@seasonkoh/webaz 0.1.24 → 0.1.26

package/dist/pwa/routes/ratings.js

@@ -1,4 +1,5 @@
 import { recordRatingReputation } from '../../layer4-economics/L4-3-reputation/reputation-engine.js';
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 const RATING_BLIND_DAYS = 14;
 function parseDim(v) {
     const n = Number(v);
@@ -7,20 +8,20 @@ function parseDim(v) {
 export function registerRatingsRoutes(app, deps) {
     const { db, generateId, auth, isTrustedRole, errorRes, broadcastSystemEvent } = deps;
     // buyer → seller 评价（一单一评，仅 completed 订单可评）
-    app.post('/api/orders/:order_id/rating', (req, res) => {
+    app.post('/api/orders/:order_id/rating', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         if (isTrustedRole(user))
             return void errorRes(res, 403, 'TRUSTED_ROLE_NO_TRADE', '受信角色无购物功能');
-        const order = db.prepare('SELECT id, buyer_id, seller_id, product_id, status FROM orders WHERE id = ?').get(req.params.order_id);
+        const order = await dbOne('SELECT id, buyer_id, seller_id, product_id, status FROM orders WHERE id = ?', [req.params.order_id]);
         if (!order)
             return void res.status(404).json({ error: '订单不存在' });
         if (order.buyer_id !== user.id)
             return void res.status(403).json({ error: '仅买家可评价' });
         if (order.status !== 'completed')
             return void res.status(400).json({ error: '订单完成后才能评价' });
-        const existing = db.prepare('SELECT order_id FROM order_ratings WHERE order_id = ?').get(order.id);
+        const existing = await dbOne('SELECT order_id FROM order_ratings WHERE order_id = ?', [order.id]);
         if (existing)
             return void res.status(400).json({ error: '已评价过，每单仅可评一次' });
         const stars = Number(req.body?.stars);
@@ -55,18 +56,18 @@ export function registerRatingsRoutes(app, deps) {
         res.json({ success: true });
     });
     // seller → buyer 反向评价
-    app.post('/api/orders/:order_id/buyer-rating', (req, res) => {
+    app.post('/api/orders/:order_id/buyer-rating', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const order = db.prepare('SELECT id, buyer_id, seller_id, status FROM orders WHERE id = ?').get(req.params.order_id);
+        const order = await dbOne('SELECT id, buyer_id, seller_id, status FROM orders WHERE id = ?', [req.params.order_id]);
         if (!order)
             return void res.status(404).json({ error: '订单不存在' });
         if (order.seller_id !== user.id)
             return void res.status(403).json({ error: '仅卖家可评价买家' });
         if (order.status !== 'completed')
             return void res.status(400).json({ error: '订单完成后才能评价' });
-        const existing = db.prepare('SELECT order_id FROM buyer_ratings WHERE order_id = ?').get(order.id);
+        const existing = await dbOne('SELECT order_id FROM buyer_ratings WHERE order_id = ?', [order.id]);
         if (existing)
             return void res.status(400).json({ error: '已评价过，每单仅可评一次' });
         const stars = Number(req.body?.stars);
@@ -96,21 +97,21 @@ export function registerRatingsRoutes(app, deps) {
         res.json({ success: true });
     });
     // 查 seller → buyer 评价（双盲遮蔽：buyer 看不到，除非自己也评过 OR 窗口到期）
-    app.get('/api/orders/:order_id/buyer-rating', (req, res) => {
+    app.get('/api/orders/:order_id/buyer-rating', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const order = db.prepare('SELECT buyer_id, seller_id FROM orders WHERE id = ?').get(req.params.order_id);
+        const order = await dbOne('SELECT buyer_id, seller_id FROM orders WHERE id = ?', [req.params.order_id]);
         if (!order)
             return void res.status(404).json({ error: '订单不存在' });
         if (order.buyer_id !== user.id && order.seller_id !== user.id) {
             return void res.status(403).json({ error: '无权查看' });
         }
-        const br = db.prepare(`SELECT stars, comment, dim_payment_speed, dim_communication, dim_responsiveness, hidden_until, created_at FROM buyer_ratings WHERE order_id = ?`).get(req.params.order_id);
+        const br = await dbOne(`SELECT stars, comment, dim_payment_speed, dim_communication, dim_responsiveness, hidden_until, created_at FROM buyer_ratings WHERE order_id = ?`, [req.params.order_id]);
         if (!br)
             return void res.json({ item: null });
         const isBuyerView = order.buyer_id === user.id;
-        const buyerAlsoRated = !!db.prepare(`SELECT order_id FROM order_ratings WHERE order_id = ?`).get(req.params.order_id);
+        const buyerAlsoRated = !!(await dbOne(`SELECT order_id FROM order_ratings WHERE order_id = ?`, [req.params.order_id]));
         const blindExpired = br.hidden_until && new Date(br.hidden_until) < new Date();
         if (isBuyerView && !buyerAlsoRated && !blindExpired) {
             return void res.json({ item: { masked: true, hidden_until: br.hidden_until, reason: 'blind_until_both_or_expire' } });
@@ -118,50 +119,56 @@ export function registerRatingsRoutes(app, deps) {
         res.json({ item: br });
     });
     // 查 buyer → seller 评价（双盲遮蔽：seller 视角同样）
-    app.get('/api/orders/:order_id/rating', (req, res) => {
+    app.get('/api/orders/:order_id/rating', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const order = db.prepare('SELECT buyer_id, seller_id FROM orders WHERE id = ?').get(req.params.order_id);
+        const order = await dbOne('SELECT buyer_id, seller_id FROM orders WHERE id = ?', [req.params.order_id]);
         if (!order)
             return void res.status(404).json({ error: '订单不存在' });
         if (order.buyer_id !== user.id && order.seller_id !== user.id) {
             return void res.status(403).json({ error: '无权查看' });
         }
-        const r = db.prepare('SELECT stars, comment, reply, replied_at, buyer_followup, buyer_followup_at, dim_quality, dim_speed, dim_service, hidden_until, created_at FROM order_ratings WHERE order_id = ?').get(req.params.order_id);
+        const r = await dbOne('SELECT stars, comment, reply, replied_at, buyer_followup, buyer_followup_at, dim_quality, dim_speed, dim_service, hidden_until, created_at FROM order_ratings WHERE order_id = ?', [req.params.order_id]);
         if (!r)
             return void res.json({ item: null });
         const isSellerView = order.seller_id === user.id;
-        const sellerAlsoRated = !!db.prepare(`SELECT order_id FROM buyer_ratings WHERE order_id = ?`).get(req.params.order_id);
+        const sellerAlsoRated = !!(await dbOne(`SELECT order_id FROM buyer_ratings WHERE order_id = ?`, [req.params.order_id]));
         const blindExpired = r.hidden_until && new Date(r.hidden_until) < new Date();
         if (isSellerView && !sellerAlsoRated && !blindExpired) {
             return void res.json({ item: { masked: true, hidden_until: r.hidden_until, reason: 'blind_until_both_or_expire' } });
         }
         res.json({ item: r });
     });
-    app.post('/api/orders/:order_id/rating/reply', (req, res) => {
+    app.post('/api/orders/:order_id/rating/reply', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const r = db.prepare('SELECT seller_id, reply FROM order_ratings WHERE order_id = ?').get(req.params.order_id);
+        const r = await dbOne('SELECT seller_id, reply, hidden_until FROM order_ratings WHERE order_id = ?', [req.params.order_id]);
         if (!r)
             return void res.status(404).json({ error: '该订单暂无评价' });
         if (r.seller_id !== user.id)
             return void res.status(403).json({ error: '仅卖家可回复' });
+        // 双盲铁律:未揭晓前不能回复(回复=已读到评价)。揭晓条件 = 自己也评过买家 OR 盲评期已过。
+        const sellerAlsoRated = !!(await dbOne(`SELECT order_id FROM buyer_ratings WHERE order_id = ?`, [req.params.order_id]));
+        const blindExpired = !!r.hidden_until && new Date(r.hidden_until) < new Date();
+        if (!sellerAlsoRated && !blindExpired) {
+            return void res.status(403).json({ error: '双盲期未结束:请先评价买家，或等盲评期满后再回应', error_code: 'RATING_STILL_BLIND' });
+        }
         if (r.reply)
             return void res.status(400).json({ error: '已回复过，每条评价仅可回复一次' });
         const reply = req.body?.reply ? String(req.body.reply).slice(0, 500) : null;
         if (!reply)
             return void res.status(400).json({ error: '回复不能为空' });
-        db.prepare(`UPDATE order_ratings SET reply = ?, replied_at = datetime('now') WHERE order_id = ?`).run(reply, req.params.order_id);
+        await dbRun(`UPDATE order_ratings SET reply = ?, replied_at = datetime('now') WHERE order_id = ?`, [reply, req.params.order_id]);
         res.json({ success: true });
     });
     // W3 买家追问 — 在卖家 reply 后可追问一次
-    app.post('/api/orders/:order_id/rating/followup', (req, res) => {
+    app.post('/api/orders/:order_id/rating/followup', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const r = db.prepare('SELECT buyer_id, reply, buyer_followup FROM order_ratings WHERE order_id = ?').get(req.params.order_id);
+        const r = await dbOne('SELECT buyer_id, reply, buyer_followup FROM order_ratings WHERE order_id = ?', [req.params.order_id]);
         if (!r)
             return void res.status(404).json({ error: '该订单暂无评价' });
         if (r.buyer_id !== user.id)
@@ -173,15 +180,14 @@ export function registerRatingsRoutes(app, deps) {
         const followup = req.body?.followup ? String(req.body.followup).trim().slice(0, 200) : '';
         if (followup.length < 2)
             return void res.status(400).json({ error: '追问内容至少 2 字' });
-        db.prepare(`UPDATE order_ratings SET buyer_followup = ?, buyer_followup_at = datetime('now') WHERE order_id = ?`)
-            .run(followup, req.params.order_id);
+        await dbRun(`UPDATE order_ratings SET buyer_followup = ?, buyer_followup_at = datetime('now') WHERE order_id = ?`, [followup, req.params.order_id]);
         res.json({ success: true });
     });
     // 公开：商品评价 + 聚合（仅展示双盲已揭晓的）
-    app.get('/api/products/:product_id/ratings', (req, res) => {
+    app.get('/api/products/:product_id/ratings', async (req, res) => {
         const limit = Math.min(50, Math.max(1, Number(req.query.limit) || 20));
         const blindOpen = `(EXISTS (SELECT 1 FROM buyer_ratings br WHERE br.order_id = r.order_id) OR r.hidden_until IS NULL OR datetime(r.hidden_until) <= datetime('now'))`;
-        const rows = db.prepare(`
+        const rows = await dbAll(`
       SELECT r.stars, r.comment, r.reply, r.replied_at, r.buyer_followup, r.buyer_followup_at, r.created_at,
              r.dim_quality, r.dim_speed, r.dim_service,
              u.name as buyer_name, u.handle as buyer_handle
@@ -189,8 +195,8 @@ export function registerRatingsRoutes(app, deps) {
       JOIN users u ON u.id = r.buyer_id
       WHERE r.product_id = ? AND ${blindOpen}
       ORDER BY r.created_at DESC LIMIT ?
-    `).all(req.params.product_id, limit);
-        const agg = db.prepare(`
+    `, [req.params.product_id, limit]);
+        const agg = await dbOne(`
       SELECT COUNT(*) as cnt, COALESCE(AVG(stars), 0) as avg_stars,
         SUM(CASE WHEN stars = 5 THEN 1 ELSE 0 END) as s5,
         SUM(CASE WHEN stars = 4 THEN 1 ELSE 0 END) as s4,
@@ -198,23 +204,77 @@ export function registerRatingsRoutes(app, deps) {
         SUM(CASE WHEN stars = 2 THEN 1 ELSE 0 END) as s2,
         SUM(CASE WHEN stars = 1 THEN 1 ELSE 0 END) as s1
       FROM order_ratings r WHERE product_id = ? AND ${blindOpen}
-    `).get(req.params.product_id);
+    `, [req.params.product_id]);
         res.json({ items: rows, agg });
     });
-    // 公开：卖家评价聚合（卖家主页）
-    app.get('/api/sellers/:seller_id/ratings', (req, res) => {
+    // 卖家:自己店铺收到的全部评价(含 order_id 便于逐条回复 + 回复/追问状态)。
+    // 与公开聚合 endpoint 分开:authed + 只返回本人的评价 + 暴露 order_id(仅给卖家本人)。
+    // 纯只读,不改任何评价 / 资金逻辑;回复仍走既有 POST /orders/:order_id/rating/reply。
+    // ⚠️ 必须注册在 /api/sellers/:seller_id/ratings 【之前】,否则 'me' 会被 :seller_id 参数路由抢匹配。
+    app.get('/api/sellers/me/ratings', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const limit = Math.min(100, Math.max(1, Number(req.query.limit) || 50));
+        // 双盲铁律:卖家看 buyer→seller 评价,必须【自己也评过买家】(buyer_ratings 存在) 或【盲评期已过】(hidden_until 到期)。
+        // 否则只返回遮蔽行(不含 stars/comment/reply),与 GET /orders/:id/rating 的揭晓条件一致 —— 防卖家看了买家评价再反向报复。
+        const rows = await dbAll(`
+      SELECT r.order_id, r.stars, r.comment, r.reply, r.replied_at, r.buyer_followup, r.buyer_followup_at, r.created_at, r.product_id, r.hidden_until,
+             p.title as product_title,
+             u.name as buyer_name, u.handle as buyer_handle,
+             (SELECT 1 FROM buyer_ratings br WHERE br.order_id = r.order_id) AS seller_also_rated
+      FROM order_ratings r
+      JOIN products p ON p.id = r.product_id
+      JOIN users u ON u.id = r.buyer_id
+      WHERE r.seller_id = ?
+      ORDER BY r.created_at DESC LIMIT ?
+    `, [user.id, limit]);
+        const now = Date.now();
+        let unreplied = 0;
+        const items = rows.map(r => {
+            const blindExpired = !!r.hidden_until && new Date(r.hidden_until).getTime() < now;
+            const revealed = !!r.seller_also_rated || blindExpired;
+            if (!revealed) {
+                // 遮蔽:只回最小信息(有评价 + 商品 + 解除条件),绝不泄露分数/评论/回复
+                return { order_id: r.order_id, product_title: r.product_title, created_at: r.created_at, hidden_until: r.hidden_until, masked: true, reveal_reason: 'blind_until_both_or_expire' };
+            }
+            if (!r.reply)
+                unreplied++;
+            return {
+                order_id: r.order_id, stars: r.stars, comment: r.comment, reply: r.reply, replied_at: r.replied_at,
+                buyer_followup: r.buyer_followup, buyer_followup_at: r.buyer_followup_at, created_at: r.created_at,
+                product_id: r.product_id, product_title: r.product_title, buyer_name: r.buyer_name, buyer_handle: r.buyer_handle,
+                masked: false,
+            };
+        });
+        // 聚合双盲铁律:cnt / avg_stars 必须【只算已揭晓评价】,否则盲评期内卖家能从均分反推买家未揭晓评分。
+        // 与公开面同 blindOpen 条件;另回 masked_count(只告知"有多少条遮蔽中",不含分数)。
+        const blindOpen = `(EXISTS (SELECT 1 FROM buyer_ratings br WHERE br.order_id = r.order_id) OR r.hidden_until IS NULL OR datetime(r.hidden_until) <= datetime('now'))`;
+        const agg = await dbOne(`
+      SELECT
+        SUM(CASE WHEN ${blindOpen} THEN 1 ELSE 0 END) as cnt,
+        COALESCE(AVG(CASE WHEN ${blindOpen} THEN stars END), 0) as avg_stars,
+        SUM(CASE WHEN ${blindOpen} THEN 0 ELSE 1 END) as masked_count
+      FROM order_ratings r WHERE r.seller_id = ?`, [user.id]);
+        res.json({ items, agg: { ...(agg || {}), unreplied } });
+    });
+    // 公开：卖家评价聚合（卖家主页）。注册在 /me 之后(见上面注释)。
+    app.get('/api/sellers/:seller_id/ratings', async (req, res) => {
         const limit = Math.min(50, Math.max(1, Number(req.query.limit) || 20));
-        const rows = db.prepare(`
+        // 双盲铁律(公开面):只展示已揭晓的评价 —— 与 GET /products/:id/ratings 同条件。
+        // 揭晓 = 双方都评过(buyer_ratings 存在) OR 无盲评窗口(hidden_until 空) OR 盲评期已过。
+        const blindOpen = `(EXISTS (SELECT 1 FROM buyer_ratings br WHERE br.order_id = r.order_id) OR r.hidden_until IS NULL OR datetime(r.hidden_until) <= datetime('now'))`;
+        const rows = await dbAll(`
       SELECT r.stars, r.comment, r.reply, r.replied_at, r.buyer_followup, r.buyer_followup_at, r.created_at, r.product_id,
              p.title as product_title,
              u.name as buyer_name, u.handle as buyer_handle
       FROM order_ratings r
       JOIN products p ON p.id = r.product_id
       JOIN users u ON u.id = r.buyer_id
-      WHERE r.seller_id = ?
+      WHERE r.seller_id = ? AND ${blindOpen}
       ORDER BY r.created_at DESC LIMIT ?
-    `).all(req.params.seller_id, limit);
-        const agg = db.prepare(`SELECT COUNT(*) as cnt, COALESCE(AVG(stars), 0) as avg_stars FROM order_ratings WHERE seller_id = ?`).get(req.params.seller_id);
+    `, [req.params.seller_id, limit]);
+        const agg = await dbOne(`SELECT COUNT(*) as cnt, COALESCE(AVG(stars), 0) as avg_stars FROM order_ratings r WHERE r.seller_id = ? AND ${blindOpen}`, [req.params.seller_id]);
         res.json({ items: rows, agg });
     });
 }

package/dist/pwa/routes/recover-key.js

@@ -1,8 +1,18 @@
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerRecoverKeyRoutes(app, deps) {
-    const { db, internalAuditorId, issueCode, findActiveCode, CODE_TTL_MIN, MAX_CODE_ATTEMPTS } = deps;
+    // db 已走 RFC-016 异步 seam(dbOne/dbAll/dbRun),不再直接用 deps.db
+    const { internalAuditorId, issueCode, findActiveCode, canDeliverCodes, emailDeliveryNotConfigured, hashPassword, CODE_TTL_MIN, MAX_CODE_ATTEMPTS } = deps;
+    // 账号标识解析 —— 与 /api/login 一致:@handle / handle(小写)优先,name 兜底。
+    // 找回三步全部复用它,否则用 handle 登录的用户(如 @holden)在找回页按 name 永远查不到、邮件不发。
+    const accountRef = (raw) => {
+        const display = String(raw || '').trim();
+        return { display, handleRef: display.replace(/^@/, '').toLowerCase() };
+    };
+    // (handle = ? OR name = ?) 子句 + 参数,排除 sys/auditor。
+    const ACCOUNT_MATCH = "(lower(coalesce(handle, '')) = ? OR name = ?) AND id NOT IN ('sys_protocol', ?)";
     // IP 级速率（5/min）— 防爆破列举账户
     const recoverKeyHits = new Map();
-    app.post('/api/recover-key', (req, res) => {
+    app.post('/api/recover-key', async (req, res) => {
         const ip = req.ip || '';
         if (ip) {
             const now = Date.now();
@@ -23,10 +33,11 @@ export function registerRecoverKeyRoutes(app, deps) {
         }
         const { name } = req.body;
         if (!name?.trim())
-            return void res.json({ error: '请填写注册时使用的名称' });
-        const rows = db.prepare("SELECT name, role, api_key, email, phone, created_at FROM users WHERE name = ? AND id NOT IN ('sys_protocol', ?)").all(name.trim(), internalAuditorId);
+            return void res.json({ error: '请填写注册时使用的名称或 @用户名' });
+        const { display, handleRef } = accountRef(name);
+        const rows = await dbAll(`SELECT name, role, api_key, email, phone, created_at FROM users WHERE ${ACCOUNT_MATCH}`, [handleRef, display, internalAuditorId]);
         if (rows.length === 0)
-            return void res.json({ error: '未找到该名称的账号' });
+            return void res.json({ error: '未找到该名称 / @用户名的账号' });
         const mask = (s) => s && s.length > 8 ? `${s.slice(0, 4)}…${s.slice(-4)}` : s;
         const maskEmail = (e) => {
             if (!e)
@@ -54,47 +65,76 @@ export function registerRecoverKeyRoutes(app, deps) {
         });
     });
     // 步骤 1：发送验证码到已绑定邮箱（防泄露：找没找到都同响应）
-    app.post('/api/recover-key/start', (req, res) => {
+    app.post('/api/recover-key/start', async (req, res) => {
         const { name, email } = req.body;
         if (!name?.trim() || !email?.trim())
             return void res.json({ error: '请填写名称和邮箱' });
+        if (!canDeliverCodes()) {
+            const unavailable = emailDeliveryNotConfigured();
+            return void res.status(unavailable.status).json({ error: unavailable.error, error_code: unavailable.error_code });
+        }
         const target = email.trim().toLowerCase();
-        const user = db.prepare(`
-      SELECT id, name, email FROM users
-      WHERE name = ? AND email = ? AND email_verified = 1
-        AND id NOT IN ('sys_protocol', ?) LIMIT 1
-    `).get(name.trim(), target, internalAuditorId);
-        if (user)
-            issueCode(user.id, 'email', target, 'recover_key');
-        res.json({
+        const genericResponse = {
             success: true,
             notice: '若该名称与邮箱组合存在，验证码已发送至该邮箱',
             expires_in_min: CODE_TTL_MIN,
-        });
+        };
+        const { display, handleRef } = accountRef(name);
+        const user = await dbOne(`
+      SELECT id, name, email FROM users
+      WHERE ${ACCOUNT_MATCH} AND email = ? AND email_verified = 1 LIMIT 1
+    `, [handleRef, display, internalAuditorId, target]);
+        if (user) {
+            const issued = await issueCode(user.id, 'email', target, 'recover_key');
+            if (!issued.ok) {
+                console.warn(`[recover-key] verification email delivery failed: ${issued.error_code}`);
+                return void res.json(genericResponse);
+            }
+        }
+        res.json(genericResponse);
     });
-    // 步骤 2：提交验证码 → 返回完整 api_key
-    app.post('/api/recover-key/confirm', (req, res) => {
-        const { name, email, code } = req.body;
+    // 步骤 2：提交验证码 → 返回完整 api_key,并可选同时重置登录密码(code + new_password)。
+    // 安全等价:本端点本就返回完整 api_key(最高凭证),允许同时重置密码不扩大权限面 —— 验证码已是同等门槛。
+    app.post('/api/recover-key/confirm', async (req, res) => {
+        const { name, email, code, new_password } = req.body;
         if (!name?.trim() || !email?.trim() || !code?.trim())
             return void res.json({ error: '请填写完整信息' });
+        // 可选新密码:格式与 change-password 一致(≥8,≤200)。先校验格式,失败【不消费验证码】,可重试。
+        const wantsPasswordReset = new_password !== undefined && new_password !== null && String(new_password) !== '';
+        if (wantsPasswordReset) {
+            if (String(new_password).length < 8)
+                return void res.json({ error: '新密码至少 8 字符' });
+            if (String(new_password).length > 200)
+                return void res.json({ error: '密码过长（>200 字符）' });
+        }
         const target = email.trim().toLowerCase();
         const row = findActiveCode('email', target, 'recover_key');
         if (!row)
             return void res.json({ error: '验证码已过期或未发送，请重新开始' });
-        const user = db.prepare(`SELECT id, name, api_key FROM users WHERE id = ?`).get(row.user_id);
-        if (!user || user.name !== name.trim())
-            return void res.json({ error: '名称与验证码不匹配' });
+        const user = await dbOne(`SELECT id, name, handle, api_key FROM users WHERE id = ?`, [row.user_id]);
+        const { display, handleRef } = accountRef(name);
+        const refMatches = !!user && (user.name === display || String(user.handle || '').toLowerCase() === handleRef);
+        if (!user || !refMatches)
+            return void res.json({ error: '名称 / @用户名与验证码不匹配' });
         if (String(row.code) !== code.trim()) {
             const attempts = row.attempts + 1;
             if (attempts >= MAX_CODE_ATTEMPTS) {
-                db.prepare("UPDATE verification_codes SET attempts = ?, used_at = datetime('now') WHERE id = ?")
-                    .run(attempts, row.id);
+                await dbRun("UPDATE verification_codes SET attempts = ?, used_at = datetime('now') WHERE id = ?", [attempts, row.id]);
                 return void res.json({ error: '错误次数过多，验证码已作废，请重新开始' });
             }
-            db.prepare("UPDATE verification_codes SET attempts = ? WHERE id = ?").run(attempts, row.id);
+            await dbRun("UPDATE verification_codes SET attempts = ? WHERE id = ?", [attempts, row.id]);
             return void res.json({ error: `验证码错误（剩余 ${MAX_CODE_ATTEMPTS - attempts} 次）` });
         }
-        db.prepare("UPDATE verification_codes SET used_at = datetime('now') WHERE id = ?").run(row.id);
-        res.json({ success: true, api_key: user.api_key, name: user.name });
+        await dbRun("UPDATE verification_codes SET used_at = datetime('now') WHERE id = ?", [row.id]);
+        // optional password reset — same credential gate as returning the api_key, so no extra power.
+        let passwordReset = false;
+        if (wantsPasswordReset) {
+            // mirror /profile/set-password: also clear lock state, else a user who forgot + got locked out by
+            // failed attempts stays locked and "new password is correct but can't log in" (auth-login rejects
+            // locked users before verifying the password).
+            await dbRun("UPDATE users SET password_hash = ?, failed_attempts = 0, locked_until = NULL, updated_at = datetime('now') WHERE id = ?", [hashPassword(String(new_password)), user.id]);
+            passwordReset = true;
+        }
+        res.json({ success: true, api_key: user.api_key, name: user.name, ...(passwordReset ? { password_reset: true } : {}) });
     });
 }

package/dist/pwa/routes/referral.js

@@ -1,28 +1,31 @@
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerReferralRoutes(app, deps) {
-    const { db, auth, requireProtocolAdmin, logAdminAction, issueInviteSlot, inviteRotationLookup } = deps;
+    // db 已全量走 RFC-016 异步 seam(dbOne/dbAll/dbRun),不再直接用 deps.db
+    const { auth, requireProtocolAdmin, logAdminAction, issueInviteSlot, inviteRotationLookup } = deps;
     // B-1: 个人邀请 dashboard
-    app.get('/api/referral/me', (req, res) => {
+    app.get('/api/referral/me', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const code = user.permanent_code || null;
         // 我直接邀请的人
-        const directInvitees = db.prepare(`
+        const directInvitees = await dbAll(`
       SELECT u.id, u.handle, u.name, u.role, u.created_at,
         (SELECT COUNT(*) FROM orders WHERE buyer_id = u.id AND status = 'completed') as completed_orders,
         (SELECT COALESCE(SUM(total_amount), 0) FROM orders WHERE buyer_id = u.id AND status = 'completed') as gmv
       FROM users u WHERE u.sponsor_id = ?
       ORDER BY u.created_at DESC LIMIT 50
-    `).all(user.id);
+    `, [user.id]);
         // 推土机奖励 / 商品分享佣金（commission_records 按订单粒度）
-        const earnings = db.prepare(`
+        const earnings = (await dbOne(`
       SELECT COUNT(*) as cnt, COALESCE(SUM(amount), 0) as total FROM commission_records WHERE beneficiary_id = ?
-    `).get(user.id);
-        const todayEarnings = db.prepare(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-1 day')`).get(user.id).t;
-        const monthEarnings = db.prepare(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-30 days')`).get(user.id).t;
+    `, [user.id]));
+        const todayEarnings = (await dbOne(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-1 day')`, [user.id])).t;
+        const monthEarnings = (await dbOne(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-30 days')`, [user.id])).t;
         res.json({
             invite_code: code,
-            invite_link: code ? `${req.protocol}://${req.get('host')}/?ref=${code}` : null,
+            invite_link: code ? `${req.protocol}://${req.get('host')}/i/${code}` : null,
+            invite_unavailable_reason: code ? null : 'permanent_code_missing — refresh or contact support',
             direct_invitees_count: directInvitees.length,
             direct_invitees: directInvitees,
             earnings: {
@@ -34,8 +37,8 @@ export function registerReferralRoutes(app, deps) {
         });
     });
     // 公开邀请码轮询（开关 ON 时）
-    app.post('/api/invite/rotate', (_req, res) => {
-        const enabled = db.prepare("SELECT value FROM system_state WHERE key='invite_rotation_enabled'").get()?.value === '1';
+    app.post('/api/invite/rotate', async (_req, res) => {
+        const enabled = (await dbOne("SELECT value FROM system_state WHERE key='invite_rotation_enabled'"))?.value === '1';
         if (!enabled)
             return void res.status(403).json({ error: '邀请码获取暂未开放', enabled: false });
         const slot = issueInviteSlot();
@@ -45,38 +48,37 @@ export function registerReferralRoutes(app, deps) {
         res.json({ enabled: true, code: u.code });
     });
     // protocol 开关
-    app.post('/api/admin/invite-rotation/toggle', (req, res) => {
+    app.post('/api/admin/invite-rotation/toggle', async (req, res) => {
         const admin = requireProtocolAdmin(req, res);
         if (!admin)
             return;
         const { enabled } = req.body;
         const v = enabled ? '1' : '0';
-        db.prepare("INSERT OR REPLACE INTO system_state (key, value) VALUES ('invite_rotation_enabled', ?)").run(v);
+        await dbRun("INSERT OR REPLACE INTO system_state (key, value) VALUES ('invite_rotation_enabled', ?)", [v]);
         logAdminAction(admin.id, 'invite_rotation_toggle', 'system', 'invite_rotation_enabled', { value: v });
         res.json({ success: true, enabled: !!enabled });
     });
     // RFC-003 #1122: 生成商品分享链接(把 MCP webaz_share_link 的本地计算搬到服务端,
     // 让 MCP NETWORK 模式可代理)。RFC-002 §3.5 valuation-layer gate:需 rewards opt-in。
-    // 与 PWA pickPreferredSide 对齐的 side 选择(team_count | pv_count)。
-    app.get('/api/share-link', (req, res) => {
+    // pre-public 去左右码:不再接受/返回 side,放置侧别由注册时系统自动决定。
+    app.get('/api/share-link', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const userId = user.id;
         const productId = String(req.query.product_id || '');
-        const sideArg = String(req.query.side || 'auto');
         if (!productId)
             return void res.status(400).json({ error: 'product_id required', error_code: 'PRODUCT_ID_REQUIRED' });
-        const optIn = db.prepare("SELECT rewards_opted_in FROM users WHERE id = ?").get(userId)?.rewards_opted_in ?? 0;
+        const optIn = (await dbOne("SELECT rewards_opted_in FROM users WHERE id = ?", [userId]))?.rewards_opted_in ?? 0;
         if (optIn !== 1) {
-            const getParam = (key, def) => {
-                const r = db.prepare("SELECT value FROM protocol_params WHERE key = ?").get(key);
+            const getParam = async (key, def) => {
+                const r = await dbOne("SELECT value FROM protocol_params WHERE key = ?", [key]);
                 return r ? Number(r.value) : def;
             };
-            const minOrders = getParam('rewards_opt_in.min_completed_orders', 1);
-            const requirePasskey = getParam('rewards_opt_in.require_passkey', 1);
-            const totalCompleted = db.prepare("SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'").get(userId).n;
-            const passkeyCount = db.prepare("SELECT COUNT(*) as n FROM webauthn_credentials WHERE user_id = ?").get(userId).n;
+            const minOrders = await getParam('rewards_opt_in.min_completed_orders', 1);
+            const requirePasskey = await getParam('rewards_opt_in.require_passkey', 1);
+            const totalCompleted = (await dbOne("SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'", [userId])).n;
+            const passkeyCount = (await dbOne("SELECT COUNT(*) as n FROM webauthn_credentials WHERE user_id = ?", [userId])).n;
             const missing = [];
             if (totalCompleted < minOrders)
                 missing.push(`completed_orders ${totalCompleted}/${minOrders}`);
@@ -86,50 +88,33 @@ export function registerReferralRoutes(app, deps) {
                 missing.push('application_not_submitted');
             return void res.status(403).json({
                 error: 'rewards_opt_in_required',
-                message: 'Share-link generation is a valuation-layer action — requires builder-identity opt-in (RFC-002 §3.5)',
+                message: 'Share-link generation is a valuation-layer (rewards / share-link) action, NOT a contribution gate — requires rewards / share-commission opt-in (RFC-002 §3.5)',
                 missing_requirements: missing,
                 next_steps: [
-                    'Open PWA #me → tap "申请共建身份 / Apply for builder identity"',
+                    'Open PWA #me → tap "申请分享分润 / Enable share-commission opt-in"',
                     'Read the 8-second disclosure (cannot skip)',
                     'Submit application — pre-checks run server-side',
                 ],
             });
         }
-        const product = db.prepare("SELECT id, title, price, commission_rate FROM products WHERE id = ? AND status='active'").get(productId);
+        const product = await dbOne("SELECT id, title, price, commission_rate FROM products WHERE id = ? AND status='active'", [productId]);
         if (!product)
             return void res.status(404).json({ error: '商品不存在或已下架', error_code: 'PRODUCT_NOT_FOUND' });
-        let side = 'right';
-        if (sideArg === 'left' || sideArg === 'right') {
-            side = sideArg;
-        }
-        else {
-            const u = db.prepare("SELECT placement_pref, total_left_pv, total_right_pv, left_count, right_count FROM users WHERE id = ?")
-                .get(userId);
-            const pref = u?.placement_pref || 'team_count';
-            if (pref === 'pv_count') {
-                const since = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000).toISOString().slice(0, 19).replace('T', ' ');
-                const w = db.prepare(`SELECT COALESCE(SUM(consumed_left_pv),0) AS l, COALESCE(SUM(consumed_right_pv),0) AS r
-                              FROM binary_score_records WHERE user_id = ? AND created_at >= ?`)
-                    .get(userId, since);
-                const leftPv = Number(u?.total_left_pv ?? 0) + Number(w.l);
-                const rightPv = Number(u?.total_right_pv ?? 0) + Number(w.r);
-                side = leftPv <= rightPv ? 'left' : 'right';
-            }
-            else {
-                side = (Number(u?.left_count ?? 0) <= Number(u?.right_count ?? 0)) ? 'left' : 'right';
-            }
-        }
-        const completed = db.prepare("SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'").get(userId).n;
-        const override = db.prepare("SELECT l1_share_override FROM users WHERE id = ?").get(userId)?.l1_share_override ?? 0;
+        // pre-public 去左右码:分享链接不再计算/携带 side(放置侧别由注册时系统自动决定)
+        const completed = (await dbOne("SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'", [userId])).n;
+        const override = (await dbOne("SELECT l1_share_override FROM users WHERE id = ?", [userId]))?.l1_share_override ?? 0;
         const canL1 = override === 1 || (override === 0 && completed > 0);
         const rate = Number(product.commission_rate ?? 0);
-        const link = `/?ref=${userId}&side=${side}#order-product/${productId}`;
+        // share ref uses permanent_code ONLY — never the raw user_id; fail clearly if it's missing.
+        const refCode = (await dbOne("SELECT permanent_code FROM users WHERE id = ?", [userId]))?.permanent_code || null;
+        if (!refCode)
+            return void res.status(409).json({ error: '邀请码暂不可用，请刷新或联系支持', error_code: 'PERMANENT_CODE_MISSING' });
+        const link = `/?ref=${refCode}#order-product/${productId}`;
         res.json({
             product: { id: product.id, title: product.title, price: product.price, commission_rate: rate },
             share_link: link,
             full_url_hint: 'Prepend webaz.xyz (production) to get the absolute URL',
-            side,
-            binary_explanation: `New user via this link → placed in your ${side === 'left' ? '🔵 left' : '🟢 right'} subtree (tail anchor)`,
+            placement_note: 'New user via this link → placement is recorded automatically by the system (no left/right choice).',
             commission_eligibility: canL1
                 ? `You will earn 3-tier commission: L1=${(rate * 0.70 * 100).toFixed(1)}% L2=${(rate * 0.20 * 100).toFixed(1)}% L3=${(rate * 0.10 * 100).toFixed(1)}% of sale price`
                 : 'You are NOT verified yet (need 1 completed purchase). 3-tier commission will be skipped, but points-matching still builds.',

package/dist/pwa/routes/reputation.js

@@ -1,3 +1,4 @@
+import { dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerReputationRoutes(app, deps) {
     const { db, auth, getReputation, getSellerMetrics } = deps;
     app.get('/api/reputation', (req, res) => {
@@ -16,9 +17,9 @@ export function registerReputationRoutes(app, deps) {
             metrics: getSellerMetrics(user.id),
         });
     });
-    app.get('/api/reputation/:userId', (req, res) => {
+    app.get('/api/reputation/:userId', async (req, res) => {
         const rep = getReputation(db, req.params.userId);
-        const decayRow = db.prepare(`SELECT last_decay_at FROM reputation_scores WHERE user_id = ?`).get(req.params.userId);
+        const decayRow = await dbOne(`SELECT last_decay_at FROM reputation_scores WHERE user_id = ?`, [req.params.userId]);
         res.json({
             level: rep.level,
             total_points: rep.total_points,