE user_id = ?`).all(user.id, user.id);
+        const keys = await dbAll(`SELECT api_key FROM users WHERE id = ? UNION SELECT api_key FROM agent_reputation WHERE user_id = ?`, [user.id, user.id]);
         const match = keys.find(k => k.api_key.startsWith(prefix));
         if (!match)
             return void res.status(404).json({ error: '未找到该 agent(或不属于你)' });
@@ -135,32 +136,30 @@ export function registerAgentGovernanceRoutes(app, deps) {
             webaz_format, // 显式重复让消费者明确选哪个
         });
     });
-    app.get('/api/me/agents/:apiKeyPrefix/log', (req, res) => {
+    app.get('/api/me/agents/:apiKeyPrefix/log', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const prefix = String(req.params.apiKeyPrefix || '').replace(/[^A-Za-z0-9_]/g, '').slice(0, 32);
         if (prefix.length < 8)
             return void res.status(400).json({ error: 'apiKeyPrefix 至少 8 字符' });
-        const targetKey = db.prepare(`SELECT api_key FROM users WHERE id = ? AND api_key LIKE ? || '%'
-      UNION SELECT api_key FROM agent_reputation WHERE user_id = ? AND api_key LIKE ? || '%'`)
-            .get(user.id, prefix, user.id, prefix);
+        const targetKey = await dbOne(`SELECT api_key FROM users WHERE id = ? AND api_key LIKE ? || '%'
+      UNION SELECT api_key FROM agent_reputation WHERE user_id = ? AND api_key LIKE ? || '%'`, [user.id, prefix, user.id, prefix]);
         if (!targetKey)
             return void res.status(404).json({ error: '未找到匹配的 agent api_key（仅可查本人的）' });
         const limit = Math.min(500, Math.max(10, Number(req.query.limit) || 100));
-        const rows = db.prepare(`SELECT endpoint, method, status_code, created_at FROM agent_call_log
-      WHERE api_key = ? AND created_at > datetime('now', '-30 days') ORDER BY id DESC LIMIT ?`).all(targetKey.api_key, limit);
+        const rows = await dbAll(`SELECT endpoint, method, status_code, created_at FROM agent_call_log
+      WHERE api_key = ? AND created_at > datetime('now', '-30 days') ORDER BY id DESC LIMIT ?`, [targetKey.api_key, limit]);
         res.json({ items: rows });
     });
-    app.post('/api/me/agents/declarations', (req, res) => {
+    app.post('/api/me/agents/declarations', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const b = req.body;
         const targetApiKey = b.api_key ? String(b.api_key) : user.api_key;
-        const ownership = db.prepare(`SELECT id FROM users WHERE id = ? AND api_key = ?
-      UNION SELECT user_id as id FROM agent_reputation WHERE user_id = ? AND api_key = ?`)
-            .get(user.id, targetApiKey, user.id, targetApiKey);
+        const ownership = await dbOne(`SELECT id FROM users WHERE id = ? AND api_key = ?
+      UNION SELECT user_id as id FROM agent_reputation WHERE user_id = ? AND api_key = ?`, [user.id, targetApiKey, user.id, targetApiKey]);
         if (!ownership)
             return void res.status(403).json({ error: 'api_key 不属于本账号' });
         const operator_name = String(b.operator_name || '').trim().slice(0, 60);
@@ -185,7 +184,7 @@ export function registerAgentGovernanceRoutes(app, deps) {
         const attestationsJson = b.attestations && typeof b.attestations === 'object' ? JSON.stringify(b.attestations).slice(0, 2000) : null;
         const repo_url = b.repo_url ? String(b.repo_url).slice(0, 200) : null;
         const homepage = b.homepage ? String(b.homepage).slice(0, 200) : null;
-        db.prepare(`INSERT INTO agent_declarations (
+        await dbRun(`INSERT INTO agent_declarations (
       api_key, user_id, operator_name, operator_contact, purpose, declared_scope, attestations, repo_url, homepage
     ) VALUES (?,?,?,?,?,?,?,?,?)
     ON CONFLICT(api_key) DO UPDATE SET
@@ -197,36 +196,35 @@ export function registerAgentGovernanceRoutes(app, deps) {
       repo_url = excluded.repo_url,
       homepage = excluded.homepage,
       revoked_at = NULL,
-      updated_at = datetime('now')`).run(targetApiKey, user.id, operator_name, operator_contact, purpose, scopeJson, attestationsJson, repo_url, homepage);
+      updated_at = datetime('now')`, [targetApiKey, user.id, operator_name, operator_contact, purpose, scopeJson, attestationsJson, repo_url, homepage]);
         invalidateAgentBlockedCache(targetApiKey);
         res.json({ ok: true });
     });
     // 用户撤销 agent（铁律 §4 human presence）
-    app.post('/api/me/agents/:apiKeyPrefix/revoke', (req, res) => {
+    app.post('/api/me/agents/:apiKeyPrefix/revoke', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const prefix = String(req.params.apiKeyPrefix || '').replace(/[^A-Za-z0-9_]/g, '').slice(0, 32);
         if (prefix.length < 8)
             return void res.status(400).json({ error: 'apiKeyPrefix 至少 8 字符' });
-        const targetKey = db.prepare(`SELECT api_key FROM users WHERE id = ? AND api_key LIKE ? || '%'
-      UNION SELECT api_key FROM agent_reputation WHERE user_id = ? AND api_key LIKE ? || '%'`)
-            .get(user.id, prefix, user.id, prefix);
+        const targetKey = await dbOne(`SELECT api_key FROM users WHERE id = ? AND api_key LIKE ? || '%'
+      UNION SELECT api_key FROM agent_reputation WHERE user_id = ? AND api_key LIKE ? || '%'`, [user.id, prefix, user.id, prefix]);
         if (!targetKey)
             return void res.status(404).json({ error: '未找到匹配的 agent api_key' });
         const hpCheck = requireHumanPresence(user.id, 'agent_revoke', (req.body || {}).webauthn_token, 'require_human_presence_for_agent_revoke', () => true);
         if (!hpCheck.ok)
             return void res.status(412).json({ error: hpCheck.reason, error_code: hpCheck.error_code });
         const reason = String((req.body || {}).reason || '').slice(0, 300);
-        db.prepare(`INSERT INTO agent_revocations (target_kind, target_value, revoked_by, revoked_by_role, reason)
+        await dbRun(`INSERT INTO agent_revocations (target_kind, target_value, revoked_by, revoked_by_role, reason)
       VALUES ('api_key', ?, ?, 'self', ?)
-      ON CONFLICT(target_kind, target_value, revoked_by) DO NOTHING`).run(targetKey.api_key, user.id, reason);
-        db.prepare(`UPDATE agent_declarations SET revoked_at = datetime('now'), revoked_reason = ? WHERE api_key = ?`).run(reason, targetKey.api_key);
+      ON CONFLICT(target_kind, target_value, revoked_by) DO NOTHING`, [targetKey.api_key, user.id, reason]);
+        await dbRun(`UPDATE agent_declarations SET revoked_at = datetime('now'), revoked_reason = ? WHERE api_key = ?`, [reason, targetKey.api_key]);
         invalidateAgentBlockedCache(targetKey.api_key);
         res.json({ ok: true });
     });
     // 撤销同 operator 名下所有 agent（仅撤销本用户给 operator 旗下 agent 的 attestation）
-    app.post('/api/me/agents/operators/:operator_name/revoke', (req, res) => {
+    app.post('/api/me/agents/operators/:operator_name/revoke', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -237,27 +235,26 @@ export function registerAgentGovernanceRoutes(app, deps) {
         if (!hpCheck.ok)
             return void res.status(412).json({ error: hpCheck.reason, error_code: hpCheck.error_code });
         const reason = String((req.body || {}).reason || '').slice(0, 300);
-        const affected = db.prepare(`UPDATE agent_attestations SET revoked_at = datetime('now')
+        const affected = await dbRun(`UPDATE agent_attestations SET revoked_at = datetime('now')
       WHERE user_id = ? AND revoked_at IS NULL
-        AND api_key IN (SELECT api_key FROM agent_declarations WHERE operator_name = ?)`)
-            .run(user.id, opName);
-        db.prepare(`INSERT INTO agent_revocations (target_kind, target_value, revoked_by, revoked_by_role, reason)
+        AND api_key IN (SELECT api_key FROM agent_declarations WHERE operator_name = ?)`, [user.id, opName]);
+        await dbRun(`INSERT INTO agent_revocations (target_kind, target_value, revoked_by, revoked_by_role, reason)
       VALUES ('operator_name', ?, ?, 'self', ?)
-      ON CONFLICT(target_kind, target_value, revoked_by) DO NOTHING`).run(opName, user.id, reason);
-        const keys = db.prepare(`SELECT api_key FROM agent_declarations WHERE operator_name = ?`).all(opName);
+      ON CONFLICT(target_kind, target_value, revoked_by) DO NOTHING`, [opName, user.id, reason]);
+        const keys = await dbAll(`SELECT api_key FROM agent_declarations WHERE operator_name = ?`, [opName]);
         for (const k of keys)
             invalidateAgentBlockedCache(k.api_key);
         res.json({ ok: true, attestations_revoked: affected.changes });
     });
     // P0 audit fix 4.2: 申诉 strike
-    app.post('/api/me/agents/strikes/:strikeId/appeal', (req, res) => {
+    app.post('/api/me/agents/strikes/:strikeId/appeal', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const strikeId = Number(req.params.strikeId);
         if (!Number.isInteger(strikeId) || strikeId <= 0)
             return void res.status(400).json({ error: 'strikeId 必须是正整数' });
-        const strike = db.prepare(`SELECT id, api_key, user_id, severity, issued_at, appeal_status FROM agent_strikes WHERE id = ?`).get(strikeId);
+        const strike = await dbOne(`SELECT id, api_key, user_id, severity, issued_at, appeal_status FROM agent_strikes WHERE id = ?`, [strikeId]);
         if (!strike)
             return void res.status(404).json({ error: 'strike 不存在' });
         if (strike.user_id !== user.id)
@@ -270,11 +267,11 @@ export function registerAgentGovernanceRoutes(app, deps) {
         const reason = String((req.body || {}).reason || '').trim().slice(0, 500);
         if (reason.length < 10)
             return void res.status(400).json({ error: '申诉理由 ≥10 字' });
-        db.prepare(`UPDATE agent_strikes SET appeal_status = 'pending', appeal_reason = ? WHERE id = ?`).run(reason, strikeId);
+        await dbRun(`UPDATE agent_strikes SET appeal_status = 'pending', appeal_reason = ? WHERE id = ?`, [reason, strikeId]);
         res.json({ ok: true, message: '申诉已提交，等待 root admin 审核' });
     });
     // Admin: 审核 strike 申诉
-    app.post('/api/admin/agent-strikes/:strikeId/decide', (req, res) => {
+    app.post('/api/admin/agent-strikes/:strikeId/decide', async (req, res) => {
         const user = requireRootAdmin(req, res);
         if (!user)
             return;
@@ -284,21 +281,20 @@ export function registerAgentGovernanceRoutes(app, deps) {
         const decision = String((req.body || {}).decision || '');
         if (!['approved', 'denied'].includes(decision))
             return void res.status(400).json({ error: 'decision 必须是 approved / denied' });
-        const strike = db.prepare(`SELECT id, api_key, appeal_status FROM agent_strikes WHERE id = ?`).get(strikeId);
+        const strike = await dbOne(`SELECT id, api_key, appeal_status FROM agent_strikes WHERE id = ?`, [strikeId]);
         if (!strike)
             return void res.status(404).json({ error: 'strike 不存在' });
         if (strike.appeal_status !== 'pending')
             return void res.status(409).json({ error: `当前状态 ${strike.appeal_status} 不可裁决` });
-        db.prepare(`UPDATE agent_strikes SET appeal_status = ?, appeal_decided_by = ?, appeal_decided_at = datetime('now') WHERE id = ?`)
-            .run(decision, user.id, strikeId);
+        await dbRun(`UPDATE agent_strikes SET appeal_status = ?, appeal_decided_by = ?, appeal_decided_at = datetime('now') WHERE id = ?`, [decision, user.id, strikeId]);
         invalidateAgentBlockedCache(strike.api_key);
         // P1 fix 5.3: appeal approved → 恢复因 strike 自动停用的 skills
         if (decision === 'approved') {
             try {
-                const uRow = db.prepare(`SELECT id FROM users WHERE api_key = ?`).get(strike.api_key);
+                const uRow = await dbOne(`SELECT id FROM users WHERE api_key = ?`, [strike.api_key]);
                 if (uRow) {
-                    const r = db.prepare(`UPDATE skills SET active = 1, disabled_by_strike_at = NULL
-            WHERE seller_id = ? AND disabled_by_strike_at IS NOT NULL AND active = 0`).run(uRow.id);
+                    const r = await dbRun(`UPDATE skills SET active = 1, disabled_by_strike_at = NULL
+            WHERE seller_id = ? AND disabled_by_strike_at IS NOT NULL AND active = 0`, [uRow.id]);
                     if (r.changes > 0)
                         console.log(`[appeal approved→skill] restored ${r.changes} skills for ${uRow.id}`);
                 }
@@ -310,17 +306,17 @@ export function registerAgentGovernanceRoutes(app, deps) {
         res.json({ ok: true, decision });
     });
     // Admin: 列出待审 strike 申诉
-    app.get('/api/admin/agent-strikes/pending', (req, res) => {
+    app.get('/api/admin/agent-strikes/pending', async (req, res) => {
         const user = requireRootAdmin(req, res);
         if (!user)
             return;
-        const rows = db.prepare(`SELECT s.id, s.api_key, s.user_id, u.handle, s.severity, s.reason_code, s.reason_detail, s.issued_at, s.appeal_reason
+        const rows = await dbAll(`SELECT s.id, s.api_key, s.user_id, u.handle, s.severity, s.reason_code, s.reason_detail, s.issued_at, s.appeal_reason
       FROM agent_strikes s JOIN users u ON u.id = s.user_id
-      WHERE s.appeal_status = 'pending' ORDER BY s.id DESC LIMIT 100`).all();
+      WHERE s.appeal_status = 'pending' ORDER BY s.id DESC LIMIT 100`);
         res.json({ items: rows });
     });
     // P1 fix 4.3: admin 主动 issue strike
-    app.post('/api/admin/agent-strikes/issue', (req, res) => {
+    app.post('/api/admin/agent-strikes/issue', async (req, res) => {
         const adminUser = requireRootAdmin(req, res);
         if (!adminUser)
             return;
@@ -328,7 +324,7 @@ export function registerAgentGovernanceRoutes(app, deps) {
         const apiKey = String(b.api_key || '').trim();
         if (apiKey.length < 8)
             return void res.status(400).json({ error: 'api_key 必填' });
-        const targetUser = db.prepare(`SELECT id, handle FROM users WHERE api_key = ?`).get(apiKey);
+        const targetUser = await dbOne(`SELECT id, handle FROM users WHERE api_key = ?`, [apiKey]);
         if (!targetUser)
             return void res.status(404).json({ error: '未找到该 api_key' });
         const reasonCode = String(b.reason_code || '').trim().slice(0, 40);
@@ -349,7 +345,7 @@ export function registerAgentGovernanceRoutes(app, deps) {
         res.json({ ok: true, target_handle: targetUser.handle, ...result });
     });
     // bilateral attestation（用户批准某 agent 的 scope）
-    app.post('/api/me/agents/attestations', (req, res) => {
+    app.post('/api/me/agents/attestations', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -357,7 +353,7 @@ export function registerAgentGovernanceRoutes(app, deps) {
         const apiKey = String(b.api_key || '');
         if (!apiKey)
             return void res.status(400).json({ error: 'api_key 必填' });
-        const decl = db.prepare(`SELECT declared_scope, operator_name, purpose FROM agent_declarations WHERE api_key = ? AND revoked_at IS NULL`).get(apiKey);
+        const decl = await dbOne(`SELECT declared_scope, operator_name, purpose FROM agent_declarations WHERE api_key = ? AND revoked_at IS NULL`, [apiKey]);
         if (!decl)
             return void res.status(404).json({ error: '该 agent 未声明 / 已撤销，无法授权' });
         let approvedScopeJson;
@@ -373,14 +369,14 @@ export function registerAgentGovernanceRoutes(app, deps) {
         const spendCapPerOrder = b.spend_cap_per_order != null ? Math.max(0, Number(b.spend_cap_per_order)) : null;
         const spendCapDaily = b.spend_cap_daily != null ? Math.max(0, Number(b.spend_cap_daily)) : null;
         const id = generateId('aat');
-        db.prepare(`INSERT INTO agent_attestations (id, api_key, user_id, approved_scope, spend_cap_per_order, spend_cap_daily)
+        await dbRun(`INSERT INTO agent_attestations (id, api_key, user_id, approved_scope, spend_cap_per_order, spend_cap_daily)
       VALUES (?,?,?,?,?,?)
       ON CONFLICT(api_key, user_id) DO UPDATE SET
         approved_scope = excluded.approved_scope,
         spend_cap_per_order = excluded.spend_cap_per_order,
         spend_cap_daily = excluded.spend_cap_daily,
         revoked_at = NULL,
-        granted_at = datetime('now')`).run(id, apiKey, user.id, approvedScopeJson, spendCapPerOrder, spendCapDaily);
+        granted_at = datetime('now')`, [id, apiKey, user.id, approvedScopeJson, spendCapPerOrder, spendCapDaily]);
         res.json({ ok: true });
     });
 }

package/dist/pwa/routes/ai.js

@@ -1,5 +1,7 @@
+import { dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerAiRoutes(app, deps) {
-    const { db, auth, anthropic } = deps;
+    // db 已走 RFC-016 异步 seam(dbOne),不再直接用 deps.db
+    const { auth, anthropic } = deps;
     // G-2: AI 价格建议
     app.post('/api/ai/price-suggestion', async (req, res) => {
         const user = auth(req, res);
@@ -11,17 +13,17 @@ export function registerAiRoutes(app, deps) {
         if (!title)
             return void res.status(400).json({ error: '请提供 title' });
         // 类目历史价位
-        const stats = db.prepare(`
+        const stats = (await dbOne(`
       SELECT COUNT(*) as cnt, COALESCE(AVG(price), 0) as avg, COALESCE(MIN(price), 0) as min, COALESCE(MAX(price), 0) as max,
         COALESCE((SELECT price FROM products WHERE status='active' AND category = ? ORDER BY price LIMIT 1 OFFSET CAST((SELECT COUNT(*) FROM products WHERE status='active' AND category = ?) / 2 AS INTEGER)), 0) as median
       FROM products WHERE status = 'active' AND category = ?
-    `).get(category || '', category || '', category || '');
+    `, [category || '', category || '', category || '']));
         // 近 30 天成交均价（更可信）
-        const recentAvg = db.prepare(`
+        const recentAvg = (await dbOne(`
       SELECT COALESCE(AVG(total_amount), 0) as avg FROM orders o
       JOIN products p ON p.id = o.product_id
       WHERE p.category = ? AND o.status = 'completed' AND o.created_at > datetime('now', '-30 days')
-    `).get(category || '').avg;
+    `, [category || ''])).avg;
         try {
             const message = await anthropic.messages.create({
                 model: 'claude-haiku-4-5-20251001',

package/dist/pwa/routes/analytics.js

@@ -1,3 +1,4 @@
+import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 function median(arr) {
     if (arr.length === 0)
         return null;
@@ -6,9 +7,10 @@ function median(arr) {
     return s.length % 2 ? s[mid] : (s[mid - 1] + s[mid]) / 2;
 }
 export function registerAnalyticsRoutes(app, deps) {
-    const { db, auth } = deps;
+    // db 已全量走 RFC-016 异步 seam(dbOne/dbAll),不再直接用 deps.db
+    const { auth } = deps;
     // 物流绩效卡 (Wave B-4)
-    app.get('/api/logistics/me/performance', (req, res) => {
+    app.get('/api/logistics/me/performance', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -16,22 +18,22 @@ export function registerAnalyticsRoutes(app, deps) {
             return void res.status(403).json({ error: '仅物流角色可访问' });
         }
         const windowDays = Math.max(7, Math.min(365, Number(req.query.window) || 30));
-        const orders = db.prepare(`
+        const orders = await dbAll(`
       SELECT id, status, created_at, updated_at,
              pickup_deadline, delivery_deadline
       FROM orders
       WHERE logistics_id = ? AND created_at > datetime('now', '-' || ? || ' days')
-    `).all(user.id, windowDays);
+    `, [user.id, windowDays]);
         const orderIds = orders.map(o => o.id);
         let history = [];
         if (orderIds.length > 0) {
             const placeholders = orderIds.map(() => '?').join(',');
-            history = db.prepare(`
+            history = await dbAll(`
         SELECT order_id, from_status, to_status, created_at
         FROM order_state_history
         WHERE order_id IN (${placeholders})
         ORDER BY created_at ASC
-      `).all(...orderIds);
+      `, orderIds);
         }
         const histByOrder = new Map();
         for (const h of history) {
@@ -78,24 +80,24 @@ export function registerAnalyticsRoutes(app, deps) {
                 }
             }
         }
-        const disputes = db.prepare(`
+        const disputes = (await dbOne(`
       SELECT COUNT(*) as n FROM disputes d
       JOIN orders o ON o.id = d.order_id
       WHERE o.logistics_id = ? AND d.created_at > datetime('now', '-' || ? || ' days')
-    `).get(user.id, windowDays).n;
+    `, [user.id, windowDays])).n;
         // 败诉两路：auto-fault 判物流 + 仲裁裁定物流为被告且退款
-        const autoFaultLost = db.prepare(`
+        const autoFaultLost = (await dbOne(`
       SELECT COUNT(*) as n FROM orders
       WHERE logistics_id = ? AND status = 'fault_logistics'
         AND updated_at > datetime('now', '-' || ? || ' days')
-    `).get(user.id, windowDays).n;
-        const arbitratedLost = db.prepare(`
+    `, [user.id, windowDays])).n;
+        const arbitratedLost = (await dbOne(`
       SELECT COUNT(*) as n FROM disputes d
       JOIN orders o ON o.id = d.order_id
       WHERE o.logistics_id = ? AND d.defendant_id = ?
         AND d.ruling_type IN ('refund_buyer','partial_refund')
         AND d.created_at > datetime('now', '-' || ? || ' days')
-    `).get(user.id, user.id, windowDays).n;
+    `, [user.id, user.id, windowDays])).n;
         const disputeLoss = autoFaultLost + arbitratedLost;
         const pickupTotalEvaluated = pickupOnTime + pickupOverdue;
         const deliveryTotalEvaluated = deliveryOnTime + deliveryOverdue;
@@ -125,14 +127,14 @@ export function registerAnalyticsRoutes(app, deps) {
         });
     });
     // 卖家销售分析 (Wave C-5)
-    app.get('/api/sellers/me/analytics', (req, res) => {
+    app.get('/api/sellers/me/analytics', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         if (user.role !== 'seller')
             return void res.status(403).json({ error: '仅卖家可访问' });
         const windowDays = Math.max(7, Math.min(365, Number(req.query.window) || 30));
-        const ordersAgg = db.prepare(`
+        const ordersAgg = (await dbOne(`
       SELECT
         COUNT(*) as total_orders,
         SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) as completed_orders,
@@ -141,8 +143,8 @@ export function registerAnalyticsRoutes(app, deps) {
         COALESCE(SUM(CASE WHEN status = 'completed' THEN total_amount ELSE 0 END), 0) as gmv,
         COALESCE(AVG(CASE WHEN status = 'completed' THEN total_amount END), 0) as aov
       FROM orders WHERE seller_id = ? AND created_at > datetime('now', '-' || ? || ' days')
-    `).get(user.id, windowDays);
-        const topProducts = db.prepare(`
+    `, [user.id, windowDays]));
+        const topProducts = await dbAll(`
       SELECT p.id, p.title, p.price, COUNT(o.id) as sales,
              COALESCE(SUM(o.total_amount), 0) as revenue
       FROM products p
@@ -153,27 +155,27 @@ export function registerAnalyticsRoutes(app, deps) {
       GROUP BY p.id
       HAVING sales > 0
       ORDER BY sales DESC LIMIT 10
-    `).all(windowDays, user.id);
-        const buyerStats = db.prepare(`
+    `, [windowDays, user.id]);
+        const buyerStats = (await dbOne(`
       SELECT
         COUNT(DISTINCT buyer_id) as unique_buyers,
         COUNT(*) as orders_count
       FROM orders WHERE seller_id = ? AND status = 'completed'
         AND created_at > datetime('now', '-' || ? || ' days')
-    `).get(user.id, windowDays);
-        const repeatBuyers = db.prepare(`
+    `, [user.id, windowDays]));
+        const repeatBuyers = (await dbOne(`
       SELECT COUNT(*) as n FROM (
         SELECT buyer_id FROM orders WHERE seller_id = ? AND status = 'completed'
           AND created_at > datetime('now', '-' || ? || ' days')
         GROUP BY buyer_id HAVING COUNT(*) > 1
       )
-    `).get(user.id, windowDays).n;
-        const wishlistAdds = db.prepare(`
+    `, [user.id, windowDays])).n;
+        const wishlistAdds = (await dbOne(`
       SELECT COUNT(*) as n FROM user_wishlist w
       JOIN products p ON p.id = w.product_id
       WHERE p.seller_id = ? AND w.created_at > datetime('now', '-' || ? || ' days')
-    `).get(user.id, windowDays).n;
-        const dailyTrend = db.prepare(`
+    `, [user.id, windowDays])).n;
+        const dailyTrend = await dbAll(`
       SELECT DATE(created_at) as date,
              COUNT(*) as orders,
              COALESCE(SUM(CASE WHEN status = 'completed' THEN total_amount ELSE 0 END), 0) as gmv
@@ -181,30 +183,30 @@ export function registerAnalyticsRoutes(app, deps) {
       WHERE seller_id = ? AND created_at > datetime('now', '-' || ? || ' days')
       GROUP BY DATE(created_at)
       ORDER BY date ASC
-    `).all(user.id, Math.min(windowDays, 30));
-        const ratingsAgg = db.prepare(`
+    `, [user.id, Math.min(windowDays, 30)]);
+        const ratingsAgg = await dbOne(`
       SELECT COUNT(*) as cnt, COALESCE(AVG(stars), 0) as avg_stars
       FROM order_ratings WHERE seller_id = ?
         AND created_at > datetime('now', '-' || ? || ' days')
-    `).get(user.id, windowDays);
-        const refundsCount = db.prepare(`
+    `, [user.id, windowDays]);
+        const refundsCount = (await dbOne(`
       SELECT COUNT(*) as n FROM return_requests
       WHERE seller_id = ? AND status = 'refunded'
         AND created_at > datetime('now', '-' || ? || ' days')
-    `).get(user.id, windowDays).n;
+    `, [user.id, windowDays])).n;
         // S1: 平均备货时长（paid → shipped 中位 hours）
-        const handlingRow = db.prepare(`
+        const handlingRow = (await dbOne(`
       SELECT COALESCE(AVG((julianday(h_ship.created_at) - julianday(h_paid.created_at)) * 24), 0) as avg_handling_hours,
              COUNT(*) as sample_n
       FROM orders o
       JOIN order_state_history h_paid ON h_paid.order_id = o.id AND h_paid.to_status = 'paid'
       JOIN order_state_history h_ship ON h_ship.order_id = o.id AND h_ship.to_status = 'shipped'
       WHERE o.seller_id = ? AND o.created_at > datetime('now', '-' || ? || ' days')
-    `).get(user.id, windowDays);
+    `, [user.id, windowDays]));
         const completedN = Number(ordersAgg.completed_orders) || 0;
         const returnRate = completedN > 0 ? refundsCount / completedN : 0;
         // S1: 上一窗口对比
-        const prevAgg = db.prepare(`
+        const prevAgg = (await dbOne(`
       SELECT
         COUNT(*) as total_orders,
         SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) as completed_orders,
@@ -212,7 +214,7 @@ export function registerAnalyticsRoutes(app, deps) {
       FROM orders WHERE seller_id = ?
         AND created_at > datetime('now', '-' || ? || ' days')
         AND created_at <= datetime('now', '-' || ? || ' days')
-    `).get(user.id, windowDays * 2, windowDays);
+    `, [user.id, windowDays * 2, windowDays]));
         res.json({
             window_days: windowDays,
             orders: ordersAgg,
@@ -247,19 +249,19 @@ export function registerAnalyticsRoutes(app, deps) {
         });
     });
     // 卖家退货仪表盘
-    app.get('/api/sellers/me/return-stats', (req, res) => {
+    app.get('/api/sellers/me/return-stats', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const totalReturns = db.prepare(`SELECT COUNT(*) as n FROM return_requests WHERE seller_id = ?`).get(user.id).n;
-        const refunded = db.prepare(`SELECT COUNT(*) as n FROM return_requests WHERE seller_id = ? AND status = 'refunded'`).get(user.id).n;
-        const rejected = db.prepare(`SELECT COUNT(*) as n FROM return_requests WHERE seller_id = ? AND status = 'rejected'`).get(user.id).n;
-        const pending = db.prepare(`SELECT COUNT(*) as n FROM return_requests WHERE seller_id = ? AND status = 'pending'`).get(user.id).n;
-        const totalOrders = db.prepare(`SELECT COUNT(*) as n FROM orders WHERE seller_id = ? AND status IN ('delivered','completed','refunded')`).get(user.id).n;
-        const reasonBreakdown = db.prepare(`
+        const totalReturns = (await dbOne(`SELECT COUNT(*) as n FROM return_requests WHERE seller_id = ?`, [user.id])).n;
+        const refunded = (await dbOne(`SELECT COUNT(*) as n FROM return_requests WHERE seller_id = ? AND status = 'refunded'`, [user.id])).n;
+        const rejected = (await dbOne(`SELECT COUNT(*) as n FROM return_requests WHERE seller_id = ? AND status = 'rejected'`, [user.id])).n;
+        const pending = (await dbOne(`SELECT COUNT(*) as n FROM return_requests WHERE seller_id = ? AND status = 'pending'`, [user.id])).n;
+        const totalOrders = (await dbOne(`SELECT COUNT(*) as n FROM orders WHERE seller_id = ? AND status IN ('delivered','completed','refunded')`, [user.id])).n;
+        const reasonBreakdown = await dbAll(`
       SELECT reason, COUNT(*) as cnt FROM return_requests
       WHERE seller_id = ? GROUP BY reason ORDER BY cnt DESC
-    `).all(user.id);
+    `, [user.id]);
         const returnRate = totalOrders > 0 ? (refunded / totalOrders) : 0;
         res.json({
             total_returns: totalReturns,