@seasonkoh/webaz 0.1.23 → 0.1.25

package/dist/pwa/routes/auth-sessions.js

@@ -1,15 +1,17 @@
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerAuthSessionsRoutes(app, deps) {
-    const { db, auth, verifyPassword, recordSession, generateSecureKey } = deps;
-    app.get('/api/auth/sessions', (req, res) => {
+    // db 已全量走 RFC-016 异步 seam(dbOne/dbAll/dbRun),不再直接用 deps.db
+    const { auth, verifyPassword, recordSession, generateSecureKey } = deps;
+    app.get('/api/auth/sessions', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const currentKey = req.headers.authorization?.replace('Bearer ', '') ?? '';
-        const rows = db.prepare(`
+        const rows = await dbAll(`
       SELECT id, ip, user_agent, fingerprint_hash, created_at, last_seen_at, revoked_at, api_key
       FROM user_sessions WHERE user_id = ? AND revoked_at IS NULL
       ORDER BY last_seen_at DESC LIMIT 30
-    `).all(user.id);
+    `, [user.id]);
         res.json({
             sessions: rows.map(r => ({
                 id: r.id,
@@ -23,23 +25,23 @@ export function registerAuthSessionsRoutes(app, deps) {
         });
     });
     // 远程吊销某个会话（不影响当前 session）
-    app.post('/api/auth/sessions/:id/revoke', (req, res) => {
+    app.post('/api/auth/sessions/:id/revoke', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const sid = req.params.id;
-        const row = db.prepare("SELECT user_id, api_key FROM user_sessions WHERE id = ?").get(sid);
+        const row = await dbOne("SELECT user_id, api_key FROM user_sessions WHERE id = ?", [sid]);
         if (!row || row.user_id !== user.id)
             return void res.status(404).json({ error: '会话不存在' });
         const currentKey = req.headers.authorization?.replace('Bearer ', '') ?? '';
         if (row.api_key === currentKey)
             return void res.json({ error: '不能吊销当前会话，请改用「全部登出」' });
-        db.prepare("UPDATE user_sessions SET revoked_at = datetime('now') WHERE id = ?").run(sid);
+        await dbRun("UPDATE user_sessions SET revoked_at = datetime('now') WHERE id = ?", [sid]);
         res.json({ ok: true });
     });
     // 一键全登出：rotate users.api_key + 吊销所有 session
     // 要求密码二次验证（防 api_key 被盗后攻击者锁死真用户）
-    app.post('/api/auth/logout-all', (req, res) => {
+    app.post('/api/auth/logout-all', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -49,9 +51,8 @@ export function registerAuthSessionsRoutes(app, deps) {
         if (!verifyPassword(pwd, user.password_hash))
             return void res.json({ error: '密码错误' });
         const newKey = generateSecureKey('key');
-        db.prepare("UPDATE users SET api_key = ? WHERE id = ?").run(newKey, user.id);
-        db.prepare("UPDATE user_sessions SET revoked_at = datetime('now') WHERE user_id = ? AND revoked_at IS NULL")
-            .run(user.id);
+        await dbRun("UPDATE users SET api_key = ? WHERE id = ?", [newKey, user.id]);
+        await dbRun("UPDATE user_sessions SET revoked_at = datetime('now') WHERE user_id = ? AND revoked_at IS NULL", [user.id]);
         // 为新 key 建一个 session 行（让当前发起者继续可用）
         try {
             recordSession(user.id, newKey, req);

package/dist/pwa/routes/blocklist.js

@@ -1,6 +1,8 @@
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerBlocklistRoutes(app, deps) {
-    const { db, auth } = deps;
-    app.post('/api/blocklist/:user_id', (req, res) => {
+    // db 已走 RFC-016 异步 seam(dbOne/dbAll/dbRun),不再直接用 deps.db
+    const { auth } = deps;
+    app.post('/api/blocklist/:user_id', async (req, res) => {
         const me = auth(req, res);
         if (!me)
             return;
@@ -9,52 +11,51 @@ export function registerBlocklistRoutes(app, deps) {
             return void res.json({ error: '不能拉黑自己' });
         if (target === 'sys_protocol')
             return void res.json({ error: '不能拉黑系统账户' });
-        const exists = db.prepare("SELECT 1 FROM users WHERE id = ?").get(target);
+        const exists = await dbOne("SELECT 1 FROM users WHERE id = ?", [target]);
         if (!exists)
             return void res.json({ error: '用户不存在' });
         const reason = (req.body?.reason || '').toString().slice(0, 200);
-        db.prepare("INSERT OR IGNORE INTO user_blocklist (blocker_id, blocked_id, reason) VALUES (?, ?, ?)")
-            .run(me.id, target, reason || null);
+        await dbRun("INSERT OR IGNORE INTO user_blocklist (blocker_id, blocked_id, reason) VALUES (?, ?, ?)", [me.id, target, reason || null]);
         res.json({ ok: true });
     });
-    app.delete('/api/blocklist/:user_id', (req, res) => {
+    app.delete('/api/blocklist/:user_id', async (req, res) => {
         const me = auth(req, res);
         if (!me)
             return;
-        db.prepare("DELETE FROM user_blocklist WHERE blocker_id = ? AND blocked_id = ?").run(me.id, req.params.user_id);
+        await dbRun("DELETE FROM user_blocklist WHERE blocker_id = ? AND blocked_id = ?", [me.id, req.params.user_id]);
         res.json({ ok: true });
     });
     // D-2: 列表
-    app.get('/api/blocklist', (req, res) => {
+    app.get('/api/blocklist', async (req, res) => {
         const me = auth(req, res);
         if (!me)
             return;
-        const rows = db.prepare(`
+        const rows = await dbAll(`
       SELECT b.blocked_id, b.reason, b.created_at,
         u.name, u.handle, u.role
       FROM user_blocklist b
       JOIN users u ON u.id = b.blocked_id
       WHERE b.blocker_id = ?
       ORDER BY b.created_at DESC LIMIT 200
-    `).all(me.id);
+    `, [me.id]);
         res.json({ items: rows });
     });
-    app.get('/api/blocklist/me', (req, res) => {
+    app.get('/api/blocklist/me', async (req, res) => {
         const me = auth(req, res);
         if (!me)
             return;
-        const rows = db.prepare(`
+        const rows = await dbAll(`
       SELECT b.blocked_id, b.reason, b.created_at, u.name as blocked_name, u.role as blocked_role
       FROM user_blocklist b LEFT JOIN users u ON u.id = b.blocked_id
       WHERE b.blocker_id = ? ORDER BY b.created_at DESC
-    `).all(me.id);
+    `, [me.id]);
         res.json({ blocked: rows });
     });
-    app.get('/api/blocklist/:user_id/status', (req, res) => {
+    app.get('/api/blocklist/:user_id/status', async (req, res) => {
         const me = auth(req, res);
         if (!me)
             return;
-        const row = db.prepare("SELECT 1 FROM user_blocklist WHERE blocker_id = ? AND blocked_id = ?").get(me.id, req.params.user_id);
+        const row = await dbOne("SELECT 1 FROM user_blocklist WHERE blocker_id = ? AND blocked_id = ?", [me.id, req.params.user_id]);
         res.json({ blocked: !!row });
     });
 }

package/dist/pwa/routes/build-feedback.js

@@ -1,9 +1,10 @@
+import { dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 import { submitBuildFeedback, listMyBuildFeedback, getBuildFeedback, adminListBuildFeedback, adminUpdateBuildFeedback, triagePendingBuildFeedback, } from '../../layer2-business/L2-8-feedback/build-feedback-engine.js';
 export function registerBuildFeedbackRoutes(app, deps) {
     const { db, auth, requireSupportAdmin } = deps;
-    const hasPasskey = (userId) => ((db.prepare('SELECT COUNT(*) AS n FROM webauthn_credentials WHERE user_id = ?').get(userId)?.n) || 0) > 0;
+    const hasPasskey = async (userId) => (((await dbOne('SELECT COUNT(*) AS n FROM webauthn_credentials WHERE user_id = ?', [userId]))?.n) || 0) > 0;
     // ── 提交 ──────────────────────────────────────────────
-    app.post('/api/build-feedback', (req, res) => {
+    app.post('/api/build-feedback', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -11,7 +12,7 @@ export function registerBuildFeedbackRoutes(app, deps) {
         // 分级门(RFC-004 精确化 2026-06-05):
         //   「报告问题」(ux_issue/bug = 用)→ 登录即可,不要 Passkey(没 Passkey 也要能报问题)
         //   「建设平台」(proposal = 建)→ 必须 Passkey(真人锚点,后期贡献/奖励才有归属)
-        if (String(type) === 'proposal' && !hasPasskey(user.id)) {
+        if (String(type) === 'proposal' && !(await hasPasskey(user.id))) {
             return void res.status(403).json({
                 error: '提交「改进提案 / proposal」需先绑定 Passkey 成为可问责真人 —— 提案是建设行为,被采纳会记入共建信誉,需真人锚点。报告 bug / 体验问题无需 Passkey。请在 webaz.xyz「我的」绑定 Passkey。',
                 error_code: 'PROPOSAL_REQUIRES_PASSKEY',
@@ -29,28 +30,28 @@ export function registerBuildFeedbackRoutes(app, deps) {
         res.json(result);
     });
     // ── 闭环:我的反馈进度 ──(必须在 /:id 之前声明)──────────
-    app.get('/api/build-feedback/mine', (req, res) => {
+    app.get('/api/build-feedback/mine', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        res.json({ feedback: listMyBuildFeedback(db, user.id) });
+        res.json({ feedback: await listMyBuildFeedback(db, user.id) });
     });
-    app.get('/api/build-feedback/:id', (req, res) => {
+    app.get('/api/build-feedback/:id', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const isAdmin = !!(user.is_admin || user.admin_permissions); // 宽松判定;admin 端点另有严格门
-        const row = getBuildFeedback(db, String(req.params.id), user.id, !!isAdmin);
+        const row = await getBuildFeedback(db, String(req.params.id), user.id, !!isAdmin);
         if (!row)
             return void res.status(404).json({ error: '反馈不存在或无权查看' });
         res.json(row);
     });
     // ── maintainer triage ────────────────────────────────
-    app.get('/api/admin/build-feedback', (req, res) => {
+    app.get('/api/admin/build-feedback', async (req, res) => {
         if (!requireSupportAdmin(req, res))
             return;
         const status = typeof req.query.status === 'string' ? req.query.status : undefined;
-        res.json({ feedback: adminListBuildFeedback(db, status) });
+        res.json({ feedback: await adminListBuildFeedback(db, status) });
     });
     // RFC-005 Phase 2:AI 自动 triage(advisory)— 批量处理 received 反馈:去重 + 标风险/摘要 + 置 triaged。
     // 不 resolve、不记功(人类的)。无 AI key 时只做确定性去重 + 置 triaged。

package/dist/pwa/routes/build-reputation.js

@@ -1,10 +1,14 @@
 import { getBuildProfile } from '../../layer2-business/L2-9-contribution/build-reputation-engine.js';
+import { withUncommittedValueBoundary } from '../../layer2-business/L2-9-contribution/contribution-display-envelope.js';
 export function registerBuildReputationRoutes(app, deps) {
     const { db, auth } = deps;
-    app.get('/api/build-reputation/me', (req, res) => {
+    // PR-5A/5B: this legacy RFC-006 contributor dashboard is a contribution display surface, so its
+    // response is wrapped in the uncommitted-value boundary (RFC-017 I-12 / §7) — build_points/tier express
+    // BUILD reputation (coordination layer) only and promise no economic value.
+    app.get('/api/build-reputation/me', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        res.json(getBuildProfile(db, user.id));
+        res.json(withUncommittedValueBoundary(await getBuildProfile(db, user.id)));
     });
 }

package/dist/pwa/routes/build-tasks.js

@@ -1,4 +1,8 @@
-import { createBuildTask, listBuildTasks, getBuildTask, claimBuildTask, submitBuildTask, releaseBuildTask, resolveBuildTask, } from '../../layer2-business/L2-9-contribution/build-tasks-engine.js';
+import { createBuildTask, claimBuildTask, submitBuildTask, releaseBuildTask, resolveBuildTask, } from '../../layer2-business/L2-9-contribution/build-tasks-engine.js';
+// PR9C-1 — read/filter the build_tasks core + PR9B agent metadata (member scope; restricted/internal hidden).
+import { listBuildTasksWithAgentMetadata, getBuildTaskWithAgentMetadata, validateTaskFilters, withContributionReadEnvelope } from '../../layer2-business/L2-9-contribution/build-task-read.js';
+// PR9C-2 — participation guard (claim/submit/release): restricted/internal 404 no-leak, auto_claimable, canonical PR.
+import { guardParticipation, validatePrRefAgainstCanonical } from '../../layer2-business/L2-9-contribution/build-task-participation.js';
 export function registerBuildTasksRoutes(app, deps) {
     const { db, auth, requireSupportAdmin } = deps;
     app.post('/api/build-tasks', (req, res) => {
@@ -11,53 +15,81 @@ export function registerBuildTasksRoutes(app, deps) {
             return void res.status(result.error_code === 'RATE_LIMITED' ? 429 : 400).json(result);
         res.json(result);
     });
+    // PR9C-1: list now returns build_tasks core + parsed agent_metadata (null for old tasks) under the
+    // uncommitted value_boundary; member scope hides restricted/internal. Bad filter → fail-closed 400.
     app.get('/api/build-tasks', (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const status = typeof req.query.status === 'string' ? req.query.status : undefined;
-        const area = typeof req.query.area === 'string' ? req.query.area : undefined;
-        const claimerId = req.query.mine === '1' ? user.id : undefined;
-        res.json({ tasks: listBuildTasks(db, { status, area, claimerId }) });
+        const v = validateTaskFilters(req.query);
+        if (!v.ok)
+            return void res.status(400).json({ error: v.detail, error_code: v.code });
+        if (req.query.mine === '1')
+            v.filters.claimerId = user.id;
+        const tasks = listBuildTasksWithAgentMetadata(db, v.filters, 'member');
+        res.json(withContributionReadEnvelope({ tasks }));
     });
     app.get('/api/build-tasks/:id', (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const row = getBuildTask(db, String(req.params.id));
-        if (!row)
+        const task = getBuildTaskWithAgentMetadata(db, String(req.params.id), 'member'); // null → not found OR restricted/internal (no leak)
+        if (!task)
             return void res.status(404).json({ error: '任务不存在' });
-        res.json(row);
+        // backward-compat: spread the legacy build_tasks fields + events at top level; only append the new fields.
+        res.json(withContributionReadEnvelope(task));
     });
+    // PR9C-2: participation guard runs BEFORE the engine — restricted/internal → 404 no-leak; metadata public
+    // task → claim respects auto_claimable. Success appends value_boundary + canonical_contribution_target only.
     app.post('/api/build-tasks/:id/claim', (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
+        const g = guardParticipation(db, String(req.params.id), 'claim');
+        if (!g.ok)
+            return void res.status(g.status).json({ error: g.message, error_code: g.code });
         const result = claimBuildTask(db, String(req.params.id), user.id, (req.body ?? {}).provenance);
         if ('error' in result) {
             const code = result.error_code === 'NOT_FOUND' ? 404 : result.error_code === 'TOO_MANY_CLAIMS' ? 429 : 409;
             return void res.status(code).json(result);
         }
-        res.json(result);
+        res.json(withContributionReadEnvelope(result));
     });
     app.post('/api/build-tasks/:id/submit', (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const { pr_ref, note } = req.body ?? {};
-        const result = submitBuildTask(db, String(req.params.id), user.id, pr_ref, note);
+        const g = guardParticipation(db, String(req.params.id), 'submit');
+        if (!g.ok)
+            return void res.status(g.status).json({ error: g.message, error_code: g.code });
+        const { pr_ref, note, verification_summary } = req.body ?? {};
+        // anti GitHub-target confusion: a PR must target the canonical repo (the response shows where to submit).
+        const pr = validatePrRefAgainstCanonical(pr_ref);
+        if (!pr.ok)
+            return void res.status(400).json(withContributionReadEnvelope({ error: pr.message, error_code: pr.code }));
+        // submit evidence (design contract): a PR/ref alone is not enough — the contributor must summarize what
+        // they ran/verified (the task's verification_commands + results). Fail-closed; stored in the event log.
+        const vs = typeof verification_summary === 'string' ? verification_summary.trim() : '';
+        if (vs.length < 1)
+            return void res.status(400).json(withContributionReadEnvelope({ error: 'submit requires a verification_summary — summarize what you ran/verified (the task verification_commands and their results)', error_code: 'VERIFICATION_SUMMARY_REQUIRED' }));
+        if (vs.length > 2000)
+            return void res.status(400).json(withContributionReadEnvelope({ error: 'verification_summary too long (max 2000 chars)', error_code: 'VERIFICATION_SUMMARY_TOO_LONG' }));
+        const result = submitBuildTask(db, String(req.params.id), user.id, pr_ref, note, vs);
         if ('error' in result)
             return void res.status(result.error_code === 'NOT_FOUND' ? 404 : 400).json(result);
-        res.json(result);
+        res.json(withContributionReadEnvelope(result));
     });
     app.post('/api/build-tasks/:id/release', (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
+        const g = guardParticipation(db, String(req.params.id), 'release');
+        if (!g.ok)
+            return void res.status(g.status).json({ error: g.message, error_code: g.code });
         const result = releaseBuildTask(db, String(req.params.id), user.id);
         if ('error' in result)
             return void res.status(result.error_code === 'NOT_FOUND' ? 404 : 400).json(result);
-        res.json(result);
+        res.json(withContributionReadEnvelope(result));
     });
     // 验收终态 —— 仅 admin/maintainer(验收=真人,RFC-006 不变量 2;不发奖励/不记信誉)
     app.post('/api/admin/build-tasks/:id/resolve', (req, res) => {

package/dist/pwa/routes/buyer-feeds.js

@@ -1,21 +1,23 @@
+import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerBuyerFeedsRoutes(app, deps) {
-    const { db, auth, isTrustedRole, errorRes, getNearbyCellPrecision, getProtocolParam } = deps;
-    app.get('/api/recommendations/me', (req, res) => {
+    // db 已走 RFC-016 异步 seam(dbOne/dbAll),不再直接用 deps.db
+    const { auth, isTrustedRole, errorRes, getNearbyCellPrecision, getProtocolParam } = deps;
+    app.get('/api/recommendations/me', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         if (isTrustedRole(user))
             return void errorRes(res, 403, 'TRUSTED_ROLE_NO_TRADE', '受信角色无购物功能');
         const limit = Math.min(30, Math.max(5, Number(req.query.limit) || 20));
-        const wishlistRows = db.prepare(`
+        const wishlistRows = await dbAll(`
       SELECT w.product_id, p.category, p.seller_id FROM user_wishlist w
       JOIN products p ON p.id = w.product_id
       WHERE w.user_id = ? AND p.status = 'active' LIMIT 50
-    `).all(user.id);
-        const purchasedRows = db.prepare(`
+    `, [user.id]);
+        const purchasedRows = await dbAll(`
       SELECT DISTINCT product_id, seller_id FROM orders WHERE buyer_id = ? AND status = 'completed' LIMIT 200
-    `).all(user.id);
-        const followedRows = db.prepare(`SELECT followee_id FROM follows WHERE follower_id = ?`).all(user.id);
+    `, [user.id]);
+        const followedRows = await dbAll(`SELECT followee_id FROM follows WHERE follower_id = ?`, [user.id]);
         const wishCats = new Set(wishlistRows.map(r => r.category).filter(Boolean));
         const knownProductIds = new Set([...wishlistRows.map(r => r.product_id), ...purchasedRows.map(r => r.product_id)]);
         const knownSellerIds = new Set([...wishlistRows.map(r => r.seller_id), ...purchasedRows.map(r => r.seller_id)]);
@@ -31,40 +33,40 @@ export function registerBuyerFeedsRoutes(app, deps) {
         let followedProducts = [];
         if (followedSellerIds.length > 0) {
             const ph = followedSellerIds.map(() => '?').join(',');
-            followedProducts = db.prepare(`
+            followedProducts = await dbAll(`
         SELECT ${baseCols}
         FROM products p JOIN users u ON u.id = p.seller_id
         WHERE p.seller_id IN (${ph}) AND p.status = 'active' AND p.stock > 0 ${exclSql}
         ORDER BY p.created_at DESC LIMIT 10
-      `).all(...followedSellerIds, ...exclArgs);
+      `, [...followedSellerIds, ...exclArgs]);
         }
         let categoryProducts = [];
         if (wishCats.size > 0) {
             const ph = [...wishCats].map(() => '?').join(',');
-            categoryProducts = db.prepare(`
+            categoryProducts = await dbAll(`
         SELECT ${baseCols}
         FROM products p JOIN users u ON u.id = p.seller_id
         WHERE p.category IN (${ph}) AND p.status = 'active' AND p.stock > 0 ${exclSql}
         ORDER BY sales_count DESC LIMIT 10
-      `).all(...wishCats, ...exclArgs);
+      `, [...wishCats, ...exclArgs]);
         }
         let pastSellerProducts = [];
         const pastSellers = [...knownSellerIds].filter(s => !followedSellerIds.includes(s));
         if (pastSellers.length > 0) {
             const ph = pastSellers.map(() => '?').join(',');
-            pastSellerProducts = db.prepare(`
+            pastSellerProducts = await dbAll(`
         SELECT ${baseCols}
         FROM products p JOIN users u ON u.id = p.seller_id
         WHERE p.seller_id IN (${ph}) AND p.status = 'active' AND p.stock > 0 ${exclSql}
         ORDER BY p.created_at DESC LIMIT 10
-      `).all(...pastSellers, ...exclArgs);
+      `, [...pastSellers, ...exclArgs]);
         }
-        const fallback = db.prepare(`
+        const fallback = await dbAll(`
       SELECT ${baseCols}
       FROM products p JOIN users u ON u.id = p.seller_id
       WHERE p.status = 'active' AND p.stock > 0 ${exclSql}
       ORDER BY sales_count DESC, p.created_at DESC LIMIT 10
-    `).all(...exclArgs);
+    `, exclArgs);
         const seen = new Set();
         const labeled = (bucket, arr) => arr.filter(it => {
             const id = String(it.id);
@@ -88,7 +90,7 @@ export function registerBuyerFeedsRoutes(app, deps) {
             },
         });
     });
-    app.get('/api/feed', (req, res) => {
+    app.get('/api/feed', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -137,13 +139,13 @@ export function registerBuyerFeedsRoutes(app, deps) {
       WHERE ts IS NOT NULL
       ORDER BY ts DESC LIMIT 50
     `;
-        const events = db.prepare(sql).all(...params);
+        const events = await dbAll(sql, params);
         res.json({ events, scope });
     });
     // 雷达扫描 MVP (2026-05-29)：scope 范围档 + window 时间窗，k≥3 守护贯穿
     //   scope: cell(本格) / neighbors(周边 3×3) / region(同城) / global(全网)
     //   window: 24h / 7d / 30d
-    app.get('/api/nearby', (req, res) => {
+    app.get('/api/nearby', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -153,7 +155,7 @@ export function registerBuyerFeedsRoutes(app, deps) {
         const days = windowKey === '24h' ? 1 : windowKey === '30d' ? 30 : 7;
         const { precision_deg, approx_km } = getNearbyCellPrecision();
         const K = getProtocolParam('nearby_k_anonymity', 3);
-        const u = db.prepare("SELECT geo_lat, geo_lng, geo_updated_at, region FROM users WHERE id = ?").get(user.id);
+        const u = (await dbOne("SELECT geo_lat, geo_lng, geo_updated_at, region FROM users WHERE id = ?", [user.id]));
         const needsGeo = scope === 'cell' || scope === 'neighbors';
         if (needsGeo && (u?.geo_lat == null || u?.geo_lng == null)) {
             // 本格/周边需定位；同城/全网不需 → 前端可引导切到更大范围
@@ -186,24 +188,24 @@ export function registerBuyerFeedsRoutes(app, deps) {
             scopeLabel = '全网';
         }
         const dayClause = `o.updated_at > datetime('now', '-${days} day')`;
-        const totals = db.prepare(`
+        const totals = (await dbOne(`
       SELECT COUNT(DISTINCT o.buyer_id) as au, COUNT(*) as orders
       FROM orders o JOIN users u ON u.id = o.buyer_id
       WHERE ${where} AND o.status = 'completed' AND ${dayClause}
-    `).get(...args);
+    `, args));
         const sufficient = Number(totals.au) >= K;
-        const topProducts = sufficient ? db.prepare(`
+        const topProducts = sufficient ? await dbAll(`
       SELECT p.id, p.title, p.price, p.category, p.images, COUNT(DISTINCT o.buyer_id) as buyers
       FROM orders o JOIN users u ON u.id = o.buyer_id JOIN products p ON p.id = o.product_id
       WHERE ${where} AND o.status = 'completed' AND ${dayClause}
       GROUP BY p.id HAVING buyers >= ? ORDER BY buyers DESC LIMIT 10
-    `).all(...args, K) : [];
-        const topCategories = sufficient ? db.prepare(`
+    `, [...args, K]) : [];
+        const topCategories = sufficient ? await dbAll(`
       SELECT p.category, COUNT(*) as orders, COUNT(DISTINCT o.buyer_id) as buyers
       FROM orders o JOIN users u ON u.id = o.buyer_id JOIN products p ON p.id = o.product_id
       WHERE ${where} AND o.status = 'completed' AND ${dayClause} AND p.category IS NOT NULL
       GROUP BY p.category HAVING buyers >= ? ORDER BY orders DESC LIMIT 6
-    `).all(...args, K) : [];
+    `, [...args, K]) : [];
         const staleDays = u?.geo_updated_at
             ? Math.floor((Date.now() - new Date(u.geo_updated_at.replace(' ', 'T') + 'Z').getTime()) / 86400_000)
             : null;

package/dist/pwa/routes/cart.js

@@ -1,12 +1,13 @@
 import { transition } from '../../layer0-foundation/L0-2-state-machine/engine.js';
 import { notifyTransition } from '../../layer2-business/L2-6-notifications/notification-engine.js';
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerCartRoutes(app, deps) {
     const { db, generateId, auth, isTrustedRole, errorRes, broadcastSystemEvent, checkStockAndMaybeDelist, addHours } = deps;
-    app.get('/api/cart', (req, res) => {
+    app.get('/api/cart', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const items = db.prepare(`
+        const items = await dbAll(`
       SELECT c.product_id, c.qty, c.added_at,
         p.title, p.price, p.category, p.commission_rate, p.stock, p.status as product_status,
         u.name as seller_name
@@ -15,10 +16,10 @@ export function registerCartRoutes(app, deps) {
       JOIN users u ON u.id = p.seller_id
       WHERE c.user_id = ?
       ORDER BY c.added_at DESC
-    `).all(user.id);
+    `, [user.id]);
         res.json({ items });
     });
-    app.post('/api/cart', (req, res) => {
+    app.post('/api/cart', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -26,29 +27,29 @@ export function registerCartRoutes(app, deps) {
         const q = Math.max(1, Math.min(99, Number(qty) || 1));
         if (!product_id)
             return void res.json({ error: 'product_id 必填' });
-        const product = db.prepare("SELECT id, status FROM products WHERE id = ?").get(product_id);
+        const product = await dbOne("SELECT id, status FROM products WHERE id = ?", [product_id]);
         if (!product)
             return void res.json({ error: '商品不存在' });
         if (product.status !== 'active')
             return void res.json({ error: '商品已下架' });
-        db.prepare(`
+        await dbRun(`
       INSERT INTO cart_items (user_id, product_id, qty) VALUES (?, ?, ?)
       ON CONFLICT(user_id, product_id) DO UPDATE SET qty = MIN(99, cart_items.qty + ?)
-    `).run(user.id, product_id, q, q);
+    `, [user.id, product_id, q, q]);
         res.json({ ok: true });
     });
-    app.patch('/api/cart/:product_id', (req, res) => {
+    app.patch('/api/cart/:product_id', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const q = Math.max(1, Math.min(99, Number(req.body.qty) || 1));
-        const r = db.prepare("UPDATE cart_items SET qty = ? WHERE user_id = ? AND product_id = ?").run(q, user.id, req.params.product_id);
+        const r = await dbRun("UPDATE cart_items SET qty = ? WHERE user_id = ? AND product_id = ?", [q, user.id, req.params.product_id]);
         if (r.changes === 0)
             return void res.json({ error: '购物车中没有此商品' });
         res.json({ ok: true, qty: q });
     });
     // C-1: 购物车批量下单（按 seller 自动分订单）
-    app.post('/api/cart/checkout', (req, res) => {
+    app.post('/api/cart/checkout', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -59,11 +60,11 @@ export function registerCartRoutes(app, deps) {
         const { shipping_address, notes } = req.body || {};
         if (!shipping_address)
             return void res.status(400).json({ error: '请填写收货地址' });
-        const items = db.prepare(`
+        const items = await dbAll(`
       SELECT c.product_id, c.qty, p.title, p.price, p.stock, p.seller_id, p.has_variants, p.status
       FROM cart_items c JOIN products p ON p.id = c.product_id
       WHERE c.user_id = ?
-    `).all(user.id);
+    `, [user.id]);
         if (items.length === 0)
             return void res.status(400).json({ error: '购物车为空' });
         const skipped = [];
@@ -93,7 +94,7 @@ export function registerCartRoutes(app, deps) {
         if (ok.length === 0) {
             return void res.status(400).json({ error: '购物车中无可下单商品', skipped });
         }
-        const wallet = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(user.id);
+        const wallet = await dbOne('SELECT balance FROM wallets WHERE user_id = ?', [user.id]);
         if (!wallet)
             return void res.status(500).json({ error: '钱包记录缺失' });
         if (wallet.balance < totalNeed)
@@ -145,11 +146,11 @@ export function registerCartRoutes(app, deps) {
             total_paid: created.reduce((s, c) => s + c.total, 0),
         });
     });
-    app.delete('/api/cart/:product_id', (req, res) => {
+    app.delete('/api/cart/:product_id', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        db.prepare("DELETE FROM cart_items WHERE user_id = ? AND product_id = ?").run(user.id, req.params.product_id);
+        await dbRun("DELETE FROM cart_items WHERE user_id = ? AND product_id = ?", [user.id, req.params.product_id]);
         res.json({ ok: true });
     });
 }