@seasonkoh/webaz 0.1.28 → 0.1.30

package/dist/pwa/routes/governance-onboarding.js

@@ -4,6 +4,8 @@ import { getCasesForRole, getCasesForMaintainer, validateCaseReviews } from '../
 // RFC-016 Phase 1 — 申请/题目/案例/申诉的校验读 + 列表读 + 单语句写 → async seam;
 //   activate/resign/resolve-appeal 的 3 个角色态 CAS db.transaction 保持同步(Phase 3 迁 pg)。
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js';
+import { grantArbitratorTx, suspendArbitrator } from '../arbitrator-lifecycle.js'; // PR-B/PR-C.2:激活桥接 active whitelist 同事务;#249-P2:仲裁员卸任真源=whitelist(suspend 可复用,非终态 revoke)
+import { isActiveWhitelistArbitrator } from '../../layer3-trust/L3-1-dispute-engine/dispute-engine.js';
 // PR #22 review fix P1-2:披露文本版本(server 与 client 同步,变更披露需 bump)
 // client 在 src/pwa/public/app.js 必须用相同 version
 export const GOVERNANCE_APPLY_DISCLOSURE_VERSION = 'v1.0-2026-06-02';
@@ -390,10 +392,14 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
                 return void errorRes(res, 401, 'PASSKEY_INVALID', `maintainer Passkey 验证失败: ${result.reason || '未知'}`);
             }
         }
-        // 5. 事务:conditional UPDATE 防竞态 + INSERT activate row + 加 users.roles
+        // 5. 事务:conditional UPDATE 防竞态 + PR-C.2 仲裁授权 + INSERT activate row + 加 users.roles(仅治理记录,非 eligibility 源)
         // PR #25 self-review fix P1-1:status check 进 transaction(防 2 maintainer 同时激活 → 2 activate row)
         // PR #25 self-review fix P1-2:不存 note 到 appeal_resolution(语义错);maintainer note 由 logAdminAction(detail) 记
+        // PR-C.2:role='arbitrator' 的 grantArbitratorTx 与状态翻转【同事务】—— 保证"governance active ⟺ whitelist active",
+        //   grant 失败(revoked/非人类/无 Passkey)→ 抛 sentinel,整个激活回滚。verifier 角色走其自身白名单,不在此桥。
         const RACE_LOST = 'RACE_LOST_PENDING_TO_ACTIVE';
+        const GRANT_ABORT = 'GRANT_ABORT';
+        let grantErr = null;
         try {
             db.transaction(() => {
                 // 5.1 conditional UPDATE 原 apply row(只在 status='pending_onboarding' 时改 → 防竞态)
@@ -402,6 +408,14 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
                     // 另一 maintainer 已激活 → 抛出 sentinel,整个事务回滚
                     throw new Error(RACE_LOST);
                 }
+                // 5.1b 仲裁授权与状态翻转同事务(唯一 runtime 授权源 = active arbitrator_whitelist)
+                if (role === 'arbitrator') {
+                    const g = grantArbitratorTx(db, { userId: app_.user_id, grantedBy: adminId, note: 'governance onboarding 激活' });
+                    if (!g.ok) {
+                        grantErr = g.error_code || 'GRANT_FAILED';
+                        throw new Error(GRANT_ABORT);
+                    }
+                }
                 // 5.2 INSERT 新 row(append-only audit trail,action='activate')
                 const activateId = generateId('gapp');
                 db.prepare(`
@@ -409,7 +423,10 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
             (id, user_id, role, action, status, passkey_sig, iron_rule_method)
           VALUES (?, ?, ?, 'activate', 'active', ?, 'passkey')
         `).run(activateId, app_.user_id, role, webauthn_token || null);
-                // 5.3 加 role 到 users.roles JSON 数组(去重)
+                // 5.3 加 role 到 users.roles JSON 数组(去重)。
+                //   仲裁员例外:仲裁资格 = active arbitrator_whitelist(5.1b 已同事务 grant,#209/#220),【不是角色】——
+                //   写进 roles 会在角色切换 UI 造出可切换的"仲裁员"假身份(与买卖身份互斥感误导用户,梦想者1号被卡案根源之一)。
+                //   普通人保留 buyer/seller 身份 + 白名单资格,仲裁台入口随 can_arbitrate 出现,买卖能力不受影响。
                 const user = db.prepare("SELECT roles FROM users WHERE id = ?").get(app_.user_id);
                 let roles = [];
                 try {
@@ -418,7 +435,7 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
                 catch {
                     roles = [];
                 }
-                if (!roles.includes(role)) {
+                if (role !== 'arbitrator' && !roles.includes(role)) {
                     roles.push(role);
                     db.prepare("UPDATE users SET roles = ? WHERE id = ?").run(JSON.stringify(roles), app_.user_id);
                 }
@@ -428,6 +445,10 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
             if (e.message === RACE_LOST) {
                 return void errorRes(res, 409, 'ALREADY_ACTIVATED', '该 application 已被其他 maintainer 激活(竞态)');
             }
+            if (e.message === GRANT_ABORT) { // PR-C.2:仲裁授权失败 → 整个激活已回滚
+                logAdminAction(adminId, 'governance_activate', 'user', app_.user_id, { ok: false, role, error_code: grantErr });
+                return void errorRes(res, 409, grantErr || 'GRANT_FAILED', '激活失败:无法授予仲裁员资格(见 error_code),激活已回滚');
+            }
             throw e; // 真实 SQL error → re-throw 给 express error handler
         }
         // 6. admin 审计 log(maintainer note 存 detail JSON,非 governance_applications 字段)
@@ -478,7 +499,10 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
         catch {
             currentRoles = [];
         }
-        if (!currentRoles.includes(role)) {
+        // #249-P2:activate 已不再把 arbitrator 写进 users.roles(资格=白名单)→ 仲裁员的"当前在任"真源
+        //   = active whitelist(或 legacy roles 残留,两者任一即可卸);verifier 真源仍 = users.roles。
+        const wlActiveArb = role === 'arbitrator' && isActiveWhitelistArbitrator(db, userId);
+        if (!currentRoles.includes(role) && !wlActiveArb) {
             return void errorRes(res, 404, 'NOT_ACTIVE', `你当前不是 ${role},无需卸任`);
         }
         // 用于日志显示 + 后续 INSERT 关联(取最新的 active 行;若没有也容许,以 user.roles 为准)
@@ -534,7 +558,8 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
         try {
             resignId = generateId('gapp');
             db.transaction(() => {
-                // 1. 重读 users.roles(进事务后)— 验证 role 仍存在再操作
+                // 1. 重读真源(进事务后)。仲裁员=active whitelist(#249 起 activate 不写 roles;suspend=自愿卸任可经
+                //    admin reinstate 复用,刻意不用终态 revoke);legacy roles 里的 'arbitrator' 存量一并摘除。verifier=users.roles。
                 const u = db.prepare("SELECT roles FROM users WHERE id = ?").get(userId);
                 let roles = [];
                 try {
@@ -543,10 +568,23 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
                 catch {
                     roles = [];
                 }
-                if (!roles.includes(role))
+                const legacyInRoles = roles.includes(role);
+                if (role === 'arbitrator') {
+                    const wlNow = isActiveWhitelistArbitrator(db, userId);
+                    if (!wlNow && !legacyInRoles)
+                        throw new Error(RACE_LOST);
+                    if (wlNow) {
+                        const m = suspendArbitrator(db, { userId, note: '主动卸任(governance resign)' });
+                        if (!m.ok)
+                            throw new Error(RACE_LOST);
+                    }
+                }
+                else if (!legacyInRoles)
                     throw new Error(RACE_LOST);
-                roles = roles.filter(r => r !== role);
-                db.prepare("UPDATE users SET roles = ? WHERE id = ?").run(JSON.stringify(roles), userId);
+                if (legacyInRoles) {
+                    roles = roles.filter(r => r !== role);
+                    db.prepare("UPDATE users SET roles = ? WHERE id = ?").run(JSON.stringify(roles), userId);
+                }
                 // 2. 把所有该 user+role 的 active 行 → inactive(可能有 apply + activate 两行)
                 db.prepare("UPDATE governance_applications SET status = 'inactive' WHERE user_id = ? AND role = ? AND status = 'active'").run(userId, role);
                 // 3. INSERT resign 行(append-only audit)

package/dist/pwa/routes/leaderboard.js

@@ -1,4 +1,42 @@
 import { dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+// ── Anonymous-projection allowlist (security: this is a NO-AUTH public endpoint) ──────────────
+// Each board's anon payload carries ONLY what the public value proposition needs: a public
+// identity for linking (handle/name) + the reputation/content signal. It must NEVER carry
+// internal canonical user ids (usr_xxx — those are the keyed inputs the #1043 cross-user-read
+// cap rate-limits; emitting them here would be a free enumeration seed-list), account-structure
+// metadata (keys_count), or behavior-fingerprint integers (calls_30d). ALLOWLIST, not denylist,
+// so a future SELECT column can't silently ride to the public surface. Canonical user id (usr_xxx)
+// is the keyed input the #1043 cross-user-read cap rate-limits, so it is DROPPED from every user
+// board (agents/buyers/sellers/arbitrators/verifiers/creators). All user cards navigate via the
+// public handle — #shop/:identifier and #u/:user_id both resolve a handle (users-public.ts
+// resolveUserId: usr_xxx / permanent_code / @handle). Product boards keep `id` — a public PRODUCT
+// id, not a user id.
+export const BOARD_ALLOWLIST = {
+    products: ['id', 'title', 'price', 'total_likes', 'completion_count', 'seller_handle', 'seller_name', 'recommend_count', 'rank_score'],
+    value_products: ['id', 'title', 'price', 'category', 'value_badge_rank', 'value_badge_pct', 'value_badge_at', 'completion_count', 'total_likes', 'seller_handle', 'seller_name'],
+    creators: ['handle', 'name', 'region', 'products_shared', 'shareable_count', 'total_likes', 'total_clicks'], // no id — card navs #u/${handle} (#u/ resolves handle)
+    buyers: ['handle', 'name', 'region', 'orders_count'],
+    sellers: ['handle', 'name', 'region', 'orders_count', 'avg_rating', 'rating_count'], // no id — card navs via handle (#shop accepts it)
+    agents: ['handle', 'name', 'trust_score', 'level', 'activity'], // NO id / keys_count / calls_30d
+    arbitrators: ['handle', 'name', 'cases_count', 'total_yes', 'total_no', 'fairness_score'],
+    verifiers: ['handle', 'name', 'tasks_done', 'tasks_correct', 'tasks_wrong', 'accuracy', 'tier'],
+};
+// calls_30d (behavior fingerprint) → coarse activity bucket (keeps "busy vs dormant" product signal
+// without leaking a raw per-account integer or the all-zero "network looks dead" aggregate).
+function activityBucket(calls) {
+    return calls >= 20 ? 'active' : calls >= 1 ? 'quiet' : 'dormant';
+}
+function projectBoard(kind, rows) {
+    const allow = BOARD_ALLOWLIST[kind] || [];
+    return rows.map(r => {
+        const src = kind === 'agents' ? { ...r, activity: activityBucket(Number(r.calls_30d) || 0) } : r;
+        const out = {};
+        for (const k of allow)
+            if (k in src)
+                out[k] = src[k];
+        return out;
+    });
+}
 export function registerLeaderboardRoutes(app, deps) {
     // db 已走 RFC-016 异步 seam(dbAll),不再直接用 deps.db
     const { internalAuditorId, rateLimitOk } = deps;
@@ -27,7 +65,7 @@ export function registerLeaderboardRoutes(app, deps) {
         ORDER BY rank_score DESC, p.id DESC
         LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'creators') {
             // 创作者维度：聚合自己 shareables 的总点赞 + 关联商品总数
@@ -43,7 +81,7 @@ export function registerLeaderboardRoutes(app, deps) {
         ORDER BY total_likes DESC, shareable_count DESC, u.id DESC
         LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         // B-2: 用户排行 — top buyers / sellers / verifiers
         // 2026-05-23 隐私第一原理：移除 gmv 字段（运营状态私密，防过早 fork）
@@ -55,7 +93,7 @@ export function registerLeaderboardRoutes(app, deps) {
         WHERE o.status = 'completed' AND u.id NOT IN ('sys_protocol', ?)
         GROUP BY u.id ORDER BY orders_count DESC, u.id DESC LIMIT ?
       `, [internalAuditorId, limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'sellers') {
             // 排序改为 评分主导（avg_rating × log(1+rating_count)），不再按 GMV
@@ -70,7 +108,7 @@ export function registerLeaderboardRoutes(app, deps) {
         ORDER BY (avg_rating * (1.0 + log(1.0 + rating_count))) DESC, rating_count DESC, orders_count DESC
         LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'value_products') {
             // 2026-05-23 S5：极致性价比榜 — 按 value_badge=1 + 同类目 rank 排
@@ -85,7 +123,7 @@ export function registerLeaderboardRoutes(app, deps) {
         WHERE p.value_badge = 1 AND p.status = 'active' AND p.stock > 0
         ORDER BY p.value_badge_rank ASC, p.value_badge_pct DESC LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'agents') {
             // 2026-05-22 AG1：Agent 评测竞赛榜单
@@ -101,12 +139,12 @@ export function registerLeaderboardRoutes(app, deps) {
             AND acl.created_at > datetime('now', '-30 days')) as calls_30d
         FROM agent_reputation ar
         JOIN users u ON u.id = ar.user_id
-        WHERE u.id != 'sys_protocol'
+        WHERE u.id != 'sys_protocol' AND u.role != 'admin'
         GROUP BY u.id
         HAVING calls_30d > 0 OR trust_score > 0
         ORDER BY trust_score DESC, calls_30d DESC LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'arbitrators') {
             // 2026-05-22 A3：仲裁员声誉排行
@@ -132,7 +170,7 @@ export function registerLeaderboardRoutes(app, deps) {
         GROUP BY u.id
         ORDER BY cases_count DESC, u.id DESC LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         if (kind === 'verifiers') {
             // 2026-05-22 V1：移除 tasks_done >= 5 门槛 — 小协议早期阶段会卡死榜单
@@ -152,7 +190,7 @@ export function registerLeaderboardRoutes(app, deps) {
         WHERE vs.tasks_done >= 1
         ORDER BY vs.tasks_done DESC, u.id DESC LIMIT ?
       `, [limit]);
-            return void res.json({ kind, items: rows });
+            return void res.json({ kind, items: projectBoard(kind, rows) });
         }
         return void res.json({ error: 'kind 必须是 products / creators / buyers / sellers / verifiers / arbitrators / agents / value_products' });
     });

package/dist/pwa/routes/listings.js

@@ -265,8 +265,8 @@ export function registerListingsRoutes(app, deps) {
           id, seller_id, title, description, price, stock, status, images,
           ship_regions, handling_hours, commission_rate, category_id, stake_amount,
           listing_id, fulfillment_type, eta_hours, freshness_ts,
-          is_clearance, clearance_until, cold_start_remaining, listing_stake_locked
-        ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,datetime('now'),?,?,?,?)
+          is_clearance, clearance_until, cold_start_remaining, listing_stake_locked, currency
+        ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,datetime('now'),?,?,?,?,'WAZ')
       `).run(id, user.id, listing.title, (body.description ? String(body.description) : listing.description || ''), priceNum, stockNum, 'active', imagesJson, shipRegions, 24, 0.10, 'cat_default', 0, req.params.id, fulfillmentType, body.eta_hours != null ? Number(body.eta_hours) : null, body.is_clearance ? 1 : 0, body.clearance_until ? String(body.clearance_until) : null, catCfg.cold_start, stakeRequired);
             db.prepare(`UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ?`).run(stakeRequired, stakeRequired, user.id);
             db.prepare(`UPDATE listings SET total_offers = total_offers + 1, updated_at = datetime('now') WHERE id = ?`).run(req.params.id);

package/dist/pwa/routes/logistics.js

@@ -1,7 +1,8 @@
 import { dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { projectDirectPayTargetForViewer } from '../direct-pay-order-redaction.js'; // 披露门:按查看者投影(物流=第三方 → 剥离收款目标)
 export function registerLogisticsRoutes(app, deps) {
-    // db 已走 RFC-016 异步 seam(dbAll),不再直接用 deps.db
-    const { auth } = deps;
+    // 查询走 RFC-016 异步 seam(dbAll);db 仅传给共享投影器(其买家分支查 ack,本路由查看者恒第三方)
+    const { auth, db } = deps;
     app.get('/api/logistics/companies', async (_req, res) => {
         const companies = await dbAll(`SELECT id, name FROM users WHERE role = 'logistics' ORDER BY name ASC`);
         res.json(companies);
@@ -32,6 +33,9 @@ export function registerLogisticsRoutes(app, deps) {
       WHERE o.logistics_id = ? AND o.status IN ('shipped','picked_up','in_transit')
       ORDER BY o.created_at ASC LIMIT 20
     `, [user.id]);
+        // 披露门:物流是非买家第三方,无条件删除 direct_p2p 收款目标(instruction 快照 + 账号快照);物流只需商品/状态/地址。
+        for (const o of [...available, ...mine])
+            projectDirectPayTargetForViewer(db, o, user.id);
         res.json({ available, mine });
     });
 }

package/dist/pwa/routes/manifests.js

@@ -2,6 +2,9 @@ import crypto from 'crypto';
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 const MANIFEST_DAILY_LIMIT = 20;
 const THUMB_MAX_BYTES = 12000; // ~12KB base64 ≈ 9KB 原始图
+// Whitelist for stored/served thumbnails: raster data-URI only. Blocks svg/text/html data URIs so a malicious
+// seller can't smuggle scriptable content that the public /thumb endpoint would serve (stored-XSS guard).
+const THUMB_DATA_URI_RE = /^data:image\/(jpeg|png|webp);base64,[A-Za-z0-9+/=]+$/;
 function verifyManifestSig(hash, ownerId, contentType, byteSize, signedAt, apiKey, signature) {
     const payload = `${hash}|${ownerId}|${contentType}|${byteSize}|${signedAt}`;
     const expected = crypto.createHmac('sha256', apiKey).update(payload).digest('hex');
@@ -25,6 +28,8 @@ export function registerManifestsRoutes(app, deps) {
             return void res.json({ error: '请关联商品或流量口令' });
         if (thumbnail_data_uri && thumbnail_data_uri.length > THUMB_MAX_BYTES)
             return void res.json({ error: '缩略图过大（≤ 9KB 原始）' });
+        if (thumbnail_data_uri && !THUMB_DATA_URI_RE.test(thumbnail_data_uri))
+            return void res.json({ error: '缩略图必须是 data:image/(jpeg|png|webp);base64 格式' });
         // 验签
         const apiKey = me.api_key;
         if (!verifyManifestSig(hash, me.id, content_type, byte_size, signed_at, apiKey, signature)) {
@@ -82,6 +87,39 @@ export function registerManifestsRoutes(app, deps) {
     `, [req.params.hash]);
         res.json({ manifest: m, peers });
     });
+    // PUBLIC thumbnail bytes for <img src> (product cards can't send an auth header). Hardened:
+    //   - :hash must be 64-hex (format guard)
+    //   - only status='active' manifests
+    //   - the stored data-URI must match the raster whitelist (jpeg/png/webp) — else 404 (no svg/text/html)
+    //   - Content-Type is FORCED from the whitelisted subtype (never echoed from the stored value) + nosniff
+    //   - size guard; SHORT revalidatable cache (max-age=300, must-revalidate) — NOT immutable: the content is
+    //     hash-fixed but its serve-ability is not (owner/admin takedown flips status), so a long cache would
+    //     keep serving a taken-down thumbnail. 5-min TTL absorbs list bursts while honoring takedown promptly.
+    //   Only the low-res thumbnail is exposed (never full-res / metadata / other columns).
+    app.get('/api/manifests/:hash/thumb', async (req, res) => {
+        const hash = String(req.params.hash || '');
+        if (!/^[0-9a-f]{64}$/i.test(hash))
+            return void res.status(400).end();
+        const m = await dbOne(`SELECT thumbnail_data_uri, status FROM manifest_registry WHERE hash = ?`, [hash]);
+        if (!m || m.status !== 'active' || !m.thumbnail_data_uri)
+            return void res.status(404).end();
+        const parsed = THUMB_DATA_URI_RE.exec(m.thumbnail_data_uri);
+        if (!parsed)
+            return void res.status(404).end();
+        let buf;
+        try {
+            buf = Buffer.from(m.thumbnail_data_uri.slice(m.thumbnail_data_uri.indexOf(',') + 1), 'base64');
+        }
+        catch {
+            return void res.status(404).end();
+        }
+        if (buf.length === 0 || buf.length > 64 * 1024)
+            return void res.status(404).end();
+        res.setHeader('Content-Type', `image/${parsed[1]}`);
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('Cache-Control', 'public, max-age=300, must-revalidate');
+        res.send(buf);
+    });
     app.get('/api/manifests/by-product/:pid', async (req, res) => {
         const user = auth(req, res);
         if (!user)

package/dist/pwa/routes/me-data.js

@@ -1,7 +1,8 @@
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { projectDirectPayTargetForViewer } from '../direct-pay-order-redaction.js'; // 披露门:自导出的 orders 也按查看者投影,不得旁路
 export function registerMeDataRoutes(app, deps) {
-    // db 已全量走 RFC-016 异步 seam(dbOne/dbAll),不再直接用 deps.db
-    const { auth } = deps;
+    // db 走 RFC-016 异步 seam(dbOne/dbAll);deps.db 仅供披露门(requireBothDisclosuresAcked 是同步 gate)
+    const { auth, db } = deps;
     // COP 飞轮: 完成订单 7d 引导发笔记
     app.get('/api/me/note-prompts', async (req, res) => {
         const user = auth(req, res);
@@ -56,6 +57,8 @@ export function registerMeDataRoutes(app, deps) {
             data.profile = await dbOne(`SELECT id, name, handle, role, region, bio, search_anchor, email, phone, permanent_code, created_at, reputation FROM users WHERE id = ?`, [uid]);
             data.wallet = await dbOne(`SELECT balance, staked, escrowed, earned FROM wallets WHERE user_id = ?`, [uid]);
             data.orders = await dbAll(`SELECT * FROM orders WHERE buyer_id = ? OR seller_id = ? ORDER BY created_at DESC LIMIT 1000`, [uid, uid]);
+            for (const o of data.orders)
+                projectDirectPayTargetForViewer(db, o, uid); // 披露门:自导出按查看者投影(买家行=ack 门/卖家行=收款方保留),JSON + CSV 同源
             data.shareables = await dbAll(`SELECT * FROM shareables WHERE owner_id = ? AND status != 'removed'`, [uid]);
             data.bookmarks = await dbAll(`SELECT b.*, s.title FROM shareable_bookmarks b LEFT JOIN shareables s ON s.id = b.shareable_id WHERE b.user_id = ?`, [uid]);
             data.likes = await dbAll(`SELECT l.*, s.title FROM shareable_likes l LEFT JOIN shareables s ON s.id = l.shareable_id WHERE l.user_id = ?`, [uid]);

package/dist/pwa/routes/mutual-cancel.js

@@ -0,0 +1,62 @@
+import { proposeMutualCancel, acceptMutualCancel, declineMutualCancel, withdrawMutualCancel, getMutualCancelState } from '../../layer3-trust/L3-1-dispute-engine/mutual-cancel.js';
+export function registerMutualCancelRoutes(app, deps) {
+    const { db, auth, generateId, errorRes } = deps;
+    // 域返回 error_code → HTTP 状态。未知/校验类 → 409(与当前状态冲突);系统缺失 → 500。
+    const httpFor = (code) => code === 'ORDER_NOT_FOUND' ? 404
+        : code === 'NOT_A_PARTY' ? 403
+            : code === 'SYS_MISSING' || code === 'TRANSITION_FAILED' ? 500
+                : 409;
+    app.get('/api/orders/:id/mutual-cancel', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const r = getMutualCancelState(db, req.params.id, user.id);
+        if (!r.ok)
+            return void errorRes(res, httpFor(r.error_code), r.error_code || 'MUTUAL_CANCEL_STATE_ERROR', r.error || '读取失败');
+        res.json({ success: true, proposal: r.proposal ?? null, can_propose: !!r.can_propose, can_accept: !!r.can_accept, can_decline: !!r.can_decline, can_withdraw: !!r.can_withdraw });
+    });
+    app.post('/api/orders/:id/mutual-cancel/propose', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const reason = typeof req.body?.reason === 'string' ? req.body.reason : null;
+        const r = proposeMutualCancel(db, req.params.id, user.id, reason, generateId('mcp'));
+        if (!r.ok)
+            return void errorRes(res, httpFor(r.error_code), r.error_code || 'MUTUAL_CANCEL_PROPOSE_ERROR', r.error || '提议失败');
+        res.json({ success: true, proposal_id: r.proposal_id, status: r.status });
+    });
+    app.post('/api/orders/:id/mutual-cancel/accept', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        let r;
+        try {
+            // 资金 + 状态翻转 + 争议 resolved 必须同一原子边界(RFC-016 钱路铁律);域函数内已做竞态重校验。
+            r = db.transaction(() => acceptMutualCancel(db, req.params.id, user.id))();
+        }
+        catch (e) {
+            return void errorRes(res, 500, 'MUTUAL_CANCEL_ACCEPT_FAILED', e.message);
+        }
+        if (!r.ok)
+            return void errorRes(res, httpFor(r.error_code), r.error_code || 'MUTUAL_CANCEL_ACCEPT_ERROR', r.error || '确认失败');
+        res.json({ success: true, status: r.status, settlement: r.settlement });
+    });
+    app.post('/api/orders/:id/mutual-cancel/decline', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const r = declineMutualCancel(db, req.params.id, user.id);
+        if (!r.ok)
+            return void errorRes(res, httpFor(r.error_code), r.error_code || 'MUTUAL_CANCEL_DECLINE_ERROR', r.error || '拒绝失败');
+        res.json({ success: true, status: r.status });
+    });
+    app.post('/api/orders/:id/mutual-cancel/withdraw', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const r = withdrawMutualCancel(db, req.params.id, user.id);
+        if (!r.ok)
+            return void errorRes(res, httpFor(r.error_code), r.error_code || 'MUTUAL_CANCEL_WITHDRAW_ERROR', r.error || '撤回失败');
+        res.json({ success: true, status: r.status });
+    });
+}