@seasonkoh/webaz 0.1.23 → 0.1.25

package/dist/pwa/routes/ratings.js

@@ -1,4 +1,5 @@
 import { recordRatingReputation } from '../../layer4-economics/L4-3-reputation/reputation-engine.js';
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 const RATING_BLIND_DAYS = 14;
 function parseDim(v) {
     const n = Number(v);
@@ -7,20 +8,20 @@ function parseDim(v) {
 export function registerRatingsRoutes(app, deps) {
     const { db, generateId, auth, isTrustedRole, errorRes, broadcastSystemEvent } = deps;
     // buyer → seller 评价（一单一评，仅 completed 订单可评）
-    app.post('/api/orders/:order_id/rating', (req, res) => {
+    app.post('/api/orders/:order_id/rating', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         if (isTrustedRole(user))
             return void errorRes(res, 403, 'TRUSTED_ROLE_NO_TRADE', '受信角色无购物功能');
-        const order = db.prepare('SELECT id, buyer_id, seller_id, product_id, status FROM orders WHERE id = ?').get(req.params.order_id);
+        const order = await dbOne('SELECT id, buyer_id, seller_id, product_id, status FROM orders WHERE id = ?', [req.params.order_id]);
         if (!order)
             return void res.status(404).json({ error: '订单不存在' });
         if (order.buyer_id !== user.id)
             return void res.status(403).json({ error: '仅买家可评价' });
         if (order.status !== 'completed')
             return void res.status(400).json({ error: '订单完成后才能评价' });
-        const existing = db.prepare('SELECT order_id FROM order_ratings WHERE order_id = ?').get(order.id);
+        const existing = await dbOne('SELECT order_id FROM order_ratings WHERE order_id = ?', [order.id]);
         if (existing)
             return void res.status(400).json({ error: '已评价过，每单仅可评一次' });
         const stars = Number(req.body?.stars);
@@ -55,18 +56,18 @@ export function registerRatingsRoutes(app, deps) {
         res.json({ success: true });
     });
     // seller → buyer 反向评价
-    app.post('/api/orders/:order_id/buyer-rating', (req, res) => {
+    app.post('/api/orders/:order_id/buyer-rating', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const order = db.prepare('SELECT id, buyer_id, seller_id, status FROM orders WHERE id = ?').get(req.params.order_id);
+        const order = await dbOne('SELECT id, buyer_id, seller_id, status FROM orders WHERE id = ?', [req.params.order_id]);
         if (!order)
             return void res.status(404).json({ error: '订单不存在' });
         if (order.seller_id !== user.id)
             return void res.status(403).json({ error: '仅卖家可评价买家' });
         if (order.status !== 'completed')
             return void res.status(400).json({ error: '订单完成后才能评价' });
-        const existing = db.prepare('SELECT order_id FROM buyer_ratings WHERE order_id = ?').get(order.id);
+        const existing = await dbOne('SELECT order_id FROM buyer_ratings WHERE order_id = ?', [order.id]);
         if (existing)
             return void res.status(400).json({ error: '已评价过，每单仅可评一次' });
         const stars = Number(req.body?.stars);
@@ -96,21 +97,21 @@ export function registerRatingsRoutes(app, deps) {
         res.json({ success: true });
     });
     // 查 seller → buyer 评价（双盲遮蔽：buyer 看不到，除非自己也评过 OR 窗口到期）
-    app.get('/api/orders/:order_id/buyer-rating', (req, res) => {
+    app.get('/api/orders/:order_id/buyer-rating', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const order = db.prepare('SELECT buyer_id, seller_id FROM orders WHERE id = ?').get(req.params.order_id);
+        const order = await dbOne('SELECT buyer_id, seller_id FROM orders WHERE id = ?', [req.params.order_id]);
         if (!order)
             return void res.status(404).json({ error: '订单不存在' });
         if (order.buyer_id !== user.id && order.seller_id !== user.id) {
             return void res.status(403).json({ error: '无权查看' });
         }
-        const br = db.prepare(`SELECT stars, comment, dim_payment_speed, dim_communication, dim_responsiveness, hidden_until, created_at FROM buyer_ratings WHERE order_id = ?`).get(req.params.order_id);
+        const br = await dbOne(`SELECT stars, comment, dim_payment_speed, dim_communication, dim_responsiveness, hidden_until, created_at FROM buyer_ratings WHERE order_id = ?`, [req.params.order_id]);
         if (!br)
             return void res.json({ item: null });
         const isBuyerView = order.buyer_id === user.id;
-        const buyerAlsoRated = !!db.prepare(`SELECT order_id FROM order_ratings WHERE order_id = ?`).get(req.params.order_id);
+        const buyerAlsoRated = !!(await dbOne(`SELECT order_id FROM order_ratings WHERE order_id = ?`, [req.params.order_id]));
         const blindExpired = br.hidden_until && new Date(br.hidden_until) < new Date();
         if (isBuyerView && !buyerAlsoRated && !blindExpired) {
             return void res.json({ item: { masked: true, hidden_until: br.hidden_until, reason: 'blind_until_both_or_expire' } });
@@ -118,32 +119,32 @@ export function registerRatingsRoutes(app, deps) {
         res.json({ item: br });
     });
     // 查 buyer → seller 评价（双盲遮蔽：seller 视角同样）
-    app.get('/api/orders/:order_id/rating', (req, res) => {
+    app.get('/api/orders/:order_id/rating', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const order = db.prepare('SELECT buyer_id, seller_id FROM orders WHERE id = ?').get(req.params.order_id);
+        const order = await dbOne('SELECT buyer_id, seller_id FROM orders WHERE id = ?', [req.params.order_id]);
         if (!order)
             return void res.status(404).json({ error: '订单不存在' });
         if (order.buyer_id !== user.id && order.seller_id !== user.id) {
             return void res.status(403).json({ error: '无权查看' });
         }
-        const r = db.prepare('SELECT stars, comment, reply, replied_at, buyer_followup, buyer_followup_at, dim_quality, dim_speed, dim_service, hidden_until, created_at FROM order_ratings WHERE order_id = ?').get(req.params.order_id);
+        const r = await dbOne('SELECT stars, comment, reply, replied_at, buyer_followup, buyer_followup_at, dim_quality, dim_speed, dim_service, hidden_until, created_at FROM order_ratings WHERE order_id = ?', [req.params.order_id]);
         if (!r)
             return void res.json({ item: null });
         const isSellerView = order.seller_id === user.id;
-        const sellerAlsoRated = !!db.prepare(`SELECT order_id FROM buyer_ratings WHERE order_id = ?`).get(req.params.order_id);
+        const sellerAlsoRated = !!(await dbOne(`SELECT order_id FROM buyer_ratings WHERE order_id = ?`, [req.params.order_id]));
         const blindExpired = r.hidden_until && new Date(r.hidden_until) < new Date();
         if (isSellerView && !sellerAlsoRated && !blindExpired) {
             return void res.json({ item: { masked: true, hidden_until: r.hidden_until, reason: 'blind_until_both_or_expire' } });
         }
         res.json({ item: r });
     });
-    app.post('/api/orders/:order_id/rating/reply', (req, res) => {
+    app.post('/api/orders/:order_id/rating/reply', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const r = db.prepare('SELECT seller_id, reply FROM order_ratings WHERE order_id = ?').get(req.params.order_id);
+        const r = await dbOne('SELECT seller_id, reply FROM order_ratings WHERE order_id = ?', [req.params.order_id]);
         if (!r)
             return void res.status(404).json({ error: '该订单暂无评价' });
         if (r.seller_id !== user.id)
@@ -153,15 +154,15 @@ export function registerRatingsRoutes(app, deps) {
         const reply = req.body?.reply ? String(req.body.reply).slice(0, 500) : null;
         if (!reply)
             return void res.status(400).json({ error: '回复不能为空' });
-        db.prepare(`UPDATE order_ratings SET reply = ?, replied_at = datetime('now') WHERE order_id = ?`).run(reply, req.params.order_id);
+        await dbRun(`UPDATE order_ratings SET reply = ?, replied_at = datetime('now') WHERE order_id = ?`, [reply, req.params.order_id]);
         res.json({ success: true });
     });
     // W3 买家追问 — 在卖家 reply 后可追问一次
-    app.post('/api/orders/:order_id/rating/followup', (req, res) => {
+    app.post('/api/orders/:order_id/rating/followup', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const r = db.prepare('SELECT buyer_id, reply, buyer_followup FROM order_ratings WHERE order_id = ?').get(req.params.order_id);
+        const r = await dbOne('SELECT buyer_id, reply, buyer_followup FROM order_ratings WHERE order_id = ?', [req.params.order_id]);
         if (!r)
             return void res.status(404).json({ error: '该订单暂无评价' });
         if (r.buyer_id !== user.id)
@@ -173,15 +174,14 @@ export function registerRatingsRoutes(app, deps) {
         const followup = req.body?.followup ? String(req.body.followup).trim().slice(0, 200) : '';
         if (followup.length < 2)
             return void res.status(400).json({ error: '追问内容至少 2 字' });
-        db.prepare(`UPDATE order_ratings SET buyer_followup = ?, buyer_followup_at = datetime('now') WHERE order_id = ?`)
-            .run(followup, req.params.order_id);
+        await dbRun(`UPDATE order_ratings SET buyer_followup = ?, buyer_followup_at = datetime('now') WHERE order_id = ?`, [followup, req.params.order_id]);
         res.json({ success: true });
     });
     // 公开：商品评价 + 聚合（仅展示双盲已揭晓的）
-    app.get('/api/products/:product_id/ratings', (req, res) => {
+    app.get('/api/products/:product_id/ratings', async (req, res) => {
         const limit = Math.min(50, Math.max(1, Number(req.query.limit) || 20));
         const blindOpen = `(EXISTS (SELECT 1 FROM buyer_ratings br WHERE br.order_id = r.order_id) OR r.hidden_until IS NULL OR datetime(r.hidden_until) <= datetime('now'))`;
-        const rows = db.prepare(`
+        const rows = await dbAll(`
       SELECT r.stars, r.comment, r.reply, r.replied_at, r.buyer_followup, r.buyer_followup_at, r.created_at,
              r.dim_quality, r.dim_speed, r.dim_service,
              u.name as buyer_name, u.handle as buyer_handle
@@ -189,8 +189,8 @@ export function registerRatingsRoutes(app, deps) {
       JOIN users u ON u.id = r.buyer_id
       WHERE r.product_id = ? AND ${blindOpen}
       ORDER BY r.created_at DESC LIMIT ?
-    `).all(req.params.product_id, limit);
-        const agg = db.prepare(`
+    `, [req.params.product_id, limit]);
+        const agg = await dbOne(`
       SELECT COUNT(*) as cnt, COALESCE(AVG(stars), 0) as avg_stars,
         SUM(CASE WHEN stars = 5 THEN 1 ELSE 0 END) as s5,
         SUM(CASE WHEN stars = 4 THEN 1 ELSE 0 END) as s4,
@@ -198,13 +198,13 @@ export function registerRatingsRoutes(app, deps) {
         SUM(CASE WHEN stars = 2 THEN 1 ELSE 0 END) as s2,
         SUM(CASE WHEN stars = 1 THEN 1 ELSE 0 END) as s1
       FROM order_ratings r WHERE product_id = ? AND ${blindOpen}
-    `).get(req.params.product_id);
+    `, [req.params.product_id]);
         res.json({ items: rows, agg });
     });
     // 公开：卖家评价聚合（卖家主页）
-    app.get('/api/sellers/:seller_id/ratings', (req, res) => {
+    app.get('/api/sellers/:seller_id/ratings', async (req, res) => {
         const limit = Math.min(50, Math.max(1, Number(req.query.limit) || 20));
-        const rows = db.prepare(`
+        const rows = await dbAll(`
       SELECT r.stars, r.comment, r.reply, r.replied_at, r.buyer_followup, r.buyer_followup_at, r.created_at, r.product_id,
              p.title as product_title,
              u.name as buyer_name, u.handle as buyer_handle
@@ -213,8 +213,8 @@ export function registerRatingsRoutes(app, deps) {
       JOIN users u ON u.id = r.buyer_id
       WHERE r.seller_id = ?
       ORDER BY r.created_at DESC LIMIT ?
-    `).all(req.params.seller_id, limit);
-        const agg = db.prepare(`SELECT COUNT(*) as cnt, COALESCE(AVG(stars), 0) as avg_stars FROM order_ratings WHERE seller_id = ?`).get(req.params.seller_id);
+    `, [req.params.seller_id, limit]);
+        const agg = await dbOne(`SELECT COUNT(*) as cnt, COALESCE(AVG(stars), 0) as avg_stars FROM order_ratings WHERE seller_id = ?`, [req.params.seller_id]);
         res.json({ items: rows, agg });
     });
 }

package/dist/pwa/routes/recover-key.js

@@ -1,8 +1,10 @@
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerRecoverKeyRoutes(app, deps) {
-    const { db, internalAuditorId, issueCode, findActiveCode, CODE_TTL_MIN, MAX_CODE_ATTEMPTS } = deps;
+    // db 已走 RFC-016 异步 seam(dbOne/dbAll/dbRun),不再直接用 deps.db
+    const { internalAuditorId, issueCode, findActiveCode, CODE_TTL_MIN, MAX_CODE_ATTEMPTS } = deps;
     // IP 级速率（5/min）— 防爆破列举账户
     const recoverKeyHits = new Map();
-    app.post('/api/recover-key', (req, res) => {
+    app.post('/api/recover-key', async (req, res) => {
         const ip = req.ip || '';
         if (ip) {
             const now = Date.now();
@@ -24,7 +26,7 @@ export function registerRecoverKeyRoutes(app, deps) {
         const { name } = req.body;
         if (!name?.trim())
             return void res.json({ error: '请填写注册时使用的名称' });
-        const rows = db.prepare("SELECT name, role, api_key, email, phone, created_at FROM users WHERE name = ? AND id NOT IN ('sys_protocol', ?)").all(name.trim(), internalAuditorId);
+        const rows = await dbAll("SELECT name, role, api_key, email, phone, created_at FROM users WHERE name = ? AND id NOT IN ('sys_protocol', ?)", [name.trim(), internalAuditorId]);
         if (rows.length === 0)
             return void res.json({ error: '未找到该名称的账号' });
         const mask = (s) => s && s.length > 8 ? `${s.slice(0, 4)}…${s.slice(-4)}` : s;
@@ -54,16 +56,16 @@ export function registerRecoverKeyRoutes(app, deps) {
         });
     });
     // 步骤 1：发送验证码到已绑定邮箱（防泄露：找没找到都同响应）
-    app.post('/api/recover-key/start', (req, res) => {
+    app.post('/api/recover-key/start', async (req, res) => {
         const { name, email } = req.body;
         if (!name?.trim() || !email?.trim())
             return void res.json({ error: '请填写名称和邮箱' });
         const target = email.trim().toLowerCase();
-        const user = db.prepare(`
+        const user = await dbOne(`
       SELECT id, name, email FROM users
       WHERE name = ? AND email = ? AND email_verified = 1
         AND id NOT IN ('sys_protocol', ?) LIMIT 1
-    `).get(name.trim(), target, internalAuditorId);
+    `, [name.trim(), target, internalAuditorId]);
         if (user)
             issueCode(user.id, 'email', target, 'recover_key');
         res.json({
@@ -73,7 +75,7 @@ export function registerRecoverKeyRoutes(app, deps) {
         });
     });
     // 步骤 2：提交验证码 → 返回完整 api_key
-    app.post('/api/recover-key/confirm', (req, res) => {
+    app.post('/api/recover-key/confirm', async (req, res) => {
         const { name, email, code } = req.body;
         if (!name?.trim() || !email?.trim() || !code?.trim())
             return void res.json({ error: '请填写完整信息' });
@@ -81,20 +83,19 @@ export function registerRecoverKeyRoutes(app, deps) {
         const row = findActiveCode('email', target, 'recover_key');
         if (!row)
             return void res.json({ error: '验证码已过期或未发送，请重新开始' });
-        const user = db.prepare(`SELECT id, name, api_key FROM users WHERE id = ?`).get(row.user_id);
+        const user = await dbOne(`SELECT id, name, api_key FROM users WHERE id = ?`, [row.user_id]);
         if (!user || user.name !== name.trim())
             return void res.json({ error: '名称与验证码不匹配' });
         if (String(row.code) !== code.trim()) {
             const attempts = row.attempts + 1;
             if (attempts >= MAX_CODE_ATTEMPTS) {
-                db.prepare("UPDATE verification_codes SET attempts = ?, used_at = datetime('now') WHERE id = ?")
-                    .run(attempts, row.id);
+                await dbRun("UPDATE verification_codes SET attempts = ?, used_at = datetime('now') WHERE id = ?", [attempts, row.id]);
                 return void res.json({ error: '错误次数过多，验证码已作废，请重新开始' });
             }
-            db.prepare("UPDATE verification_codes SET attempts = ? WHERE id = ?").run(attempts, row.id);
+            await dbRun("UPDATE verification_codes SET attempts = ? WHERE id = ?", [attempts, row.id]);
             return void res.json({ error: `验证码错误（剩余 ${MAX_CODE_ATTEMPTS - attempts} 次）` });
         }
-        db.prepare("UPDATE verification_codes SET used_at = datetime('now') WHERE id = ?").run(row.id);
+        await dbRun("UPDATE verification_codes SET used_at = datetime('now') WHERE id = ?", [row.id]);
         res.json({ success: true, api_key: user.api_key, name: user.name });
     });
 }

package/dist/pwa/routes/referral.js

@@ -1,28 +1,31 @@
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerReferralRoutes(app, deps) {
-    const { db, auth, requireProtocolAdmin, logAdminAction, issueInviteSlot, inviteRotationLookup } = deps;
+    // db 已全量走 RFC-016 异步 seam(dbOne/dbAll/dbRun),不再直接用 deps.db
+    const { auth, requireProtocolAdmin, logAdminAction, issueInviteSlot, inviteRotationLookup } = deps;
     // B-1: 个人邀请 dashboard
-    app.get('/api/referral/me', (req, res) => {
+    app.get('/api/referral/me', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const code = user.permanent_code || null;
         // 我直接邀请的人
-        const directInvitees = db.prepare(`
+        const directInvitees = await dbAll(`
       SELECT u.id, u.handle, u.name, u.role, u.created_at,
         (SELECT COUNT(*) FROM orders WHERE buyer_id = u.id AND status = 'completed') as completed_orders,
         (SELECT COALESCE(SUM(total_amount), 0) FROM orders WHERE buyer_id = u.id AND status = 'completed') as gmv
       FROM users u WHERE u.sponsor_id = ?
       ORDER BY u.created_at DESC LIMIT 50
-    `).all(user.id);
+    `, [user.id]);
         // 推土机奖励 / 商品分享佣金（commission_records 按订单粒度）
-        const earnings = db.prepare(`
+        const earnings = (await dbOne(`
       SELECT COUNT(*) as cnt, COALESCE(SUM(amount), 0) as total FROM commission_records WHERE beneficiary_id = ?
-    `).get(user.id);
-        const todayEarnings = db.prepare(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-1 day')`).get(user.id).t;
-        const monthEarnings = db.prepare(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-30 days')`).get(user.id).t;
+    `, [user.id]));
+        const todayEarnings = (await dbOne(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-1 day')`, [user.id])).t;
+        const monthEarnings = (await dbOne(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-30 days')`, [user.id])).t;
         res.json({
             invite_code: code,
-            invite_link: code ? `${req.protocol}://${req.get('host')}/?ref=${code}` : null,
+            invite_link: code ? `${req.protocol}://${req.get('host')}/i/${code}` : null,
+            invite_unavailable_reason: code ? null : 'permanent_code_missing — refresh or contact support',
             direct_invitees_count: directInvitees.length,
             direct_invitees: directInvitees,
             earnings: {
@@ -34,8 +37,8 @@ export function registerReferralRoutes(app, deps) {
         });
     });
     // 公开邀请码轮询（开关 ON 时）
-    app.post('/api/invite/rotate', (_req, res) => {
-        const enabled = db.prepare("SELECT value FROM system_state WHERE key='invite_rotation_enabled'").get()?.value === '1';
+    app.post('/api/invite/rotate', async (_req, res) => {
+        const enabled = (await dbOne("SELECT value FROM system_state WHERE key='invite_rotation_enabled'"))?.value === '1';
         if (!enabled)
             return void res.status(403).json({ error: '邀请码获取暂未开放', enabled: false });
         const slot = issueInviteSlot();
@@ -45,20 +48,20 @@ export function registerReferralRoutes(app, deps) {
         res.json({ enabled: true, code: u.code });
     });
     // protocol 开关
-    app.post('/api/admin/invite-rotation/toggle', (req, res) => {
+    app.post('/api/admin/invite-rotation/toggle', async (req, res) => {
         const admin = requireProtocolAdmin(req, res);
         if (!admin)
             return;
         const { enabled } = req.body;
         const v = enabled ? '1' : '0';
-        db.prepare("INSERT OR REPLACE INTO system_state (key, value) VALUES ('invite_rotation_enabled', ?)").run(v);
+        await dbRun("INSERT OR REPLACE INTO system_state (key, value) VALUES ('invite_rotation_enabled', ?)", [v]);
         logAdminAction(admin.id, 'invite_rotation_toggle', 'system', 'invite_rotation_enabled', { value: v });
         res.json({ success: true, enabled: !!enabled });
     });
     // RFC-003 #1122: 生成商品分享链接(把 MCP webaz_share_link 的本地计算搬到服务端,
     // 让 MCP NETWORK 模式可代理)。RFC-002 §3.5 valuation-layer gate:需 rewards opt-in。
     // 与 PWA pickPreferredSide 对齐的 side 选择(team_count | pv_count)。
-    app.get('/api/share-link', (req, res) => {
+    app.get('/api/share-link', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -67,16 +70,16 @@ export function registerReferralRoutes(app, deps) {
         const sideArg = String(req.query.side || 'auto');
         if (!productId)
             return void res.status(400).json({ error: 'product_id required', error_code: 'PRODUCT_ID_REQUIRED' });
-        const optIn = db.prepare("SELECT rewards_opted_in FROM users WHERE id = ?").get(userId)?.rewards_opted_in ?? 0;
+        const optIn = (await dbOne("SELECT rewards_opted_in FROM users WHERE id = ?", [userId]))?.rewards_opted_in ?? 0;
         if (optIn !== 1) {
-            const getParam = (key, def) => {
-                const r = db.prepare("SELECT value FROM protocol_params WHERE key = ?").get(key);
+            const getParam = async (key, def) => {
+                const r = await dbOne("SELECT value FROM protocol_params WHERE key = ?", [key]);
                 return r ? Number(r.value) : def;
             };
-            const minOrders = getParam('rewards_opt_in.min_completed_orders', 1);
-            const requirePasskey = getParam('rewards_opt_in.require_passkey', 1);
-            const totalCompleted = db.prepare("SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'").get(userId).n;
-            const passkeyCount = db.prepare("SELECT COUNT(*) as n FROM webauthn_credentials WHERE user_id = ?").get(userId).n;
+            const minOrders = await getParam('rewards_opt_in.min_completed_orders', 1);
+            const requirePasskey = await getParam('rewards_opt_in.require_passkey', 1);
+            const totalCompleted = (await dbOne("SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'", [userId])).n;
+            const passkeyCount = (await dbOne("SELECT COUNT(*) as n FROM webauthn_credentials WHERE user_id = ?", [userId])).n;
             const missing = [];
             if (totalCompleted < minOrders)
                 missing.push(`completed_orders ${totalCompleted}/${minOrders}`);
@@ -86,16 +89,16 @@ export function registerReferralRoutes(app, deps) {
                 missing.push('application_not_submitted');
             return void res.status(403).json({
                 error: 'rewards_opt_in_required',
-                message: 'Share-link generation is a valuation-layer action — requires builder-identity opt-in (RFC-002 §3.5)',
+                message: 'Share-link generation is a valuation-layer (rewards / share-link) action, NOT a contribution gate — requires rewards / share-commission opt-in (RFC-002 §3.5)',
                 missing_requirements: missing,
                 next_steps: [
-                    'Open PWA #me → tap "申请共建身份 / Apply for builder identity"',
+                    'Open PWA #me → tap "申请分享分润 / Enable share-commission opt-in"',
                     'Read the 8-second disclosure (cannot skip)',
                     'Submit application — pre-checks run server-side',
                 ],
             });
         }
-        const product = db.prepare("SELECT id, title, price, commission_rate FROM products WHERE id = ? AND status='active'").get(productId);
+        const product = await dbOne("SELECT id, title, price, commission_rate FROM products WHERE id = ? AND status='active'", [productId]);
         if (!product)
             return void res.status(404).json({ error: '商品不存在或已下架', error_code: 'PRODUCT_NOT_FOUND' });
         let side = 'right';
@@ -103,14 +106,12 @@ export function registerReferralRoutes(app, deps) {
             side = sideArg;
         }
         else {
-            const u = db.prepare("SELECT placement_pref, total_left_pv, total_right_pv, left_count, right_count FROM users WHERE id = ?")
-                .get(userId);
+            const u = await dbOne("SELECT placement_pref, total_left_pv, total_right_pv, left_count, right_count FROM users WHERE id = ?", [userId]);
             const pref = u?.placement_pref || 'team_count';
             if (pref === 'pv_count') {
                 const since = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000).toISOString().slice(0, 19).replace('T', ' ');
-                const w = db.prepare(`SELECT COALESCE(SUM(consumed_left_pv),0) AS l, COALESCE(SUM(consumed_right_pv),0) AS r
-                              FROM binary_score_records WHERE user_id = ? AND created_at >= ?`)
-                    .get(userId, since);
+                const w = (await dbOne(`SELECT COALESCE(SUM(consumed_left_pv),0) AS l, COALESCE(SUM(consumed_right_pv),0) AS r
+                              FROM binary_score_records WHERE user_id = ? AND created_at >= ?`, [userId, since]));
                 const leftPv = Number(u?.total_left_pv ?? 0) + Number(w.l);
                 const rightPv = Number(u?.total_right_pv ?? 0) + Number(w.r);
                 side = leftPv <= rightPv ? 'left' : 'right';
@@ -119,11 +120,15 @@ export function registerReferralRoutes(app, deps) {
                 side = (Number(u?.left_count ?? 0) <= Number(u?.right_count ?? 0)) ? 'left' : 'right';
             }
         }
-        const completed = db.prepare("SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'").get(userId).n;
-        const override = db.prepare("SELECT l1_share_override FROM users WHERE id = ?").get(userId)?.l1_share_override ?? 0;
+        const completed = (await dbOne("SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'", [userId])).n;
+        const override = (await dbOne("SELECT l1_share_override FROM users WHERE id = ?", [userId]))?.l1_share_override ?? 0;
         const canL1 = override === 1 || (override === 0 && completed > 0);
         const rate = Number(product.commission_rate ?? 0);
-        const link = `/?ref=${userId}&side=${side}#order-product/${productId}`;
+        // share ref uses permanent_code ONLY — never the raw user_id; fail clearly if it's missing.
+        const refCode = (await dbOne("SELECT permanent_code FROM users WHERE id = ?", [userId]))?.permanent_code || null;
+        if (!refCode)
+            return void res.status(409).json({ error: '邀请码暂不可用，请刷新或联系支持', error_code: 'PERMANENT_CODE_MISSING' });
+        const link = `/?ref=${refCode}&side=${side}#order-product/${productId}`;
         res.json({
             product: { id: product.id, title: product.title, price: product.price, commission_rate: rate },
             share_link: link,

package/dist/pwa/routes/reputation.js

@@ -1,3 +1,4 @@
+import { dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerReputationRoutes(app, deps) {
     const { db, auth, getReputation, getSellerMetrics } = deps;
     app.get('/api/reputation', (req, res) => {
@@ -16,9 +17,9 @@ export function registerReputationRoutes(app, deps) {
             metrics: getSellerMetrics(user.id),
         });
     });
-    app.get('/api/reputation/:userId', (req, res) => {
+    app.get('/api/reputation/:userId', async (req, res) => {
         const rep = getReputation(db, req.params.userId);
-        const decayRow = db.prepare(`SELECT last_decay_at FROM reputation_scores WHERE user_id = ?`).get(req.params.userId);
+        const decayRow = await dbOne(`SELECT last_decay_at FROM reputation_scores WHERE user_id = ?`, [req.params.userId]);
         res.json({
             level: rep.level,
             total_points: rep.total_points,