@seasonkoh/webaz 0.1.27 → 0.1.29

package/dist/pwa/routes/admin-direct-receive-deposits.js

@@ -0,0 +1,321 @@
+import { confirmProductionReceipt } from '../../direct-receive-deposits.js';
+import { reviewAmlFlag } from '../../direct-pay-aml-review.js';
+import { recordKybReview, recordSanctionsScreening, recordAmlFlagIngress, amlDetailHash } from '../../direct-pay-compliance-ingress.js';
+import { readDirectPayLaunchReadiness } from '../../direct-pay-launch-readiness.js';
+import { approveDeferral, rejectDeferral, listDeferrals } from '../../direct-receive-deferral.js';
+import { listProductVerifications, reviewProductVerification } from '../../product-verification.js';
+import { listStoreVerifications, reviewStoreVerification } from '../../store-verification.js';
+import { requireDirectPayHumanPasskey } from '../direct-pay-guards.js';
+import { recordFeePrepayTopup, recordFeePrepayAdjustment, recordFeePrepayRefund, getDirectPayFeeAccount } from '../../direct-pay-fee-ar.js';
+export function registerAdminDirectReceiveDepositsRoutes(app, deps) {
+    const { db, requireRootAdmin, consumeGateToken, logAdminAction, getProtocolParam } = deps;
+    // POST /api/admin/direct-receive/deposits/:id/confirm-production — ROOT + 真人 Passkey 手动确认生产保证金 receipt。
+    //   当前恒 fail-closed(无 legal-cleared rail → assert 抛 → PRODUCTION_RAIL_NOT_CLEARED)。
+    app.post('/api/admin/direct-receive/deposits/:id/confirm-production', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const depositId = req.params.id;
+        const railId = String(req.body?.rail_id || '');
+        const amountUnits = Number(req.body?.expected_amount_units);
+        const receiptRef = String(req.body?.receipt_ref || '');
+        const jurisdiction = String(req.body?.jurisdiction || '');
+        const webauthnToken = req.body?.webauthn_token;
+        // 现场真人 Passkey(铁律)。purpose_data 绑定【完整动作字段】:deposit/rail/amount/receipt/jurisdiction 全等才放行,
+        //   防止把一次签名复用到另一笔/另一参数的确认上。
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: admin.id, webauthnToken, purpose: 'direct_receive_production_confirm',
+            validate: (data) => {
+                const d = data;
+                return !!d && d.deposit_id === depositId && d.rail_id === railId && Number(d.amount_units) === amountUnits
+                    && d.receipt_ref === receiptRef && d.jurisdiction === jurisdiction;
+            },
+        });
+        // 每次 ROOT 尝试都审计 —— 含【gate 失败】(生产保证金确认本身是敏感控制事件,缺 Passkey / 缺 token /
+        //   purpose_data 不符的 ROOT 尝试同样要留痕)。非 ROOT 不审计(requireRootAdmin 已拦,无可信 admin 身份)。
+        if (!gate.ok) {
+            logAdminAction(admin.id, 'direct_receive.production_confirm', 'direct_receive_deposit', depositId, { rail_id: railId, jurisdiction, ok: false, outcome: gate.error_code === 'PASSKEY_REQUIRED_FOR_DIRECT_PAY' ? 'passkey_required' : 'human_presence_required', error_code: gate.error_code });
+            return void res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+        }
+        // 写入只走唯一 writer。assert 抛 → 当前恒 fail-closed。每次 ROOT 尝试都审计(含结果)。
+        try {
+            const r = confirmProductionReceipt(db, { depositId, railId, expectedAmountUnits: amountUnits, receiptRef, jurisdiction });
+            logAdminAction(admin.id, 'direct_receive.production_confirm', 'direct_receive_deposit', depositId, { rail_id: railId, jurisdiction, ok: r.ok, outcome: r.ok ? (r.already ? 'already' : 'confirmed') : r.reason });
+            if (!r.ok)
+                return void res.status(409).json({ error: r.reason, error_code: 'PRODUCTION_CONFIRM_REJECTED' });
+            return void res.json({ ok: true, status: r.status, already: !!r.already });
+        }
+        catch (e) {
+            // assertProductionDepositRail(及任何写前异常)→ 生产 rail 未 legal-clear → fail-closed。
+            logAdminAction(admin.id, 'direct_receive.production_confirm', 'direct_receive_deposit', depositId, { rail_id: railId, jurisdiction, ok: false, outcome: 'rail_not_cleared', error: e.message });
+            return void res.status(409).json({ error: '生产保证金收款轨未通过法务/生产放行,暂不可确认', error_code: 'PRODUCTION_RAIL_NOT_CLEARED' });
+        }
+    });
+    // POST /api/admin/direct-receive/aml-flags/:id/review — ROOT + 真人 Passkey 复核单条 AML flag (PR-6E)。
+    //   route 只做 auth + gate + 参数校验 + 调 reviewAmlFlag(唯一 review writer,原子改 flag + 写 audit)。
+    app.post('/api/admin/direct-receive/aml-flags/:id/review', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const flagId = req.params.id;
+        const decision = String(req.body?.decision || '');
+        const notes = req.body?.notes != null ? String(req.body.notes) : undefined;
+        const webauthnToken = req.body?.webauthn_token;
+        // 现场真人 Passkey(铁律)。purpose_data 绑 flag_id + decision:一次签名只用于该 flag 的该决策,杜绝复用。
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: admin.id, webauthnToken, purpose: 'direct_pay_aml_review',
+            validate: (data) => {
+                const d = data;
+                return !!d && d.flag_id === flagId && d.decision === decision;
+            },
+        });
+        if (!gate.ok) {
+            // gate 失败也审计(无 PII:flag_id + decision + 结果);成功复核的审计由 reviewAmlFlag 原子写入。
+            logAdminAction(admin.id, 'direct_pay.aml_review', 'aml_flag', flagId, { decision, ok: false, outcome: gate.error_code === 'PASSKEY_REQUIRED_FOR_DIRECT_PAY' ? 'passkey_required' : 'human_presence_required', error_code: gate.error_code });
+            return void res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+        }
+        const r = reviewAmlFlag(db, { flagId, reviewerId: admin.id, decision, notes });
+        if (!r.ok) {
+            const status = r.error === 'FLAG_NOT_FOUND' ? 404 : 400;
+            return void res.status(status).json({ error: 'AML flag 复核失败', error_code: r.error });
+        }
+        return void res.json({ ok: true, flag_id: r.flagId, decision: r.decision, status: r.status, disposition: r.disposition });
+    });
+    // ── PR-6F 合规 ingress(受控写入入口)。三端点共用:ROOT + 真人 Passkey(purpose-bound)+ 调 ingress helper。 ──
+    //   route 只做 auth + gate + 取参 + 调 helper(helper 原子写台账 + 审计);gate 失败也审计。无 vendor 外呼、无资金/状态机改动。
+    const str = (v) => v != null ? String(v) : '';
+    const opt = (v) => v != null ? String(v) : undefined;
+    // gatedIngress 返回一个 express handler(literal-path app.post 调用之 —— 让 API-doc 扫描器能识别端点)。
+    const gatedIngress = (purpose, makeValidate, run, failAudit) => (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: admin.id, webauthnToken: req.body?.webauthn_token, purpose, validate: makeValidate(req),
+        });
+        if (!gate.ok) {
+            const fa = failAudit(req);
+            logAdminAction(admin.id, purpose, 'user', fa.targetId, { ...fa.detail, ok: false, error_code: gate.error_code });
+            return void res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+        }
+        const r = run(req, admin.id);
+        if (!r.ok) {
+            // 业务校验失败(Passkey 已过)也留痕:money-adjacent admin 尝试(如退款余额不足被拒)必须可审计。
+            const fa = failAudit(req);
+            logAdminAction(admin.id, purpose, 'user', fa.targetId, { ...fa.detail, ok: false, error_code: r.error });
+            return void res.status(400).json({ error: '合规 ingress 失败', error_code: r.error });
+        }
+        return void res.json({ ok: true, id: r.id });
+    };
+    // POST /api/admin/direct-receive/kyb-reviews — KYB 复核结论 ingress(ROOT + 真人 Passkey)。
+    // Passkey purpose_data 绑定【完整写入内容】(user_id+status+provider_ref+expires_at):签 A 写 B 一律拒。
+    app.post('/api/admin/direct-receive/kyb-reviews', gatedIngress('direct_pay_kyb_ingress', (req) => (data) => {
+        const d = data;
+        return !!d && str(d.user_id) === str(req.body?.user_id) && str(d.status) === str(req.body?.status)
+            && str(d.provider_ref) === str(req.body?.provider_ref) && str(d.expires_at) === str(req.body?.expires_at);
+    }, (req, adminId) => recordKybReview(db, { userId: str(req.body?.user_id), reviewerId: adminId, status: str(req.body?.status), providerRef: opt(req.body?.provider_ref), expiresAt: opt(req.body?.expires_at) }), (req) => ({ targetId: str(req.body?.user_id), detail: { kyb_status: str(req.body?.status) } })));
+    // POST /api/admin/direct-receive/sanctions-screenings — 制裁筛查结论 ingress(ROOT + 真人 Passkey;high-risk)。
+    // purpose_data 绑定 user_id+status+provider_ref+expires_at。
+    app.post('/api/admin/direct-receive/sanctions-screenings', gatedIngress('direct_pay_sanctions_ingress', (req) => (data) => {
+        const d = data;
+        return !!d && str(d.user_id) === str(req.body?.user_id) && str(d.status) === str(req.body?.status)
+            && str(d.provider_ref) === str(req.body?.provider_ref) && str(d.expires_at) === str(req.body?.expires_at);
+    }, (req, adminId) => recordSanctionsScreening(db, { userId: str(req.body?.user_id), reviewerId: adminId, status: str(req.body?.status), providerRef: opt(req.body?.provider_ref), expiresAt: opt(req.body?.expires_at) }), (req) => ({ targetId: str(req.body?.user_id), detail: { sanctions_status: str(req.body?.status) } })));
+    // POST /api/admin/direct-receive/aml-flags — AML flag ingress(ROOT + 真人 Passkey;high-risk)。与 .../aml-flags/:id/review 区分。
+    // purpose_data 绑定 user_id+rule+severity+status+related_order_id+detail_hash(canonical):签 A 写 B 一律拒。
+    const amlDetail = (req) => (req.body?.detail && typeof req.body.detail === 'object' && !Array.isArray(req.body.detail)) ? req.body.detail : undefined;
+    app.post('/api/admin/direct-receive/aml-flags', gatedIngress('direct_pay_aml_ingress', (req) => (data) => {
+        const d = data;
+        return !!d && str(d.user_id) === str(req.body?.user_id) && str(d.rule) === str(req.body?.rule) && str(d.severity) === str(req.body?.severity)
+            && str(d.status) === str(req.body?.status) && str(d.related_order_id) === str(req.body?.related_order_id) && str(d.detail_hash) === amlDetailHash(amlDetail(req));
+    }, (req, adminId) => recordAmlFlagIngress(db, { userId: str(req.body?.user_id), reviewerId: adminId, rule: str(req.body?.rule), severity: str(req.body?.severity), status: str(req.body?.status), relatedOrderId: opt(req.body?.related_order_id), detail: amlDetail(req) }), (req) => ({ targetId: str(req.body?.user_id), detail: { rule: str(req.body?.rule), severity: str(req.body?.severity), aml_status: str(req.body?.status) } })));
+    // POST /api/admin/direct-receive/fee-prepay — 记录商家【平台服务费预付款】(ROOT + 真人 Passkey)。append-only;
+    //   invoice_id NULL = 未分配预充值 → 计入 available_prepay(首单后续建单门)。purpose_data 绑定 seller_id+amount_units+method+evidence_ref。
+    //   不碰 buyer wallet/escrow/order/settlement/refund;非买家 escrow/保证金/penalty。本轮无"余额退款"(仅正向预付款登记)。
+    app.post('/api/admin/direct-receive/fee-prepay', gatedIngress('direct_pay_fee_prepay_record', (req) => (data) => {
+        const d = data;
+        return !!d && str(d.seller_id) === str(req.body?.seller_id) && Number(d.amount_units) === Number(req.body?.amount_units)
+            && str(d.method) === str(req.body?.method) && str(d.evidence_ref) === str(req.body?.evidence_ref);
+    }, (req, adminId) => recordFeePrepayTopup(db, { sellerId: str(req.body?.seller_id), amountUnits: Number(req.body?.amount_units), method: str(req.body?.method), recordedBy: adminId, evidenceRef: opt(req.body?.evidence_ref), note: opt(req.body?.note) }), (req) => ({ targetId: str(req.body?.seller_id), detail: { amount_units: Number(req.body?.amount_units), method: str(req.body?.method) } })));
+    // POST /api/admin/direct-receive/fee-adjust — 平台服务费账务【更正】(ROOT + 真人 Passkey)。带符号 delta;append-only + audit。
+    //   ≠ 退款(不动真钱,只调记账)。purpose_data 绑 seller_id+delta_units+reason。
+    app.post('/api/admin/direct-receive/fee-adjust', gatedIngress('direct_pay_fee_adjust', (req) => (data) => {
+        const d = data;
+        return !!d && str(d.seller_id) === str(req.body?.seller_id) && Number(d.delta_units) === Number(req.body?.delta_units) && str(d.reason) === str(req.body?.reason);
+    }, (req, adminId) => recordFeePrepayAdjustment(db, { sellerId: str(req.body?.seller_id), deltaUnits: Number(req.body?.delta_units), reason: str(req.body?.reason), recordedBy: adminId }), (req) => ({ targetId: str(req.body?.seller_id), detail: { delta_units: Number(req.body?.delta_units) } })));
+    // POST /api/admin/direct-receive/fee-refund — 平台服务费余额【退款】(ROOT + 真人 Passkey)。真实退还未消耗预付款;
+    //   amount ≤ 当前 available(helper 同事务校验)。append-only + audit。purpose_data 绑 seller_id+amount_units+method+evidence_ref。
+    app.post('/api/admin/direct-receive/fee-refund', gatedIngress('direct_pay_fee_refund', (req) => (data) => {
+        const d = data;
+        return !!d && str(d.seller_id) === str(req.body?.seller_id) && Number(d.amount_units) === Number(req.body?.amount_units)
+            && str(d.method) === str(req.body?.method) && str(d.evidence_ref) === str(req.body?.evidence_ref);
+    }, (req, adminId) => recordFeePrepayRefund(db, { sellerId: str(req.body?.seller_id), amountUnits: Number(req.body?.amount_units), method: str(req.body?.method), recordedBy: adminId, evidenceRef: opt(req.body?.evidence_ref), reason: opt(req.body?.reason) }), (req) => ({ targetId: str(req.body?.seller_id), detail: { amount_units: Number(req.body?.amount_units), method: str(req.body?.method) } })));
+    // GET /api/admin/direct-receive/fee-account/:seller_id — ROOT 只读:某商家平台服务费账户汇总(余额/预充值/应收/调整/退款/在途预估/宽限)。
+    //   只读诊断,不写、无 Passkey(读不授权能力);卖家私密财务,买家/卖家拿不到此 admin 视图。
+    app.get('/api/admin/direct-receive/fee-account/:seller_id', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        return void res.json({ ok: true, account: getDirectPayFeeAccount(db, str(req.params.seller_id)) });
+    });
+    // POST /api/admin/direct-receive/readiness — ROOT + 真人 Passkey:返回【完整】Direct Pay launch readiness(blockers + facts,
+    //   含 KYB/sanctions/AML/base-bond/rail clearance 全细节)。只读诊断(不写库、不 flip launch);ROOT 专用,买家/卖家拿不到。
+    app.post('/api/admin/direct-receive/readiness', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const sellerId = req.body?.seller_id != null ? String(req.body.seller_id) : undefined;
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: admin.id, webauthnToken: req.body?.webauthn_token, purpose: 'direct_pay_admin_readiness',
+            validate: (data) => { const d = data; return !!d && String(d.seller_id ?? '') === String(sellerId ?? ''); },
+        });
+        if (!gate.ok) {
+            logAdminAction(admin.id, 'direct_pay.admin_readiness', 'user', sellerId ?? null, { ok: false, error_code: gate.error_code });
+            return void res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+        }
+        const readiness = readDirectPayLaunchReadiness(db, { getProtocolParam, sellerId });
+        logAdminAction(admin.id, 'direct_pay.admin_readiness', 'user', sellerId ?? null, { ok: true, ready: readiness.ready, blocker_count: readiness.blockers.length });
+        return void res.json(readiness);
+    });
+    // ── 缓交(deferred base-bond)审批队列。读 = ROOT;批准/拒绝 = ROOT + 真人 Passkey(铁律,授予绝不自动)。 ──
+    //   approveDeferral/rejectDeferral 是唯一 writer;本文件零 direct_receive_deferrals 直写。审批只改缓交状态机,
+    //   【不】碰 buyer wallet/escrow/order/settlement/refund/privileges,也不 flip launch。
+    const DEFERRAL_STATUSES = new Set(['pending', 'granted', 'rejected', 'expired']);
+    // GET /api/admin/direct-receive/deferrals?status=pending — ROOT 审批队列(默认全部;可按 status 过滤)。纯读。
+    app.get('/api/admin/direct-receive/deferrals', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const status = req.query?.status != null ? String(req.query.status) : '';
+        if (status && !DEFERRAL_STATUSES.has(status))
+            return void res.status(400).json({ error: '非法 status', error_code: 'BAD_STATUS' });
+        return void res.json({ deferrals: listDeferrals(db, status ? { status: status } : {}) });
+    });
+    // POST /api/admin/direct-receive/deferrals/:id/approve — ROOT + 真人 Passkey 批准缓交。
+    //   Passkey purpose_data 绑定【完整审批条款】(deferral_id + reduced_quota_factor + grace_days):签 A 批 B / 改条款一律拒。
+    app.post('/api/admin/direct-receive/deferrals/:id/approve', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const deferralId = req.params.id;
+        const rqfRaw = req.body?.reduced_quota_factor;
+        const graceRaw = req.body?.grace_days;
+        const webauthnToken = req.body?.webauthn_token;
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: admin.id, webauthnToken, purpose: 'direct_pay_deferral_approve',
+            validate: (data) => {
+                const d = data;
+                return !!d && str(d.deferral_id) === deferralId && str(d.reduced_quota_factor) === str(rqfRaw) && str(d.grace_days) === str(graceRaw);
+            },
+        });
+        if (!gate.ok) {
+            logAdminAction(admin.id, 'direct_pay.deferral_approve', 'direct_receive_deferral', deferralId, { ok: false, outcome: gate.error_code === 'PASSKEY_REQUIRED_FOR_DIRECT_PAY' ? 'passkey_required' : 'human_presence_required', error_code: gate.error_code });
+            return void res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+        }
+        const r = approveDeferral(db, { deferralId, adminId: admin.id, nowIso: new Date().toISOString(),
+            graceDays: graceRaw != null ? Number(graceRaw) : undefined, reducedQuotaFactor: rqfRaw != null ? Number(rqfRaw) : undefined });
+        logAdminAction(admin.id, 'direct_pay.deferral_approve', 'direct_receive_deferral', deferralId, { ok: r.ok, outcome: r.ok ? (r.already ? 'already' : 'granted') : r.reason });
+        if (!r.ok)
+            return void res.status(409).json({ error: r.reason, error_code: 'DEFERRAL_APPROVE_REJECTED' });
+        return void res.json({ ok: true, status: r.status, already: !!r.already });
+    });
+    // POST /api/admin/direct-receive/deferrals/:id/reject — ROOT + 真人 Passkey 拒绝缓交。purpose_data 绑 deferral_id。
+    app.post('/api/admin/direct-receive/deferrals/:id/reject', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const deferralId = req.params.id;
+        const webauthnToken = req.body?.webauthn_token;
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: admin.id, webauthnToken, purpose: 'direct_pay_deferral_reject',
+            validate: (data) => { const d = data; return !!d && str(d.deferral_id) === deferralId; },
+        });
+        if (!gate.ok) {
+            logAdminAction(admin.id, 'direct_pay.deferral_reject', 'direct_receive_deferral', deferralId, { ok: false, outcome: gate.error_code === 'PASSKEY_REQUIRED_FOR_DIRECT_PAY' ? 'passkey_required' : 'human_presence_required', error_code: gate.error_code });
+            return void res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+        }
+        const r = rejectDeferral(db, { deferralId, adminId: admin.id });
+        logAdminAction(admin.id, 'direct_pay.deferral_reject', 'direct_receive_deferral', deferralId, { ok: r.ok, outcome: r.ok ? (r.already ? 'already' : 'rejected') : r.reason });
+        if (!r.ok)
+            return void res.status(409).json({ error: r.reason, error_code: 'DEFERRAL_REJECT_REJECTED' });
+        return void res.json({ ok: true, status: r.status, already: !!r.already });
+    });
+    // ── 按产品认证(per-product verification)审批。读 = ROOT;verify/reject = ROOT + 真人 Passkey(硬门:核验=放行该产品直付,
+    //   capability-granting → 铁律 Passkey)。reviewProductVerification 是唯一 writer;本文件零 product_verifications 直写。 ──
+    const PV_STATUSES = new Set(['issued', 'submitted', 'verified', 'rejected']);
+    // GET /api/admin/direct-receive/product-verifications?status=submitted — ROOT 审核队列(默认全部)。纯读。
+    app.get('/api/admin/direct-receive/product-verifications', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const status = req.query?.status != null ? String(req.query.status) : '';
+        if (status && !PV_STATUSES.has(status))
+            return void res.status(400).json({ error: '非法 status', error_code: 'BAD_STATUS' });
+        return void res.json({ verifications: listProductVerifications(db, status ? { status: status } : {}) });
+    });
+    // POST /api/admin/direct-receive/product-verifications/:id/review — ROOT + 真人 Passkey 手动核对结论(verified|rejected)。
+    //   Passkey purpose_data 绑 verification_id + decision:签 A 用 B / 改结论一律拒。verify = 放行该产品直付(逐品,绝不放行全部)。
+    app.post('/api/admin/direct-receive/product-verifications/:id/review', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const verificationId = req.params.id;
+        const decision = String(req.body?.decision || '');
+        const notes = req.body?.notes != null ? String(req.body.notes) : undefined;
+        const webauthnToken = req.body?.webauthn_token;
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: admin.id, webauthnToken, purpose: 'direct_pay_product_verify',
+            validate: (data) => { const d = data; return !!d && str(d.verification_id) === verificationId && str(d.decision) === decision; },
+        });
+        if (!gate.ok) {
+            logAdminAction(admin.id, 'direct_pay.product_verify', 'product_verification', verificationId, { decision, ok: false, outcome: gate.error_code === 'PASSKEY_REQUIRED_FOR_DIRECT_PAY' ? 'passkey_required' : 'human_presence_required', error_code: gate.error_code });
+            return void res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+        }
+        const r = reviewProductVerification(db, { id: verificationId, reviewerId: admin.id, decision: decision, notes });
+        logAdminAction(admin.id, 'direct_pay.product_verify', 'product_verification', verificationId, { decision, ok: r.ok, outcome: r.ok ? (r.already ? 'already' : r.status) : r.reason });
+        if (!r.ok)
+            return void res.status(409).json({ error: r.reason, error_code: 'PRODUCT_VERIFICATION_REVIEW_REJECTED' });
+        return void res.json({ ok: true, status: r.status, already: !!r.already });
+    });
+    // ── 店铺认证(per-seller)审批 = 逐品验证豁免决定。读 = ROOT;verify/reject = ROOT + 真人 Passkey。 ──
+    //   核店铺时勾选 per_product_exempt:true → 该卖家所有商品免逐品验证(capability-granting → 铁律 Passkey;
+    //   purpose_data 绑 verification_id+decision+per_product_exempt,签 A 用 B / 改豁免位一律拒)。reviewStoreVerification 唯一 writer。
+    const SV_STATUSES = new Set(['issued', 'submitted', 'verified', 'rejected']);
+    // GET /api/admin/direct-receive/store-verifications?status=submitted — ROOT 审核队列(默认全部)。纯读。
+    app.get('/api/admin/direct-receive/store-verifications', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const status = req.query?.status != null ? String(req.query.status) : '';
+        if (status && !SV_STATUSES.has(status))
+            return void res.status(400).json({ error: '非法 status', error_code: 'BAD_STATUS' });
+        return void res.json({ verifications: listStoreVerifications(db, status ? { status: status } : {}) });
+    });
+    // POST /api/admin/direct-receive/store-verifications/:id/review — ROOT + 真人 Passkey 核店铺 + 勾选逐品豁免。
+    app.post('/api/admin/direct-receive/store-verifications/:id/review', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const verificationId = req.params.id;
+        const decision = String(req.body?.decision || '');
+        const perProductExempt = req.body?.per_product_exempt === true;
+        const notes = req.body?.notes != null ? String(req.body.notes) : undefined;
+        const webauthnToken = req.body?.webauthn_token;
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: admin.id, webauthnToken, purpose: 'direct_pay_store_verify',
+            validate: (data) => {
+                const d = data;
+                return !!d && str(d.verification_id) === verificationId && str(d.decision) === decision && (d.per_product_exempt === true) === perProductExempt;
+            },
+        });
+        if (!gate.ok) {
+            logAdminAction(admin.id, 'direct_pay.store_verify', 'store_verification', verificationId, { decision, per_product_exempt: perProductExempt, ok: false, outcome: gate.error_code === 'PASSKEY_REQUIRED_FOR_DIRECT_PAY' ? 'passkey_required' : 'human_presence_required', error_code: gate.error_code });
+            return void res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+        }
+        const r = reviewStoreVerification(db, { id: verificationId, reviewerId: admin.id, decision: decision, perProductExempt, notes });
+        logAdminAction(admin.id, 'direct_pay.store_verify', 'store_verification', verificationId, { decision, per_product_exempt: perProductExempt, ok: r.ok, outcome: r.ok ? (r.already ? 'already' : r.status) : r.reason });
+        if (!r.ok)
+            return void res.status(409).json({ error: r.reason, error_code: 'STORE_VERIFICATION_REVIEW_REJECTED' });
+        return void res.json({ ok: true, status: r.status, per_product_exempt: !!r.perProductExempt, already: !!r.already });
+    });
+}

package/dist/pwa/routes/agent-grants.js

@@ -0,0 +1,255 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js';
+import { initAgentDelegationGrantsSchema, initAgentPairingSchema, initAgentGrantAuthLogSchema } from '../../runtime/webaz-schema-helpers.js';
+import { validateRequestedCapabilities, clampTtlSeconds, grantIsActive } from '../../runtime/agent-grant-scopes.js';
+import { generateUserCode, verifyPkceS256, clampPairingTtlSeconds, pairingApprovable, pairingRetrievable } from '../../runtime/agent-pairing.js';
+import { verifyGrantToken } from '../../runtime/agent-grant-verifier.js';
+// Bounds on a pairing request (anti-bloat for the anonymous start endpoint).
+const MAX_CAPABILITIES = 12;
+const MAX_CONSTRAINTS_JSON = 2000;
+function safeParseCaps(json) {
+    try {
+        return JSON.parse(String(json));
+    }
+    catch {
+        return [];
+    }
+}
+/** Server-generated consent view for a pairing — canonical scope labels only, no secrets. */
+function consentView(p) {
+    return {
+        pairing_id: p.pairing_id,
+        agent_label: p.agent_label || null,
+        reason: p.reason || null, // agent-supplied free text (display only)
+        capabilities: safeParseCaps(p.capabilities), // server-validated safe scopes
+        status: p.status,
+        expires_at: p.expires_at,
+        notice: 'Approving issues a scoped, short-lived, revocable delegation grant — NOT your api_key, NOT your funds. Safe (read/draft) scopes only; it can never move money, vote, arbitrate, or change keys.',
+    };
+}
+export function registerAgentGrantsRoutes(app, deps) {
+    const { db, auth, generateId, rateLimitOk } = deps;
+    // PWA runtime self-init (MCP gets the tables via applyWebazRuntimeSchema). Idempotent.
+    initAgentDelegationGrantsSchema(db);
+    initAgentPairingSchema(db);
+    initAgentGrantAuthLogSchema(db);
+    // ─────────────────────────── RFC-020 PR-C2a: opt-in grant-scope enforcement ───────────────────────────
+    // EXPLICIT, per-route, per-SAFE-scope. NOT global auth — a gtk_* token is accepted ONLY by routes that
+    // deliberately mount requireAgentGrantScope(scope); auth()/api_key is untouched and never accepts gtk_*.
+    // Risk / never-delegable scopes can never pass (the verifier hard-fails non-safe required scopes).
+    const requireAgentGrantScope = (scope) => async (req, res, next) => {
+        // Anti-abuse: throttle the grant-consumption path BEFORE any DB work (parity with pair/start).
+        // Bounds both anonymous probing and valid-grant spam, and caps audit-log growth.
+        if (!rateLimitOk(`agent_grant:${req.ip || 'anon'}`, 30, 60_000)) {
+            return void res.status(429).json({ error: 'too_many_grant_requests', error_code: 'GRANT_RATE_LIMITED', retry_after_s: 60 });
+        }
+        const bearer = (req.header('authorization') || '').replace(/^Bearer\s+/i, '');
+        const presentedGrant = bearer.startsWith('gtk_'); // a request that presents no grant bearer isn't "grant-authorized"
+        const r = await verifyGrantToken(bearer, scope);
+        // Append-only audit (RFC-020 §3.7 + invariant: every grant-authorized request is audited). Only audit
+        // requests that actually presented a grant bearer — a no-token request is pure noise (and an unauth
+        // bloat vector), not a grant-authorized request.
+        let audited = false;
+        if (presentedGrant) {
+            try {
+                await dbRun('INSERT INTO agent_grant_auth_log (grant_id, human_id, capability, outcome, error_code) VALUES (?,?,?,?,?)', [r.ok ? r.principal.grant_id : (r.grant_id ?? null), r.ok ? r.principal.human_id : (r.human_id ?? null), scope, r.ok ? 'allow' : 'deny', r.ok ? null : r.error_code]);
+                audited = true;
+            }
+            catch (e) {
+                console.error('[agent-grant] audit write failed:', e.message);
+            }
+        }
+        // Deny path: return the denial regardless of audit (no access is granted, so nothing to fail closed on).
+        if (!r.ok)
+            return void res.status(r.status).json({ error: r.error, error_code: r.error_code });
+        // Success path: FAIL CLOSED if the authorization could not be audited — a grant-authorized request
+        // must never proceed unaudited (RFC-020 invariant). Better to deny (503, retryable) than act unaccountably.
+        if (!audited)
+            return void res.status(503).json({ error: 'authorization audit unavailable; refusing to proceed unaudited', error_code: 'GRANT_AUDIT_FAILED' });
+        req.agentGrant = r.principal;
+        next();
+    };
+    // Vertical slice (zero-risk): grant principal introspection. Proves the verifier + opt-in middleware
+    // end-to-end on a brand-new read-only endpoint that touches NO existing route and NO money path.
+    app.get('/api/agent-grants/whoami', requireAgentGrantScope('read_public'), (req, res) => {
+        const p = req.agentGrant;
+        res.json({ grant: p, note: 'Authorized via delegation grant (safe scope read_public). This is a grant principal, not a human session.' });
+    });
+    // ─────────────────────────── RFC-020 PR-C1: pairing (device-flow + PKCE) ───────────────────────────
+    // C1 = pairing + credential delivery ONLY. No grant is consumed by any tool here (that is PR-C2).
+    // (pair 1) Agent starts a pairing — UNAUTHENTICATED (agent has no credential yet). Safe scopes only.
+    app.post('/api/agent-grants/pair/start', async (req, res) => {
+        // Rate-limit the anonymous write FIRST (anti-bloat: no DB row unless under the cap).
+        if (!rateLimitOk(`agent_pair_start:${req.ip || 'anon'}`, 10, 60_000)) {
+            return void res.status(429).json({ error: 'too_many_pairing_starts', retry_after_s: 60 });
+        }
+        const body = (req.body || {});
+        const codeChallenge = typeof body.code_challenge === 'string' ? body.code_challenge : '';
+        if (!codeChallenge || codeChallenge.length < 32 || codeChallenge.length > 256)
+            return void res.status(400).json({ error: 'code_challenge required (PKCE S256)' });
+        const caps = Array.isArray(body.capabilities) ? body.capabilities : [];
+        if (caps.length > MAX_CAPABILITIES)
+            return void res.status(400).json({ error: 'too_many_capabilities', max: MAX_CAPABILITIES });
+        const v = validateRequestedCapabilities(caps);
+        if (!v.ok)
+            return void res.status(403).json({ error: 'pairing_rejected', rejected: v.rejected }); // risk + never-delegable hard-reject
+        const pairingId = generateId('par');
+        const userCode = generateUserCode();
+        const ttl = clampPairingTtlSeconds(body.ttl_seconds);
+        const expiresAt = new Date(Date.now() + ttl * 1000).toISOString();
+        const label = typeof body.agent_label === 'string' ? body.agent_label.slice(0, 120) : null;
+        const reason = typeof body.reason === 'string' ? body.reason.slice(0, 280) : null; // agent free text only
+        const pubkey = typeof body.agent_pubkey === 'string' ? body.agent_pubkey.slice(0, 1000) : null; // RESERVED (PoP), not verified in C1
+        const capsJson = JSON.stringify(v.safe.map(c => ({ capability: c, constraints: (caps.find(x => x?.capability === c)?.constraints) || {} })));
+        if (capsJson.length > MAX_CONSTRAINTS_JSON)
+            return void res.status(400).json({ error: 'capabilities_too_large', max_bytes: MAX_CONSTRAINTS_JSON });
+        await dbRun('INSERT INTO agent_pairing_sessions (pairing_id, user_code, code_challenge, agent_label, agent_pubkey, reason, capabilities, status, expires_at) VALUES (?,?,?,?,?,?,?,?,?)', [pairingId, userCode, codeChallenge, label, pubkey, reason, capsJson, 'pending', expiresAt]);
+        res.status(201).json({
+            pairing_id: pairingId,
+            user_code: userCode,
+            approve_url: `/#pair?code=${userCode}`,
+            expires_at: expiresAt,
+            note: 'Ask the human to open approve_url at webaz.xyz (logged in) and approve. Then retrieve the credential with the PKCE verifier.',
+        });
+    });
+    // (pair 2) Human reviews the server-generated consent — human-authenticated.
+    app.get('/api/agent-grants/pair/:user_code', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const p = await dbOne('SELECT * FROM agent_pairing_sessions WHERE user_code = ?', [req.params.user_code]);
+        if (!p)
+            return void res.status(404).json({ error: 'pairing_not_found' });
+        if (!pairingApprovable(p, new Date().toISOString()))
+            return void res.status(409).json({ error: 'pairing_not_pending_or_expired', status: p.status });
+        res.json({ consent: consentView(p) });
+    });
+    // (pair 3) Human approves — human-authenticated. Issues the grant (token_hash filled at retrieve).
+    app.post('/api/agent-grants/pair/:user_code/approve', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const now = new Date().toISOString();
+        const p = await dbOne('SELECT * FROM agent_pairing_sessions WHERE user_code = ?', [req.params.user_code]);
+        if (!p)
+            return void res.status(404).json({ error: 'pairing_not_found' });
+        if (!pairingApprovable(p, now))
+            return void res.status(409).json({ error: 'pairing_not_pending_or_expired', status: p.status });
+        // Re-validate scopes at approval time (defense in depth) — must still be safe-only.
+        const caps = safeParseCaps(p.capabilities);
+        const v = validateRequestedCapabilities(caps);
+        if (!v.ok)
+            return void res.status(403).json({ error: 'pairing_rejected', rejected: v.rejected });
+        const grantId = generateId('grt');
+        const expiresAt = new Date(Date.now() + clampTtlSeconds(undefined) * 1000).toISOString();
+        // Grant created WITHOUT a token (token_hash NULL) — the bearer is minted only at retrieval.
+        await dbRun('INSERT INTO agent_delegation_grants (grant_id, human_id, agent_label, capabilities, token_hash, human_confirm_required, status, expires_at) VALUES (?,?,?,?,?,?,?,?)', [grantId, user.id, p.agent_label || null, JSON.stringify(caps), null, 0, 'active', expiresAt]);
+        await dbRun("UPDATE agent_pairing_sessions SET status='approved', human_id=?, grant_id=?, approved_at=? WHERE user_code=? AND status='pending'", [user.id, grantId, now, req.params.user_code]);
+        res.json({ success: true, grant_id: grantId, capabilities: caps });
+    });
+    // (pair 4) Agent retrieves the credential ONCE via PKCE verifier — UNAUTHENTICATED (PKCE-gated).
+    app.post('/api/agent-grants/pair/:pairing_id/retrieve', async (req, res) => {
+        const now = new Date().toISOString();
+        const verifier = typeof req.body?.code_verifier === 'string' ? req.body.code_verifier : '';
+        const p = await dbOne('SELECT * FROM agent_pairing_sessions WHERE pairing_id = ?', [req.params.pairing_id]);
+        if (!p)
+            return void res.status(404).json({ error: 'pairing_not_found' });
+        if (p.status === 'consumed' || p.consumed_at)
+            return void res.status(409).json({ error: 'pairing_already_consumed' });
+        if (!pairingRetrievable(p, now))
+            return void res.status(409).json({ error: 'pairing_not_approved_or_expired', status: p.status });
+        if (!verifyPkceS256(verifier, String(p.code_challenge)))
+            return void res.status(403).json({ error: 'pkce_mismatch' });
+        // Confirm the issued grant is still active (could have been revoked between approve and retrieve).
+        const grant = await dbOne('SELECT grant_id, status, capabilities, expires_at FROM agent_delegation_grants WHERE grant_id = ?', [String(p.grant_id)]);
+        if (!grant || grant.status !== 'active')
+            return void res.status(409).json({ error: 'grant_inactive' });
+        // Mint the bearer ONCE here; persist only its SHA-256 hash. Raw bearer is returned a single time.
+        const token = `gtk_${randomBytes(32).toString('hex')}`;
+        const tokenHash = createHash('sha256').update(token).digest('hex');
+        // One-time consume: only succeeds if still approved+unconsumed (guards against retrieval races/reuse).
+        const consumed = await dbRun("UPDATE agent_pairing_sessions SET status='consumed', consumed_at=? WHERE pairing_id=? AND status='approved' AND consumed_at IS NULL", [now, req.params.pairing_id]);
+        if (!consumed || consumed.changes !== 1)
+            return void res.status(409).json({ error: 'pairing_already_consumed' });
+        await dbRun('UPDATE agent_delegation_grants SET token_hash=? WHERE grant_id=?', [tokenHash, grant.grant_id]);
+        res.json({
+            grant_id: grant.grant_id,
+            token, // shown ONCE — agent stores it locally; server keeps only the hash
+            token_note: 'Shown once. Store in your OS secret store; the server keeps only a hash and cannot reissue it.',
+            capabilities: safeParseCaps(grant.capabilities),
+            expires_at: grant.expires_at,
+        });
+    });
+    // ── Issue a grant (human-authenticated). Safe scopes only; risk/never-delegable rejected. ──
+    app.post('/api/agent-grants', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const body = (req.body || {});
+        const caps = Array.isArray(body.capabilities) ? body.capabilities : [];
+        const v = validateRequestedCapabilities(caps);
+        if (!v.ok) {
+            // Fail-closed: any risk / never-delegable / unknown scope rejects the whole request.
+            return void res.status(403).json({ error: 'grant_rejected', rejected: v.rejected });
+        }
+        const ttl = clampTtlSeconds(body.ttl_seconds);
+        const grantId = generateId('grt');
+        const token = `gtk_${randomBytes(32).toString('hex')}`; // bearer — shown once
+        const tokenHash = createHash('sha256').update(token).digest('hex');
+        const expiresAt = new Date(Date.now() + ttl * 1000).toISOString();
+        const label = typeof body.agent_label === 'string' ? body.agent_label.slice(0, 120) : null;
+        const capsJson = JSON.stringify(v.safe.map(c => ({
+            capability: c,
+            constraints: (caps.find(x => x?.capability === c)?.constraints) || {},
+        })));
+        await dbRun('INSERT INTO agent_delegation_grants (grant_id, human_id, agent_label, capabilities, token_hash, human_confirm_required, status, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)', [grantId, user.id, label, capsJson, tokenHash, 0, 'active', expiresAt]);
+        res.status(201).json({
+            grant_id: grantId,
+            token,
+            token_note: 'Shown once — store securely. The server keeps only a hash; it cannot show this again.',
+            capabilities: JSON.parse(capsJson),
+            expires_at: expiresAt,
+            note: 'Bearer-first grant for safe scopes only. Risk scopes are not delegable until their route has a live-Passkey gate; PoP binding is required before any risk scope or longer-lived delegation (RFC-020).',
+        });
+    });
+    // ── Read: the human's connected agents (no secrets) + recent-use from the audit log (PR-D). ──
+    // last_used_at / use_count come from agent_grant_auth_log (RFC-020 §3.7) — the data the
+    // "Connected agents" UI shows so a human can spot stale/unused or busy agents before revoking.
+    app.get('/api/agent-grants', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const rows = await dbAll(`SELECT g.grant_id, g.agent_label, g.capabilities, g.status, g.created_at, g.expires_at, g.revoked_at, g.revoked_reason,
+              MAX(CASE WHEN l.outcome = 'allow' THEN l.ts END) AS last_used_at,
+              COUNT(CASE WHEN l.outcome = 'allow' THEN 1 END) AS use_count
+         FROM agent_delegation_grants g
+         LEFT JOIN agent_grant_auth_log l ON l.grant_id = g.grant_id
+        WHERE g.human_id = ?
+        GROUP BY g.grant_id
+        ORDER BY g.created_at DESC`, [user.id]);
+        const now = new Date().toISOString();
+        res.json({
+            grants: rows.map(g => ({
+                ...g,
+                capabilities: safeParseCaps(g.capabilities),
+                use_count: Number(g.use_count) || 0,
+                active: grantIsActive(g, now),
+            })),
+        });
+    });
+    // ── Revoke (online, one-click). ──
+    app.post('/api/agent-grants/:grant_id/revoke', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const grantId = req.params.grant_id;
+        const g = await dbOne('SELECT grant_id, status FROM agent_delegation_grants WHERE grant_id = ? AND human_id = ?', [grantId, user.id]);
+        if (!g)
+            return void res.status(404).json({ error: 'grant_not_found' });
+        if (g.status === 'revoked')
+            return void res.json({ success: true, already_revoked: true, grant_id: grantId });
+        const reason = typeof req.body?.reason === 'string' ? req.body.reason.slice(0, 200) : null;
+        await dbRun("UPDATE agent_delegation_grants SET status = 'revoked', revoked_at = ?, revoked_reason = ? WHERE grant_id = ? AND human_id = ?", [new Date().toISOString(), reason, grantId, user.id]);
+        res.json({ success: true, grant_id: grantId });
+    });
+}

package/dist/pwa/routes/buyer-feeds.js

@@ -1,4 +1,5 @@
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { genuineSalePredicate } from '../../layer0-foundation/L0-2-state-machine/genuine-sale.js'; // RFC-018 PR4: 真实成交(排除全额退货)
 export function registerBuyerFeedsRoutes(app, deps) {
     // db 已走 RFC-016 异步 seam(dbOne/dbAll),不再直接用 deps.db
     const { auth, isTrustedRole, errorRes, getNearbyCellPrecision, getProtocolParam } = deps;
@@ -28,7 +29,7 @@ export function registerBuyerFeedsRoutes(app, deps) {
             ? `AND p.id NOT IN (${exclArgs.map(() => '?').join(',')})`
             : '';
         const baseCols = `p.id, p.title, p.price, p.stock, p.category, p.images, p.has_variants, p.seller_id,
-      (SELECT COUNT(1) FROM orders o WHERE o.product_id = p.id AND o.status = 'completed') as sales_count,
+      (SELECT COUNT(1) FROM orders o WHERE o.product_id = p.id AND ${genuineSalePredicate('o')}) as sales_count,
       u.name as seller_name, u.handle as seller_handle`;
         let followedProducts = [];
         if (followedSellerIds.length > 0) {

package/dist/pwa/routes/chat.js

@@ -108,7 +108,12 @@ export function registerChatRoutes(app, deps) {
         CASE WHEN c.user_a = ? THEN c.unread_a ELSE c.unread_b END as my_unread,
         CASE WHEN c.user_a = ? THEN c.user_b ELSE c.user_a END as other_id,
         (SELECT handle FROM users WHERE id = CASE WHEN c.user_a = ? THEN c.user_b ELSE c.user_a END) as other_handle,
-        (SELECT name   FROM users WHERE id = CASE WHEN c.user_a = ? THEN c.user_b ELSE c.user_a END) as other_name
+        (SELECT name   FROM users WHERE id = CASE WHEN c.user_a = ? THEN c.user_b ELSE c.user_a END) as other_name,
+        -- 友好标签:订单/问商品 → 商品名,让收件箱里同一对方的多个会话可区分(不只显示 kind)。无新 bind 参数(仅用 c.kind/c.context_id)。
+        (CASE c.kind
+           WHEN 'order'      THEN (SELECT p.title FROM orders o JOIN products p ON p.id = o.product_id WHERE o.id = c.context_id)
+           WHEN 'listing_qa' THEN (SELECT title FROM products WHERE id = c.context_id)
+           ELSE NULL END) as context_title
       FROM conversations c
       WHERE (c.user_a = ? OR c.user_b = ?) AND c.status NOT IN ('blocked','archived')
       ORDER BY COALESCE(c.last_message_at, c.created_at) DESC

package/dist/pwa/routes/dashboards.js

@@ -1,4 +1,5 @@
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { genuineSalePredicate } from '../../layer0-foundation/L0-2-state-machine/genuine-sale.js'; // RFC-018 PR4: 真实成交(排除全额退货)
 export function registerDashboardsRoutes(app, deps) {
     // db 已走 RFC-016 异步 seam(dbOne/dbAll),不再直接用 deps.db
     const { auth } = deps;
@@ -70,7 +71,7 @@ export function registerDashboardsRoutes(app, deps) {
     `, [userId, userId, userId, userId, userId, userId]);
         const highComm = await dbAll(`
       SELECT p.id, p.title, p.price, p.commission_rate, p.images, p.category,
-        (SELECT COUNT(*) FROM orders o WHERE o.product_id = p.id AND o.status = 'completed') as sales_count
+        (SELECT COUNT(*) FROM orders o WHERE o.product_id = p.id AND ${genuineSalePredicate('o')}) as sales_count
       FROM products p
       WHERE p.status = 'active'
         AND p.commission_rate > 0