@seasonkoh/webaz 0.1.27 → 0.1.29

package/dist/pwa/routes/leaderboard.js

@@ -1,4 +1,42 @@
 import { dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+// ── Anonymous-projection allowlist (security: this is a NO-AUTH public endpoint) ──────────────
+// Each board's anon payload carries ONLY what the public value proposition needs: a public
+// identity for linking (handle/name) + the reputation/content signal. It must NEVER carry
+// internal canonical user ids (usr_xxx — those are the keyed inputs the #1043 cross-user-read
+// cap rate-limits; emitting them here would be a free enumeration seed-list), account-structure
+// metadata (keys_count), or behavior-fingerprint integers (calls_30d). ALLOWLIST, not denylist,
+// so a future SELECT column can't silently ride to the public surface. Canonical user id (usr_xxx)
+// is the keyed input the #1043 cross-user-read cap rate-limits, so it is DROPPED from every user
+// board (agents/buyers/sellers/arbitrators/verifiers/creators). All user cards navigate via the
+// public handle — #shop/:identifier and #u/:user_id both resolve a handle (users-public.ts
+// resolveUserId: usr_xxx / permanent_code / @handle). Product boards keep `id` — a public PRODUCT
+// id, not a user id.
+export const BOARD_ALLOWLIST = {
+    products: ['id', 'title', 'price', 'total_likes', 'completion_count', 'seller_handle', 'seller_name', 'recommend_count', 'rank_score'],
+    value_products: ['id', 'title', 'price', 'category', 'value_badge_rank', 'value_badge_pct', 'value_badge_at', 'completion_count', 'total_likes', 'seller_handle', 'seller_name'],
+    creators: ['handle', 'name', 'region', 'products_shared', 'shareable_count', 'total_likes', 'total_clicks'], // no id — card navs #u/${handle} (#u/ resolves handle)
+    buyers: ['handle', 'name', 'region', 'orders_count'],
+    sellers: ['handle', 'name', 'region', 'orders_count', 'avg_rating', 'rating_count'], // no id — card navs via handle (#shop accepts it)
+    agents: ['handle', 'name', 'trust_score', 'level', 'activity'], // NO id / keys_count / calls_30d
+    arbitrators: ['handle', 'name', 'cases_count', 'total_yes', 'total_no', 'fairness_score'],
+    verifiers: ['handle', 'name', 'tasks_done', 'tasks_correct', 'tasks_wrong', 'accuracy', 'tier'],
+};
+// calls_30d (behavior fingerprint) → coarse activity bucket (keeps "busy vs dormant" product signal
+// without leaking a raw per-account integer or the all-zero "network looks dead" aggregate).
+function activityBucket(calls) {
+    return calls >= 20 ? 'active' : calls >= 1 ? 'quiet' : 'dormant';
+}
+function projectBoard(kind, rows) {
+    const allow = BOARD_ALLOWLIST[kind] || [];
+    return rows.map(r => {
+        const src = kind === 'agents' ? { ...r, activity: activityBucket(Number(r.calls_30d) || 0) } : r;
+        const out = {};
+        for (const k of allow)
+            if (k in src)
+                out[k] = src[k];
+        return out;
+    });
+}
 export function registerLeaderboardRoutes(app, deps) {
     // db 已走 RFC-016 异步 seam(dbAll),不再直接用 deps.db
     const { internalAuditorId, rateLimitOk } = deps;
@@ -27,7 +65,7 @@ export function registerLeaderboardRoutes(app, deps) {
         ORDER BY rank_score DESC, p.id DESC
         LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'creators') {
             // 创作者维度：聚合自己 shareables 的总点赞 + 关联商品总数
@@ -43,7 +81,7 @@ export function registerLeaderboardRoutes(app, deps) {
         ORDER BY total_likes DESC, shareable_count DESC, u.id DESC
         LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         // B-2: 用户排行 — top buyers / sellers / verifiers
         // 2026-05-23 隐私第一原理：移除 gmv 字段（运营状态私密，防过早 fork）
@@ -55,7 +93,7 @@ export function registerLeaderboardRoutes(app, deps) {
         WHERE o.status = 'completed' AND u.id NOT IN ('sys_protocol', ?)
         GROUP BY u.id ORDER BY orders_count DESC, u.id DESC LIMIT ?
       `, [internalAuditorId, limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'sellers') {
             // 排序改为 评分主导（avg_rating × log(1+rating_count)），不再按 GMV
@@ -70,7 +108,7 @@ export function registerLeaderboardRoutes(app, deps) {
         ORDER BY (avg_rating * (1.0 + log(1.0 + rating_count))) DESC, rating_count DESC, orders_count DESC
         LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'value_products') {
             // 2026-05-23 S5：极致性价比榜 — 按 value_badge=1 + 同类目 rank 排
@@ -85,7 +123,7 @@ export function registerLeaderboardRoutes(app, deps) {
         WHERE p.value_badge = 1 AND p.status = 'active' AND p.stock > 0
         ORDER BY p.value_badge_rank ASC, p.value_badge_pct DESC LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'agents') {
             // 2026-05-22 AG1：Agent 评测竞赛榜单
@@ -101,12 +139,12 @@ export function registerLeaderboardRoutes(app, deps) {
             AND acl.created_at > datetime('now', '-30 days')) as calls_30d
         FROM agent_reputation ar
         JOIN users u ON u.id = ar.user_id
-        WHERE u.id != 'sys_protocol'
+        WHERE u.id != 'sys_protocol' AND u.role != 'admin'
         GROUP BY u.id
         HAVING calls_30d > 0 OR trust_score > 0
         ORDER BY trust_score DESC, calls_30d DESC LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'arbitrators') {
             // 2026-05-22 A3：仲裁员声誉排行
@@ -132,7 +170,7 @@ export function registerLeaderboardRoutes(app, deps) {
         GROUP BY u.id
         ORDER BY cases_count DESC, u.id DESC LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'verifiers') {
             // 2026-05-22 V1：移除 tasks_done >= 5 门槛 — 小协议早期阶段会卡死榜单
@@ -152,7 +190,7 @@ export function registerLeaderboardRoutes(app, deps) {
         WHERE vs.tasks_done >= 1
         ORDER BY vs.tasks_done DESC, u.id DESC LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         return void res.json({ error: 'kind 必须是 products / creators / buyers / sellers / verifiers / arbitrators / agents / value_products' });
     });

package/dist/pwa/routes/listings.js

@@ -265,8 +265,8 @@ export function registerListingsRoutes(app, deps) {
           id, seller_id, title, description, price, stock, status, images,
           ship_regions, handling_hours, commission_rate, category_id, stake_amount,
           listing_id, fulfillment_type, eta_hours, freshness_ts,
-          is_clearance, clearance_until, cold_start_remaining, listing_stake_locked
-        ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,datetime('now'),?,?,?,?)
+          is_clearance, clearance_until, cold_start_remaining, listing_stake_locked, currency
+        ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,datetime('now'),?,?,?,?,'WAZ')
       `).run(id, user.id, listing.title, (body.description ? String(body.description) : listing.description || ''), priceNum, stockNum, 'active', imagesJson, shipRegions, 24, 0.10, 'cat_default', 0, req.params.id, fulfillmentType, body.eta_hours != null ? Number(body.eta_hours) : null, body.is_clearance ? 1 : 0, body.clearance_until ? String(body.clearance_until) : null, catCfg.cold_start, stakeRequired);
             db.prepare(`UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ?`).run(stakeRequired, stakeRequired, user.id);
             db.prepare(`UPDATE listings SET total_offers = total_offers + 1, updated_at = datetime('now') WHERE id = ?`).run(req.params.id);

package/dist/pwa/routes/logistics.js

@@ -1,4 +1,5 @@
 import { dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { stripDirectPayPaymentTarget } from '../direct-pay-order-redaction.js'; // 披露门:物流第三方绝不该见收款目标
 export function registerLogisticsRoutes(app, deps) {
     // db 已走 RFC-016 异步 seam(dbAll),不再直接用 deps.db
     const { auth } = deps;
@@ -32,6 +33,9 @@ export function registerLogisticsRoutes(app, deps) {
       WHERE o.logistics_id = ? AND o.status IN ('shipped','picked_up','in_transit')
       ORDER BY o.created_at ASC LIMIT 20
     `, [user.id]);
+        // 披露门:物流是非买家第三方,无条件删除 direct_p2p 收款目标(instruction 快照 + 账号快照);物流只需商品/状态/地址。
+        for (const o of [...available, ...mine])
+            stripDirectPayPaymentTarget(o);
         res.json({ available, mine });
     });
 }

package/dist/pwa/routes/manifests.js

@@ -2,6 +2,9 @@ import crypto from 'crypto';
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 const MANIFEST_DAILY_LIMIT = 20;
 const THUMB_MAX_BYTES = 12000; // ~12KB base64 ≈ 9KB 原始图
+// Whitelist for stored/served thumbnails: raster data-URI only. Blocks svg/text/html data URIs so a malicious
+// seller can't smuggle scriptable content that the public /thumb endpoint would serve (stored-XSS guard).
+const THUMB_DATA_URI_RE = /^data:image\/(jpeg|png|webp);base64,[A-Za-z0-9+/=]+$/;
 function verifyManifestSig(hash, ownerId, contentType, byteSize, signedAt, apiKey, signature) {
     const payload = `${hash}|${ownerId}|${contentType}|${byteSize}|${signedAt}`;
     const expected = crypto.createHmac('sha256', apiKey).update(payload).digest('hex');
@@ -25,6 +28,8 @@ export function registerManifestsRoutes(app, deps) {
             return void res.json({ error: '请关联商品或流量口令' });
         if (thumbnail_data_uri && thumbnail_data_uri.length > THUMB_MAX_BYTES)
             return void res.json({ error: '缩略图过大（≤ 9KB 原始）' });
+        if (thumbnail_data_uri && !THUMB_DATA_URI_RE.test(thumbnail_data_uri))
+            return void res.json({ error: '缩略图必须是 data:image/(jpeg|png|webp);base64 格式' });
         // 验签
         const apiKey = me.api_key;
         if (!verifyManifestSig(hash, me.id, content_type, byte_size, signed_at, apiKey, signature)) {
@@ -82,6 +87,39 @@ export function registerManifestsRoutes(app, deps) {
     `, [req.params.hash]);
         res.json({ manifest: m, peers });
     });
+    // PUBLIC thumbnail bytes for <img src> (product cards can't send an auth header). Hardened:
+    //   - :hash must be 64-hex (format guard)
+    //   - only status='active' manifests
+    //   - the stored data-URI must match the raster whitelist (jpeg/png/webp) — else 404 (no svg/text/html)
+    //   - Content-Type is FORCED from the whitelisted subtype (never echoed from the stored value) + nosniff
+    //   - size guard; SHORT revalidatable cache (max-age=300, must-revalidate) — NOT immutable: the content is
+    //     hash-fixed but its serve-ability is not (owner/admin takedown flips status), so a long cache would
+    //     keep serving a taken-down thumbnail. 5-min TTL absorbs list bursts while honoring takedown promptly.
+    //   Only the low-res thumbnail is exposed (never full-res / metadata / other columns).
+    app.get('/api/manifests/:hash/thumb', async (req, res) => {
+        const hash = String(req.params.hash || '');
+        if (!/^[0-9a-f]{64}$/i.test(hash))
+            return void res.status(400).end();
+        const m = await dbOne(`SELECT thumbnail_data_uri, status FROM manifest_registry WHERE hash = ?`, [hash]);
+        if (!m || m.status !== 'active' || !m.thumbnail_data_uri)
+            return void res.status(404).end();
+        const parsed = THUMB_DATA_URI_RE.exec(m.thumbnail_data_uri);
+        if (!parsed)
+            return void res.status(404).end();
+        let buf;
+        try {
+            buf = Buffer.from(m.thumbnail_data_uri.slice(m.thumbnail_data_uri.indexOf(',') + 1), 'base64');
+        }
+        catch {
+            return void res.status(404).end();
+        }
+        if (buf.length === 0 || buf.length > 64 * 1024)
+            return void res.status(404).end();
+        res.setHeader('Content-Type', `image/${parsed[1]}`);
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('Cache-Control', 'public, max-age=300, must-revalidate');
+        res.send(buf);
+    });
     app.get('/api/manifests/by-product/:pid', async (req, res) => {
         const user = auth(req, res);
         if (!user)

package/dist/pwa/routes/me-data.js

@@ -1,7 +1,8 @@
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { redactUnackedDirectPayTarget } from '../direct-pay-order-redaction.js'; // 披露门:自导出的 orders 也不得旁路
 export function registerMeDataRoutes(app, deps) {
-    // db 已全量走 RFC-016 异步 seam(dbOne/dbAll),不再直接用 deps.db
-    const { auth } = deps;
+    // db 走 RFC-016 异步 seam(dbOne/dbAll);deps.db 仅供披露门(requireBothDisclosuresAcked 是同步 gate)
+    const { auth, db } = deps;
     // COP 飞轮: 完成订单 7d 引导发笔记
     app.get('/api/me/note-prompts', async (req, res) => {
         const user = auth(req, res);
@@ -56,6 +57,8 @@ export function registerMeDataRoutes(app, deps) {
             data.profile = await dbOne(`SELECT id, name, handle, role, region, bio, search_anchor, email, phone, permanent_code, created_at, reputation FROM users WHERE id = ?`, [uid]);
             data.wallet = await dbOne(`SELECT balance, staked, escrowed, earned FROM wallets WHERE user_id = ?`, [uid]);
             data.orders = await dbAll(`SELECT * FROM orders WHERE buyer_id = ? OR seller_id = ? ORDER BY created_at DESC LIMIT 1000`, [uid, uid]);
+            for (const o of data.orders)
+                redactUnackedDirectPayTarget(db, o, uid); // 披露门:自导出也不得在 D1/D2 ack 前泄露 direct_p2p 收款目标(JSON + CSV 同源)
             data.shareables = await dbAll(`SELECT * FROM shareables WHERE owner_id = ? AND status != 'removed'`, [uid]);
             data.bookmarks = await dbAll(`SELECT b.*, s.title FROM shareable_bookmarks b LEFT JOIN shareables s ON s.id = b.shareable_id WHERE b.user_id = ?`, [uid]);
             data.likes = await dbAll(`SELECT l.*, s.title FROM shareable_likes l LEFT JOIN shareables s ON s.id = l.shareable_id WHERE l.user_id = ?`, [uid]);

package/dist/pwa/routes/orders-action.js

@@ -1,6 +1,25 @@
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js';
+import { releaseFeeStake } from '../../direct-pay-ledger.js'; // Rail1 直付:取消/超时释放任何遗留模拟质押(AR 订单无 stake → no-op)
+import { requireBothDisclosuresAcked } from '../../direct-pay-disclosures.js'; // PR-4e: D1/D2 披露契约门
+import { requireDirectPayHumanPasskey } from '../direct-pay-guards.js'; // PR-4e: 现场真人 Passkey/gate-token 门
 export function registerOrdersActionRoutes(app, deps) {
-    const { db, auth, isTrustedRole, generateId, transition, notifyTransition, settleOrder, settleFault, detectFraud, createDispute, checkTimeouts, recordViolationReputation, broadcastSystemEvent } = deps;
+    const { db, auth, isTrustedRole, generateId, transition, notifyTransition, settleOrder, settleFault, detectFraud, createDispute, checkTimeouts, recordViolationReputation, broadcastSystemEvent, consumeGateToken } = deps;
+    // PR-4e: direct_p2p 风险动作门 —— ① D1/D2 两次披露都 ack(缺则 DISCLOSURE_NOT_ACKED);② 现场真人 Passkey + 一次性
+    //   WebAuthn gate token(purpose 固定 direct_pay_order_action,order+action 走 purpose_data + validate)。
+    //   纯前置门:返回 ok 才允许后续写入。【先 disclosure(只读)再 Passkey(消费 token)】→ 缺 ack 不浪费 token。
+    //   调用方必须在【任何写入前 + 只读状态预检之后】调用,避免错误状态消耗 token。
+    function directPayActionGate(orderId, action, userId, webauthnToken) {
+        const disc = requireBothDisclosuresAcked(db, orderId);
+        if (!disc.ok)
+            return { ok: false, status: 409, error: disc.reason || '需先完成两次风险披露确认', error_code: disc.error_code || 'DISCLOSURE_NOT_ACKED' };
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId, webauthnToken, purpose: 'direct_pay_order_action',
+            validate: (data) => { const d = data; return !!d && d.order_id === orderId && d.action === action; },
+        });
+        if (!gate.ok)
+            return { ok: false, status: 403, error: gate.reason || '需现场真人 Passkey 确认', error_code: gate.error_code || 'HUMAN_PRESENCE_REQUIRED' };
+        return { ok: true };
+    }
     // RFC-007 stage 2：卖家主动拒单 reason_code 白名单。
     //   classification(客观无责 vs 主观有责)是 stage 3 auto-verify 的事;stage 2 仅捕获 + 一律走违约结算。
     //   objective-claimed(stage 3 将尝试确定性核验):stock_consumed_concurrent / stale_price_snapshot / force_majeure
@@ -93,23 +112,38 @@ export function registerOrdersActionRoutes(app, deps) {
             return void res.status(400).json({ error: `订单状态 ${order.status} 不可确认面交` });
         if (order.has_pending_claim)
             return void res.status(400).json({ error: '存在进行中的验证任务，不可确认' });
+        // Rail1:平台费已切换为链下应收(accrue 在完成结算时,与 completed 同一原子边界,fail-closed)。
+        //   建单不再锁 fee-stake,故【不再】前置要求 locked stake(AR 订单本就无 stake)。
+        const isDirectP2p = order.payment_rail === 'direct_p2p';
+        // PR-4e:direct_p2p 面交完成 = RISK 动作 → 两次披露门 + 现场真人 Passkey 门。
+        if (isDirectP2p) {
+            const g = directPayActionGate(req.params.id, 'confirm_in_person', user.id, req.body?.webauthn_token);
+            if (!g.ok)
+                return void res.status(g.status).json({ error: g.error, error_code: g.error_code });
+        }
         const tx = db.transaction(() => {
             db.prepare(`UPDATE orders SET status='completed', updated_at=datetime('now') WHERE id = ?`).run(req.params.id);
             db.prepare(`INSERT INTO order_state_history (id, order_id, from_status, to_status, actor_id, actor_role, notes)
         VALUES (?,?,?,?,?,?, '面交完成 — 买家确认')`)
                 .run(generateId('hst'), req.params.id, order.status, 'completed', user.id, user.role || 'buyer');
+            // direct_p2p:取平台费进同一事务 → 取费失败(缺 locked stake)回滚 completed,订单不会 terminal-completed 而费用落空。
+            if (isDirectP2p)
+                settleOrder(req.params.id);
         });
         try {
             tx();
         }
         catch (e) {
-            return void res.status(500).json({ error: '状态写入失败：' + e.message });
-        }
-        try {
-            settleOrder(req.params.id);
+            return void res.status(isDirectP2p ? 409 : 500).json({ error: (isDirectP2p ? '直付完成结算失败,订单未完成：' : '状态写入失败：') + e.message, ...(isDirectP2p ? { error_code: 'DIRECT_PAY_SETTLE_FAILED' } : {}) });
         }
-        catch (e) {
-            console.error('[settleOrder in-person]', e);
+        // escrow:沿用原有非原子结算(失败仅记日志,不回滚 completed —— 与既有行为一致,本次不改 escrow)。
+        if (!isDirectP2p) {
+            try {
+                settleOrder(req.params.id);
+            }
+            catch (e) {
+                console.error('[settleOrder in-person]', e);
+            }
         }
         res.json({ success: true });
     });
@@ -137,6 +171,32 @@ export function registerOrdersActionRoutes(app, deps) {
         if (action === 'confirm' && uid !== buyerId) {
             return void res.status(403).json({ error: '你不是本订单的买家', error_code: 'NOT_ORDER_BUYER' });
         }
+        // Rail1 直付:买家专属动作。mark_paid = 买家声明"我已付款"→ accepted(进卖家发货流程);
+        //   cancel = 付款前买家取消 → cancelled(释放费用质押)。仅 buyer、仅 direct_p2p 且仍在付款窗口。
+        if (action === 'mark_paid' || action === 'cancel') {
+            if (uid !== buyerId) {
+                return void res.status(403).json({ error: '你不是本订单的买家', error_code: 'NOT_ORDER_BUYER' });
+            }
+            if (order.payment_rail !== 'direct_p2p' || order.status !== 'direct_pay_window') {
+                return void res.status(409).json({ error: '该操作仅适用于直付订单的付款窗口', error_code: 'NOT_DIRECT_PAY_WINDOW' });
+            }
+        }
+        // PR-4e:mark_paid = direct_p2p RISK 动作(已过 direct_pay_window 只读预检)→ 两次披露门 + 现场真人 Passkey 门。cancel 不门控。
+        if (action === 'mark_paid') {
+            const g = directPayActionGate(req.params.id, 'mark_paid', uid, req.body?.webauthn_token);
+            if (!g.ok)
+                return void res.status(g.status).json({ error: g.error, error_code: g.error_code });
+        }
+        // Rail1:平台费链下应收,accrue 在完成结算时(settleOrder direct_p2p 分支)与 completed 同一原子边界、fail-closed
+        //   (accrueFeeReceivable 缺费即抛 → 回滚 completed)。故【不再】前置要求 locked fee-stake。
+        // PR-4e:direct_p2p confirm = RISK 动作。先【只读状态预检】(仅 delivered 可确认收货,杜绝错误状态消耗 token),再两次披露门 + 现场真人 Passkey 门。
+        if (action === 'confirm' && order.payment_rail === 'direct_p2p') {
+            if (order.status !== 'delivered')
+                return void res.status(409).json({ error: `订单状态 ${order.status} 不可确认收货(仅 delivered)`, error_code: 'ORDER_NOT_DELIVERED' });
+            const g = directPayActionGate(req.params.id, 'confirm', uid, req.body?.webauthn_token);
+            if (!g.ok)
+                return void res.status(g.status).json({ error: g.error, error_code: g.error_code });
+        }
         if (action === 'pickup' || action === 'transit' || action === 'deliver') {
             // pickup 时若订单尚无物流，允许领取（孤儿单兜底）
             const isOrphanPickup = action === 'pickup' && !logisticsId;
@@ -254,9 +314,28 @@ export function registerOrdersActionRoutes(app, deps) {
                 note: '已就客观无责拒单发起人工仲裁举证。自动终结已暂停,等待仲裁员裁决:维持→免责全退+退质押,驳回→违约结算。',
             });
         }
+        // Rail1 直付:付款窗口内买家取消 → cancelled + 释放费用质押(单事务:转移成功必同步放质押,
+        //   杜绝"已取消但质押漏放"泄漏 —— cancelled 单超时 cron 不再扫,放质押无后备路径,故必须原子)。
+        if (action === 'cancel') {
+            const fromStatusCancel = order.status;
+            try {
+                db.transaction(() => {
+                    const r = transition(db, req.params.id, 'cancelled', uid, [], notes);
+                    if (!r.success)
+                        throw new Error(r.error || '状态转移失败');
+                    releaseFeeStake(db, { orderId: req.params.id });
+                })();
+            }
+            catch (e) {
+                return void res.status(409).json({ error: e.message, error_code: 'CANCEL_FAILED' });
+            }
+            notifyTransition(db, req.params.id, fromStatusCancel, 'cancelled');
+            return void res.json({ success: true, status: 'cancelled', fee_stake_released: true });
+        }
         const actionMap = {
             accept: 'accepted', ship: 'shipped', pickup: 'picked_up',
-            transit: 'in_transit', deliver: 'delivered', confirm: 'confirmed', dispute: 'disputed'
+            transit: 'in_transit', deliver: 'delivered', confirm: 'confirmed', dispute: 'disputed',
+            mark_paid: 'accepted', // Rail1 直付:买家声明"我已付款" → accepted(汇入既有卖家发货流程;协议不验真实付款)
         };
         const toStatus = actionMap[action];
         if (!toStatus)
@@ -270,6 +349,32 @@ export function registerOrdersActionRoutes(app, deps) {
         VALUES (?,?,?,'description',?,?,?)`).run(eid, req.params.id, user.id, evidence_description, `hash_${Date.now()}`, evReasons.length ? JSON.stringify(evReasons) : null);
             evidenceIds.push(eid);
         }
+        // Rail1 全原子(Codex P1):direct_p2p confirm 必须把 delivered→confirmed→completed→settle/accrue 包进【同一 db.transaction】。
+        //   否则 delivered→confirmed 先单独提交、随后 accrue 失败 → 订单卡在 confirmed(retry 被 ORDER_NOT_DELIVERED 拒)。
+        //   任一步失败 → 整体回滚到 delivered(可重试);成功后再发通知。confirm-in-person 是另一端点、已单事务原子。
+        if (action === 'confirm' && order.payment_rail === 'direct_p2p') {
+            try {
+                db.transaction(() => {
+                    const r1 = transition(db, req.params.id, 'confirmed', user.id, evidenceIds, notes);
+                    if (!r1.success)
+                        throw new Error(r1.error || 'confirmed transition failed');
+                    const r2 = transition(db, req.params.id, 'completed', 'sys_protocol', [], '系统自动结算');
+                    if (!r2.success)
+                        throw new Error(r2.error || 'completed transition failed');
+                    settleOrder(req.params.id); // direct_p2p 分支:释放遗留模拟 stake + accrueFeeReceivable(fail-closed)
+                })();
+            }
+            catch (e) {
+                return void res.status(409).json({ error: `直付完成结算失败,订单未完成(仍停在 delivered,可重试):${e.message}`, error_code: 'DIRECT_PAY_SETTLE_FAILED' });
+            }
+            notifyTransition(db, req.params.id, 'delivered', 'confirmed');
+            notifyTransition(db, req.params.id, 'confirmed', 'completed');
+            try {
+                broadcastSystemEvent('order_completed', '✓', `订单完成 ${req.params.id}`, req.params.id);
+            }
+            catch { }
+            return void res.json({ success: true, status: 'completed', settlement: { rail: 'direct_p2p', fee_accrued: true } });
+        }
         const fromStatus = order.status;
         const result = transition(db, req.params.id, toStatus, user.id, evidenceIds, notes);
         if (!result.success)
@@ -292,6 +397,7 @@ export function registerOrdersActionRoutes(app, deps) {
         let settlementBreakdown = null;
         if (toStatus === 'confirmed') {
             const sysUser = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
+            // direct_p2p confirm 已在上方【全原子早返回块】处理(delivered→confirmed→completed→settle 同一 tx);此处仅 escrow。
             transition(db, req.params.id, 'completed', sysUser.id, [], '系统自动结算');
             notifyTransition(db, req.params.id, 'confirmed', 'completed');
             settleOrder(req.params.id);
@@ -339,7 +445,9 @@ export function registerOrdersActionRoutes(app, deps) {
                             reserveByKind.escrow_expired = round2(Number(r.s));
                     }
                     const redirectedToCommissionReserve = round2(reserveByKind.region_cap + reserveByKind.chain_gap + reserveByKind.orphan_sponsor + reserveByKind.opt_out_deactivated + reserveByKind.escrow_expired);
-                    const escrowRow = (await dbOne("SELECT COALESCE(SUM(amount),0) AS s FROM pending_commission_escrow WHERE order_id = ? AND status = 'pending'", [req.params.id]));
+                    // RFC-018: matures_at IS NULL = opt-out escrow only; clearing rows (matures_at NOT NULL) are
+                    // surfaced separately (PR3), not mislabeled as opt-out escrow here.
+                    const escrowRow = (await dbOne("SELECT COALESCE(SUM(amount),0) AS s FROM pending_commission_escrow WHERE order_id = ? AND status = 'pending' AND matures_at IS NULL", [req.params.id]));
                     const heldInOptOutEscrow = round2(Number(escrowRow.s));
                     // QA 轮 9.5 P2：payouts 表只 MCP legacy 写，PWA settleOrder 直更 wallet.balance 不写 payouts
                     // 改用公式推算 sellerAmount（跟 PWA settleOrder 内部计算一致），更可靠

package/dist/pwa/routes/orders-create.js

@@ -1,6 +1,7 @@
 import { buildCartMandate, buildPaymentMandate, signMandate } from './ap2-mandate.js';
 // RFC-014 PR3 — 金额走整数 base-units;钱包写绝对值(防 REAL 浮点加法 dust)。
 import { toUnits, toDecimal, mulQty, mulRate } from '../../money.js';
+import { createDirectPayResponse } from '../../direct-pay-create.js'; // PR-4c: direct_p2p 建单分叉(生产门+收款指令门+原子建单;本金不入协议)
 import { applyWalletDelta } from '../../ledger.js';
 import { dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam(仅下单事务外的预检查;事务内 escrow/INSERT 保持同步)
 // 店铺推荐 → 商品三级归因的【懒升级】(sync,跑在下单事务内、getProductShareChain 之前)。
@@ -236,6 +237,9 @@ export function registerOrdersCreateRoutes(app, deps) {
         const insurancePremium = toDecimal(insurancePremiumU);
         const totalAmount = toDecimal(totalAmountU);
         const donationAmount = toDecimal(donationAmountU);
+        // PR-4c:direct_p2p 分叉 —— 本金不入协议,跳过下方 escrow 预检/事务,改走直付建单(生产门+收款指令门+原子建单,仅锁卖家 fee-stake)。
+        if (String(req.body?.payment_rail || '') === 'direct_p2p')
+            return void createDirectPayResponse(res, db, { generateId, transition, appendOrderEvent, getProtocolParam }, { product, buyerId: user.id, reqQty, basePrice, totalAmount, totalAmountU, shippingAddress: String(shipping_address), directReceiveAccountId: (typeof req.body?.direct_receive_account_id === 'string' && req.body.direct_receive_account_id) ? String(req.body.direct_receive_account_id) : undefined, opts: { variantId: variant_id, hasVariants: Number(product.has_variants) === 1, flashActive: !!flashSale, couponCode: coupon_code, buyInsurance: !!buy_insurance, donationPct: donationPctNum, isGift: !!is_gift, anonymous: anonymousFlag === 1, deliveryWindow: !!delivery_window } });
         // 友好预检查(读):真正的守恒在下面的同步事务内(applyWalletDelta 绝对值落库)。
         const wallet = await dbOne('SELECT balance FROM wallets WHERE user_id = ?', [user.id]);
         if (!wallet)

package/dist/pwa/routes/orders-read.js

@@ -1,6 +1,9 @@
 // RFC-011 §⑥ 事件游标流(纯 db 函数,party-gated)
 import { listOrderEventsSince } from '../../layer0-foundation/L0-2-state-machine/order-chain.js';
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { requireBothDisclosuresAcked } from '../../direct-pay-disclosures.js'; // PR-4f-b: direct_p2p 收款说明响应契约门
+import { redactUnackedDirectPayTarget } from '../direct-pay-order-redaction.js'; // 收款目标披露门(共享;所有 orders reader 必过)
+import { getQrImageForOwner } from '../../direct-receive-account-qr.js'; // Rail1 D2:ack 门后按订单快照 qr_ref 取收款码字节((ref,seller_id) 域内)
 export function registerOrdersReadRoutes(app, deps) {
     const { db, auth, getOrderStatus, getOrderChain, verifyOrderChain, getOrderDispute } = deps;
     app.get('/api/orders', async (req, res) => {
@@ -25,6 +28,7 @@ export function registerOrdersReadRoutes(app, deps) {
                 delete o.recipient_code;
                 o.buyer_name = '🔒 ' + (typeof code === 'string' ? code : 'PR-?????');
             }
+            redactUnackedDirectPayTarget(db, o, user.id); // #179 审计 P1:列表也过披露门,不得旁路
         }
         res.json(orders);
     });
@@ -194,6 +198,38 @@ export function registerOrdersReadRoutes(app, deps) {
                 delete order.recipient_code;
             }
         }
+        // Direct Pay 响应契约门:direct_p2p 收款目标(instruction 快照 + 账号快照 qr_ref),买家在 D1/D2 both-acked 前
+        //   【不得】从 API 拿到(非仅 UI 软门)。与 /api/orders 列表共用同一 redact,防旁路(#179 审计 P1)。
+        redactUnackedDirectPayTarget(db, order, user.id);
         res.json({ ...statusInfo, history, product, dispute, trackingInfo });
     });
+    // Rail1 D2:直付订单收款二维码(硬化转发)。仅【订单买家】+ 两次披露 both-acked 后可取;按建单时快照的 (qr_ref, seller_id)
+    //   取【当时那一版】图字节。未 ack / 非买家 / 无 QR / 非 direct_p2p → 统一 404(不枚举,不泄露)。图字节不入 order JSON。
+    app.get('/api/orders/:id/direct-pay-qr', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const orderId = String(req.params.id);
+        const order = await dbOne('SELECT buyer_id, seller_id, payment_rail, direct_pay_account_snapshot FROM orders WHERE id = ?', [orderId]);
+        if (!order || order.payment_rail !== 'direct_p2p' || order.buyer_id !== user.id)
+            return void res.status(404).end();
+        if (!requireBothDisclosuresAcked(db, orderId).ok)
+            return void res.status(404).end(); // 未 ack:与"无 QR"同样 404,不泄露存在性
+        let snap = {};
+        try {
+            snap = order.direct_pay_account_snapshot ? JSON.parse(order.direct_pay_account_snapshot) : {};
+        }
+        catch {
+            snap = {};
+        }
+        if (!snap.qr_ref)
+            return void res.status(404).end();
+        const img = getQrImageForOwner(db, snap.qr_ref, order.seller_id); // (ref, seller_id) 域内取字节;seller_id 取自订单,非用户输入
+        if (!img)
+            return void res.status(404).end();
+        res.setHeader('Content-Type', img.mime);
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('Cache-Control', 'private, no-store');
+        res.send(img.buf);
+    });
 }

package/dist/pwa/routes/p2p-products.js

@@ -51,8 +51,8 @@ export function registerP2pProductsRoutes(app, deps) {
         await dbRun(`
       INSERT INTO products (id, seller_id, title, description, price, stock, status, images, ship_regions,
         handling_hours, commission_rate, category_id, stake_amount, p2p_mode, content_hash, peer_endpoint,
-        content_signature, content_signed_at)
-      VALUES (?,?,?,?,?,?,'active',?,?,24,0.10,'cat_default',0,1,?,?,?,?)
+        content_signature, content_signed_at, currency)
+      VALUES (?,?,?,?,?,?,'active',?,?,24,0.10,'cat_default',0,1,?,?,?,?,'WAZ')
     `, [
             id, user.id, title,
             `[P2P] ${title}（完整详情见卖家节点）`,

package/dist/pwa/routes/products-create.js

@@ -23,7 +23,7 @@ export function registerProductsCreateRoutes(app, deps) {
         const quotaCheck = checkSellerCanList(user);
         if (!quotaCheck.ok)
             return void res.json({ error: quotaCheck.reason });
-        const { title, description, price, stock = 1, category = '', specs, brand, model, source_url, source_price, external_title, weight_kg, ship_regions = '全国', handling_hours = 24, estimated_days, fragile = 0, return_days = 7, return_condition = '', warranty_days = 0, commission_rate, product_type = 'retail', // 里程碑 6
+        const { title, description, price, stock = 1, category = '', specs, brand, model, source_url, source_price, external_title, weight_kg, ship_regions = '全国', handling_hours = 24, estimated_days, fragile = 0, return_days = 7, return_condition = '', warranty_days = 0, low_stock_threshold = 3, auto_delist_on_zero = 1, commission_rate, product_type = 'retail', // 里程碑 6
         aliases = [], // 里程碑 7.2：上架时同步声明的 alias 集合
         image_hashes = [], // 商品图片 — 只存 hash（64 hex），实际 blob 在卖家节点 IDB
          } = req.body;
@@ -80,14 +80,16 @@ export function registerProductsCreateRoutes(app, deps) {
       specs, brand, model, source_url, source_price, source_price_at,
       weight_kg, ship_regions, handling_hours, estimated_days, fragile,
       return_days, return_condition, warranty_days,
+      low_stock_threshold, auto_delist_on_zero,
       commitment_hash, description_hash, price_hash, hashed_at,
-      commission_rate, product_type, images
-    ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`, [
+      commission_rate, product_type, images, currency
+    ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'WAZ')`, [
             id, user.id, title, description, priceNum, Number(stock), category, stakeAmount,
             specsJson, brand ?? null, model ?? null,
             source_url ?? null, source_price ? Number(source_price) : null, source_price ? now : null,
             weight_kg ? Number(weight_kg) : null, ship_regions, Number(handling_hours), estJson, fragile ? 1 : 0,
             Number(return_days), return_condition, Number(warranty_days),
+            Math.max(0, Math.floor(Number(low_stock_threshold) || 0)), auto_delist_on_zero ? 1 : 0,
             makeCommitmentHash(pFields), makeDescriptionHash({ title, description, specs: specsJson }),
             makePriceHash(priceNum, now), now,
             commissionRateNum, product_type, imagesJsonForInsert

package/dist/pwa/routes/products-links.js

@@ -1,4 +1,5 @@
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { invalidateProductVerification } from '../../product-verification.js';
 export function registerProductsLinksRoutes(app, deps) {
     // 只读/单写站点走 RFC-016 异步 seam;db 保留:认领冲突分支是 fee-lock 资金路径,
     // INSERT 链接 + INSERT 验证任务 + 钱包扣费必须原子(db.transaction + 守恒/dup guard),Phase 3 迁 pg 行锁。
@@ -15,6 +16,21 @@ export function registerProductsLinksRoutes(app, deps) {
         const links = await dbAll(`SELECT id, url, source, verified, revoked, verify_note, added_at, platform, external_id, external_title FROM product_external_links WHERE product_id = ? ORDER BY added_at ASC`, [req.params.id]);
         res.json(links);
     });
+    // Buyer-facing read for the product detail page: VERIFIED + non-revoked links only, shape { links }.
+    // NOT owner-gated (any logged-in viewer) — separate from the owner-only /links above (which returns a bare
+    // array the seller workbench consumes; that stays untouched). Only public-safe columns are returned.
+    app.get('/api/products/:id/external-links', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        // Mirror product-detail visibility (products-crud GET /:id): others see active only; the seller sees own
+        // non-active. Otherwise 404 — never leak source URLs of a warehouse/deleted product to non-owners.
+        const product = await dbOne("SELECT id FROM products WHERE id = ? AND (status = 'active' OR seller_id = ?)", [req.params.id, user.id]);
+        if (!product)
+            return void res.status(404).json({ error: 'not_found' });
+        const links = await dbAll(`SELECT url, platform, external_title FROM product_external_links WHERE product_id = ? AND verified = 1 AND revoked = 0 ORDER BY added_at ASC`, [req.params.id]);
+        res.json({ links });
+    });
     // 新链接（无人认领）直接 verified=1；已被他人认领则发起众包验证任务
     app.post('/api/products/:id/links', async (req, res) => {
         const user = auth(req, res);
@@ -69,6 +85,12 @@ export function registerProductsLinksRoutes(app, deps) {
             await dbRun(`INSERT INTO product_external_links
         (id, product_id, url, source, verified, verified_at, platform, external_id, external_title)
         VALUES (?, ?, ?, 'manual', 1, datetime('now'), ?, ?, ?)`, [linkId, req.params.id, url, meta?.platform ?? null, meta?.external_id ?? null, linkExternalTitle]);
+            try {
+                invalidateProductVerification(db, String(req.params.id));
+            }
+            catch (e) {
+                console.error('[product-verify invalidate]', e);
+            } // PR-⑥ 反作弊:外链变更 → 作废直付逐品验证
             return void res.json({ link_id: linkId, verified: 1, external_title: linkExternalTitle, message: '链接已关联' });
         }
         // 已被他人认领：发起众包验证任务
@@ -129,6 +151,12 @@ export function registerProductsLinksRoutes(app, deps) {
             console.error('[products-links claim tx]', msg);
             return void res.status(500).json({ error: '发起认领失败,请重试' });
         }
+        try {
+            invalidateProductVerification(db, String(req.params.id));
+        }
+        catch (e) {
+            console.error('[product-verify invalidate]', e);
+        } // PR-⑥ 反作弊:外链变更 → 作废直付逐品验证
         res.json({
             link_id: linkId,
             task_id: taskId,
@@ -147,6 +175,12 @@ export function registerProductsLinksRoutes(app, deps) {
         if (!product || product.seller_id !== user.id)
             return void res.status(403).json({ error: '无权限' });
         await dbRun('DELETE FROM product_external_links WHERE id = ? AND product_id = ?', [req.params.linkId, req.params.id]);
+        try {
+            invalidateProductVerification(db, String(req.params.id));
+        }
+        catch (e) {
+            console.error('[product-verify invalidate]', e);
+        } // PR-⑥ 反作弊:外链变更 → 作废直付逐品验证
         res.json({ success: true });
     });
 }

package/dist/pwa/routes/products-list.js

@@ -1,5 +1,6 @@
 import { createHmac } from 'crypto';
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { genuineSalePredicate } from '../../layer0-foundation/L0-2-state-machine/genuine-sale.js'; // RFC-018 PR4: 真实成交(排除全额退货)
 export function registerProductsListRoutes(app, deps) {
     // db 已走 RFC-016 异步 seam(dbOne/dbAll),不再直接用 deps.db
     const { getUser, VALID_PRODUCT_TYPES, RAW_MODE_MIN_TRUST, getAgentTrustCached, VALID_SORTS, PRODUCT_LIMITS, TRENDING_SCORE_EXPR, findProductsByAlias, decodeProductCursor, encodeProductCursor, MASTER_SEED, formatProductForAgent } = deps;
@@ -52,7 +53,7 @@ export function registerProductsListRoutes(app, deps) {
       COALESCE(rs.total_points, 0) as rep_points, COALESCE(rs.level, 'new') as rep_level,
       COALESCE(rs.transactions_done, 0) as seller_tx_count,
       pc.seasonal_months as seasonal_months,
-      (SELECT COUNT(1) FROM orders o WHERE o.product_id = p.id AND o.status = 'completed') as sales_count,
+      (SELECT COUNT(1) FROM orders o WHERE o.product_id = p.id AND ${genuineSalePredicate('o')}) as sales_count,
       (SELECT COUNT(DISTINCT buyer_id) FROM order_ratings r WHERE r.product_id = p.id AND r.stars >= 4) as recommend_count,
       (SELECT COUNT(*) FROM dispute_cases dc WHERE dc.seller_id = p.seller_id) as seller_dispute_count,
       -- 卖家仲裁胜率：无案件视为 0.8 中性（未经检验）；有案件按真实比率