@seasonkoh/webaz 0.1.28 → 0.1.30

package/dist/pwa/public/app-direct-pay-product-verify.js

@@ -0,0 +1,103 @@
+// Direct Pay (Rail 1) — 按产品认证 UI (PR-④b)。UI ONLY。两个面:
+//   ① SELLER 自助(seller workbench settings):逐产品申领验证码 → 贴到外部商品页 → 提交该产品外链 → 看逐产品状态。
+//   ② ADMIN 审核队列(#admin/product-verifications):打开卖家提交的外链手动核对验证码,verify/reject(ROOT + 真人 Passkey)。
+//   硬门:每个产品都须【单独】被 admin 核验才可直付;一次验证绝不放行所有产品。诚实:WebAZ 不抓取链接,admin 手动核。
+//   不碰 wallet/escrow/settlement/refund;只调既有受门控端点。
+
+// ── 状态 → 双语文案 ──
+window.dpPvCopy = () => ({
+  issued:    { icon: '①', text: t('已签发验证码,请贴到该商品的外部页面后提交链接') },
+  submitted: { icon: '⏳', text: t('已提交,等待管理员核验') },
+  verified:  { icon: '✅', text: t('已通过验证,可直付') },
+  rejected:  { icon: '🚫', text: t('未通过,请修正后重新申请') },
+})
+
+// ══════ SELLER 自助面板 ══════
+window.dpSellerProductVerifySection = () => `
+  <div class="card" style="margin-bottom:12px;border:1px solid #e5e7eb">
+    <div style="font-size:14px;font-weight:700;margin-bottom:4px">🔖 ${t('逐产品直付验证(仅你可见)')}</div>
+    <div style="font-size:12px;color:#6b7280;line-height:1.6;margin-bottom:10px">${t('每个走直付收款的商品都需【单独】通过平台人工验证(防作弊):申领验证码 → 贴到该商品的外部平台页面 → 回来提交该商品链接 → 管理员手动核对。未验证的商品只能用托管交易。')}</div>
+    <div id="dp-seller-pv">${loading$()}</div>
+  </div>`
+
+window.dpHydrateSellerProductVerify = async () => {
+  const box = document.getElementById('dp-seller-pv')
+  if (!box) return
+  const [products, vres] = await Promise.all([GET('/my-products'), GET('/direct-receive/product-verifications')])
+  if (!Array.isArray(products) || !vres || vres.error) { box.innerHTML = `<div style="font-size:12px;color:#dc2626">${window.dpErrorText ? window.dpErrorText(vres && vres.error_code, vres && vres.error) : t('操作失败,请重试')}</div>`; return }
+  const byProduct = {}; for (const v of (vres.verifications || [])) { if (!byProduct[v.product_id]) byProduct[v.product_id] = v }  // 最新在前
+  const copy = window.dpPvCopy()
+  if (!products.length) { box.innerHTML = `<div style="font-size:12px;color:#9ca3af">${t('你还没有商品')}</div>`; return }
+  box.innerHTML = products.map(p => {
+    const v = byProduct[p.id]
+    const meta = v ? (copy[v.status] || { icon: 'ℹ️', text: v.status }) : null
+    let action = ''
+    if (!v || v.status === 'rejected') {
+      action = `<button onclick="window.dpRequestProductVerify('${p.id}')" style="padding:6px 12px;background:#2563eb;color:#fff;border:none;border-radius:6px;font-size:12px;font-weight:600;cursor:pointer">${t('申请验证')}</button>`
+    } else if (v.status === 'issued') {
+      action = `
+        <div style="font-size:12px;color:#374151;margin-bottom:6px">${t('验证码')}: <code style="background:#f3f4f6;padding:2px 6px;border-radius:4px;font-weight:700">${escHtml(v.code)}</code> · ${t('把它展示在该商品的外部页面')}</div>
+        <input id="dp-pv-url-${p.id}" type="url" placeholder="${t('该商品的外部链接(http/https)')}" style="width:100%;padding:6px;border:1px solid #d1d5db;border-radius:4px;font-size:12px;margin-bottom:6px">
+        <button onclick="window.dpSubmitProductVerify('${p.id}')" style="padding:6px 12px;background:#2563eb;color:#fff;border:none;border-radius:6px;font-size:12px;font-weight:600;cursor:pointer">${t('提交链接')}</button>`
+    }
+    return `<div style="padding:8px 0;border-top:1px solid #f3f4f6">
+      <div style="font-size:13px;font-weight:600;color:#374151">${escHtml(p.title || p.id)}</div>
+      ${meta ? `<div style="font-size:12px;color:#6b7280;margin:4px 0">${meta.icon} ${escHtml(meta.text)}</div>` : ''}
+      ${action}
+    </div>`
+  }).join('')
+}
+
+window.dpRequestProductVerify = async (productId) => {
+  const r = await POST('/direct-receive/product-verification', { product_id: productId })
+  if (!r || r.error) { if (typeof toast$ === 'function') toast$(window.dpErrorText ? window.dpErrorText(r && r.error_code, r && r.error) : t('操作失败,请重试'), 'error'); return }
+  if (typeof toast$ === 'function') toast$(t('验证码已签发'))
+  window.dpHydrateSellerProductVerify()
+}
+
+window.dpSubmitProductVerify = async (productId) => {
+  const el = document.getElementById('dp-pv-url-' + productId)
+  const url = el && el.value ? el.value.trim() : ''
+  if (!url) { if (typeof toast$ === 'function') toast$(t('请填写该商品的外部链接'), 'error'); return }
+  const r = await PUT('/direct-receive/product-verification', { product_id: productId, external_url: url })
+  if (!r || r.error) { if (typeof toast$ === 'function') toast$(window.dpErrorText ? window.dpErrorText(r && r.error_code, r && r.error) : t('操作失败,请重试'), 'error'); return }
+  if (typeof toast$ === 'function') toast$(t('已提交,等待管理员核验'))
+  window.dpHydrateSellerProductVerify()
+}
+
+// ══════ ADMIN 审核队列 ══════
+window.renderAdminProductVerifications = async function (app) {
+  if (!state.user) { renderLogin(); return }
+  if (!isAdmin()) { app.innerHTML = shell(`<div class="alert alert-info">${t('仅限管理员')}</div>`, 'admin'); return }
+  app.innerHTML = shell(loading$(), 'admin')
+  const data = await GET('/admin/direct-receive/product-verifications?status=submitted')
+  if (!data || data.error) { app.innerHTML = shell(alert$('error', (data && data.error) || t('加载失败')), 'admin'); return }
+  const rows = data.verifications || []
+  const list = rows.length ? rows.map(v => `
+    <div class="card" style="margin-bottom:10px">
+      <div style="font-size:11px;color:#9ca3af">${escHtml(v.seller_id)} · ${escHtml(v.product_id)} · ${fmtTime(v.created_at)}</div>
+      <div style="font-size:13px;margin-top:6px">${t('验证码')}: <code style="background:#f3f4f6;padding:2px 6px;border-radius:4px;font-weight:700">${escHtml(v.code)}</code>${v.platform ? ` · ${escHtml(v.platform)}` : ''}</div>
+      <div style="font-size:12px;margin-top:4px">${t('外部链接')}: ${v.external_url ? `<a href="${encodeURI(v.external_url)}" target="_blank" rel="noopener noreferrer nofollow" style="color:#2563eb;text-decoration:underline;word-break:break-all">${escHtml(v.external_url)}</a>` : '—'}</div>
+      <div style="font-size:11px;color:#9ca3af;margin-top:4px">${t('请手动打开链接,确认该商品页面上展示了上面的验证码,再决定通过/拒绝。')}</div>
+      <div style="display:flex;gap:6px;margin-top:10px">
+        <button class="btn btn-primary btn-sm" style="font-size:12px" onclick="window.doReviewProductVerify('${v.id}','verified')">✓ ${t('通过(真人 Passkey)')}</button>
+        <button class="btn btn-sm" style="font-size:12px;background:#dc2626;border-color:#dc2626;color:#fff" onclick="window.doReviewProductVerify('${v.id}','rejected')">✗ ${t('拒绝(真人 Passkey)')}</button>
+      </div>
+    </div>`).join('') : `<div class="empty"><div class="empty-icon">📥</div><div class="empty-text">${t('暂无待核验商品')}</div></div>`
+  app.innerHTML = shell(`
+    <h1 class="page-title">🔖 ${t('逐产品直付验证审核')}</h1>
+    <div style="margin-bottom:12px"><button class="btn btn-outline btn-sm" style="width:auto" onclick="navigate('#admin')">${t('返回概览')}</button></div>
+    <div style="font-size:12px;color:#6b7280;line-height:1.6;margin-bottom:10px">${t('每个商品需单独核验:打开卖家提交的外部链接,确认页面展示了验证码再通过。通过=该商品可直付(逐品,绝不放行全部)。通过/拒绝均需真人 Passkey。')}</div>
+    ${list}
+  `, 'admin')
+}
+
+// purpose_data 绑 verification_id + decision(签 A 用 B / 改结论一律拒)。
+window.doReviewProductVerify = async function (id, decision) {
+  const token = await requestPasskeyGate('direct_pay_product_verify', { verification_id: id, decision })
+  if (!token) { if (typeof toast$ === 'function') toast$(t('需要真人 Passkey 确认'), 'error'); return }
+  const r = await POST(`/admin/direct-receive/product-verifications/${id}/review`, { decision, webauthn_token: token })
+  if (!r || r.error) { if (typeof toast$ === 'function') toast$(window.dpErrorText ? window.dpErrorText(r && r.error_code, r && r.error) : t('操作失败,请重试'), 'error'); return }
+  if (typeof toast$ === 'function') toast$(decision === 'verified' ? t('该商品已通过验证') : t('该商品已拒绝'))
+  window.renderAdminProductVerifications(document.getElementById('app'))
+}

package/dist/pwa/public/app-direct-pay-readiness.js

@@ -0,0 +1,38 @@
+// Direct Pay (Rail 1) — SELLER de-identified readiness panel (PR readiness-seller-ui)。UI ONLY。
+//   只渲染【卖家可行动 / 脱敏状态】项(收款说明 / Passkey / 履约保证金 / 商户审核 / 暂停 / 平台开放)。
+//   数据来自 GET /api/direct-receive/readiness(后端已脱敏:绝不下发 raw blocker、也绝不暴露 KYB/制裁/AML 分项)。
+//   前端只做 code→卖家可读双语文案 的映射,绝不展示原始内部判定码。Direct Pay 仍 non-launchable / fail-closed。
+//   不碰 wallet/escrow/settlement/refund/钱路;不开真实 rail;不声称已上线。买家侧不展示本面板。
+
+// 内部 code → 卖家安全双语文案(ok / 未达成 两态 + 可行动入口)。绝不出现 KYB/sanctions/AML 字样。
+window.dpSellerReadinessCopy = () => ({
+  PLATFORM_OPEN: { ok: t('平台侧直付已开放'), no: t('直付平台侧暂未开放(无需你操作)') },
+  PAYMENT_INSTRUCTION: { ok: t('已设置收款说明'), no: t('未设置收款说明'), action: t('去设置收款说明'), href: '#seller/settings' },
+  PASSKEY: { ok: t('已注册 Passkey'), no: t('未注册 Passkey'), action: t('去注册 Passkey'), href: '#me' },
+  BASE_BOND: { ok: t('履约保证金已完成'), no: t('履约保证金未完成') },
+  COMPLIANCE_REVIEW: { ok: t('商户审核已通过'), no: t('商户审核进行中或未通过') },
+  NOT_SUSPENDED: { ok: t('直付资格正常'), no: t('直付资格已被暂停') },
+})
+
+window.dpSellerReadinessSection = () => `
+  <div class="card" style="margin-bottom:12px;border:1px solid #e5e7eb">
+    <div style="font-size:14px;font-weight:700;margin-bottom:4px">🧭 ${t('直付开通进度(仅你可见)')}</div>
+    <div style="font-size:12px;color:#6b7280;line-height:1.6;margin-bottom:10px">${t('以上为你的直付开通进度;直付按轨道分阶段开放,完成可行动项不代表立即可用。')}</div>
+    <div id="dp-seller-readiness">${loading$()}</div>
+  </div>`
+
+window.dpHydrateSellerReadiness = async () => {
+  const box = document.getElementById('dp-seller-readiness')
+  if (!box) return
+  const r = await GET('/direct-receive/readiness')
+  if (!r || r.error) { box.innerHTML = `<div style="font-size:12px;color:#dc2626">${window.dpErrorText ? window.dpErrorText(r && r.error_code, r && r.error) : t('操作失败,请重试')}</div>`; return }
+  const copy = window.dpSellerReadinessCopy()
+  const rows = (r.items || []).map(it => {
+    const c = copy[it.code]; if (!c) return ''
+    const icon = it.ok ? '✅' : (it.actionable ? '⚠️' : '⏳')
+    const text = it.ok ? c.ok : c.no
+    const act = (!it.ok && it.actionable && c.action) ? ` · <a href="${c.href}" style="color:#2563eb;font-weight:600;text-decoration:underline">${c.action}</a>` : ''
+    return `<li style="display:flex;gap:8px;align-items:flex-start;font-size:13px;line-height:1.7;color:#374151"><span>${icon}</span><span>${escHtml(text)}${act}</span></li>`
+  }).join('')
+  box.innerHTML = `<ul style="margin:0;padding-left:2px;list-style:none">${rows}</ul>`
+}

package/dist/pwa/public/app-direct-pay-reconcile.js

@@ -0,0 +1,19 @@
+// 直付卖家对账卡(审计项 F)。UI ONLY;不碰钱路。买家 mark_paid 后(accepted,发货前)在卖家视角显性化
+//   对账三要素:①期望参考号(dpPayRef 派生,银行流水附言应恰为此值,一键复制便于流水搜索)②应付金额
+//   (E 冻结的 payable 快照,与买家所见同一数字)③同买家同金额在途多单告警(DTO duplicate_amount_alert,
+//   与 mark_paid D2 时间线预警同口径 —— 防一笔转账冒充两单)。买家声称的参考在时间线(mark_paid note)可见。
+//   发货即确认收款(D4 弹窗把关),此卡把核对动作前置到打开订单页的每一刻。中文 t(),英文 i18n.js _EN。
+window.dpReconcileCard = (order, isSeller) => {
+  if (!order || !isSeller || order.payment_rail !== 'direct_p2p' || order.status !== 'accepted') return ''
+  const ref = window.dpPayRef ? window.dpPayRef(order.id) : ''
+  const pay = window.dpPayAmountText ? window.dpPayAmountText(order) : ''
+  const dup = Number(order.duplicate_amount_alert) || 0
+  return `<div class="card" style="border:1px solid #bbf7d0;background:linear-gradient(135deg,#f0fdf4,#dcfce7)">
+    <div style="font-size:13px;font-weight:700;color:#166534;margin-bottom:4px">🧾 ${t('发货前对账(买家已标记付款)')}</div>
+    <div style="font-size:12px;color:#374151;line-height:1.9">
+      <div>${t('银行/收款App流水附言应为')} <code style="font-size:13px;font-weight:700;background:#fff;border:1px solid #bbf7d0;border-radius:6px;padding:2px 6px">${escHtml(ref)}</code>${window.dpCopyBtn ? window.dpCopyBtn(ref) : ''}</div>
+      ${pay ? `<div>💸 ${escHtml(pay)}</div>` : ''}
+      ${dup > 0 ? `<div style="color:#b91c1c;font-weight:600">⚠️ ${t('同买家另有')} ${dup} ${t('笔同金额直付订单在途 —— 每笔转账只能核销一个订单,请逐单核对参考号,谨防一笔款冒充多单。')}</div>` : ''}
+      <div style="font-size:11px;color:#6b7280">${t('请核实款项【已到账】且附言/金额与本单一致再发货;发货即视为确认收款。未收到请点"未收到货款"。')}</div>
+    </div></div>`
+}

package/dist/pwa/public/app-direct-pay-returns.js

@@ -0,0 +1,56 @@
+// 直付(direct_p2p)送达后退货·场外退款握手前端 —— 退货骨架 UI 在 app.js renderReturnWidgetForOrder,
+//   本模块只提供直付分支的 hooks(状态标签/握手动作块/升级判定与文案)。UI ONLY,真正边界在后端
+//   routes/direct-pay-returns.ts + 域模块。中文 t(),英文 i18n.js _EN。库存绝不自动恢复(退货验收上架)。
+
+window.dpReturnStatusLabels = () => ({ await_refund: t('待卖家场外退款'), refund_marked: t('卖家已声明退款 · 待你确认') })
+window.dpReturnStatusColors = () => ({ await_refund: '#d97706', refund_marked: '#2563eb', accepted_pickup_pending: '#16a34a', picked_up: '#2563eb' })
+
+// 握手动作块:卖家在 await_refund 声明退款;买家在 refund_marked 确认(Passkey)。其余状态返回 ''。
+window.dpReturnHandshake = (item, isBuyer, isSellerView, order) => {
+  if (!order || order.payment_rail !== 'direct_p2p') return ''
+  const note = `<div style="font-size:11px;color:#92400e;background:#fffbeb;border:1px solid #fde68a;border-radius:6px;padding:6px 8px;margin-bottom:8px">${t('直付非托管:退款由卖家在协议外完成,平台只记录握手,不经手货款。')}</div>`
+  if (isSellerView && item.status === 'await_refund') {
+    return `${note}<div style="font-size:12px;color:#374151;margin-bottom:6px">${t('你已同意退货。请在协议外向买家退款,然后声明;买家确认后退货完成。')}</div>
+      <input id="dp-ret-ref-${item.id}" class="form-control" maxlength="200" placeholder="${t('退款参考(转账单号等,可选,买家可见)')}" style="margin-bottom:8px;font-size:12px">
+      <button class="btn btn-primary btn-sm" style="width:auto;font-size:12px" onclick="dpReturnMarkRefunded('${item.id}','${order.id}')">${t('我已退款')}</button>`
+  }
+  if (isBuyer && item.status === 'await_refund') {
+    return `${note}<div style="font-size:12px;color:#6b7280;margin-bottom:8px">⏳ ${t('卖家已同意退货,等待其在协议外向你退款并声明。超期未退款可升级争议。')}</div>`
+  }
+  if (isBuyer && item.status === 'refund_marked') {
+    return `${note}<div style="font-size:12px;color:#374151;margin-bottom:8px">💸 ${t('卖家已声明退款')}${item.refund_reference ? '「' + escHtml(item.refund_reference) + '」' : ''}。${t('请先核实退款已到账;未收到请勿确认,可发起争议。')}</div>
+      <button class="btn btn-primary btn-sm" style="width:auto;font-size:12px" onclick="dpReturnConfirmRefund('${item.id}','${order.id}')">${t('已收到退款,完成退货(需 Passkey)')}</button>`
+  }
+  if (isSellerView && item.status === 'refund_marked') {
+    return `${note}<div style="font-size:12px;color:#6b7280">⏳ ${t('你已声明退款,等待买家确认收到。提示:退回货物须验收后手动上架,库存不会自动恢复。')}</div>`
+  }
+  return ''
+}
+
+// 升级争议判定(与后端 directPayReturnEscalatable 同口径;窗口天数由后端最终裁决,前端只做展示预判)
+window.dpReturnCanEscalate = (item, order) => {
+  if (!order || order.payment_rail !== 'direct_p2p') return false
+  if (item.status === 'refund_marked') return true
+  if (item.status === 'await_refund' && item.await_refund_since) return (Date.now() - new Date(String(item.await_refund_since).replace(' ', 'T') + 'Z').getTime()) >= 5 * 86400 * 1000
+  return false
+}
+window.dpReturnEscalateHint = (item) => item.status === 'refund_marked'
+  ? t('若卖家声明退款但你并未收到,可升级至平台仲裁(直付为信誉裁决)')
+  : t('卖家同意退货后超期未退款 — 可升级至平台仲裁(直付为信誉裁决)')
+
+window.dpReturnMarkRefunded = async (rid, oid) => {
+  if (typeof confirmModal === 'function' && !(await confirmModal(t('确认你已在协议外向买家完成退货退款?声明后买家确认即完成;虚假声明将留痕并可被追责。'), t('我已退款'), { danger: true }))) return
+  const el = document.getElementById('dp-ret-ref-' + rid)
+  const r = await POST('/return-requests/' + rid + '/mark-refunded', { refund_reference: (el && el.value || '').trim() })
+  if (r.error) return void toast$(r.error, 'error')
+  toast$(t('已声明退款,等待买家确认'), 'success'); renderOrderDetail(document.getElementById('app'), oid)
+}
+window.dpReturnConfirmRefund = async (rid, oid) => {
+  if (typeof confirmModal === 'function' && !(await confirmModal(t('确认已收到卖家退款?确认后退货完成,不可撤销。若尚未到账请勿确认。'), t('已收到,完成退货'), { danger: true }))) return
+  let token
+  try { token = await requestPasskeyGate('direct_pay_order_action', { order_id: oid, action: 'return_refund_confirm' }) }
+  catch (e) { if (window.dpPromptRegisterPasskey) await window.dpPromptRegisterPasskey(e); return }
+  const r = await POST('/return-requests/' + rid + '/confirm-refund', { webauthn_token: token })
+  if (r.error) return void toast$(window.dpErrorText ? window.dpErrorText(r.error_code, r.error) : r.error, 'error')
+  toast$(t('退货已完成'), 'success'); renderOrderDetail(document.getElementById('app'), oid)
+}

package/dist/pwa/public/app-direct-pay-reveal.js

@@ -0,0 +1,82 @@
+// Direct Pay (Rail 1) — 收款信息可见性生命周期 (PR-2)。UI ONLY。
+//   模型:待支付(direct_pay_window)→ 自动展示卖家收款说明+QR 一个【30 分钟窗口】,超时自动隐藏,可【轻量】重新显示(重置窗口);
+//   其它所有状态(已付/完成/取消/过期/争议/退款…)→ 默认隐藏,需【二次验证:现场 Passkey + 风险提示】才临时展示(同样 30 分钟窗口)。
+//   金额(应付)非敏感,任何状态都常显。
+//   诚实边界:这是【客户端展示/同意】控制 —— 防误付空单 + 不长留敏感收款信息在屏 + 现场在场二次同意;
+//   【并非】新的服务器机密边界(收款目标对 both-acked 的订单买家经订单 API 仍可得,后端授权门仍是 both-acked 归属)。
+//   订单隔离(P1):所有 DOM 写入只经 dpInstrBox(orderId) 取容器 —— 容器 data-order-id 必须仍等于该 orderId,
+//   否则(已切到别的订单页)一律 bail。切换订单渲染时先清掉所有旧 timer,杜绝旧订单 timer/重看改写当前订单面板。
+window._dpRevealTimers = window._dpRevealTimers || {}
+window.DP_REVEAL_MS = 30 * 60 * 1000
+
+// 终态/无效单(不应再付款)——重看时给强风险提示。
+window.dpIsVoidOrder = (status) => ['cancelled', 'expired', 'direct_expired_unconfirmed', 'disputed', 'dispute_dismissed', 'refunded_full', 'refunded_partial', 'fault_seller', 'fault_buyer', 'fault_logistics'].includes(status)
+
+// 订单隔离守卫:仅当当前 #dp-order-instr 容器仍属于 orderId 才返回它;否则 null(已切换订单 → 任何写入都不得落到别的订单页)。
+window.dpInstrBox = (orderId) => { const b = document.getElementById('dp-order-instr'); return (b && b.getAttribute('data-order-id') === String(orderId)) ? b : null }
+window.dpClearRevealTimer = (orderId) => { const tmr = window._dpRevealTimers[orderId]; if (tmr) { clearTimeout(tmr.to); clearInterval(tmr.iv); delete window._dpRevealTimers[orderId] } }
+window.dpClearAllRevealTimers = () => { for (const k of Object.keys(window._dpRevealTimers)) window.dpClearRevealTimer(k) }
+
+// 收款说明+QR 展示块(含倒计时);到点 → 隐藏。lightweight=true:重新显示无需 Passkey(待支付轨)。
+window.dpShowPaymentInfo = (order, orderId, lightweight) => {
+  const box = window.dpInstrBox(orderId); if (!box) return   // 已切到别的订单页 → 不写
+  window.dpClearRevealTimer(orderId)
+  const snap = order && order.direct_pay_instruction_snapshot ? order.direct_pay_instruction_snapshot : ''
+  const pay = window.dpPayAmountText ? window.dpPayAmountText(order) : ''
+  if (!snap) { box.innerHTML = `<div style="font-size:12px;color:#9ca3af">${t('卖家尚未设置收款说明,暂不可直付')}</div>`; return }
+  box.innerHTML = `<div style="font-size:12px;color:#374151;background:#fff;border:1px solid #fde68a;border-radius:8px;padding:8px 10px">
+    ${pay ? `<div style="font-size:13px;font-weight:700;color:#92400e;margin-bottom:4px">💸 ${escHtml(pay)}</div>` : ''}
+    <div style="font-size:11px;color:#9ca3af;margin-bottom:2px">${t('卖家收款说明(下单时快照)')}${window.dpCopyBtn ? window.dpCopyBtn(snap, t('复制收款说明')) : ''}</div><div style="white-space:pre-wrap;word-break:break-word">${escHtml(snap)}</div><div id="dp-order-qr"></div>${lightweight && window.dpMemoInputHtml ? window.dpMemoInputHtml(orderId) : ''}
+    <div style="font-size:10px;color:#9ca3af;margin-top:6px">${t('自动隐藏倒计时')}: <span id="dp-reveal-countdown">30:00</span></div></div>`
+  if (window.dpLoadOrderQr) window.dpLoadOrderQr(orderId)
+  const end = Date.now() + window.DP_REVEAL_MS
+  const tick = () => { const b = window.dpInstrBox(orderId); if (!b) return window.dpClearRevealTimer(orderId); const el = b.querySelector('#dp-reveal-countdown'); if (!el) return; const s = Math.max(0, Math.round((end - Date.now()) / 1000)); el.textContent = `${Math.floor(s / 60)}:${String(s % 60).padStart(2, '0')}` }
+  tick()
+  window._dpRevealTimers[orderId] = { iv: setInterval(tick, 1000), to: setTimeout(() => window.dpHidePaymentInfo(order, orderId, lightweight), window.DP_REVEAL_MS) }
+}
+
+// 隐藏收款信息 → 显示重看入口。lightweight:待支付轨点一下即可;否则需 Passkey+风险提示。
+window.dpHidePaymentInfo = (order, orderId, lightweight) => {
+  window.dpClearRevealTimer(orderId)
+  const box = window.dpInstrBox(orderId); if (!box) return   // 已切到别的订单页 → 不写
+  const pay = window.dpPayAmountText ? window.dpPayAmountText(order) : ''
+  const hint = lightweight ? t('为保护你的收款信息,已隐藏。') : t('订单已不在待支付阶段,收款信息默认隐藏。')
+  const btn = lightweight
+    ? `<button class="btn btn-outline btn-sm" onclick="dpReShowPaymentInfo('${orderId}')">${t('重新显示')}</button>`
+    : `<button class="btn btn-outline btn-sm" onclick="dpGatedRevealPaymentInfo('${orderId}')">${t('查看收款信息(需 Passkey 验证)')}</button>`
+  box.innerHTML = `<div style="font-size:12px;color:#374151;background:#fff;border:1px solid #fde68a;border-radius:8px;padding:8px 10px">
+    ${pay ? `<div style="font-size:13px;font-weight:700;color:#92400e;margin-bottom:4px">💸 ${escHtml(pay)}</div>` : ''}
+    <div style="font-size:11px;color:#9ca3af;margin-bottom:6px">${escHtml(hint)}</div>${btn}</div>`
+}
+
+// 轻量重新显示:GET【最新】订单后按【当前状态】重新分派 —— 仍待支付才轻量重显;若期间已取消/过期/争议等,
+//   dpRenderPaymentInfo 会走隐藏+Passkey 二次验证路径(绝不用旧按钮 lightweight 展示一个已失效订单的收款信息)。
+window.dpReShowPaymentInfo = async (orderId) => {
+  if (!window.dpInstrBox(orderId)) return
+  const o = await GET(`/orders/${orderId}`); const ord = o && o.order ? o.order : null
+  const box = window.dpInstrBox(orderId); if (ord && box) window.dpRenderPaymentInfo(box, ord, orderId)
+}
+
+// 非待支付:二次验证(风险提示 + 现场 Passkey)后临时展示一个 30 分钟窗口。
+window.dpGatedRevealPaymentInfo = async (orderId) => {
+  if (!window.dpInstrBox(orderId)) return
+  const o = await GET(`/orders/${orderId}`); const ord = o && o.order ? o.order : null
+  if (!ord) return
+  const warn = window.dpIsVoidOrder(ord.status)
+    ? t('⚠️ 此订单已取消/终止,请【勿再付款】。收款信息仅供对账/存证查看。')
+    : t('⚠️ 你已完成付款。收款信息仅供对账/维权查看,请勿重复付款。')
+  const go = await confirmModal(`${warn}\n\n${t('继续查看需现场 Passkey 验证。')}`, t('继续(需 Passkey)'), { danger: true })
+  if (!go || !window.dpInstrBox(orderId)) return
+  try { await requestPasskeyGate('direct_pay_payment_info_reveal', { order_id: orderId }) }
+  catch (e) { if (window.dpPromptRegisterPasskey) await window.dpPromptRegisterPasskey(e); return }
+  window.dpShowPaymentInfo(ord, orderId, false)
+}
+
+// 订单详情:按状态渲染收款信息可见性。【先确认当前容器仍属于该 orderId,再清 timer】——否则旧订单 stale hydrate 回包
+//   会把当前订单的自动隐藏 timer 一并清掉(敏感收款信息永不隐藏)。both-acked 由调用方(dpHydrateOrderDisclosure)先保证。
+window.dpRenderPaymentInfo = (_box, order, orderId) => {
+  if (!order || !window.dpInstrBox(orderId)) return   // 当前页已不是该订单 → 不动任何 timer/DOM
+  window.dpClearAllRevealTimers()
+  if (order.payment_rail === 'direct_p2p' && order.status === 'direct_pay_window') window.dpShowPaymentInfo(order, orderId, true)
+  else window.dpHidePaymentInfo(order, orderId, false)
+}

package/dist/pwa/public/app-direct-pay-sales-report.js

@@ -0,0 +1,70 @@
+// Direct Pay 卖家【直接收款销售统计 + 对账 + 逐单平台费明细】section。UI ONLY,只读。
+//   数据:GET /api/sellers/me/direct-pay-report(requireSeller,仅本人)。直付=非托管,货款买家直付卖家,平台不经手 →
+//   钱包/收入视图看不到直付销售,故此处按订单聚合销售额 + 逐单平台服务费,便于对账(可选日期区间 + 客户端 CSV 导出)。
+//   销售额=下单计价币(买家应付金额);平台服务费=USDC。两者不同币种,分列不混加。
+;(function () {
+  const _n = (v) => (Number(v) || 0)
+  const _amt = (v) => _n(v).toLocaleString(undefined, { maximumFractionDigits: 2 })                 // 销售额(计价币)
+  const _fee = (v) => v == null ? '—' : (_n(v).toFixed(6).replace(/\.?0+$/, '') || '0') + ' USDC'   // 平台费(USDC)
+  let _last = null
+
+  window.dpSalesReportSection = () => {
+    setTimeout(() => window.dpHydrateSalesReport(), 60)
+    return `<div class="card" style="margin-bottom:12px;border:1px solid #e5e7eb">
+      <div style="font-size:14px;font-weight:700;margin-bottom:4px">🧾 ${t('直接收款销售统计 + 对账(仅你可见)')}</div>
+      <div style="font-size:12px;color:#6b7280;line-height:1.6;margin-bottom:10px">${t('直付为非托管:货款由买家直接付给你,平台不经手。此处按你的订单聚合销售额与逐单平台服务费,便于对账。')}</div>
+      <div style="display:flex;gap:6px;align-items:center;flex-wrap:wrap;margin-bottom:10px">
+        <input type="date" id="dpsr-from" style="font-size:12px;padding:4px 6px;border:1px solid #e5e7eb;border-radius:6px">
+        <span style="color:#9ca3af">→</span>
+        <input type="date" id="dpsr-to" style="font-size:12px;padding:4px 6px;border:1px solid #e5e7eb;border-radius:6px">
+        <button class="btn btn-outline btn-sm" style="font-size:11px;padding:4px 10px" onclick="dpHydrateSalesReport(document.getElementById('dpsr-from').value, document.getElementById('dpsr-to').value)">${t('查询')}</button>
+        <button class="btn btn-outline btn-sm" style="font-size:11px;padding:4px 10px" onclick="dpSalesReportExport()">📥 ${t('导出对账 CSV')}</button>
+      </div>
+      <div id="dpsr-body">${typeof loading$ === 'function' ? loading$() : ''}</div>
+    </div>`
+  }
+
+  window.dpHydrateSalesReport = async (from, to) => {
+    const box = document.getElementById('dpsr-body'); if (!box) return
+    const q = []
+    if (from && /^\d{4}-\d{2}-\d{2}$/.test(from)) q.push('from=' + from)
+    if (to && /^\d{4}-\d{2}-\d{2}$/.test(to)) q.push('to=' + to)
+    const r = await GET('/sellers/me/direct-pay-report' + (q.length ? '?' + q.join('&') : '')).catch(() => null)
+    if (!r || r.error) { box.innerHTML = `<div style="font-size:12px;color:#dc2626">${t('操作失败,请重试')}</div>`; return }
+    _last = r
+    const s = r.summary
+    if (!s || s.order_count === 0) { box.innerHTML = `<div style="font-size:12px;color:#9ca3af;padding:8px 0">${t('该区间暂无直接收款订单')}</div>`; return }
+    const tile = (label, val, sub) => `<div style="flex:1;min-width:96px;background:#faf5ff;border:1px solid #ede9fe;border-radius:8px;padding:8px 10px"><div style="font-size:11px;color:#7c3aed">${label}</div><div style="font-size:16px;font-weight:700;color:#5b21b6">${val}</div>${sub ? `<div style="font-size:10px;color:#9ca3af">${sub}</div>` : ''}</div>`
+    const tiles = `<div style="display:flex;gap:6px;flex-wrap:wrap;margin-bottom:10px">
+      ${tile(t('已完成销售额'), _amt(s.completed_sales), t('已完成') + ' ' + s.completed_count + ' ' + t('单'))}
+      ${tile(t('订单总额'), _amt(s.gross_order_total), t('含在途/已关闭') + ' · ' + s.order_count + ' ' + t('单'))}
+      ${tile(t('已计提平台费'), _fee(s.fee_accrued_total), s.fee_order_count + ' ' + t('单'))}
+      ${tile(t('在途 / 已关闭'), s.in_flight_count + ' / ' + s.closed_count, t('单'))}
+    </div>`
+    const byMonth = (r.by_month && r.by_month.length > 1) ? `<div style="margin-bottom:10px"><div style="font-size:12px;color:#6b7280;margin-bottom:4px">${t('按月(已完成 / 订单总额)')}</div>${r.by_month.map(m => `<div style="display:flex;justify-content:space-between;font-size:12px;padding:2px 0;border-bottom:1px solid #f3f4f6"><span>${escHtml(m.month)}</span><span>${_amt(m.completed_sales)} <span style="color:#9ca3af">/ ${_amt(m.gross_order_total)}</span></span></div>`).join('')}</div>` : ''
+    const th = (txt, right) => `<th style="text-align:${right ? 'right' : 'left'};padding:5px 4px;font-size:11px;color:#9ca3af;white-space:nowrap">${txt}</th>`
+    const rowsHtml = r.orders.map(o => `<tr style="border-bottom:1px solid #f3f4f6">
+      <td style="padding:5px 4px;font-size:11px"><a href="#order/${o.id}" style="color:#6366f1;text-decoration:none">${escHtml(String(o.id).slice(0, 10))}</a></td>
+      <td style="padding:5px 4px;font-size:11px;color:#6b7280;white-space:nowrap">${typeof fmtTime === 'function' ? fmtTime(o.created_at) : escHtml(o.created_at)}</td>
+      <td style="padding:5px 4px;font-size:11px">${typeof statusBadge === 'function' ? statusBadge(o.status, 'direct_p2p') : escHtml(o.status)}</td>
+      <td style="padding:5px 4px;font-size:11px;text-align:right;font-weight:600">${_amt(o.total_amount)}</td>
+      <td style="padding:5px 4px;font-size:11px;text-align:right;color:#7c3aed">${_fee(o.fee_amount)}</td>
+    </tr>`).join('')
+    const table = `<div style="overflow-x:auto"><table style="width:100%;border-collapse:collapse">
+      <thead><tr style="border-bottom:1px solid #e5e7eb">${th(t('订单'))}${th(t('时间'))}${th(t('状态'))}${th(t('销售额'), true)}${th(t('平台费'), true)}</tr></thead>
+      <tbody>${rowsHtml}</tbody></table></div>${r.truncated ? `<div style="font-size:11px;color:#b45309;margin-top:6px">${t('仅显示最近 500 单,请用日期区间缩小范围')}</div>` : ''}`
+    box.innerHTML = tiles + byMonth + table
+  }
+
+  // 客户端 CSV 导出(对账用:逐单销售额 + 平台费一张表,对银行流水)。
+  window.dpSalesReportExport = () => {
+    if (!_last || !_last.orders || !_last.orders.length) { (window.toast$ || window.alert)(t('暂无数据可导出')); return }
+    const esc = (v) => { const x = v == null ? '' : String(v); return /[",\n]/.test(x) ? '"' + x.replace(/"/g, '""') + '"' : x }
+    const lines = [['order_id', 'created_at', 'status', 'sales_amount', 'platform_fee_usdc', 'fee_accrued_at', 'ship_to_region', 'product'].join(',')]
+    for (const o of _last.orders) lines.push([o.id, o.created_at, o.status, o.total_amount, o.fee_amount == null ? '' : o.fee_amount, o.fee_accrued_at || '', o.ship_to_region || '', o.product_title || ''].map(esc).join(','))
+    const a = document.createElement('a'); a.href = URL.createObjectURL(new Blob(['' + lines.join('\n')], { type: 'text/csv;charset=utf-8' }))
+    a.download = 'webaz-directpay-reconcile-' + new Date().toISOString().slice(0, 10) + '.csv'
+    document.body.appendChild(a); a.click(); a.remove(); URL.revokeObjectURL(a.href)
+    if (window.toast$) window.toast$(t('导出完成'))
+  }
+})()

package/dist/pwa/public/app-direct-pay-store-verify.js

@@ -0,0 +1,100 @@
+// Direct Pay (Rail 1) — 店铺认证 UI (PR-⑤b) = 逐品验证的【豁免】路径。UI ONLY。两个面:
+//   ① SELLER 自助(seller workbench settings):申领店铺验证码 → 贴到外部店铺页 → 提交店铺链接 → 看状态(含是否已豁免)。
+//   ② ADMIN 审核队列(#admin/store-verifications):打开卖家提交的店铺链接手动核对验证码,verify/reject;verify 时可【勾选
+//      “免逐品验证”】(per_product_exempt)→ 该卖家所有商品免逐品、可直付。ROOT + 真人 Passkey。
+//   诚实:WebAZ 不抓取链接,admin 手动核。不碰 wallet/escrow/settlement/refund;只调既有受门控端点。
+
+window.dpSvCopy = () => ({
+  issued:    { icon: '①', text: t('已签发验证码,请贴到你的外部店铺页后提交店铺链接') },
+  submitted: { icon: '⏳', text: t('已提交,等待管理员核验') },
+  verified:  { icon: '✅', text: t('店铺已通过验证') },
+  rejected:  { icon: '🚫', text: t('未通过,请修正后重新申请') },
+})
+
+// ══════ SELLER 自助面板 ══════
+window.dpSellerStoreVerifySection = () => `
+  <div class="card" style="margin-bottom:12px;border:1px solid #e5e7eb">
+    <div style="font-size:14px;font-weight:700;margin-bottom:4px">🏬 ${t('店铺认证(可申请免逐品验证)')}</div>
+    <div style="font-size:12px;color:#6b7280;line-height:1.6;margin-bottom:10px">${t('默认每个商品需单独验证才能直付。你也可以申请【店铺认证】:申领验证码 → 贴到你的外部店铺主页 → 提交店铺链接 → 管理员手动核对;通过且管理员勾选豁免后,你【所有商品】免逐品验证即可直付。')}</div>
+    <div id="dp-seller-sv">${loading$()}</div>
+  </div>`
+
+window.dpHydrateSellerStoreVerify = async () => {
+  const box = document.getElementById('dp-seller-sv')
+  if (!box) return
+  const r = await GET('/direct-receive/store-verification')
+  if (!r || r.error) { box.innerHTML = `<div style="font-size:12px;color:#dc2626">${window.dpErrorText ? window.dpErrorText(r && r.error_code, r && r.error) : t('操作失败,请重试')}</div>`; return }
+  const v = r.verification, copy = window.dpSvCopy()
+  if (!v || v.status === 'rejected') {
+    const prior = v ? `<div style="font-size:12px;color:#6b7280;margin-bottom:8px">${copy.rejected.icon} ${escHtml(copy.rejected.text)}</div>` : ''
+    box.innerHTML = prior + `<button onclick="window.dpRequestStoreVerify()" style="padding:8px 16px;background:#2563eb;color:#fff;border:none;border-radius:6px;font-size:13px;font-weight:600;cursor:pointer">${t('申请店铺认证')}</button>`
+    return
+  }
+  const meta = copy[v.status] || { icon: 'ℹ️', text: v.status }
+  const lines = [`<div style="font-size:13px;font-weight:600;color:#374151">${meta.icon} ${escHtml(meta.text)}</div>`]
+  if (v.status === 'issued') {
+    lines.push(`<div style="font-size:12px;color:#374151;margin:6px 0">${t('验证码')}: <code style="background:#f3f4f6;padding:2px 6px;border-radius:4px;font-weight:700">${escHtml(v.code)}</code> · ${t('把它展示在你的外部店铺主页')}</div>`)
+    lines.push(`<input id="dp-sv-url" type="url" placeholder="${t('你的外部店铺链接(http/https)')}" style="width:100%;padding:6px;border:1px solid #d1d5db;border-radius:4px;font-size:12px;margin-bottom:6px">`)
+    lines.push(`<button onclick="window.dpSubmitStoreVerify()" style="padding:6px 12px;background:#2563eb;color:#fff;border:none;border-radius:6px;font-size:12px;font-weight:600;cursor:pointer">${t('提交店铺链接')}</button>`)
+  } else if (v.status === 'verified') {
+    lines.push(`<div style="font-size:12px;color:${r.exempt ? '#166534' : '#6b7280'};margin-top:4px">${r.exempt ? '✅ ' + t('已豁免逐品验证:你的所有商品可直付') : t('已通过,但未获逐品豁免:商品仍需逐个验证')}</div>`)
+  }
+  box.innerHTML = `<div style="display:flex;flex-direction:column;gap:2px">${lines.join('')}</div>`
+}
+
+window.dpRequestStoreVerify = async () => {
+  const r = await POST('/direct-receive/store-verification', {})
+  if (!r || r.error) { if (typeof toast$ === 'function') toast$(window.dpErrorText ? window.dpErrorText(r && r.error_code, r && r.error) : t('操作失败,请重试'), 'error'); return }
+  if (typeof toast$ === 'function') toast$(t('验证码已签发'))
+  window.dpHydrateSellerStoreVerify()
+}
+
+window.dpSubmitStoreVerify = async () => {
+  const el = document.getElementById('dp-sv-url')
+  const url = el && el.value ? el.value.trim() : ''
+  if (!url) { if (typeof toast$ === 'function') toast$(t('请填写你的外部店铺链接'), 'error'); return }
+  const r = await PUT('/direct-receive/store-verification', { external_url: url })
+  if (!r || r.error) { if (typeof toast$ === 'function') toast$(window.dpErrorText ? window.dpErrorText(r && r.error_code, r && r.error) : t('操作失败,请重试'), 'error'); return }
+  if (typeof toast$ === 'function') toast$(t('已提交,等待管理员核验'))
+  window.dpHydrateSellerStoreVerify()
+}
+
+// ══════ ADMIN 审核队列 ══════
+window.renderAdminStoreVerifications = async function (app) {
+  if (!state.user) { renderLogin(); return }
+  if (!isAdmin()) { app.innerHTML = shell(`<div class="alert alert-info">${t('仅限管理员')}</div>`, 'admin'); return }
+  app.innerHTML = shell(loading$(), 'admin')
+  const data = await GET('/admin/direct-receive/store-verifications?status=submitted')
+  if (!data || data.error) { app.innerHTML = shell(alert$('error', (data && data.error) || t('加载失败')), 'admin'); return }
+  const rows = data.verifications || []
+  const list = rows.length ? rows.map(v => `
+    <div class="card" style="margin-bottom:10px">
+      <div style="font-size:11px;color:#9ca3af">${escHtml(v.user_id)} · ${fmtTime(v.created_at)}</div>
+      <div style="font-size:13px;margin-top:6px">${t('验证码')}: <code style="background:#f3f4f6;padding:2px 6px;border-radius:4px;font-weight:700">${escHtml(v.code)}</code>${v.platform ? ` · ${escHtml(v.platform)}` : ''}</div>
+      <div style="font-size:12px;margin-top:4px">${t('店铺链接')}: ${v.external_url ? `<a href="${encodeURI(v.external_url)}" target="_blank" rel="noopener noreferrer nofollow" style="color:#2563eb;text-decoration:underline;word-break:break-all">${escHtml(v.external_url)}</a>` : '—'}</div>
+      <div style="font-size:11px;color:#9ca3af;margin-top:4px">${t('请手动打开链接,确认店铺主页展示了上面的验证码,再决定通过/拒绝。')}</div>
+      <label style="display:flex;align-items:center;gap:6px;font-size:12px;color:#374151;margin-top:8px"><input type="checkbox" id="sv-exempt-${v.id}"> ${t('免逐品验证(通过后该卖家所有商品可直付)')}</label>
+      <div style="display:flex;gap:6px;margin-top:8px">
+        <button class="btn btn-primary btn-sm" style="font-size:12px" onclick="window.doReviewStoreVerify('${v.id}','verified')">✓ ${t('通过(真人 Passkey)')}</button>
+        <button class="btn btn-sm" style="font-size:12px;background:#dc2626;border-color:#dc2626;color:#fff" onclick="window.doReviewStoreVerify('${v.id}','rejected')">✗ ${t('拒绝(真人 Passkey)')}</button>
+      </div>
+    </div>`).join('') : `<div class="empty"><div class="empty-icon">📥</div><div class="empty-text">${t('暂无待核验店铺')}</div></div>`
+  app.innerHTML = shell(`
+    <h1 class="page-title">🏬 ${t('店铺认证审核')}</h1>
+    <div style="margin-bottom:12px"><button class="btn btn-outline btn-sm" style="width:auto" onclick="navigate('#admin')">${t('返回概览')}</button></div>
+    <div style="font-size:12px;color:#6b7280;line-height:1.6;margin-bottom:10px">${t('打开卖家提交的店铺链接,确认店铺页展示了验证码再通过。勾选“免逐品验证”=该卖家所有商品免逐个验证即可直付(请仅对可信商户勾选)。通过/拒绝均需真人 Passkey。')}</div>
+    ${list}
+  `, 'admin')
+}
+
+// purpose_data 绑 verification_id + decision + per_product_exempt(改任一项一律拒)。
+window.doReviewStoreVerify = async function (id, decision) {
+  const exempt = decision === 'verified' && !!(document.getElementById('sv-exempt-' + id) || {}).checked
+  const body = { verification_id: id, decision, per_product_exempt: exempt }
+  const token = await requestPasskeyGate('direct_pay_store_verify', body)
+  if (!token) { if (typeof toast$ === 'function') toast$(t('需要真人 Passkey 确认'), 'error'); return }
+  const r = await POST(`/admin/direct-receive/store-verifications/${id}/review`, { decision, per_product_exempt: exempt, webauthn_token: token })
+  if (!r || r.error) { if (typeof toast$ === 'function') toast$(window.dpErrorText ? window.dpErrorText(r && r.error_code, r && r.error) : t('操作失败,请重试'), 'error'); return }
+  if (typeof toast$ === 'function') toast$(decision === 'verified' ? (r.per_product_exempt ? t('店铺已通过,已豁免逐品验证') : t('店铺已通过')) : t('店铺申请已拒绝'))
+  window.renderAdminStoreVerifications(document.getElementById('app'))
+}