@seasonkoh/webaz 0.1.28 → 0.1.30

package/dist/pwa/routes/direct-receive-accounts.js

@@ -0,0 +1,155 @@
+import { listSellerAccounts, getAccount, addAccount, updateAccount, deactivateAccount, listSellerAccountOptions } from '../../direct-receive-accounts.js';
+import { storeQrImage, getQrImageForOwner, appendAccountEvent } from '../../direct-receive-account-qr.js';
+import { requireDirectPayHumanPasskey } from '../direct-pay-guards.js';
+import { dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam(route 层读走 async 口)
+const GATE_PURPOSE = 'direct_receive_account_manage';
+export function registerDirectReceiveAccountsRoutes(app, deps) {
+    const { db, auth, generateId, consumeGateToken } = deps;
+    /** 登录 + seller 角色。返回 user 或 null(已写响应)。 */
+    function requireSeller(req, res) {
+        const user = auth(req, res);
+        if (!user)
+            return null;
+        if (user.role !== 'seller') {
+            res.status(403).json({ error: '仅卖家可管理直付收款账号', error_code: 'SELLER_ONLY' });
+            return null;
+        }
+        return user;
+    }
+    /** 现场真人 Passkey 门(写操作)。action(+可选 account_id)绑 purpose_data。返回 true=通过(否则已写 403)。 */
+    function passkeyOk(req, res, userId, action, accountId) {
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId, webauthnToken: req.body?.webauthn_token,
+            purpose: GATE_PURPOSE,
+            validate: (data) => {
+                const d = data;
+                if (!d || d.action !== action)
+                    return false;
+                return accountId ? d.account_id === accountId : true;
+            },
+        });
+        if (!gate.ok) {
+            res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+            return false;
+        }
+        return true;
+    }
+    /** owner-scoped 取账号;不存在/非本人 → null + 404(不枚举)。 */
+    function ownedAccount(res, id, sellerId) {
+        const acc = getAccount(db, id);
+        if (!acc || acc.seller_id !== sellerId) {
+            res.status(404).json({ error: '账号不存在', error_code: 'ACCOUNT_NOT_FOUND' });
+            return null;
+        }
+        return acc;
+    }
+    // ── list（本人;不返回 raw QR,只含 qr_image_ref)──
+    app.get('/api/direct-receive/accounts', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        res.json({ accounts: listSellerAccounts(db, user.id, { includeInactive: true }) });
+    });
+    // ── buyer-facing:某商品卖家的【可选收款账号】(结算前选"怎么付")。任意登录用户可读;字面路径,不与 /accounts/:id 冲突。
+    //   ⚠️ 只下发元数据 method/currency/label —— instruction 原文与 QR 受披露门保护,D1/D2 ack 后才随订单快照给买家。
+    app.get('/api/direct-receive/selectable-accounts', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const productId = String(req.query.product_id || '');
+        if (!productId)
+            return void res.status(400).json({ error: '缺少 product_id', error_code: 'PRODUCT_ID_REQUIRED' });
+        const product = await dbOne('SELECT seller_id, status FROM products WHERE id = ?', [productId]);
+        if (!product || product.status === 'deleted')
+            return void res.status(404).json({ error: '商品不存在', error_code: 'PRODUCT_NOT_FOUND' });
+        res.json({ options: listSellerAccountOptions(db, product.seller_id) });
+    });
+    // ── add(Passkey)──
+    app.post('/api/direct-receive/accounts', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        if (!passkeyOk(req, res, user.id, 'add'))
+            return;
+        const b = req.body || {};
+        const out = db.transaction(() => {
+            const r = addAccount(db, user.id, { method: b.method, currency: b.currency, instruction: b.instruction, label: b.label }, generateId);
+            if (r.ok)
+                appendAccountEvent(db, { accountId: r.account.id, sellerId: user.id, eventType: 'account_added' }, generateId);
+            return r;
+        })();
+        if (!out.ok)
+            return void res.status(400).json({ error: out.reason, error_code: 'ACCOUNT_INPUT_INVALID' });
+        res.json({ ok: true, account: out.account });
+    });
+    // ── update(Passkey + owner)──
+    app.put('/api/direct-receive/accounts/:id', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        const id = String(req.params.id);
+        if (!ownedAccount(res, id, user.id))
+            return;
+        if (!passkeyOk(req, res, user.id, 'update', id))
+            return;
+        const b = req.body || {};
+        const out = db.transaction(() => {
+            const r = updateAccount(db, id, user.id, { method: b.method, currency: b.currency, instruction: b.instruction, label: b.label });
+            if (r.ok && r.changed)
+                appendAccountEvent(db, { accountId: id, sellerId: user.id, eventType: 'account_updated' }, generateId);
+            return r;
+        })();
+        if (!out.ok)
+            return void res.status(400).json({ error: out.reason, error_code: 'ACCOUNT_INPUT_INVALID' });
+        res.json({ ok: true, changed: out.changed });
+    });
+    // ── deactivate(Passkey + owner)──
+    app.delete('/api/direct-receive/accounts/:id', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        const id = String(req.params.id);
+        if (!ownedAccount(res, id, user.id))
+            return;
+        if (!passkeyOk(req, res, user.id, 'deactivate', id))
+            return;
+        let changed = false;
+        db.transaction(() => {
+            changed = deactivateAccount(db, id, user.id);
+            if (changed)
+                appendAccountEvent(db, { accountId: id, sellerId: user.id, eventType: 'account_deactivated' }, generateId);
+        })();
+        res.json({ ok: true, changed });
+    });
+    // ── upload / replace QR(Passkey + owner;immutable content-addressed store)──
+    app.put('/api/direct-receive/accounts/:id/qr', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        const id = String(req.params.id);
+        if (!ownedAccount(res, id, user.id))
+            return;
+        if (!passkeyOk(req, res, user.id, 'qr', id))
+            return;
+        const r = storeQrImage(db, { accountId: id, sellerId: user.id, dataUri: req.body?.qr_data_uri }, generateId);
+        if (!r.ok)
+            return void res.status(400).json({ error: r.reason, error_code: 'QR_INVALID' });
+        res.json({ ok: true, qr_image_ref: r.ref });
+    });
+    // ── QR preview(owner-only read;硬化转发;不存在/非本人 → 404)──
+    app.get('/api/direct-receive/accounts/:id/qr', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        const acc = getAccount(db, String(req.params.id));
+        if (!acc || acc.seller_id !== user.id || !acc.qr_image_ref)
+            return void res.status(404).end();
+        const img = getQrImageForOwner(db, acc.qr_image_ref, user.id);
+        if (!img)
+            return void res.status(404).end();
+        res.setHeader('Content-Type', img.mime); // server-set from whitelist, never echoed from client
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('Cache-Control', 'private, no-store'); // private seller data — not the public cache thumbnails use
+        res.send(img.buf);
+    });
+}

package/dist/pwa/routes/direct-receive-payment-instructions.js

@@ -0,0 +1,45 @@
+import { getActivePaymentInstruction, setActivePaymentInstruction, deactivatePaymentInstruction, MAX_INSTRUCTION_LEN, MAX_LABEL_LEN, } from '../../direct-receive-payment-instruction.js';
+export function registerDirectReceivePaymentInstructionRoutes(app, deps) {
+    const { db, auth, generateId } = deps;
+    /** 登录 + seller 角色门。返回 user 或 null(已写错误响应)。 */
+    function requireSeller(req, res) {
+        const user = auth(req, res);
+        if (!user)
+            return null;
+        if (user.role !== 'seller') {
+            res.status(403).json({ error: '仅卖家可设置收款说明', error_code: 'SELLER_ONLY' });
+            return null;
+        }
+        return user;
+    }
+    // GET — 卖家本人当前 active 收款说明;无则 instruction:null(200,显式空状态,便于 UI 渲染“尚未设置”)。
+    app.get('/api/direct-receive/payment-instruction', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        return void res.json({ instruction: getActivePaymentInstruction(db, user.id) });
+    });
+    // PUT — 设置/替换卖家当前 active 收款说明。instruction 必填、trim、长度上限;label 可选、trim、长度上限。
+    app.put('/api/direct-receive/payment-instruction', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        const instruction = typeof req.body?.instruction === 'string' ? req.body.instruction.trim() : '';
+        if (!instruction)
+            return void res.status(400).json({ error: '收款说明不能为空', error_code: 'INSTRUCTION_REQUIRED' });
+        if (instruction.length > MAX_INSTRUCTION_LEN)
+            return void res.status(400).json({ error: `收款说明过长(上限 ${MAX_INSTRUCTION_LEN} 字符)`, error_code: 'INSTRUCTION_TOO_LONG' });
+        const rawLabel = typeof req.body?.label === 'string' ? req.body.label.trim() : '';
+        if (rawLabel.length > MAX_LABEL_LEN)
+            return void res.status(400).json({ error: `标签过长(上限 ${MAX_LABEL_LEN} 字符)`, error_code: 'LABEL_TOO_LONG' });
+        const saved = setActivePaymentInstruction(db, user.id, { instruction, label: rawLabel || null }, generateId);
+        return void res.json({ ok: true, instruction: saved });
+    });
+    // DELETE — 停用卖家当前 active 收款说明(软停用,留历史为 inactive)。停用后 create route fail-closed。
+    app.delete('/api/direct-receive/payment-instruction', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        return void res.json({ ok: true, deactivated: deactivatePaymentInstruction(db, user.id) });
+    });
+}

package/dist/pwa/routes/disputes-read.js

@@ -1,6 +1,6 @@
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerDisputesReadRoutes(app, deps) {
-    const { db, auth, errorRes, getOpenDisputes, getDisputeDetails, getEvidenceRequests, listEvidenceFiles, isEligibleArbitrator } = deps;
+    const { db, auth, errorRes, getOpenDisputes, getDisputeDetails, getEvidenceRequests, listEvidenceFiles, isEligibleArbitrator, isArbitrationAdmin } = deps;
     // 仲裁员：查看所有开放争议
     app.get('/api/disputes', async (req, res) => {
         const user = auth(req, res);
@@ -19,8 +19,8 @@ export function registerDisputesReadRoutes(app, deps) {
         const dispute = await dbOne('SELECT id, order_id, reason, initiator_id, defendant_id FROM disputes WHERE id = ?', [req.params.id]);
         if (!dispute)
             return void res.status(404).json({ error: '争议不存在' });
-        const role = user.role;
-        if (dispute.initiator_id !== user.id && dispute.defendant_id !== user.id && role !== 'arbitrator') {
+        // PR-E fix:同详情/parties —— party 或 active whitelist 仲裁员;不再用 role === 'arbitrator'。
+        if (dispute.initiator_id !== user.id && dispute.defendant_id !== user.id && !isEligibleArbitrator(user.id).ok) {
             return void res.status(403).json({ error: '无权查看' });
         }
         const order = await dbOne('SELECT product_id FROM orders WHERE id = ?', [dispute.order_id]);
@@ -90,12 +90,16 @@ export function registerDisputesReadRoutes(app, deps) {
         const dispute = await getDisputeDetails(db, req.params.id);
         if (!dispute)
             return void res.status(404).json({ error: '争议不存在' });
-        const role = user.role;
-        // 允许：发起方、被告方、物流方、仲裁员
+        // PR-E:允许 发起方 / 被告方 / 物流方 / active whitelist 仲裁员。不再用 role === 'arbitrator'(旧旁路 →
+        //   suspended/revoked/role-only 可越权读、whitelist-only 买家被错误挡)。授权源统一为 isEligibleArbitrator。
         const orderForAuth = await dbOne('SELECT logistics_id FROM orders WHERE id = ?', [dispute.order_id]);
         const isLogisticsParty = orderForAuth?.logistics_id === user.id;
+        // 当事方 / active 白名单仲裁员 / arbitration-admin(争议查看 —— 只读监督)。admin 门用 isArbitrationAdmin(user)
+        //   而非 user.role==='admin':与后台列表 /admin/disputes(requireArbitrationAdmin)【同一】授权模型,否则会错放
+        //   (role='admin' 但无 arbitration 权限的 admin 绕过列表边界直读详情)/ 错挡(roles=["buyer","admin"] 的 admin 进不去)。
+        //   裁定/驳回等【动作】仍在 disputes-write 由 isEligibleArbitrator + 指派 + COI 门守,admin 只看不能裁。
         if (dispute.initiator_id !== user.id && dispute.defendant_id !== user.id
-            && !isLogisticsParty && role !== 'arbitrator') {
+            && !isLogisticsParty && !isEligibleArbitrator(user.id).ok && !isArbitrationAdmin(user)) {
             return void res.status(403).json({ error: '无权查看此争议' });
         }
         // 原告证据 — 从状态机历史中取 disputed 转移时附带的
@@ -308,8 +312,13 @@ export function registerDisputesReadRoutes(app, deps) {
             });
         }
         events.sort((a, b) => String(a.ts).localeCompare(String(b.ts)));
+        // 仲裁员【驳回仲裁,退回协商】可达性(与 dismissDisputeToNegotiation / pq_withdraw 同谓词):direct_p2p + 最近一次进入
+        //   disputed 是 from payment_query + 未裁定。前端据此才在裁定面板显示"驳回仲裁"选项;真正拦截仍在路由/域函数。
+        const lastDispFrom = await dbOne("SELECT from_status FROM order_state_history WHERE order_id = ? AND to_status = 'disputed' ORDER BY created_at DESC, rowid DESC LIMIT 1", [dispute.order_id]);
+        const canDismissToNegotiation = dispute.payment_rail === 'direct_p2p' && lastDispFrom?.from_status === 'payment_query' && (dispute.status === 'open' || dispute.status === 'in_review');
         res.json({
             ...dispute,
+            can_dismiss_to_negotiation: canDismissToNegotiation,
             plaintiff_evidence: plaintiffEvidence,
             defendant_evidence: defendantEvidence,
             party_evidence: partyEvidence,
@@ -344,6 +353,11 @@ export function registerDisputesReadRoutes(app, deps) {
         if (!dispute)
             return void res.status(404).json({ error: '争议不存在' });
         const order = await dbOne('SELECT buyer_id, seller_id, logistics_id FROM orders WHERE id = ?', [dispute.order_id]);
+        // PR-E:同详情权限门 —— 仅 涉案方 或 active whitelist 仲裁员可读涉案方名单(此前任意登录用户可读=泄露)。
+        const isParty = [order?.buyer_id, order?.seller_id, order?.logistics_id, dispute.initiator_id, dispute.defendant_id].filter(Boolean).includes(user.id);
+        if (!isParty && !isEligibleArbitrator(user.id).ok) {
+            return void res.status(403).json({ error: '无权查看涉案方' });
+        }
         const partyIds = [dispute.initiator_id, dispute.defendant_id, order?.logistics_id].filter(Boolean);
         const uniqueIds = [...new Set(partyIds)];
         const parties = (await Promise.all(uniqueIds.map(id => dbOne('SELECT id, name, role FROM users WHERE id = ?', [id])))).filter(Boolean);

package/dist/pwa/routes/disputes-write.js

@@ -7,8 +7,33 @@ import { applyWalletDelta } from '../../ledger.js';
 // RFC-016 Phase 1 — 纯只读端点/校验读/SNF 分发读/标记写 → async seam;arbitrate 仲裁核心(原子领取 +
 //   2 settlement db.transaction + reputation/strike/publish)与 tx 内 appendAuditLog 保持同步(Phase 3 迁 pg)。
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js';
+import { arbitratorHasConflict } from '../arbitrator-lifecycle.js'; // PR-B COI 硬门
+import { dismissDisputeToNegotiation } from '../../layer3-trust/L3-1-dispute-engine/dispute-engine.js'; // 仲裁员驳回仲裁,退回协商(非胜负裁决)
 export function registerDisputesWriteRoutes(app, deps) {
-    const { db, auth, generateId, detectFraud, errorRes, isEligibleArbitrator, requireHumanPresence, getDisputeDetails, respondToDispute, arbitrateDispute, addPartyEvidence, requestEvidence, markEvidenceExpiry, uploadEvidence, EVIDENCE_MAX_BYTES, EVIDENCE_ALLOWED_MIME, appendOrderEvent, FUND_BASE_RATE, settleCommission, depositToFund, calculatePv, recordDisputeReputation, issueAgentStrike, publishDisputeCase, logAdminAction, snfSend, getProtocolParam } = deps;
+    const { db, auth, generateId, detectFraud, errorRes, isEligibleArbitrator, requireHumanPresence, getDisputeDetails, respondToDispute, arbitrateDispute, addPartyEvidence, requestEvidence, markEvidenceExpiry, uploadEvidence, EVIDENCE_MAX_BYTES, EVIDENCE_ALLOWED_MIME, appendOrderEvent, FUND_BASE_RATE, settleCommission, depositToFund, calculatePv, recordDisputeReputation, issueAgentStrike, publishDisputeCase, logAdminAction, snfSend, getProtocolParam, notifyTransition } = deps;
+    // PR-E:案件级仲裁操作(裁定 / 补证)统一的【原子领取或校验指派】。assigned 为空 → CAS 首位领取;
+    //   非空且不含 caller → NOT_ASSIGNED_ARBITRATOR。arbitrate 与 request-evidence 共用,防"任意 active 仲裁员操作任意案"。
+    const claimOrCheckAssignment = (disputeId, userId) => {
+        const row = db.prepare('SELECT assigned_arbitrators FROM disputes WHERE id = ?').get(disputeId);
+        let assigned = [];
+        try {
+            assigned = JSON.parse(row?.assigned_arbitrators || '[]');
+        }
+        catch { }
+        if (assigned.length === 0) {
+            const claim = db.prepare(`UPDATE disputes SET assigned_arbitrators = ? WHERE id = ? AND (assigned_arbitrators IS NULL OR assigned_arbitrators = '[]')`).run(JSON.stringify([userId]), disputeId);
+            if (claim.changes === 0) {
+                const fresh = db.prepare('SELECT assigned_arbitrators FROM disputes WHERE id = ?').get(disputeId);
+                try {
+                    assigned = JSON.parse(fresh?.assigned_arbitrators || '[]');
+                }
+                catch { }
+            }
+            else
+                assigned = [userId];
+        }
+        return assigned.includes(userId) ? { ok: true } : { ok: false, error_code: 'NOT_ASSIGNED_ARBITRATOR' };
+    };
     // ── RFC-007 stage 5：客观拒单【临时判责】的仲裁翻案 ─────────────────────────────
     //   卖家 contest_decline 后,订单 = fault_seller + decline_objective_pending=1 + decline_contested=1(未结算)。
     //   仲裁员(真实人工 + WebAuthn)裁决:uphold → declined_nofault(免责全退+退质押);reject → 违约结算。
@@ -117,7 +142,7 @@ export function registerDisputesWriteRoutes(app, deps) {
         const { ruling, reason, refund_amount, liable_party_id, liability_parties } = req.body;
         if (!ruling || !reason)
             return void res.json({ error: '请提供裁定结果（ruling）和理由（reason）' });
-        const validRulings = ['refund_buyer', 'release_seller', 'partial_refund', 'liability_split'];
+        const validRulings = ['refund_buyer', 'release_seller', 'partial_refund', 'liability_split', 'dismiss_to_negotiation'];
         if (!validRulings.includes(ruling)) {
             return void res.json({ error: `ruling 必须是 ${validRulings.join(' / ')} 之一` });
         }
@@ -134,32 +159,52 @@ export function registerDisputesWriteRoutes(app, deps) {
         const dispute = await getDisputeDetails(db, req.params.id);
         if (!dispute)
             return void res.status(404).json({ error: '争议不存在' });
-        // P0: 防"任意仲裁员裁决任意争议"
-        // 若 assigned_arbitrators 为空 → 首位调用者原子领取
-        const arbRow = db.prepare(`SELECT assigned_arbitrators FROM disputes WHERE id = ?`).get(req.params.id);
-        let assignedArbitrators = [];
-        try {
-            assignedArbitrators = JSON.parse(arbRow?.assigned_arbitrators || '[]');
-        }
-        catch { }
-        if (assignedArbitrators.length === 0) {
-            const claimRes = db.prepare(`UPDATE disputes SET assigned_arbitrators = ? WHERE id = ? AND (assigned_arbitrators IS NULL OR assigned_arbitrators = '[]')`)
-                .run(JSON.stringify([user.id]), req.params.id);
-            if (claimRes.changes === 0) {
-                const fresh = db.prepare(`SELECT assigned_arbitrators FROM disputes WHERE id = ?`).get(req.params.id);
-                try {
-                    assignedArbitrators = JSON.parse(fresh?.assigned_arbitrators || '[]');
-                }
-                catch { }
+        // PR-B COI 硬门:当事方(买家/卖家/物流/发起人/被诉人)不得仲裁本案。在领取/裁定前拦截。
+        if (arbitratorHasConflict(db, dispute.order_id, dispute.initiator_id ?? null, dispute.defendant_id ?? null, user.id)) {
+            return void res.status(403).json({ error: '你是本案当事方,不可仲裁(利益冲突)', error_code: 'ARBITRATOR_CONFLICT_OF_INTEREST' });
+        }
+        // P0: 防"任意仲裁员裁决任意争议" —— 原子领取或校验指派(与 request-evidence 共用 helper)。
+        const claim = claimOrCheckAssignment(req.params.id, user.id);
+        if (!claim.ok) {
+            return void res.status(403).json({ error: '此争议未分配给你 — 仅指派的仲裁员可裁定', error_code: claim.error_code || 'NOT_ASSIGNED_ARBITRATOR' });
+        }
+        // 仲裁员【驳回仲裁,退回协商】—— 非胜负裁决:不结算/不退款/不收仲裁费/不扣信誉/不动 escrow。仅 direct_p2p 且由 payment_query 升级来的争议;
+        //   域函数硬校验 rail + payment_query-origin + 未裁定,否则 NOT_PAYMENT_QUERY_DISPUTE / ARBITRATION_DISMISS_NOT_ALLOWED。状态回退 + dispute 关闭同一原子事务。
+        if (ruling === 'dismiss_to_negotiation') {
+            let dm;
+            try {
+                dm = db.transaction(() => dismissDisputeToNegotiation(db, req.params.id, reason))();
+            }
+            catch (e) {
+                return void errorRes(res, 500, 'DISMISS_FAILED', e.message);
             }
-            else {
-                assignedArbitrators = [user.id];
+            if (!dm.success) {
+                const st = dm.error_code === 'DISPUTE_NOT_FOUND' ? 404 : (dm.error_code === 'SYS_MISSING' || dm.error_code === 'TRANSITION_FAILED') ? 500 : 409;
+                return void errorRes(res, st, dm.error_code || 'DISMISS_FAILED', dm.error || '驳回仲裁失败');
             }
+            try {
+                appendOrderEvent(db, { orderId: dm.order_id, eventType: 'transition', fromStatus: 'disputed', toStatus: 'payment_query', actorId: user.id, actorRole: 'arbitrator', extra: { action: 'dismiss_to_negotiation', dispute_id: req.params.id, reason, non_custodial: true } });
+            }
+            catch (e) {
+                console.warn('[order-chain] dismiss event:', e.message);
+            }
+            try {
+                markEvidenceExpiry(db, req.params.id);
+            }
+            catch (e) {
+                console.warn('[evidence] mark expiry:', e.message);
+            }
+            try {
+                notifyTransition(db, dm.order_id, 'disputed', 'payment_query');
+            }
+            catch (e) {
+                console.warn('[notify] dismiss:', e.message);
+            }
+            return void res.json({ success: true, status: 'payment_query', dispute_dismissed: true, returned_to_negotiation: true, message: '已驳回仲裁,退回买卖双方协商' });
         }
-        if (!assignedArbitrators.includes(user.id)) {
-            return void res.status(403).json({ error: '此争议未分配给你 — 仅指派的仲裁员可裁定', error_code: 'NOT_ASSIGNED_ARBITRATOR' });
-        }
-        // 协议层：仲裁员签名的 ruling 入订单链
+        // 协议层：仲裁员签名的 ruling 入订单链。direct_p2p 非托管=仅信誉裁决,绝不把请求里的退款/赔付金额写进【签名链/timeline】
+        //   (即便资金层不动钱,签名链会永久留假语义)→ 强制 non_custodial + 金额/责任方全清。
+        const ncRail = dispute.payment_rail === 'direct_p2p';
         try {
             appendOrderEvent(db, {
                 orderId: dispute.order_id,
@@ -172,9 +217,10 @@ export function registerDisputesWriteRoutes(app, deps) {
                     action: 'arbitration_ruling',
                     dispute_id: req.params.id,
                     ruling, reason,
-                    refund_amount: refund_amount ? Number(refund_amount) : null,
-                    liable_party_id: liable_party_id || null,
-                    liability_parties: liability_parties || null,
+                    non_custodial: ncRail || undefined,
+                    refund_amount: ncRail ? null : (refund_amount ? Number(refund_amount) : null),
+                    liable_party_id: ncRail ? null : (liable_party_id || null),
+                    liability_parties: ncRail ? null : (liability_parties || null),
                 },
             });
         }
@@ -191,8 +237,10 @@ export function registerDisputesWriteRoutes(app, deps) {
         catch (e) {
             console.warn('[evidence] mark expiry:', e.message);
         }
+        // 非托管(直付)争议:协议不持货款、不做托管结算 → 【跳过】所有佣金/PV/基金分润钩子(否则会从卖家余额扣不存在的佣金)。
+        const nonCustodial = !!result.non_custodial;
         // release_seller 等同正常完成 → 触发推土机分润 + 原子能
-        if (ruling === 'release_seller') {
+        if (ruling === 'release_seller' && !nonCustodial) {
             try {
                 db.transaction(() => {
                     const order = db.prepare("SELECT * FROM orders WHERE id = ?").get(dispute.order_id);
@@ -233,8 +281,8 @@ export function registerDisputesWriteRoutes(app, deps) {
                 console.error('[dispute commission/pv hook]', e);
             }
         }
-        // Bug-A fix：partial_refund / liability_split 也按 effectiveBase 发 commission/PV/基金池
-        if (ruling === 'partial_refund' || ruling === 'liability_split') {
+        // Bug-A fix：partial_refund / liability_split 也按 effectiveBase 发 commission/PV/基金池(非托管跳过)
+        if ((ruling === 'partial_refund' || ruling === 'liability_split') && !nonCustodial) {
             try {
                 db.transaction(() => {
                     const order = db.prepare("SELECT * FROM orders WHERE id = ?").get(dispute.order_id);
@@ -519,13 +567,23 @@ export function registerDisputesWriteRoutes(app, deps) {
         }
     });
     // 仲裁员：请求某方补证
-    app.post('/api/disputes/:id/request-evidence', (req, res) => {
+    app.post('/api/disputes/:id/request-evidence', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
+        // PR-E:① active whitelist ② COI(当事方不可补证本案,与 arbitrate 同门) ③ 已分配/领取该案(claim-if-empty)④ 涉案方目标(engine)。
         const elig = isEligibleArbitrator(user.id);
         if (!elig.ok)
             return void errorRes(res, 403, 'NOT_ARBITRATOR', elig.reason || '仅限仲裁员');
+        const disp = await getDisputeDetails(db, req.params.id);
+        if (!disp)
+            return void res.status(404).json({ error: '争议不存在' });
+        if (arbitratorHasConflict(db, disp.order_id, disp.initiator_id ?? null, disp.defendant_id ?? null, user.id)) {
+            return void res.status(403).json({ error: '你是本案当事方,不可补证(利益冲突)', error_code: 'ARBITRATOR_CONFLICT_OF_INTEREST' });
+        }
+        const claim = claimOrCheckAssignment(req.params.id, user.id);
+        if (!claim.ok)
+            return void errorRes(res, 403, claim.error_code || 'NOT_ASSIGNED_ARBITRATOR', '此争议未分配给你 — 仅指派的仲裁员可补证');
         const { requested_from_id, evidence_types, description, deadline_hours = 48 } = req.body;
         if (!requested_from_id || !description)
             return void res.json({ error: '请指定被要求方和证据要求说明' });
@@ -538,7 +596,7 @@ export function registerDisputesWriteRoutes(app, deps) {
         }
         const result = requestEvidence(db, req.params.id, user.id, requested_from_id, evidence_types, description, Number(deadline_hours));
         if (!result.success)
-            return void res.json({ error: result.error });
+            return void res.json({ error: result.error, error_code: result.error_code });
         res.json({ success: true, request_id: result.requestId });
     });
     // ─── task #1093 stage 6: arbitrator_pause / resume auto_judge ─────

package/dist/pwa/routes/external-anchors.js

@@ -1,5 +1,6 @@
 import { dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 import { createAnchor, verifyAnchorSignature, revokeAnchor, issueOwnershipToken, submitVerification, getAnchor, listAnchorsByProduct, listAnchorsBySeller, distributeAnchorRewards, ANCHOR_VERIFICATION_FEE_RECOMMENDED, } from '../../layer1-agent/L1-2-external-anchor/anchor-engine.js';
+import { isEligibleArbitrator } from '../arbitrator-lifecycle.js'; // 仲裁能力唯一源=active 白名单(distribute 是动钱动作,不认 legacy role)
 export function registerExternalAnchorsRoutes(app, deps) {
     const { db, auth } = deps;
     app.post('/api/external-anchors', (req, res) => {
@@ -42,12 +43,13 @@ export function registerExternalAnchorsRoutes(app, deps) {
             total_paid_out: verifications.reduce((s, v) => s + Number(v.reward_amount || 0), 0),
         });
     });
-    // 手动 distribute（admin/arbitrator 补救：anchor 已 community 但 fee_paid_out=0）
+    // 手动 distribute（admin/白名单仲裁员 补救：anchor 已 community 但 fee_paid_out=0）——动钱动作,仲裁员认 active
+    //   白名单(isEligibleArbitrator),不认 legacy user.role(否则已 suspend/revoke 但 role 未同步的账号仍可触发放款)。
     app.post('/api/external-anchors/:id/distribute-rewards', (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        if (user.role !== 'admin' && user.role !== 'arbitrator')
+        if (user.role !== 'admin' && !isEligibleArbitrator(db, user.id).ok)
             return void res.status(403).json({ error: '仅管理员/仲裁员可手动分发' });
         const paid = distributeAnchorRewards(db, req.params.id);
         res.json({ ok: true, paid });

package/dist/pwa/routes/fee-prepay-requests.js

@@ -0,0 +1,66 @@
+import { listActivePlatformAccounts } from '../../platform-receive-accounts.js';
+import { createFeePrepayRequest, listSellerRequests, cancelRequest } from '../../direct-pay-fee-prepay-request.js';
+// N3:申请提交 → 通知有审批权的 admin(approve/reject 是 ROOT 门,只通知 root;regional 收到也办不了)。
+import { createNotification } from '../../layer2-business/L2-6-notifications/notification-engine.js';
+import { dbAll } from '../../layer0-foundation/L0-1-database/db.js';
+export function registerFeePrepayRequestRoutes(app, deps) {
+    const { db, auth, generateId } = deps;
+    /** 登录 + seller 角色。返回 user 或 null(已写响应)。 */
+    function requireSeller(req, res) {
+        const user = auth(req, res);
+        if (!user)
+            return null;
+        if (user.role !== 'seller') {
+            res.status(403).json({ error: '仅卖家可申请平台服务费预充值', error_code: 'SELLER_ONLY' });
+            return null;
+        }
+        return user;
+    }
+    // ── 卖家看平台收款方式(active;含 instruction + qr_data_uri —— 平台公开收款明细,据此付款)──
+    app.get('/api/direct-receive/platform-receive-accounts', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        res.json({ accounts: listActivePlatformAccounts(db) });
+    });
+    // ── 提交预充值申请(不 Passkey;凭据必填)──
+    app.post('/api/direct-receive/fee-prepay-request', async (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        const b = req.body || {};
+        const r = createFeePrepayRequest(db, user.id, {
+            amountUnits: Number(b.amount_units), currency: b.currency, platformAccountId: b.platform_account_id,
+            evidenceRef: b.evidence_ref, evidenceNote: b.evidence_note,
+        }, generateId);
+        if (!r.ok)
+            return void res.status(400).json({ error: r.reason, error_code: 'FEE_PREPAY_REQUEST_INVALID' });
+        // N3:通知 root admin 有待审申请(此前提交后无人收到任何未读信号,全靠人肉翻队列)。best-effort 不阻断。
+        try {
+            const roots = await dbAll("SELECT id FROM users WHERE role = 'admin' AND (admin_type = 'root' OR admin_type IS NULL)");
+            const amountUsdc = Number(b.amount_units) / 1_000_000;
+            for (const a of roots) {
+                createNotification(db, a.id, null, 'dp_fee_prepay_requested', '💳 新预充值申请待审', `卖家 ${String(user.name ?? user.id)} 申请平台服务费预充值 ${amountUsdc} USDC,请到 admin 后台核对到账后处理。`, { templateKey: 'dp_fee_prepay_requested', params: { seller: String(user.name ?? user.id), amount: amountUsdc } });
+            }
+        }
+        catch (e) {
+            console.warn('[fee-prepay-request notify]', e.message);
+        }
+        res.json({ ok: true, request: r.request });
+    });
+    // ── 卖家看自己的申请(全状态)──
+    app.get('/api/direct-receive/fee-prepay-requests', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        res.json({ requests: listSellerRequests(db, user.id) });
+    });
+    // ── 卖家撤销自己的 pending 申请 ──
+    app.post('/api/direct-receive/fee-prepay-request/:id/cancel', (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        const changed = cancelRequest(db, String(req.params.id), user.id);
+        res.json({ ok: true, changed });
+    });
+}

package/dist/pwa/routes/fx.js

@@ -0,0 +1,12 @@
+import { getUsdRates, SUPPORTED_CURRENCIES } from '../../fx-rates.js';
+export function registerFxRoutes(app, deps) {
+    const { rateLimitOk } = deps;
+    app.get('/api/fx/rates', async (req, res) => {
+        const ip = req.ip || 'unknown';
+        if (!rateLimitOk(`fx:${ip}`, 60, 60_000))
+            return void res.status(429).json({ error: 'rate-limited' });
+        const snap = await getUsdRates();
+        res.setHeader('Cache-Control', 'public, max-age=300');
+        res.json({ ...snap, currencies: SUPPORTED_CURRENCIES });
+    });
+}