@seasonkoh/webaz 0.1.28 → 0.1.30

package/dist/pwa/public/app-bond-ui.js

@@ -0,0 +1,108 @@
+// 商家履约保证金 UI(B1 缴纳闭环)。UI ONLY —— 双锁/凭据/幂等全在后端。
+//   ① 通知模板(申报/确认/驳回);② 卖家 settings 状态卡(要求额度/状态/缓交/申报表单——通道未放行时隐藏表单,诚实提示);
+//   ③ admin 保证金申报队列页(#admin/bond-deposits:核对到账→确认[ROOT+Passkey,当前被 Lock B 挡属预期]/驳回)。
+;(function () {
+  const S = window._notifSub
+  const P = (emoji, titleZh, bodyZh) => (p) => ({ title: emoji + ' ' + t(titleZh), body: S(t(bodyZh), p) })
+  Object.assign(window.NOTIF_TEMPLATES, {
+    bond_deposit_submitted: P('🏦', '新保证金缴纳申报待核实', '卖家 {seller} 申报已缴纳履约保证金(T0,凭据 {evidence})。请核对真实到账后在 admin 后台确认(ROOT+Passkey)。'),
+    bond_deposit_confirmed: P('✅', '履约保证金已确认锁定', '你的保证金已核实到账并正式锁定,直付入场的保证金门已满足。退出时可申请退还(须无未了结直付责任)。'),
+    bond_deposit_rejected: P('❌', '保证金申报未通过核实', '你的保证金缴纳申报未通过核实{note}。请核对付款凭据后重新提交,或联系平台。'),
+  })
+
+  const ST = () => ({ pending: t('待运营核实'), confirmed: t('已核实待锁定'), locked: t('已锁定生效'), insufficient: t('金额不足待补缴'), expired: t('已失效/被驳回'), refunding: t('退还中'), refunded: t('已退还'), slashed: t('已被罚没') })
+
+  // ② 卖家 settings 状态卡(settings 链尾注入 + hydrate)
+  window.bondSellerSection = () => `
+    <div class="card" id="bond-card">
+      <div style="font-size:14px;font-weight:700;margin-bottom:6px">🏦 ${t('直付履约保证金')}</div>
+      <div id="bond-body" style="font-size:12px;color:#6b7280">${loading$()}</div>
+    </div>`
+  window.bondHydrateSeller = async () => {
+    const box = document.getElementById('bond-body'); if (!box) return
+    const s = await GET('/direct-receive/bond-status').catch(() => null)
+    if (!s) { box.textContent = t('加载失败,请刷新'); return }
+    const d = s.deposit
+    const statusLine = d
+      ? `<div style="margin-bottom:6px">${t('当前状态')}:<strong>${ST()[d.status] || d.status}</strong>${d.status === 'pending' ? ` · ${t('凭据')} ${escHtml(d.evidence_ref || '-')}` : ''}${d.reject_note ? `<br><span style="color:#dc2626">${t('驳回说明')}:${escHtml(d.reject_note)}</span>` : ''}</div>`
+      : `<div style="margin-bottom:6px">${t('当前状态')}:<strong>${t('未缴纳')}</strong></div>`
+    const deferralLine = s.deferral
+      ? `<div style="margin-bottom:6px;color:#92400e">🕓 ${t('缓交生效中')}${s.deferral.expires_at ? ` · ${t('到期')} ${fmtTime(s.deferral.expires_at)}` : ''}(${t('额度受限;缴清保证金后转正式')})</div>` : ''
+    const payBlock = s.rail_cleared
+      ? `<div style="margin:8px 0;padding:8px;background:#f9fafb;border-radius:8px">
+          <div style="font-weight:600;margin-bottom:4px">${t('缴纳方式')}(${t('转账后提交凭据申报')}):</div>
+          ${window.bondAccountSelector ? window.bondAccountSelector(s) : (s.payment_accounts || []).map(a => `<div style="margin-bottom:4px">· ${escHtml(a.method || '')} ${escHtml(a.currency || '')}:${escHtml(a.instruction || '')}</div>`).join('') || t('暂无收款方式,请联系平台')}
+        </div>
+        ${(!d || ['expired', 'refunded'].includes(d.status)) ? `${window.bondTermsBlock ? window.bondTermsBlock(s) : ''}
+        <input class="form-control" id="bond-evidence" maxlength="120" placeholder="${t('付款凭据号(转账单号/链上 tx,必填)')}" style="margin-bottom:8px;font-size:12px">
+        <button class="btn btn-primary btn-sm" style="width:auto" onclick="bondSubmitDeposit()">${t('提交缴纳申报')}</button>` : ''}
+        ${d && d.status === 'pending' ? `<button class="btn btn-outline btn-sm" style="width:auto" onclick="bondCancelDeposit('${d.id}')">${t('撤回申报')}</button>` : ''}`
+      : `<div style="margin:8px 0;padding:8px;background:#fffbeb;border:1px solid #fde68a;border-radius:8px;color:#92400e">${escHtml(s.note || '')}</div>`
+    box.innerHTML = `
+      <div style="margin-bottom:6px">${t('要求额度')}:<strong>${s.required.display} ${s.required.currency}</strong>(${s.required.tier})</div>
+      ${statusLine}${deferralLine}${payBlock}${window.bondRefundBlock ? window.bondRefundBlock(s) : ''}${window.bondSlashNotice ? window.bondSlashNotice(s) : ''}
+      <div id="bond-msg" style="margin-top:6px;font-size:11px"></div>`
+  }
+  window.bondSubmitDeposit = async () => {
+    const msg = document.getElementById('bond-msg')
+    const evidence = (document.getElementById('bond-evidence')?.value || '').trim()
+    if (!evidence) { msg.innerHTML = `<span style="color:#dc2626">${t('付款凭据号必填')}</span>`; return }
+    const r = await POST('/direct-receive/bond-deposit', { evidence_ref: evidence, platform_account_id: (document.querySelector('input[name="bond-acc"]:checked')?.value || ''), agree_terms_version: (document.getElementById('bond-terms-agree')?.checked ? (window._bondTermsVersion || '') : '') })
+    if (r.error) { msg.innerHTML = `<span style="color:#dc2626">${r.error}</span>`; return }
+    toast$(t('申报已提交,等待运营核实'), 'success'); window.bondHydrateSeller()
+  }
+  window.bondCancelDeposit = async (id) => {
+    if (typeof confirmModal === 'function' && !(await confirmModal(t('确认撤回保证金缴纳申报?'), t('撤回申报'), { danger: true }))) return
+    const r = await POST(`/direct-receive/bond-deposit/${id}/cancel`, {})
+    if (r.error) return void toast$(r.error, 'error')
+    window.bondHydrateSeller()
+  }
+
+  // ③ admin 申报队列页(#admin/bond-deposits;确认走既有 confirm-production 端点 —— Lock B 未放行前 409 属预期,页面明示)
+  window.renderAdminBondDeposits = function (app) {
+    if (!state.user) { renderLogin(); return }
+    if (typeof isAdmin === 'function' && !isAdmin()) { app.innerHTML = shell(`<div class="alert alert-info">${t('仅限管理员')}</div>`, 'admin'); return }
+    if ((state.user.admin_type || 'root') !== 'root') { app.innerHTML = shell(`<div class="alert alert-info">${t('仅限根管理员')}</div>`, 'admin'); return }
+    app.innerHTML = shell(`
+      <h1 class="page-title">🏦 ${t('保证金缴纳申报')}</h1>
+      <div style="margin-bottom:8px"><button class="btn btn-outline btn-sm" style="width:auto" onclick="navigate('#admin/dp-ops')">${t('返回 Direct Pay 商户运营')}</button></div>
+      <div style="font-size:12px;color:#6b7280;line-height:1.6;margin-bottom:10px">${t('卖家的履约保证金缴纳申报。请【核对凭据对应的真实到账】后确认(ROOT+Passkey,双锁:生产放行 registry 未开时确认会被拒,属预期 fail-closed);核不上则驳回(留说明)。')}</div>
+      <div id="bond-adm-box">${loading$()}</div>
+    `, 'admin')
+    window.bondAdmHydrate()
+  }
+  window.bondAdmHydrate = async (status) => {
+    const box = document.getElementById('bond-adm-box'); if (!box) return
+    const r = await GET(`/admin/direct-receive/deposits${status ? `?status=${status}` : ''}`).catch(() => null)
+    if (!r || !Array.isArray(r.deposits)) { box.textContent = t('加载失败,请刷新'); return }
+    if (r.deposits.length === 0) { box.innerHTML = `<div class="alert alert-info">${t('暂无申报')}</div>`; return }
+    box.innerHTML = r.deposits.map(d => `
+      <div class="card" style="font-size:12px">
+        <div style="display:flex;justify-content:space-between;gap:8px;flex-wrap:wrap">
+          <div><strong>${escHtml(d.seller_name || d.user_id)}</strong> ${d.seller_handle ? '@' + escHtml(d.seller_handle) : ''} · ${d.tier} · ${t('要求')} ${d.required_amount} ${String(d.currency).toUpperCase()}</div>
+          <div><strong>${ST()[d.status] || d.status}</strong></div>
+        </div>
+        <div style="color:#6b7280;margin-top:4px">${t('申报单')} ${d.id} · ${t('凭据')}:${escHtml(d.external_ref || '-')} · ${fmtTime(d.created_at)}${d.reject_note ? ` · <span style="color:#dc2626">${escHtml(d.reject_note)}</span>` : ''}</div>${window.bondAdmRefundActions ? window.bondAdmRefundActions(d) : ''}
+        ${d.status === 'pending' ? `
+        <div style="display:flex;gap:8px;margin-top:8px;flex-wrap:wrap">
+          <button class="btn btn-primary btn-sm" style="width:auto;font-size:11px" onclick="bondAdmConfirm('${d.id}', ${Math.round(Number(d.required_amount) * 1e6)}, '${escHtml(d.external_ref || '')}')">${t('已核实到账,确认锁定(Passkey)')}</button>
+          <button class="btn btn-outline btn-sm" style="width:auto;font-size:11px;color:#dc2626;border-color:#fecaca" onclick="bondAdmReject('${d.id}')">${t('核不上,驳回')}</button>
+        </div>` : ''}
+      </div>`).join('')
+  }
+  window.bondAdmConfirm = async (id, amountUnits, receiptRef) => {
+    const jurisdiction = prompt(t('法域代码(须在放行白名单内,如 SG)'), 'SG'); if (!jurisdiction) return
+    let token
+    try { token = await requestPasskeyGate('direct_receive_production_confirm', { deposit_id: id, rail_id: 'operator_attested', amount_units: amountUnits, receipt_ref: receiptRef, jurisdiction }) }
+    catch (e) { if (window.dpPromptRegisterPasskey) await window.dpPromptRegisterPasskey(e); return }
+    const r = await POST(`/admin/direct-receive/deposits/${id}/confirm-production`, { rail_id: 'operator_attested', expected_amount_units: amountUnits, receipt_ref: receiptRef, jurisdiction, webauthn_token: token })
+    if (r.error) return void toast$(r.error_code === 'PRODUCTION_RAIL_NOT_CLEARED' ? t('生产放行 registry 未开(法务清门后翻转)—— 确认被拒属预期 fail-closed') : r.error, 'error')
+    toast$(t('已确认锁定,卖家保证金门已满足'), 'success'); window.bondAdmHydrate()
+  }
+  window.bondAdmReject = async (id) => {
+    const note = prompt(t('驳回说明(卖家可见,可空)'), '') ?? ''
+    const r = await POST(`/admin/direct-receive/deposits/${id}/reject`, { note })
+    if (r.error) return void toast$(r.error, 'error')
+    toast$(t('已驳回'), 'success'); window.bondAdmHydrate()
+  }
+})()

package/dist/pwa/public/app-chat-poll.js

@@ -0,0 +1,29 @@
+// 聊天详情实时轮询。renderChatDetail 只在进入/发消息时拉取消息(无实时推送),对方发来的消息原先停留会话时
+//   看不到(只有通知那条独立轮询能提示)。这里每几秒拉一次会话,就地刷新 #chat-msgs:保持"已在底部则贴底"、
+//   不碰输入框/快捷面板、查看时把新到消息标记已读。自清理:#chat-msgs 离开 DOM 或路由已不是本会话时立即停;
+//   单计时器(window._chatPollTimer),重新进入任一会话先清旧的(不堆叠)。逻辑放独立文件因 app.js 已到 LOC 上限。后台/锁屏暂停,回前台由 app-poll-governor 经 _chatPollNow 补拉。
+//   ⚠️ 用【最后一条消息 id】判变化,不能用消息条数——后端默认只返回最近 50 条(滑动窗口),长会话里新消息进来后
+//      条数仍是 50,用 length 比较会永远判"无变化"而不刷新/不标已读(长会话恰是最需要 live update 的场景)。
+window.startChatPoll = (id, initialMsgs) => {
+  if (window._chatPollTimer) { clearInterval(window._chatPollTimer); window._chatPollTimer = null }
+  const lastOf = (arr) => (arr && arr.length) ? String(arr[arr.length - 1].id || arr[arr.length - 1].created_at || '') : ''
+  let last = lastOf(initialMsgs); const stop = () => { if (window._chatPollTimer) { clearInterval(window._chatPollTimer); window._chatPollTimer = null; window._chatPollNow = null } }
+  const tickFn = async () => {
+    const box = document.getElementById('chat-msgs')
+    if (!box || !location.hash.includes('chat/' + id)) return stop()             // 已离开本会话 → 自清理
+    if (document.hidden) return; let rr = null                                   // 后台/锁屏:暂停(定时器保留,回前台恢复)
+    try { rr = await GET('/conversations/' + encodeURIComponent(id)) } catch { return }
+    if (!rr || rr.error) return
+    const msgs = rr.messages || []
+    const newLast = lastOf(msgs)
+    if (newLast === last) return                                                 // 最后一条没变 → 无新消息
+    last = newLast
+    const atBottom = box.scrollHeight - box.scrollTop - box.clientHeight < 40
+    box.innerHTML = msgs.length === 0
+      ? `<div style="text-align:center;color:#9ca3af;padding:30px 0;font-size:12px">${t('开始第一句问候')}</div>`
+      : msgs.map(m => window.renderChatBubble(m, state.user.id)).join('')
+    if (atBottom) box.scrollTop = box.scrollHeight                               // 原本贴底就继续贴底,否则不打扰阅读位置
+    POST('/conversations/' + encodeURIComponent(id) + '/read').catch(() => {})   // fire-and-forget:用 .catch 而非 try/catch(POST 返回 Promise,异步 reject 包不住)
+  }
+  window._chatPollTimer = setInterval(tickFn, 4000); window._chatPollNow = tickFn
+}

package/dist/pwa/public/app-contribution-hub.js

@@ -0,0 +1,23 @@
+// 共建运营 admin hub —— 把散落在主 admin 面板的「共建(社区建设)」功能归到一处。UI ONLY,只链接既有路由,
+//   不改任何后端/权限(每个子页自身的鉴权不变)。镜像 Direct Pay 商户运营 hub 的结构。
+//   分区:共建建议收件箱(全 admin) / 建任务治理(root) / 贡献账号归属(自助 + root 审批)。中文 t(),英文 i18n.js _EN。
+
+window.renderAdminContributionHub = function (app) {
+  if (!state.user) { renderLogin(); return }
+  if (!isAdmin()) { app.innerHTML = shell(`<div class="alert alert-info">${t('仅限管理员')}</div>`, 'admin'); return }
+  const root = (state.user.admin_type || 'root') === 'root'
+  const grp = (title, cards) => `<div style="font-size:13px;font-weight:700;color:#374151;margin:14px 0 6px">${title}</div>${cards}`
+  app.innerHTML = shell(`
+    <h1 class="page-title">🌱 ${t('共建运营')}</h1>
+    <div style="margin-bottom:8px"><button class="btn btn-outline btn-sm" style="width:auto" onclick="navigate('#admin/protocol')">${t('返回协议管理')}</button></div>
+    <div style="font-size:12px;color:#6b7280;line-height:1.6;margin-bottom:6px">${t('共建(社区建设)集中入口:外部建议收件箱、建任务治理、贡献账号归属。')}</div>
+    ${grp(t('共建建议(收件箱)'),
+      adminLinkCard('🛠️', t('任务建议收件箱'), t('陌生人 / agent 提交的共建任务建议;审阅 → 转正式任务'), '#admin/task-proposals') +
+      adminLinkCard('📨', t('Welcome 提交'), t('#welcome 留下的邮箱订阅 + 建议'), '#admin/public-ideas'))}
+    ${root ? grp(t('建任务治理'),
+      adminLinkCard('🎟️', t('建任务额度审核'), t('非根管理员的建任务扩容申请;批准 = 限时计数授权(仅 root)'), '#admin/quota-requests')) : ''}
+    ${grp(t('贡献账号归属'),
+      adminLinkCard('🔗', t('关联个人贡献账号'), t('把本管理席位的协调贡献归属到你的真实个人账号(需对方确认 + root 审批)'), '#me/operator-claims') +
+      (root ? adminLinkCard('🪪', t('操作席位关联审批'), t('管理席位→个人贡献账号的关联申请;确认 + 审批 / 撤销(仅 root)'), '#admin/operator-claims') : ''))}
+  `, 'admin')
+}

package/dist/pwa/public/app-create-kinds.js

@@ -0,0 +1,17 @@
+// Unified create entry — a small "全新商品 ⇄ 二手闲置" kind chooser shown at the top of BOTH create surfaces
+// (the seller new-goods form and the secondhand publish page), so each create flow surfaces the other kind
+// instead of being a dead-end. Mirrors UOMA's single Goods-incl.-secondhand create entry, WITHOUT merging the
+// two backends: /api/products and /api/secondhand keep their own flows, fee rates and role rules.
+//   createKindChooserHtml(current): current ∈ {'new','secondhand'}. The active pill is inert; the other pill
+//     navigates — 'new' → goCreateListingFromBuy() (the smart seller entry: handles anon / buyer→seller
+//     upgrade / role switch), 'secondhand' → #secondhand/publish (open to any logged-in user).
+window.createKindChooserHtml = (current) => {
+  const t = window.t || ((s) => s)
+  const pill = (active, label, onclick) => active
+    ? `<span style="flex:1;text-align:center;padding:7px 0;border-radius:8px;font-size:13px;font-weight:600;background:#111827;color:#fff">${label}</span>`
+    : `<button type="button" onclick="${onclick}" style="flex:1;text-align:center;padding:7px 0;border-radius:8px;font-size:13px;font-weight:500;background:#f3f4f6;color:#374151;border:1px solid #e5e7eb;cursor:pointer">${label}</button>`
+  return `<div style="display:flex;gap:8px;margin-bottom:16px">`
+    + pill(current === 'new', '🆕 ' + t('全新商品'), 'goCreateListingFromBuy()')
+    + pill(current === 'secondhand', '♻️ ' + t('二手闲置'), "location.hash='#secondhand/publish'")
+    + `</div>`
+}

package/dist/pwa/public/app-direct-pay-accounts.js

@@ -0,0 +1,141 @@
+// Direct Pay (Rail 1) — 卖家多收款账号 + 收款二维码 管理 UI (Phase C2)。UI ONLY。
+//   接 Phase C1 后端 /api/direct-receive/accounts(list / add / update / deactivate + /:id/qr upload·preview)。
+//   写操作(add/update/deactivate/qr)均需现场真人 Passkey(purpose direct_receive_account_manage,
+//   action[+account_id] 绑 purpose_data);QR 预览走 Authorization header fetch→blob(<img src> 带不了 header)。
+//   WebAZ 只存储/展示卖家自填内容与二维码字节,绝不验证/路由/托管资金,也不解析二维码。双语 parity 由 test-direct-pay-ui.ts 守。
+
+// 账号相关 error_code → 双语文案;未命中回落到 dpErrorText(直付通用码)。
+window.draAccountErrorText = (code, fallback) => {
+  const M = {
+    SELLER_ONLY: t('仅卖家可管理收款账号'),
+    ACCOUNT_NOT_FOUND: t('账号不存在'),
+    ACCOUNT_INPUT_INVALID: t('账号信息不合法'),
+    QR_INVALID: t('二维码图片不合法(仅支持 PNG/WebP,解码后 ≤ 64KB)'),
+    HUMAN_PRESENCE_REQUIRED: t('需现场真人 Passkey 确认'),
+    PASSKEY_REQUIRED: t('需先注册 Passkey'),
+  }
+  return M[code] || (window.dpErrorText ? window.dpErrorText(code, fallback) : (fallback || t('操作失败,请重试')))
+}
+
+// ── 卖家设置:多收款账号面板(section + hydrate)──────────────────────────────────────────────
+window.draAccountsSection = () => `
+  <div class="card" style="margin-bottom:12px">
+    <div style="font-size:14px;font-weight:700;margin-bottom:6px">🧾 ${t('直付收款账号')}</div>
+    <div style="font-size:12px;color:#6b7280;line-height:1.6;margin-bottom:10px">${t('你可维护多个收款账号(各自币种、可选二维码),买家直付时自选其一。WebAZ 只存储与展示,不验证付款方式或币种,不路由/托管资金,也不解析二维码。')}</div>
+    <div id="dra-accounts-box">${loading$()}</div>
+  </div>`
+
+window.draHydrateAccounts = async () => {
+  const box = document.getElementById('dra-accounts-box')
+  if (!box) return
+  const r = await GET('/direct-receive/accounts')
+  if (r.error) { box.innerHTML = alert$('error', window.draAccountErrorText(r.error_code, r.error)); return }
+  const accounts = r.accounts || []
+  box.innerHTML = `
+    <div id="dra-msg"></div>
+    ${accounts.length ? accounts.map(a => window.draAccountCard(a)).join('') : `<div style="font-size:12px;color:#9ca3af;margin-bottom:10px">${t('尚未添加收款账号')}</div>`}
+    <details style="margin-top:8px"><summary style="font-size:13px;font-weight:600;color:#2563eb;cursor:pointer">＋ ${t('新增收款账号')}</summary>
+      <div style="padding:8px 2px 2px">${window.draAccountForm('new')}</div></details>`
+  window.draLoadQrThumbs(accounts)
+}
+
+window.draAccountCard = (a) => {
+  const inactive = a.status !== 'active'
+  return `<div style="border:1px solid ${inactive ? '#e5e7eb' : '#d1fae5'};background:${inactive ? '#f9fafb' : '#f0fdf4'};border-radius:10px;padding:10px 12px;margin-bottom:8px;opacity:${inactive ? '0.6' : '1'}">
+    <div style="display:flex;justify-content:space-between;align-items:flex-start;gap:8px">
+      <div style="min-width:0">
+        <div style="font-size:13px;font-weight:700;color:#111827">${a.label ? escHtml(a.label) : (a.method ? escHtml(a.method) : t('收款账号'))}${inactive ? ` · <span style="color:#9ca3af;font-weight:400">${t('已停用')}</span>` : ''}</div>
+        <div style="font-size:11px;color:#6b7280;margin:2px 0 4px">${a.method ? escHtml(a.method) : ''}${a.method && a.currency ? ' · ' : ''}${a.currency ? escHtml(a.currency) : ''}</div>
+        <div style="font-size:12px;color:#374151;white-space:pre-wrap;word-break:break-word">${escHtml(a.instruction)}</div>
+      </div>
+      <div id="dra-qr-${a.id}" style="flex:0 0 auto;width:72px;height:72px;display:flex;align-items:center;justify-content:center;border:1px dashed #d1d5db;border-radius:8px;font-size:10px;color:#9ca3af;text-align:center">${a.qr_image_ref ? loading$() : t('无二维码')}</div>
+    </div>
+    ${inactive ? '' : `<div style="display:flex;gap:8px;flex-wrap:wrap;margin-top:8px;align-items:center">
+      <details style="flex:0 0 auto"><summary style="font-size:12px;color:#2563eb;cursor:pointer">${t('编辑')}</summary><div style="padding:8px 2px 2px">${window.draAccountForm(a.id, a)}</div></details>
+      <label class="btn btn-outline btn-sm" style="cursor:pointer;margin:0">${a.qr_image_ref ? t('更换二维码') : t('上传二维码')}<input type="file" accept="image/png,image/webp" style="display:none" onchange="draUploadQr('${a.id}', this)"></label>
+      <button class="btn btn-outline btn-sm" style="color:#dc2626;border-color:#dc2626" onclick="draDeactivateAccount('${a.id}')">${t('停用')}</button>
+    </div>`}
+  </div>`
+}
+
+// 文本字段表单(id='new' 为新增;否则为该账号编辑)。QR 不在此处改 —— 由文件上传单独走 /:id/qr。
+window.draAccountForm = (id, a) => {
+  const p = id === 'new' ? 'new' : id
+  return `
+    <div class="form-group"><label class="form-label">${t('收款说明')} <span style="font-size:11px;color:#9ca3af">${t('(展示给买家,如 PayNow / 银行转账 等)')}</span></label>
+      <textarea class="form-control" id="dra-instr-${p}" rows="3" maxlength="500" placeholder="${t('例:PayNow +65 9xxx(场外结算)')}">${a ? escHtml(a.instruction) : ''}</textarea></div>
+    <div style="display:flex;gap:8px">
+      <div class="form-group" style="flex:1"><label class="form-label">${t('收款方式')}</label><input class="form-control" id="dra-method-${p}" maxlength="40" value="${a && a.method ? escHtml(a.method) : ''}" placeholder="${t('如 PayNow')}"></div>
+      <div class="form-group" style="flex:1"><label class="form-label">${t('币种')}</label><input class="form-control" id="dra-currency-${p}" maxlength="8" value="${a && a.currency ? escHtml(a.currency) : ''}" placeholder="${t('如 SGD / USDC')}"></div>
+    </div>
+    <div class="form-group"><label class="form-label">${t('标签(可选)')}</label><input class="form-control" id="dra-label-${p}" maxlength="40" value="${a && a.label ? escHtml(a.label) : ''}" placeholder="${t('如 PayNow')}"></div>
+    <button class="btn btn-primary btn-sm" onclick="${id === 'new' ? 'draAddAccount()' : `draUpdateAccount('${id}')`}">${t('保存')}</button>`
+}
+
+window.draReadForm = (p) => ({
+  instruction: document.getElementById(`dra-instr-${p}`)?.value?.trim() || '',
+  method: document.getElementById(`dra-method-${p}`)?.value?.trim() || '',
+  currency: document.getElementById(`dra-currency-${p}`)?.value?.trim() || '',
+  label: document.getElementById(`dra-label-${p}`)?.value?.trim() || '',
+})
+
+// 现场真人 Passkey token;失败(无 Passkey / 取消 / 不支持)→ 提示注册入口并返回 null。
+window.draGate = async (action, accountId) => {
+  try { return await requestPasskeyGate('direct_receive_account_manage', accountId ? { action, account_id: accountId } : { action }) }
+  catch (e) { if (window.dpPromptRegisterPasskey) await window.dpPromptRegisterPasskey(e); return null }
+}
+
+window.draAddAccount = async () => {
+  const f = window.draReadForm('new')
+  if (!f.instruction) { if (typeof toast$ === 'function') toast$(t('收款说明不能为空'), 'error'); return }
+  const token = await window.draGate('add'); if (!token) return
+  const r = await POST('/direct-receive/accounts', { ...f, webauthn_token: token })
+  if (r.error) { if (typeof toast$ === 'function') toast$(window.draAccountErrorText(r.error_code, r.error), 'error'); return }
+  if (typeof toast$ === 'function') toast$(t('已保存'), 'success'); window.draHydrateAccounts()
+}
+
+window.draUpdateAccount = async (id) => {
+  const f = window.draReadForm(id)
+  if (!f.instruction) { if (typeof toast$ === 'function') toast$(t('收款说明不能为空'), 'error'); return }
+  const token = await window.draGate('update', id); if (!token) return
+  const r = await PUT('/direct-receive/accounts/' + id, { ...f, webauthn_token: token })
+  if (r.error) { if (typeof toast$ === 'function') toast$(window.draAccountErrorText(r.error_code, r.error), 'error'); return }
+  if (typeof toast$ === 'function') toast$(t('已保存'), 'success'); window.draHydrateAccounts()
+}
+
+window.draDeactivateAccount = async (id) => {
+  const go = await confirmModal(t('停用后买家将无法选择该收款账号,确定停用?'), t('停用'), { danger: true })
+  if (!go) return
+  const token = await window.draGate('deactivate', id); if (!token) return
+  const r = await api('DELETE', '/direct-receive/accounts/' + id, { webauthn_token: token })
+  if (r.error) { if (typeof toast$ === 'function') toast$(window.draAccountErrorText(r.error_code, r.error), 'error'); return }
+  if (typeof toast$ === 'function') toast$(t('已停用'), 'success'); window.draHydrateAccounts()
+}
+
+// 上传/更换二维码:客户端先卡类型(png|webp)+大小(≤64KB)→ 读为 data URI → Passkey → PUT。后端仍严格复核。
+window.draUploadQr = async (id, input) => {
+  const file = input && input.files && input.files[0]; if (input) input.value = ''
+  if (!file) return
+  if (file.type !== 'image/png' && file.type !== 'image/webp') { if (typeof toast$ === 'function') toast$(t('二维码仅支持 PNG 或 WebP 图片'), 'error'); return }
+  if (file.size > 64 * 1024) { if (typeof toast$ === 'function') toast$(t('二维码图片过大(需 ≤ 64KB)'), 'error'); return }
+  let dataUri
+  try { dataUri = await new Promise((res, rej) => { const fr = new FileReader(); fr.onload = () => res(fr.result); fr.onerror = rej; fr.readAsDataURL(file) }) }
+  catch { if (typeof toast$ === 'function') toast$(t('二维码读取失败'), 'error'); return }
+  const token = await window.draGate('qr', id); if (!token) return
+  const r = await PUT('/direct-receive/accounts/' + id + '/qr', { qr_data_uri: dataUri, webauthn_token: token })
+  if (r.error) { if (typeof toast$ === 'function') toast$(window.draAccountErrorText(r.error_code, r.error), 'error'); return }
+  if (typeof toast$ === 'function') toast$(t('二维码已上传'), 'success'); window.draHydrateAccounts()
+}
+
+// 二维码缩略图:owner-only 端点需 Authorization header,<img src> 带不了 → fetch→blob→objectURL。
+window.draLoadQrThumbs = (accounts) => {
+  (accounts || []).filter(a => a.qr_image_ref).forEach(a => setTimeout(async () => {
+    const el = document.getElementById('dra-qr-' + a.id); if (!el) return
+    try {
+      const resp = await fetch('/api/direct-receive/accounts/' + a.id + '/qr', { headers: { Authorization: 'Bearer ' + state.apiKey } })
+      if (!resp.ok) { el.textContent = '❌'; return }
+      const url = URL.createObjectURL(await resp.blob())
+      el.innerHTML = `<img src="${url}" alt="${t('收款二维码')}" style="width:72px;height:72px;object-fit:contain;border-radius:6px">`
+    } catch { el.textContent = '❌' }
+  }, 0))
+}

package/dist/pwa/public/app-direct-pay-buyer.js

@@ -0,0 +1,72 @@
+// Direct Pay (Rail 1) — 买家侧收款账号选择 + 分账号 FX + ack 门后收款码展示 (Phase D3)。UI ONLY。
+//   接 D1(GET /api/direct-receive/selectable-accounts 只读元数据)+ D2(建单带 direct_receive_account_id、
+//   GET /api/orders/:id/direct-pay-qr ack 门后取图)。选账号在【下单前】(与建单契约一致);收款目标(instruction 原文 +
+//   QR 图)仍只在 D1/D2 both-acked 后经订单快照 / QR 端点展示。WebAZ 不验证/路由/托管,FX 纯展示。双语 parity 由 test-direct-pay-ui.ts 守。
+
+// USDC 金额 → 任意币种展示串(用于"卖家按 <币种> 收款 ≈ X");无 rate/币种不支持 → 仅币种码。
+window.dpFxInCurrency = (usdc, currency) => {
+  const cur = String(currency || '').toUpperCase()
+  const r = window._fxRates
+  const n = Number(usdc)
+  const sym = { CNY: '¥', EUR: '€', INR: '₹', SGD: 'S$', USD: '$', IDR: 'Rp', MYR: 'RM', PHP: '₱', VND: '₫', THB: '฿' }
+  if (!cur) return ''
+  if (cur === 'USDC' || cur === 'USD') return Number.isFinite(n) ? `${sym.USD}${n >= 100 ? Math.round(n) : n.toFixed(2)}` : ''
+  const rate = r && r.rates ? Number(r.rates[cur]) : NaN
+  if (!(rate > 0) || !Number.isFinite(n)) return cur   // 币种不在 FX 表:只显示币种码,不臆造换算
+  const local = n * rate
+  return `${sym[cur] || (cur + ' ')}${local >= 100 ? Math.round(local) : local.toFixed(2)}`
+}
+
+// 选直付且可用时加载卖家可选收款账号(元数据 only)。0 个 → 清空(legacy 单条说明,无需选);≥1 → 单选列表(默认首个)。
+window.dpLoadBuyerAccounts = async (productId) => {
+  const box = document.getElementById('dp-account-picker')
+  if (!box) return
+  let r
+  try { r = await GET('/direct-receive/selectable-accounts?product_id=' + encodeURIComponent(productId || '')) } catch { r = null }
+  const opts = (r && r.options) || []
+  if (!opts.length) { box.innerHTML = ''; return }   // legacy-only 卖家:无多账号,走单条说明,不显示选择器
+  box.innerHTML = `
+    <div style="font-size:12px;font-weight:600;color:#374151;margin:8px 0 4px">${t('选择卖家收款方式')}</div>
+    ${opts.map((o, i) => {
+      const title = o.label ? escHtml(o.label) : (o.method ? escHtml(o.method) : t('收款账号'))
+      const sub = [o.method ? escHtml(o.method) : '', o.currency ? escHtml(o.currency) : ''].filter(Boolean).join(' · ')
+      return `<label style="display:flex;gap:8px;align-items:flex-start;font-size:13px;padding:6px 2px;cursor:pointer">
+        <input type="radio" name="dp-account" value="${escHtml(o.account_id)}" ${i === 0 ? 'checked' : ''}>
+        <span><b>${title}</b>${sub ? ` <span style="color:#6b7280;font-size:11px">${sub}</span>` : ''}<span data-dp-fx-cur="${o.currency ? escHtml(o.currency) : ''}" style="display:block;color:#6b7280;font-size:11px"></span></span>
+      </label>`
+    }).join('')}
+    <div style="font-size:11px;color:#9ca3af;margin-top:2px">${t('收款明细与二维码将在完成风险确认后显示')}</div>`
+  window.dpRenderAccountFx()   // 按【当前订单总额 = 单价 × 数量】渲染分账号 FX(数量后续变化由 qtyStep/qtyClamp 再刷新)
+}
+
+// 当前直付订单总额(USDC)= 单价(data-amt)×【当前数量】(#inp-qty);直付买家场外付这个数,绝不能只按单价显示。
+window.dpAccountTotalUsdc = () => {
+  const unit = Number(document.getElementById('dp-rail-block')?.getAttribute('data-amt') || '')
+  const q = document.getElementById('inp-qty')
+  const qty = q ? Math.max(1, Math.floor(Number(q.value) || 1)) : 1
+  return Number.isFinite(unit) ? unit * qty : NaN
+}
+// 用【当前订单总额】渲染/刷新分账号 FX 金额(数量改变后由 qtyStep/qtyClamp 调用)。无该币种汇率 → dpFxInCurrency 回落币种码。
+window.dpRenderAccountFx = () => {
+  const total = window.dpAccountTotalUsdc()
+  document.querySelectorAll('#dp-account-picker [data-dp-fx-cur]').forEach((el) => {
+    const cur = el.getAttribute('data-dp-fx-cur')
+    const fx = (cur && Number.isFinite(total)) ? window.dpFxInCurrency(total, cur) : ''
+    el.innerHTML = fx ? `${t('卖家按此收款')} ≈ ${fx}` : ''
+  })
+}
+
+// 当前选中的收款账号 id(供建单带上);无选择器(legacy)/未选 → '' → 建单省略该字段,后端回落单条说明。
+window.dpSelectedAccountId = () => document.querySelector('input[name="dp-account"]:checked')?.value || ''
+
+// ack 门后:取订单收款二维码(owner+both-acked 才 200;Authorization header 走 fetch→blob,<img src> 带不了头)。
+window.dpLoadOrderQr = async (orderId) => {
+  const box = document.getElementById('dp-order-qr')
+  if (!box) return
+  try {
+    const resp = await fetch('/api/orders/' + encodeURIComponent(orderId) + '/direct-pay-qr', { headers: { Authorization: 'Bearer ' + (window.state && window.state.apiKey) } }); if (!box.isConnected) return   // 切走了(box 离屏)→ 绝不把本单 QR 写进别单面板(纵深防御:box 在 await 前捕获,离屏写入本不可见,此处显式封边)
+    if (!resp.ok) { box.innerHTML = ''; return }   // 无 QR / 未 ack:静默不显(instruction 文本已单独展示)
+    const url = URL.createObjectURL(await resp.blob())
+    box.innerHTML = `<div style="font-size:11px;color:#9ca3af;margin:6px 0 2px">${t('收款二维码')}</div><img src="${url}" alt="${t('收款二维码')}" style="width:150px;height:150px;object-fit:contain;border:1px solid #e5e7eb;border-radius:8px">`
+  } catch { box.innerHTML = '' }
+}

package/dist/pwa/public/app-direct-pay-cancel-refund.js

@@ -0,0 +1,72 @@
+// 直付取消退款握手前端(审计项 C)—— 付款后(accepted)·发货前:买家申请取消 → 卖家场外退款并声明 →
+//   买家确认收到(Passkey)→ 系统无责关单。UI ONLY(真正边界在后端 direct-pay-cancel-refund 路由 + 域模块)。
+//   状态来自订单详情 DTO 的 order.cancel_refund(仅 direct_p2p+accepted 计算),同步渲染。中文 t(),英文 i18n.js _EN。
+
+window.dpCancelRefundCard = (order, isBuyer, isSeller) => {
+  if (!order || order.payment_rail !== 'direct_p2p' || order.status !== 'accepted' || !(isBuyer || isSeller)) return ''
+  const cr = order.cancel_refund
+  if (!cr) return ''
+  const oid = order.id
+  const req = cr.request
+  const eff = req && req.status
+  const head = `<div style="font-size:13px;font-weight:700;color:#92400e;margin-bottom:4px">↩️ ${t('取消订单并退款(直付)')}</div>
+    <div style="font-size:12px;color:#4b5563;line-height:1.7;margin-bottom:8px">${t('直付非托管:平台不持货款,退款由卖家在协议外完成,双方在此握手确认,订单无责取消。')}</div>`
+  let body = ''
+  if (isBuyer && cr.can_confirm) {
+    body = `<div style="font-size:12px;color:#374151;margin-bottom:8px">💸 ${t('卖家已声明退款')}${req && req.refund_reference ? '「' + escHtml(req.refund_reference) + '」' : ''}。${t('请先核实退款已到账;未收到请勿确认,可发起争议。')}</div>
+      <button class="btn btn-primary btn-sm" style="width:auto" onclick="dpCrConfirm('${oid}')">${t('已收到退款,确认取消订单(需 Passkey)')}</button>`
+  } else if (isBuyer && eff === 'requested') {
+    body = `<div style="font-size:12px;color:#6b7280;margin-bottom:8px">⏳ ${t('已向卖家发出取消退款请求,等待响应(超期可重新申请或发起争议)。')}</div>
+      <button class="btn btn-outline btn-sm" style="width:auto" onclick="dpCrWithdraw('${oid}')">${t('撤回请求')}</button>`
+  } else if (isBuyer && cr.can_request) {
+    const hint = eff === 'declined' ? `<div style="font-size:12px;color:#b91c1c;margin-bottom:6px">${t('卖家拒绝了上次请求(继续发货)。可再次申请或与卖家沟通。')}</div>` : (eff === 'expired' ? `<div style="font-size:12px;color:#b91c1c;margin-bottom:6px">${t('上次请求卖家未在期限内响应。可重新申请,或发起争议。')}</div>` : '')
+    body = `${hint}<textarea id="dp-cr-reason-${oid}" class="form-control" rows="2" placeholder="${t('取消理由(可选,卖家可见)')}" style="margin-bottom:8px;font-size:12px"></textarea>
+      <button class="btn btn-outline btn-sm" style="width:auto" onclick="dpCrRequest('${oid}')">${t('申请取消并退款')}</button>`
+  } else if (isSeller && cr.can_respond) {
+    body = `<div style="font-size:12px;color:#374151;margin-bottom:8px">📩 ${t('买家申请取消订单并退款。')}${req && req.reason ? '「' + escHtml(req.reason) + '」' : ''} ${t('同意:先在协议外退款,再点"我已退款";不同意:拒绝并继续发货。')}</div>
+      <input id="dp-cr-ref-${oid}" class="form-control" maxlength="200" placeholder="${t('退款参考(转账单号等,可选,买家可见)')}" style="margin-bottom:8px;font-size:12px">
+      <div style="display:flex;gap:8px;flex-wrap:wrap">
+        <button class="btn btn-primary btn-sm" style="width:auto" onclick="dpCrMarkRefunded('${oid}')">${t('我已退款')}</button>
+        <button class="btn btn-outline btn-sm" style="width:auto" onclick="dpCrDecline('${oid}')">${t('拒绝(继续发货)')}</button>
+      </div>`
+  } else if (isSeller && eff === 'refund_marked') {
+    body = `<div style="font-size:12px;color:#6b7280">⏳ ${t('你已声明退款,等待买家确认收到后订单将无责取消。')}</div>`
+  } else return ''
+  return `<div class="card" style="border:1px solid #fde68a;background:linear-gradient(135deg,#fffbeb,#fef3c7)">${head}${body}</div>`
+}
+
+const dpCrToast = (m, kind) => { if (typeof toast$ === 'function') toast$(m, kind) }
+const dpCrReload = (oid) => renderOrderDetail(document.getElementById('app'), oid)
+
+window.dpCrRequest = async (oid) => {
+  const el = document.getElementById('dp-cr-reason-' + oid)
+  const r = await POST('/orders/' + oid + '/cancel-refund/request', { reason: (el && el.value || '').trim() })
+  if (r.error) return void dpCrToast(r.error, 'error')
+  dpCrToast(t('已发出取消退款请求,等待卖家响应'), 'success'); dpCrReload(oid)
+}
+window.dpCrDecline = async (oid) => {
+  const r = await POST('/orders/' + oid + '/cancel-refund/decline', {})
+  if (r.error) return void dpCrToast(r.error, 'error')
+  dpCrReload(oid)
+}
+window.dpCrMarkRefunded = async (oid) => {
+  if (typeof confirmModal === 'function' && !(await confirmModal(t('确认你已在协议外向买家完成退款?声明后买家确认即取消订单;虚假声明将留痕并可被追责。'), t('我已退款'), { danger: true }))) return
+  const el = document.getElementById('dp-cr-ref-' + oid)
+  const r = await POST('/orders/' + oid + '/cancel-refund/mark-refunded', { refund_reference: (el && el.value || '').trim() })
+  if (r.error) return void dpCrToast(r.error, 'error')
+  dpCrToast(t('已声明退款,等待买家确认'), 'success'); dpCrReload(oid)
+}
+window.dpCrWithdraw = async (oid) => {
+  const r = await POST('/orders/' + oid + '/cancel-refund/withdraw', {})
+  if (r.error) return void dpCrToast(r.error, 'error')
+  dpCrReload(oid)
+}
+window.dpCrConfirm = async (oid) => {
+  if (typeof confirmModal === 'function' && !(await confirmModal(t('确认已收到卖家退款?确认后订单将无责取消,不可撤销。若尚未到账请勿确认。'), t('已收到,取消订单'), { danger: true }))) return
+  let token
+  try { token = await requestPasskeyGate('direct_pay_order_action', { order_id: oid, action: 'cancel_refund_confirm' }) }
+  catch (e) { if (window.dpPromptRegisterPasskey) await window.dpPromptRegisterPasskey(e); return }
+  const r = await POST('/orders/' + oid + '/cancel-refund/confirm', { webauthn_token: token })
+  if (r.error) return void dpCrToast(window.dpErrorText ? window.dpErrorText(r.error_code, r.error) : r.error, 'error')
+  dpCrToast(t('订单已无责取消'), 'success'); dpCrReload(oid)
+}

package/dist/pwa/public/app-direct-pay-compliance.js

@@ -0,0 +1,67 @@
+// Direct Pay (Rail 1) — ADMIN 商户合规录入 (PR-⑧)。UI ONLY。
+//   录入【每个卖家】的 KYB 复核结论 + 制裁筛查结论(直付入场硬门:必须 KYB approved + sanctions clear)。
+//   后端已有受门控端点(admin-direct-receive-deposits):POST /api/admin/direct-receive/kyb-reviews · /sanctions-screenings,
+//   均 ROOT + 真人 Passkey(purpose direct_pay_kyb_ingress / direct_pay_sanctions_ingress;purpose_data 绑
+//   user_id+status+provider_ref+expires_at,签 A 写 B 拒)。本屏只接线,不碰资金/状态机。
+//   ⚠️ 仅【记录你已实际完成的尽调结论】——不代替真实 KYB/制裁筛查。
+
+window.renderAdminDirectReceiveCompliance = async function (app) {
+  if (!state.user) { renderLogin(); return }
+  if (!isAdmin()) { app.innerHTML = shell(`<div class="alert alert-info">${t('仅限管理员')}</div>`, 'admin'); return }
+  const sel = (id, opts) => `<select id="${id}" style="width:100%;padding:7px;border:1px solid #d1d5db;border-radius:6px;font-size:13px">${opts.map(o => `<option value="${o[0]}">${o[1]}</option>`).join('')}</select>`
+  const inp = (id, ph) => `<input id="${id}" placeholder="${ph}" style="width:100%;padding:7px;border:1px solid #d1d5db;border-radius:6px;font-size:13px">`
+  app.innerHTML = shell(`
+    <h1 class="page-title">🧾 ${t('商户合规录入')}</h1>
+    <div style="margin-bottom:12px"><button class="btn btn-outline btn-sm" style="width:auto" onclick="navigate('#admin')">${t('返回概览')}</button></div>
+    <div style="font-size:12px;color:#6b7280;line-height:1.6;margin-bottom:6px">${t('录入卖家的 KYB / 制裁筛查结论(直付入场硬门)。仅记录你【已实际完成】的尽调结论,不代替真实筛查;均需真人 Passkey。')}</div>
+    <div style="font-size:12px;color:#b45309;line-height:1.6;margin-bottom:10px">${t('⚠️ 外部审核编号只填外部审核系统的 case id;切勿填写身份证/护照/住址/证件文件链接 —— 该字段会【明文入库】。')}</div>
+    <div class="card" style="margin-bottom:12px;border:1px solid #e5e7eb">
+      <div style="font-size:13px;font-weight:700;margin-bottom:8px">${t('卖家用户 ID')}</div>
+      ${inp('cmp-user', t('卖家用户 ID(seller user id)'))}
+    </div>
+    <div class="card" style="margin-bottom:12px;border:1px solid #e5e7eb">
+      <div style="font-size:13px;font-weight:700;margin-bottom:8px">🪪 ${t('KYB 复核结论')}</div>
+      <div style="display:flex;flex-direction:column;gap:6px">
+        ${sel('cmp-kyb-status', [['approved', t('通过 approved')], ['pending', t('待定 pending')], ['rejected', t('拒绝 rejected')], ['revoked', t('撤销 revoked')]])}
+        ${inp('cmp-kyb-ref', t('外部审核编号 / vendor case id(选填)'))}
+        ${inp('cmp-kyb-exp', t('有效期 expires_at(选填,如 2027-01-01)'))}
+        <button class="btn btn-primary btn-sm" style="align-self:flex-start;font-size:12px" onclick="window.doIngestKyb()">${t('记录 KYB(真人 Passkey)')}</button>
+      </div>
+    </div>
+    <div class="card" style="margin-bottom:12px;border:1px solid #e5e7eb">
+      <div style="font-size:13px;font-weight:700;margin-bottom:8px">🛡️ ${t('制裁筛查结论')}</div>
+      <div style="display:flex;flex-direction:column;gap:6px">
+        ${sel('cmp-sanc-status', [['clear', t('通过 clear')], ['flagged', t('命中 flagged')], ['blocked', t('阻断 blocked')]])}
+        ${inp('cmp-sanc-ref', t('外部审核编号 / vendor case id(选填)'))}
+        ${inp('cmp-sanc-exp', t('有效期 expires_at(选填)'))}
+        <button class="btn btn-primary btn-sm" style="align-self:flex-start;font-size:12px" onclick="window.doIngestSanctions()">${t('记录制裁筛查(真人 Passkey)')}</button>
+      </div>
+    </div>
+    <div style="font-size:12px;color:#6b7280">${t('录入后用就绪报告核对:')} <code>npm run direct-pay:readiness</code></div>
+  `, 'admin')
+}
+
+// 通用:取卖家 id + 组装 body(provider_ref/expires_at 仅在非空时带);purpose_data 必须与请求体逐字一致。
+function _dpComplianceBody(statusId, refId, expId) {
+  const get = (id) => { const e = document.getElementById(id); return e ? e.value.trim() : '' }
+  const user_id = get('cmp-user')
+  if (!user_id) return null
+  const body = { user_id, status: get(statusId) }
+  const ref = get(refId), exp = get(expId)
+  if (ref) body.provider_ref = ref
+  if (exp) body.expires_at = exp
+  return body
+}
+
+async function _dpComplianceIngest(purpose, path, statusId, refId, expId, okMsg) {
+  const body = _dpComplianceBody(statusId, refId, expId)
+  if (!body) { if (typeof toast$ === 'function') toast$(t('请填写卖家用户 ID'), 'error'); return }
+  const token = await requestPasskeyGate(purpose, body)   // purpose_data = body(逐字绑定)
+  if (!token) { if (typeof toast$ === 'function') toast$(t('需要真人 Passkey 确认'), 'error'); return }
+  const r = await POST(path, { ...body, webauthn_token: token })
+  if (!r || r.error) { if (typeof toast$ === 'function') toast$(window.dpErrorText ? window.dpErrorText(r && r.error_code, r && r.error) : t('操作失败,请重试'), 'error'); return }
+  if (typeof toast$ === 'function') toast$(okMsg)
+}
+
+window.doIngestKyb = () => _dpComplianceIngest('direct_pay_kyb_ingress', '/admin/direct-receive/kyb-reviews', 'cmp-kyb-status', 'cmp-kyb-ref', 'cmp-kyb-exp', t('KYB 结论已记录'))
+window.doIngestSanctions = () => _dpComplianceIngest('direct_pay_sanctions_ingress', '/admin/direct-receive/sanctions-screenings', 'cmp-sanc-status', 'cmp-sanc-ref', 'cmp-sanc-exp', t('制裁筛查结论已记录'))

package/dist/pwa/public/app-direct-pay-copy.js

@@ -0,0 +1,12 @@
+// Direct Pay (Rail 1) — 一键复制按钮(付款说明 / 付款参考号 / 金额)。UI ONLY;不碰任何钱路。
+//   买家场外付款需把收款账号/参考号抄进银行 App —— 手抄是整条轨最易错的一步,复制按钮把出错率降到 0。
+//   文本存 data-dpcopy(escHtml 转义双引号/单引号,属性安全);点按走 app.js 健壮 copyText(clipboard→execCommand 回退),
+//   成功后短暂显示 ✓ 已复制再还原。escHtml/copyText/t 均为运行时(render/click 时)调用,此文件早于 app.js 加载无碍。
+window.dpCopyBtn = (text, label) => `<button type="button" class="btn btn-sm dp-copy-btn" style="padding:2px 8px;font-size:11px;background:#eef2ff;color:#4338ca;border:none;border-radius:6px;cursor:pointer;white-space:nowrap;vertical-align:middle" data-dpcopy="${escHtml(String(text ?? ''))}" onclick="dpDoCopy(this)">📋 ${escHtml(label || t('复制'))}</button>`
+window.dpDoCopy = async (el) => {
+  if (!el || el.dataset.busy === '1') return
+  const ok = await copyText(el.getAttribute('data-dpcopy') || '')
+  if (!ok) return
+  const orig = el.innerHTML; el.dataset.busy = '1'; el.innerHTML = '✓ ' + t('已复制')
+  setTimeout(() => { el.innerHTML = orig; el.dataset.busy = '' }, 1500)
+}