@seasonkoh/webaz 0.1.24 → 0.1.26

package/dist/pwa/routes/auction.js

@@ -1,6 +1,8 @@
 // RFC-014 PR6 — 拍卖 stake 锁定/释放走整数 base-units + 绝对值落库。
 import { toUnits } from '../../money.js';
 import { applyWalletDelta } from '../../ledger.js';
+// RFC-016 Phase 1 — 纯校验读/公开读/读回 → async seam;db.transaction 内 stake 写序列 + cron 保持同步。
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js';
 // ─── 拍卖常量（域内）──────────────────────────────────────────
 const AUC_MAX_WINDOW_MIN = 14 * 24 * 60; // 14 天上限
 const AUC_MIN_WINDOW_MIN = 5;
@@ -54,9 +56,9 @@ export function fireDueAuctionReminders(db, generateId) {
     return { fired };
 }
 export function registerAuctionRoutes(app, deps) {
-    const { db, auth, generateId, RFQ_MAX_QTY, RFQ_MAX_PRICE, LISTING_CATEGORIES, isListingCategoryKey, requireProtocolAdmin } = deps;
+    const { db, auth, generateId, RFQ_MAX_QTY, RFQ_MAX_PRICE, LISTING_CATEGORIES, isListingCategoryKey, requireProtocolAdmin, logAdminAction } = deps;
     // 卖家发起拍卖
-    app.post('/api/auctions', (req, res) => {
+    app.post('/api/auctions', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -90,12 +92,12 @@ export function registerAuctionRoutes(app, deps) {
         const windowMin = Math.max(AUC_MIN_WINDOW_MIN, Math.min(AUC_MAX_WINDOW_MIN, Math.floor(Number(body.window_min || AUC_DEFAULT_WINDOW_MIN))));
         const sniperExtend = Math.max(0, Math.min(60, Math.floor(Number(body.sniper_extend_min ?? AUC_DEFAULT_SNIPER_MIN))));
         // 频率限制
-        const today = db.prepare("SELECT COUNT(1) as n FROM auctions WHERE seller_id = ? AND created_at > datetime('now','-1 day')").get(user.id).n;
+        const today = (await dbOne("SELECT COUNT(1) as n FROM auctions WHERE seller_id = ? AND created_at > datetime('now','-1 day')", [user.id])).n;
         if (today >= AUC_DAILY_CAP_PER_SELLER)
             return void res.json({ error: `今日已达上限 ${AUC_DAILY_CAP_PER_SELLER} 场拍卖` });
         // 卖家担保金
         const sellerStake = aucSellerStake(startingPrice);
-        const wallet = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(user.id);
+        const wallet = await dbOne('SELECT balance FROM wallets WHERE user_id = ?', [user.id]);
         if (!wallet || Number(wallet.balance) < sellerStake) {
             return void res.json({ error: `余额不足，卖家担保金 ${sellerStake} WAZ（5% × 起拍价）` });
         }
@@ -103,7 +105,7 @@ export function registerAuctionRoutes(app, deps) {
         let productId = null;
         if (body.product_id) {
             productId = String(body.product_id);
-            const p = db.prepare("SELECT seller_id, stock, status FROM products WHERE id = ?").get(productId);
+            const p = await dbOne("SELECT seller_id, stock, status FROM products WHERE id = ?", [productId]);
             if (!p)
                 return void res.json({ error: '关联商品不存在' });
             if (p.seller_id !== user.id)
@@ -114,19 +116,43 @@ export function registerAuctionRoutes(app, deps) {
                 return void res.json({ error: `库存不足（${p.stock} < ${qty}）` });
         }
         const id = generateId('auc');
-        db.transaction(() => {
-            db.prepare(`
-        INSERT INTO auctions (id, seller_id, listing_id, product_id, title, spec_json, qty, category,
-          starting_price, current_price, min_increment, reserve_price, deadline_at, sniper_extend_min,
-          seller_stake_locked, notes)
-        VALUES (?,?,?,?,?,?,?,?,?,?,?,?,datetime('now', '+' || ? || ' minutes'),?,?,?)
-      `).run(id, user.id, body.listing_id ? String(body.listing_id) : null, productId, title, body.spec_json ? JSON.stringify(body.spec_json) : null, qty, cat, startingPrice, startingPrice, minIncrement, reservePrice, windowMin, sniperExtend, sellerStake, body.notes ? String(body.notes).slice(0, 500) : null);
-            applyWalletDelta(db, user.id, { balance: -toUnits(sellerStake), staked: toUnits(sellerStake) });
-            if (productId)
-                db.prepare("UPDATE products SET status = 'auction_pending', updated_at = datetime('now') WHERE id = ?").run(productId);
-        })();
-        // QA 轮 12 P1：返回完整 echo 字段 + ISO deadline_at 与 detail 一致
-        const created = db.prepare('SELECT deadline_at, status FROM auctions WHERE id = ?').get(id);
+        try {
+            db.transaction(() => {
+                // 余额守恒 guard(Codex PR#228 P1):tx 内重读余额并在任何写之前判定。
+                // 上面 `await dbOne` 预检与同步 stake tx 之间有 yield,并发请求可都通过陈旧余额预检后
+                // 双双锁押 → 超额。同步 tx 体内无 yield,这次重读反映已提交的扣减,失败即抛回滚。
+                const wTx = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(user.id);
+                if (!wTx || Number(wTx.balance) < sellerStake)
+                    throw new Error('AUC_INSUFFICIENT');
+                db.prepare(`
+          INSERT INTO auctions (id, seller_id, listing_id, product_id, title, spec_json, qty, category,
+            starting_price, current_price, min_increment, reserve_price, deadline_at, sniper_extend_min,
+            seller_stake_locked, notes)
+          VALUES (?,?,?,?,?,?,?,?,?,?,?,?,datetime('now', '+' || ? || ' minutes'),?,?,?)
+        `).run(id, user.id, body.listing_id ? String(body.listing_id) : null, productId, title, body.spec_json ? JSON.stringify(body.spec_json) : null, qty, cat, startingPrice, startingPrice, minIncrement, reservePrice, windowMin, sniperExtend, sellerStake, body.notes ? String(body.notes).slice(0, 500) : null);
+                applyWalletDelta(db, user.id, { balance: -toUnits(sellerStake), staked: toUnits(sellerStake) });
+                // 商品状态机 CAS(Codex follow-up #239):active→auction_pending 必须带 status 守卫。
+                // 上面 `await dbOne` 校验 status='active' 与同步 tx 间有 yield,并发 create 可都通过陈旧
+                // 'active' 预检 → 同一商品被双双挂进两个拍卖。CAS changes=0 即已被他人移走,抛回滚。
+                if (productId) {
+                    const flipped = db.prepare("UPDATE products SET status = 'auction_pending', updated_at = datetime('now') WHERE id = ? AND status = 'active'").run(productId);
+                    if (flipped.changes === 0)
+                        throw new Error('AUC_PRODUCT_CONFLICT');
+                }
+            })();
+        }
+        catch (e) {
+            const msg = e.message;
+            if (msg === 'AUC_INSUFFICIENT') {
+                return void res.json({ error: `余额不足，卖家担保金 ${sellerStake} WAZ（5% × 起拍价）` });
+            }
+            if (msg === 'AUC_PRODUCT_CONFLICT') {
+                return void res.json({ error: '关联商品状态已变更（可能已被上架到其它拍卖或下架），请刷新后重试' });
+            }
+            throw e;
+        }
+        // QA 轮 12 P1：返回完整 echo 字段 + ISO deadline_at 与 detail 一致(tx 后纯读回)
+        const created = (await dbOne('SELECT deadline_at, status FROM auctions WHERE id = ?', [id]));
         res.json({
             id,
             seller_stake: sellerStake,
@@ -145,7 +171,7 @@ export function registerAuctionRoutes(app, deps) {
         });
     });
     // 看板：浏览公开拍卖（匿名可访问）
-    app.get('/api/auctions', (req, res) => {
+    app.get('/api/auctions', async (req, res) => {
         const where = ["a.status = 'open'", "a.deadline_at > datetime('now')"];
         const args = [];
         if (req.query.category) {
@@ -159,7 +185,7 @@ export function registerAuctionRoutes(app, deps) {
             args.push(like, like);
         }
         const limit = Math.min(100, Math.max(1, Number(req.query.limit) || 30));
-        const rows = db.prepare(`
+        const rows = await dbAll(`
       SELECT a.id, a.seller_id, a.title, a.qty, a.category, a.starting_price, a.current_price,
              a.min_increment, a.reserve_price, a.deadline_at, a.bid_count, a.sniper_extend_min, a.created_at,
              u.handle as seller_handle, u.region as seller_region
@@ -168,42 +194,42 @@ export function registerAuctionRoutes(app, deps) {
       WHERE ${where.join(' AND ')}
       ORDER BY a.deadline_at ASC
       LIMIT ?
-    `).all(...args, limit);
+    `, [...args, limit]);
         res.json({ items: rows, categories: LISTING_CATEGORIES });
     });
     // 我的：买家=我出过价的，卖家=我发起的
-    app.get('/api/auctions/mine', (req, res) => {
+    app.get('/api/auctions/mine', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const seller = db.prepare(`SELECT * FROM auctions WHERE seller_id = ? ORDER BY created_at DESC LIMIT 50`).all(user.id);
-        const buyer = db.prepare(`
+        const seller = await dbAll(`SELECT * FROM auctions WHERE seller_id = ? ORDER BY created_at DESC LIMIT 50`, [user.id]);
+        const buyer = await dbAll(`
       SELECT DISTINCT a.*, (SELECT b.price FROM auction_bids b WHERE b.auction_id = a.id AND b.buyer_id = ? ORDER BY b.submitted_at DESC LIMIT 1) as my_last_bid,
         (SELECT b.status FROM auction_bids b WHERE b.auction_id = a.id AND b.buyer_id = ? ORDER BY b.submitted_at DESC LIMIT 1) as my_last_status
       FROM auctions a
       JOIN auction_bids b ON b.auction_id = a.id
       WHERE b.buyer_id = ? ORDER BY a.created_at DESC LIMIT 50
-    `).all(user.id, user.id, user.id);
+    `, [user.id, user.id, user.id]);
         res.json({ as_seller: seller, as_buyer: buyer });
     });
     // 详情：含 bid 历史（buyer 身份脱敏；卖家+出价人本人 可见全名）
-    app.get('/api/auctions/:id', (req, res) => {
+    app.get('/api/auctions/:id', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const auc = db.prepare('SELECT * FROM auctions WHERE id = ?').get(req.params.id);
+        const auc = await dbOne('SELECT * FROM auctions WHERE id = ?', [req.params.id]);
         if (!auc)
             return void res.status(404).json({ error: '拍卖不存在' });
         const isSellerSelf = auc.seller_id === user.id;
         const isSettled = auc.status !== 'open';
-        const bids = db.prepare(`
+        const bids = await dbAll(`
       SELECT b.id, b.buyer_id, b.price, b.stake_locked, b.status, b.submitted_at, b.resolved_at,
         u.handle as buyer_handle
       FROM auction_bids b
       LEFT JOIN users u ON u.id = b.buyer_id
       WHERE b.auction_id = ?
       ORDER BY b.price DESC, b.submitted_at ASC
-    `).all(req.params.id);
+    `, [req.params.id]);
         // 脱敏：非 (卖家/拍卖结束/出价人本人) 时，buyer_id 用后 6 位 + handle 隐藏
         const safeBids = bids.map(b => {
             const isMine = b.buyer_id === user.id;
@@ -218,11 +244,11 @@ export function registerAuctionRoutes(app, deps) {
         res.json({ auction: auc, bids: safeBids, is_seller: isSellerSelf });
     });
     // 拍卖「⏰ 提醒我」(#959)
-    app.post('/api/auctions/:id/remind', (req, res) => {
+    app.post('/api/auctions/:id/remind', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const aucRow = db.prepare("SELECT id, deadline_at, status, seller_id FROM auctions WHERE id = ?").get(req.params.id);
+        const aucRow = await dbOne("SELECT id, deadline_at, status, seller_id FROM auctions WHERE id = ?", [req.params.id]);
         if (!aucRow)
             return void res.status(404).json({ error: '拍卖不存在' });
         if (aucRow.seller_id === user.id)
@@ -246,28 +272,28 @@ export function registerAuctionRoutes(app, deps) {
         tx();
         res.json({ ok: true, subscribed: true, leads_minutes: AUCTION_REMINDER_LEADS });
     });
-    app.delete('/api/auctions/:id/remind', (req, res) => {
+    app.delete('/api/auctions/:id/remind', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const r = db.prepare("DELETE FROM auction_reminders WHERE auction_id = ? AND user_id = ?").run(req.params.id, user.id);
+        const r = await dbRun("DELETE FROM auction_reminders WHERE auction_id = ? AND user_id = ?", [req.params.id, user.id]);
         res.json({ ok: true, deleted: r.changes });
     });
-    app.get('/api/auctions/:id/remind', (req, res) => {
+    app.get('/api/auctions/:id/remind', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const rows = db.prepare("SELECT lead_minutes, fire_at, sent_at FROM auction_reminders WHERE auction_id = ? AND user_id = ? ORDER BY lead_minutes DESC").all(req.params.id, user.id);
+        const rows = await dbAll("SELECT lead_minutes, fire_at, sent_at FROM auction_reminders WHERE auction_id = ? AND user_id = ? ORDER BY lead_minutes DESC", [req.params.id, user.id]);
         res.json({ subscribed: rows.length > 0, reminders: rows });
     });
     // 买家：出价
-    app.post('/api/auctions/:id/bids', (req, res) => {
+    app.post('/api/auctions/:id/bids', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         if (user.role !== 'buyer')
             return void res.json({ error: '仅买家可出价' });
-        const auc = db.prepare('SELECT * FROM auctions WHERE id = ?').get(req.params.id);
+        const auc = await dbOne('SELECT * FROM auctions WHERE id = ?', [req.params.id]);
         if (!auc)
             return void res.status(404).json({ error: '拍卖不存在' });
         if (auc.status !== 'open')
@@ -298,10 +324,10 @@ export function registerAuctionRoutes(app, deps) {
         }
         const qty = Math.max(1, Math.floor(Number(auc.qty || 1)));
         const stake = aucBuyerStake(price, qty);
-        const wallet = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(user.id);
+        const wallet = await dbOne('SELECT balance FROM wallets WHERE user_id = ?', [user.id]);
         // QA 轮 12 P1：自我加价 affordability check 应含已锁旧 stake（会在 tx 内释放）
         // 否则用户必须 ≥ 2× stake 余额才能加价，UX 卡。
-        const myExisting = db.prepare("SELECT stake_locked FROM auction_bids WHERE auction_id = ? AND buyer_id = ? AND status = 'active'").get(req.params.id, user.id);
+        const myExisting = await dbOne("SELECT stake_locked FROM auction_bids WHERE auction_id = ? AND buyer_id = ? AND status = 'active'", [req.params.id, user.id]);
         const myExistingStake = Number(myExisting?.stake_locked || 0);
         const availableForBid = Number(wallet?.balance || 0) + myExistingStake;
         if (!wallet || availableForBid < stake) {
@@ -313,104 +339,117 @@ export function registerAuctionRoutes(app, deps) {
         let newDeadlineExt = null;
         let sellerTopup = 0;
         let closedErr = '';
-        db.transaction(() => {
-            // P1 #4：TX 内重读 auction 状态 + deadline 防 TOCTOU
-            const fresh = db.prepare('SELECT status, deadline_at, current_price, bid_count, seller_stake_locked, max_extends, extends_used, sniper_extend_min FROM auctions WHERE id = ?').get(req.params.id);
-            if (!fresh) {
-                closedErr = 'not_found';
-                return;
-            }
-            if (fresh.status !== 'open') {
-                closedErr = `closed_${fresh.status}`;
-                return;
-            }
-            if (fresh.deadline_at <= new Date().toISOString().replace('T', ' ').slice(0, 19)) {
-                closedErr = 'expired';
-                return;
-            }
-            // 价格重判（中间可能有别人插队）
-            const curFresh = Number(fresh.current_price);
-            const isFirstFresh = Number(fresh.bid_count) === 0;
-            if (isFirstFresh) {
-                if (price < startingPrice) {
-                    closedErr = `below_starting_${startingPrice}`;
+        try {
+            db.transaction(() => {
+                // P1 #4：TX 内重读 auction 状态 + deadline 防 TOCTOU
+                const fresh = db.prepare('SELECT status, deadline_at, current_price, bid_count, seller_stake_locked, max_extends, extends_used, sniper_extend_min FROM auctions WHERE id = ?').get(req.params.id);
+                if (!fresh) {
+                    closedErr = 'not_found';
                     return;
                 }
-            }
-            else {
-                const minNeed = Math.round((curFresh + Number(auc.min_increment)) * 100) / 100;
-                if (price < minNeed) {
-                    closedErr = `below_min_${minNeed}`;
+                if (fresh.status !== 'open') {
+                    closedErr = `closed_${fresh.status}`;
                     return;
                 }
-            }
-            // 释放本人之前的 active bid
-            const myPrev = db.prepare("SELECT id, stake_locked FROM auction_bids WHERE auction_id = ? AND buyer_id = ? AND status = 'active'").get(req.params.id, user.id);
-            if (myPrev) {
-                db.prepare("UPDATE auction_bids SET status = 'outbid', resolved_at = datetime('now') WHERE id = ?").run(myPrev.id);
-                if (myPrev.stake_locked > 0)
-                    applyWalletDelta(db, user.id, { balance: toUnits(myPrev.stake_locked), staked: -toUnits(myPrev.stake_locked) });
-            }
-            // 释放别人的最高 active bid
-            const others = db.prepare("SELECT id, buyer_id, stake_locked FROM auction_bids WHERE auction_id = ? AND status = 'active' AND buyer_id != ?").all(req.params.id, user.id);
-            for (const o of others) {
-                db.prepare("UPDATE auction_bids SET status = 'outbid', resolved_at = datetime('now') WHERE id = ?").run(o.id);
-                if (o.stake_locked > 0)
-                    applyWalletDelta(db, o.buyer_id, { balance: toUnits(o.stake_locked), staked: -toUnits(o.stake_locked) });
-            }
-            // 插入新 bid
-            db.prepare(`INSERT INTO auction_bids (id, auction_id, buyer_id, price, stake_locked) VALUES (?,?,?,?,?)`)
-                .run(id, req.params.id, user.id, price, stake);
-            applyWalletDelta(db, user.id, { balance: -toUnits(stake), staked: toUnits(stake) });
-            // P1 #9：卖家 stake 动态补足（5% × current_price，余额不足则尽量补）
-            const targetSellerStake = Math.max(1, Math.round(price * AUC_SELLER_STAKE_PCT * 100) / 100);
-            const curSellerStake = Number(fresh.seller_stake_locked) || 0;
-            if (targetSellerStake > curSellerStake) {
-                const delta = Math.round((targetSellerStake - curSellerStake) * 100) / 100;
-                const sWal = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(auc.seller_id);
-                const canTopup = sWal ? Math.min(delta, Number(sWal.balance)) : 0;
-                if (canTopup > 0) {
-                    applyWalletDelta(db, auc.seller_id, { balance: -toUnits(canTopup), staked: toUnits(canTopup) });
-                    db.prepare('UPDATE auctions SET seller_stake_locked = seller_stake_locked + ? WHERE id = ?').run(canTopup, req.params.id);
-                    sellerTopup = canTopup;
+                if (fresh.deadline_at <= new Date().toISOString().replace('T', ' ').slice(0, 19)) {
+                    closedErr = 'expired';
+                    return;
                 }
-            }
-            // P1 #5：反狙击延长（max_extends 上限保护）
-            const sniperMin = Number(fresh.sniper_extend_min || 0);
-            const deadlineMs = Date.parse(String(fresh.deadline_at).replace(' ', 'T') + 'Z');
-            const nowMs = Date.now();
-            const inSnipeWindow = sniperMin > 0 && deadlineMs - nowMs < sniperMin * 60_000;
-            const canExtend = Number(fresh.extends_used) < Number(fresh.max_extends || 10);
-            if (inSnipeWindow && canExtend) {
-                newDeadlineExt = sniperMin;
-                db.prepare(`UPDATE auctions SET current_price = ?, bid_count = bid_count + 1,
+                // 价格重判（中间可能有别人插队）
+                const curFresh = Number(fresh.current_price);
+                const isFirstFresh = Number(fresh.bid_count) === 0;
+                if (isFirstFresh) {
+                    if (price < startingPrice) {
+                        closedErr = `below_starting_${startingPrice}`;
+                        return;
+                    }
+                }
+                else {
+                    const minNeed = Math.round((curFresh + Number(auc.min_increment)) * 100) / 100;
+                    if (price < minNeed) {
+                        closedErr = `below_min_${minNeed}`;
+                        return;
+                    }
+                }
+                // 释放本人之前的 active bid
+                const myPrev = db.prepare("SELECT id, stake_locked FROM auction_bids WHERE auction_id = ? AND buyer_id = ? AND status = 'active'").get(req.params.id, user.id);
+                if (myPrev) {
+                    db.prepare("UPDATE auction_bids SET status = 'outbid', resolved_at = datetime('now') WHERE id = ?").run(myPrev.id);
+                    if (myPrev.stake_locked > 0)
+                        applyWalletDelta(db, user.id, { balance: toUnits(myPrev.stake_locked), staked: -toUnits(myPrev.stake_locked) });
+                }
+                // 释放别人的最高 active bid
+                const others = db.prepare("SELECT id, buyer_id, stake_locked FROM auction_bids WHERE auction_id = ? AND status = 'active' AND buyer_id != ?").all(req.params.id, user.id);
+                for (const o of others) {
+                    db.prepare("UPDATE auction_bids SET status = 'outbid', resolved_at = datetime('now') WHERE id = ?").run(o.id);
+                    if (o.stake_locked > 0)
+                        applyWalletDelta(db, o.buyer_id, { balance: toUnits(o.stake_locked), staked: -toUnits(o.stake_locked) });
+                }
+                // 余额守恒 guard(Codex PR#228 P1):tx 内、释放本人旧 stake 之后、锁新 stake 之前重读余额。
+                // 上面 `await dbOne` 预检与同步 tx 间的 yield 让并发请求都通过陈旧余额 → 双双锁押超额。
+                // 此时 balance 已含本人旧 stake 的释放(若有),等价于预检的 availableForBid;不足即抛回滚。
+                const wTx = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(user.id);
+                if (!wTx || Number(wTx.balance) < stake)
+                    throw new Error('AUC_INSUFFICIENT');
+                // 插入新 bid
+                db.prepare(`INSERT INTO auction_bids (id, auction_id, buyer_id, price, stake_locked) VALUES (?,?,?,?,?)`)
+                    .run(id, req.params.id, user.id, price, stake);
+                applyWalletDelta(db, user.id, { balance: -toUnits(stake), staked: toUnits(stake) });
+                // P1 #9：卖家 stake 动态补足（5% × current_price，余额不足则尽量补）
+                const targetSellerStake = Math.max(1, Math.round(price * AUC_SELLER_STAKE_PCT * 100) / 100);
+                const curSellerStake = Number(fresh.seller_stake_locked) || 0;
+                if (targetSellerStake > curSellerStake) {
+                    const delta = Math.round((targetSellerStake - curSellerStake) * 100) / 100;
+                    const sWal = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(auc.seller_id);
+                    const canTopup = sWal ? Math.min(delta, Number(sWal.balance)) : 0;
+                    if (canTopup > 0) {
+                        applyWalletDelta(db, auc.seller_id, { balance: -toUnits(canTopup), staked: toUnits(canTopup) });
+                        db.prepare('UPDATE auctions SET seller_stake_locked = seller_stake_locked + ? WHERE id = ?').run(canTopup, req.params.id);
+                        sellerTopup = canTopup;
+                    }
+                }
+                // P1 #5：反狙击延长（max_extends 上限保护）
+                const sniperMin = Number(fresh.sniper_extend_min || 0);
+                const deadlineMs = Date.parse(String(fresh.deadline_at).replace(' ', 'T') + 'Z');
+                const nowMs = Date.now();
+                const inSnipeWindow = sniperMin > 0 && deadlineMs - nowMs < sniperMin * 60_000;
+                const canExtend = Number(fresh.extends_used) < Number(fresh.max_extends || 10);
+                if (inSnipeWindow && canExtend) {
+                    newDeadlineExt = sniperMin;
+                    db.prepare(`UPDATE auctions SET current_price = ?, bid_count = bid_count + 1,
                     deadline_at = datetime(deadline_at, '+' || ? || ' minutes'),
                     extends_used = extends_used + 1,
                     updated_at = datetime('now') WHERE id = ?`).run(price, sniperMin, req.params.id);
+                }
+                else {
+                    db.prepare(`UPDATE auctions SET current_price = ?, bid_count = bid_count + 1, updated_at = datetime('now') WHERE id = ?`).run(price, req.params.id);
+                }
+            })();
+        }
+        catch (e) {
+            if (e.message === 'AUC_INSUFFICIENT') {
+                return void res.json({ error: `余额不足，出价押金 ${stake} WAZ（被超越后立即释放）` });
             }
-            else {
-                db.prepare(`UPDATE auctions SET current_price = ?, bid_count = bid_count + 1, updated_at = datetime('now') WHERE id = ?`).run(price, req.params.id);
-            }
-        })();
+            throw e;
+        }
         if (closedErr) {
             const ce = closedErr;
             return void res.json({ error: ce === 'expired' ? '拍卖已到期' : ce === 'not_found' ? '拍卖不存在' : ce.startsWith('below_') ? '出价不足，请刷新页面查看当前最高价' : `拍卖已结束（${ce}）` });
         }
-        // 通知卖家 + 被超越的买家
+        // 通知卖家 + 被超越的买家(tx 后 fire-and-forget 单写 → seam)
         try {
-            db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, created_at)
-                  VALUES (?,?,'auction_new_bid',?,?,datetime('now'))`)
-                .run(generateId('ntf'), auc.seller_id, `🔨 新出价 ${price} WAZ`, `拍卖：${String(auc.title).slice(0, 30)}`);
+            await dbRun(`INSERT INTO notifications (id, user_id, type, title, body, created_at)
+                  VALUES (?,?,'auction_new_bid',?,?,datetime('now'))`, [generateId('ntf'), auc.seller_id, `🔨 新出价 ${price} WAZ`, `拍卖：${String(auc.title).slice(0, 30)}`]);
         }
         catch { }
         res.json({ id, stake_locked: stake, current_price: price, sniper_extended_min: newDeadlineExt, seller_topup: sellerTopup || undefined });
     });
     // 卖家：取消（仅未出价时）
-    app.delete('/api/auctions/:id', (req, res) => {
+    app.delete('/api/auctions/:id', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const auc = db.prepare('SELECT * FROM auctions WHERE id = ?').get(req.params.id);
+        const auc = await dbOne('SELECT * FROM auctions WHERE id = ?', [req.params.id]);
         if (!auc)
             return void res.status(404).json({ error: '拍卖不存在' });
         if (auc.seller_id !== user.id)
@@ -434,6 +473,8 @@ export function registerAuctionRoutes(app, deps) {
         const admin = requireProtocolAdmin(req, res);
         if (!admin)
             return;
-        res.json(fireDueAuctionReminders(db, generateId));
+        const result = fireDueAuctionReminders(db, generateId);
+        logAdminAction(admin.id, 'auction_reminders_run', 'protocol', null, { result });
+        res.json(result);
     });
 }

package/dist/pwa/routes/auth-login.js

@@ -1,13 +1,15 @@
+import { dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerAuthLoginRoutes(app, deps) {
-    const { db, INTERNAL_AUDITOR_ID, isLocked, verifyPassword, recordFailure, resetFailures, recordSession } = deps;
-    app.post('/api/login', (req, res) => {
+    // db 已全量走 RFC-016 异步 seam(dbAll),不再直接用 deps.db
+    const { INTERNAL_AUDITOR_ID, isLocked, verifyPassword, recordFailure, resetFailures, recordSession } = deps;
+    app.post('/api/login', async (req, res) => {
         const { name, password } = req.body;
         if (!name?.trim() || !password)
             return void res.json({ error: '请填写用户名 / 昵称和密码' });
         const ref = name.trim().replace(/^@/, '').toLowerCase();
-        let matches = db.prepare("SELECT * FROM users WHERE handle = ? AND id NOT IN ('sys_protocol', ?)").all(ref, INTERNAL_AUDITOR_ID);
+        let matches = await dbAll("SELECT * FROM users WHERE handle = ? AND id NOT IN ('sys_protocol', ?)", [ref, INTERNAL_AUDITOR_ID]);
         if (matches.length === 0) {
-            matches = db.prepare("SELECT * FROM users WHERE name = ? AND id NOT IN ('sys_protocol', ?)").all(name.trim(), INTERNAL_AUDITOR_ID);
+            matches = await dbAll("SELECT * FROM users WHERE name = ? AND id NOT IN ('sys_protocol', ?)", [name.trim(), INTERNAL_AUDITOR_ID]);
         }
         if (matches.length === 0)
             return void res.json({ error: '账号或密码错误' });

package/dist/pwa/routes/auth-read.js

@@ -1,10 +1,12 @@
+import { dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerAuthReadRoutes(app, deps) {
-    const { db, auth, safeRoles, getRegionMaxLevels, userMlmGate, getUserLevel } = deps;
-    app.get('/api/me', (req, res) => {
+    // db 已全量走 RFC-016 异步 seam(dbOne),不再直接用 deps.db
+    const { auth, safeRoles, getRegionMaxLevels, userMlmGate, getUserLevel } = deps;
+    app.get('/api/me', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const wallet = db.prepare('SELECT * FROM wallets WHERE user_id = ?').get(user.id);
+        const wallet = await dbOne('SELECT * FROM wallets WHERE user_id = ?', [user.id]);
         let roles = [];
         try {
             roles = JSON.parse(user.roles || JSON.stringify([user.role]));
@@ -14,17 +16,25 @@ export function registerAuthReadRoutes(app, deps) {
         }
         const region = user.region || 'global';
         const maxLevels = getRegionMaxLevels(region);
-        const pvEnabled = db.prepare("SELECT pv_enabled FROM region_config WHERE region = ?").get(region)?.pv_enabled ?? 0;
-        res.json({ ...user, api_key: undefined, roles, wallet: wallet || null, region_max_levels: maxLevels, region_pv_enabled: Number(pvEnabled) === 1 ? 1 : 0 });
+        const pvEnabled = (await dbOne("SELECT pv_enabled FROM region_config WHERE region = ?", [region]))?.pv_enabled ?? 0;
+        // 恢复能力标志(供首页"无恢复方式"横幅 + 凭证清单徽章用)。password_hash 不外泄,只回布尔。
+        const passkeyCount = (await dbOne('SELECT COUNT(*) AS n FROM webauthn_credentials WHERE user_id = ?', [user.id]))?.n ?? 0;
+        res.json({
+            ...user, api_key: undefined, password_hash: undefined,
+            roles, wallet: wallet || null, region_max_levels: maxLevels, region_pv_enabled: Number(pvEnabled) === 1 ? 1 : 0,
+            email_verified: !!user.email_verified,
+            has_password: !!user.password_hash,
+            has_passkey: Number(passkeyCount) > 0,
+        });
     });
-    app.get('/api/profile', (req, res) => {
+    app.get('/api/profile', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const wallet = db.prepare('SELECT balance, staked, escrowed, earned FROM wallets WHERE user_id = ?').get(user.id);
+        const wallet = await dbOne('SELECT balance, staked, escrowed, earned FROM wallets WHERE user_id = ?', [user.id]);
         const roles = safeRoles(user);
-        const pv = db.prepare("SELECT total_left_pv, total_right_pv FROM users WHERE id = ?").get(user.id);
-        const pendingScore = db.prepare("SELECT COALESCE(SUM(score),0) as s FROM binary_score_records WHERE user_id = ? AND settled_at IS NULL").get(user.id).s;
+        const pv = await dbOne("SELECT total_left_pv, total_right_pv FROM users WHERE id = ?", [user.id]);
+        const pendingScore = (await dbOne("SELECT COALESCE(SUM(score),0) as s FROM binary_score_records WHERE user_id = ? AND settled_at IS NULL", [user.id])).s;
         res.json({
             id: user.id, name: user.name, role: user.role, roles, api_key: user.api_key, wallet: wallet || null,
             permanent_code: user.permanent_code ?? null,
@@ -41,9 +51,10 @@ export function registerAuthReadRoutes(app, deps) {
             phone: user.phone ?? null,
             phone_verified: !!user.phone_verified,
             has_password: !!user.password_hash,
+            has_passkey: ((await dbOne('SELECT COUNT(*) AS n FROM webauthn_credentials WHERE user_id = ?', [user.id]))?.n ?? 0) > 0,
             region: user.region ?? 'global',
             region_max_levels: getRegionMaxLevels(user.region || 'global'),
-            region_pv_enabled: (db.prepare("SELECT pv_enabled FROM region_config WHERE region = ?").get(user.region || 'global')?.pv_enabled ?? 0) === 1 ? 1 : 0,
+            region_pv_enabled: (((await dbOne("SELECT pv_enabled FROM region_config WHERE region = ?", [user.region || 'global']))?.pv_enabled ?? 0) === 1 ? 1 : 0),
             ...(() => { const g = userMlmGate(user.region || 'global'); return { mlm_ui_visible: g.mlmUiVisible, mlm_payout_levels: g.payoutLevels }; })(),
             bio: user.bio ?? null,
             search_anchor: user.search_anchor ?? null,