@seasonkoh/webaz 0.1.28 → 0.1.30

package/dist/pwa/routes/orders-read.js

@@ -1,12 +1,27 @@
 // RFC-011 §⑥ 事件游标流(纯 db 函数,party-gated)
 import { listOrderEventsSince } from '../../layer0-foundation/L0-2-state-machine/order-chain.js';
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { requireBothDisclosuresAcked } from '../../direct-pay-disclosures.js'; // PR-4f-b: direct_p2p 收款说明响应契约门
+import { projectDirectPayTargetForViewer } from '../direct-pay-order-redaction.js'; // 收款目标披露门:按查看者一次分派(买家=ack 门/卖家=收款方保留/第三方=剥离),所有 orders reader 必过
+import { getMutualCancelState } from '../../layer3-trust/L3-1-dispute-engine/mutual-cancel.js'; // 协商取消(无责合意)可达性 + 当前提议(仅 disputed 计算,UI 便利字段)
+import { getCancelRefundState } from '../../direct-pay-cancel-refund.js'; // 直付取消退款握手状态(仅 direct_p2p+accepted 计算,UI 便利字段)
+import { isEligibleArbitrator } from '../arbitrator-lifecycle.js'; // 白名单仲裁员可查【争议中】订单(裁定所需);不看 legacy role==='arbitrator'
+import { getQrImageForOwner } from '../../direct-receive-account-qr.js'; // Rail1 D2:ack 门后按订单快照 qr_ref 取收款码字节((ref,seller_id) 域内)
+import { readTradeTermsSnapshot } from '../../trade-terms.js'; // S0:下单冻结的交易条款(时效/退货/清关/税责),争议书面依据
 export function registerOrdersReadRoutes(app, deps) {
     const { db, auth, getOrderStatus, getOrderChain, verifyOrderChain, getOrderDispute } = deps;
+    // 仲裁员订单可见性(详情 + 签名链共用同一谓词,防两路漂移):active 白名单(唯一能力源,不看 legacy user.role)
+    //   且【该订单存在争议记录】—— 含已裁定/已驳回:裁定后订单离开 disputed,但仲裁员复盘/申诉处理自己的案件仍需可见,
+    //   与 disputes-read"任意 active 仲裁员可读任意争议(含已结)"同口径。无争议记录的订单一律不可见 → 不可枚举任意订单。
+    const arbitratorCanViewOrder = async (orderId, userId) => isEligibleArbitrator(db, userId).ok && !!(await dbOne('SELECT 1 FROM disputes WHERE order_id = ? LIMIT 1', [orderId]));
     app.get('/api/orders', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
+        // 可选按支付轨筛选(escrow=托管 / direct_p2p=直接收款);非法值忽略。参与方 OR 必须整体括起,否则 AND 优先级会绑错。
+        const rail = req.query.rail === 'direct_p2p' ? 'direct_p2p' : req.query.rail === 'escrow' ? 'escrow' : null;
+        const railClause = rail ? ' AND o.payment_rail = ?' : '';
+        const railParams = rail ? [rail] : [];
         const orders = await dbAll(`
       SELECT o.*, p.title as product_title, p.images,
         ub.name as buyer_name, us.name as seller_name
@@ -14,9 +29,9 @@ export function registerOrdersReadRoutes(app, deps) {
       JOIN products p ON o.product_id = p.id
       JOIN users ub ON o.buyer_id = ub.id
       JOIN users us ON o.seller_id = us.id
-      WHERE o.buyer_id = ? OR o.seller_id = ? OR o.logistics_id = ?
+      WHERE (o.buyer_id = ? OR o.seller_id = ? OR o.logistics_id = ?)${railClause}
       ORDER BY o.created_at DESC LIMIT 50
-    `, [user.id, user.id, user.id]);
+    `, [user.id, user.id, user.id, ...railParams]);
         // B2 隐私购物：列表里也做相同 mask（防 seller/logistics 通过列表绕过详情 mask）
         for (const o of orders) {
             if (Number(o.anonymous_recipient) === 1 && o.buyer_id !== user.id) {
@@ -25,6 +40,8 @@ export function registerOrdersReadRoutes(app, deps) {
                 delete o.recipient_code;
                 o.buyer_name = '🔒 ' + (typeof code === 'string' ? code : 'PR-?????');
             }
+            projectDirectPayTargetForViewer(db, o, user.id); // #179/#218 审计:收款目标按查看者投影(买家=ack 门/卖家保留/第三方剥离),列表不得旁路
+            delete o.trade_terms_snapshot; // S0:列表不下放条款快照原始串(详情页解析后下放,列表省流量)
         }
         res.json(orders);
     });
@@ -37,6 +54,7 @@ export function registerOrdersReadRoutes(app, deps) {
         const field = role === 'seller' ? 'o.seller_id' : 'o.buyer_id';
         const from = req.query.from ? String(req.query.from) : null;
         const to = req.query.to ? String(req.query.to) : null;
+        const rail = req.query.rail === 'direct_p2p' ? 'direct_p2p' : req.query.rail === 'escrow' ? 'escrow' : null;
         const where = [`${field} = ?`];
         const params = [user.id];
         if (from) {
@@ -47,10 +65,15 @@ export function registerOrdersReadRoutes(app, deps) {
             where.push(`o.created_at <= ?`);
             params.push(to);
         }
+        if (rail) {
+            where.push(`o.payment_rail = ?`);
+            params.push(rail);
+        } // 按支付轨导出(对账:托管 vs 直接收款分开)
         const EXPORT_LIMIT = 5000;
         const rows = await dbAll(`
       SELECT o.id, o.created_at, o.status, o.quantity, o.unit_price, o.total_amount,
              o.coupon_discount, o.variant_options_snapshot, o.shipping_address,
+             COALESCE(o.payment_rail, 'escrow') as payment_rail,
              p.title as product_title, p.category,
              ub.handle as buyer_handle, ub.name as buyer_name,
              us.handle as seller_handle, us.name as seller_name
@@ -72,7 +95,7 @@ export function registerOrdersReadRoutes(app, deps) {
             }
             return s;
         };
-        const headers = ['order_id', 'created_at', 'status', 'product', 'category', 'qty', 'unit_price', 'total', 'coupon_discount', 'variant', 'buyer', 'seller', 'address'];
+        const headers = ['order_id', 'created_at', 'status', 'payment_rail', 'product', 'category', 'qty', 'unit_price', 'total', 'coupon_discount', 'variant', 'buyer', 'seller', 'address'];
         const lines = [headers.join(',')];
         for (const r of rows) {
             let variantStr = '';
@@ -83,7 +106,7 @@ export function registerOrdersReadRoutes(app, deps) {
             }
             catch { }
             lines.push([
-                r.id, r.created_at, r.status, r.product_title, r.category,
+                r.id, r.created_at, r.status, r.payment_rail, r.product_title, r.category,
                 r.quantity, r.unit_price, r.total_amount, r.coupon_discount || 0,
                 variantStr, r.buyer_handle, r.seller_handle, r.shipping_address,
             ].map(csvEscape).join(','));
@@ -99,7 +122,7 @@ export function registerOrdersReadRoutes(app, deps) {
         // UTF-8 BOM 帮 Excel 识别
         res.send('' + lines.join('\n'));
     });
-    // 订单签名链 — 当事人 + arbitrator + admin 可查
+    // 订单签名链 — 当事人 + 白名单仲裁员(涉争议订单) + admin 可查
     app.get('/api/orders/:id/chain', async (req, res) => {
         const user = auth(req, res);
         if (!user)
@@ -108,9 +131,12 @@ export function registerOrdersReadRoutes(app, deps) {
         if (!order)
             return void res.status(404).json({ error: '订单不存在' });
         const uid = user.id;
-        const isParty = uid === order.buyer_id || uid === order.seller_id || uid === order.logistics_id || user.role === 'arbitrator' || user.role === 'admin';
-        if (!isParty)
+        // 仲裁员链访问与订单详情同一谓词(arbitratorCanViewOrder):裁定需验签名链;legacy role==='arbitrator' 旁路已移除
+        //   (否则 role-only/已吊销账号可读任意订单链,而真·白名单仲裁员 role=buyer 反被 403,链徽标在裁定页显示"链异常")。
+        const isParty = uid === order.buyer_id || uid === order.seller_id || uid === order.logistics_id;
+        if (!isParty && user.role !== 'admin' && !(await arbitratorCanViewOrder(req.params.id, uid))) {
             return void res.status(403).json({ error: '无权查看此订单链' });
+        }
         const chain = await getOrderChain(db, req.params.id);
         const verification = await verifyOrderChain(db, req.params.id);
         res.json({ chain, verification });
@@ -141,7 +167,12 @@ export function registerOrdersReadRoutes(app, deps) {
         const order = statusInfo.order;
         const isLogisticsPickup = user.role === 'logistics' &&
             !order.logistics_id && order.status === 'shipped';
-        if (order.buyer_id !== user.id && order.seller_id !== user.id && order.logistics_id !== user.id && user.role !== 'arbitrator' && !isLogisticsPickup) {
+        // 白名单仲裁员(role 可能是 buyer,非 legacy 'arbitrator')需查看涉争议订单以裁定/复盘。能力源【唯一】= active
+        //   arbitrator_whitelist;legacy role 旁路已移除(否则 role-only/已吊销账号可读任意订单)。谓词= arbitratorCanViewOrder:
+        //   订单须【存在争议记录】(含已裁定/已驳回 —— 只放行 disputed 会让仲裁员在裁定落地、订单离开 disputed 的瞬间失去访问,
+        //   已结 tab 的"查看订单"全部 403);无争议记录的订单不可见 → 不可枚举。
+        const isParty = order.buyer_id === user.id || order.seller_id === user.id || order.logistics_id === user.id;
+        if (!isParty && !isLogisticsPickup && !(await arbitratorCanViewOrder(req.params.id, user.id))) {
             return void res.status(403).json({ error: '无权查看此订单' });
         }
         // M8: 二手订单从 secondhand_items 查；商家订单从 products 查
@@ -194,6 +225,73 @@ export function registerOrdersReadRoutes(app, deps) {
                 delete order.recipient_code;
             }
         }
+        // Direct Pay 响应契约门:收款目标按查看者投影 —— 买家在 D1/D2 both-acked 前不得拿到(非仅 UI 软门);卖家=收款方保留;
+        //   非买卖双方第三方(disputed-order 仲裁员、logistics-pickup)一律剥离(#179/#218 审计;仲裁若确需看收款目标,
+        //   应另做显式、可审计、受指派/案件/目的约束的 reveal 路径)。与 /api/orders 列表共用同一投影器,防旁路。
+        projectDirectPayTargetForViewer(db, order, user.id);
+        // Rail1 撤回仲裁可达性(与 orders-action pq_withdraw 权威门同谓词):仅当【当前 disputed + 最近一次进入
+        //   disputed 是 from payment_query + 争议未裁定】。前端据此才显示"撤回仲裁"按钮 —— 履约类争议(货损/货不对版
+        //   的 delivered→disputed)不给该按钮。UI 便利字段,真正拦截仍在路由。
+        const disputedFroms = history.filter(h => h.to_status === 'disputed').map(h => h.from_status);
+        order.can_withdraw_payment_query_dispute =
+            order.status === 'disputed' && disputedFroms[disputedFroms.length - 1] === 'payment_query' && !!dispute;
+        // 争议协商收口·买家侧(与 orders-action dispute_withdraw_confirm 权威门同谓词):仅当【当前 disputed +
+        //   最近一次进入 disputed 是 from delivered(履约争议)+ 争议未裁定 + 查看者=买家=争议发起人】。
+        //   前端据此才显示"我已收到货·撤诉并确认收货";UI 便利字段,真正拦截仍在路由。
+        order.can_confirm_receipt_close_dispute =
+            order.status === 'disputed' && disputedFroms[disputedFroms.length - 1] === 'delivered'
+                && !!dispute && dispute.initiator_id === user.id && order.buyer_id === user.id;
+        // 协商取消(无责·双方合意)握手状态 —— 仅 disputed 单计算,供订单页同步渲染 propose/accept/decline/withdraw。真正边界在 mutual-cancel 路由。
+        if (order.status === 'disputed') {
+            const mc = getMutualCancelState(db, req.params.id, user.id);
+            order.mutual_cancel = mc.ok ? { proposal: mc.proposal ?? null, can_propose: !!mc.can_propose, can_accept: !!mc.can_accept, can_decline: !!mc.can_decline, can_withdraw: !!mc.can_withdraw } : null;
+        }
+        // 直付取消退款握手状态(审计项 C)—— 仅 direct_p2p + accepted(付款后·发货前)计算,供订单页同步渲染。
+        //   party-gated(域内);非当事方(仲裁员等)拿 null。真正边界在 direct-pay-cancel-refund 路由。
+        if (order.payment_rail === 'direct_p2p' && order.status === 'accepted') {
+            const cr = getCancelRefundState(db, req.params.id, user.id);
+            order.cancel_refund = cr.ok ? { request: cr.request ?? null, can_request: !!cr.can_request, can_respond: !!cr.can_respond, can_confirm: !!cr.can_confirm, can_withdraw: !!cr.can_withdraw } : null;
+            // 审计项 F:卖家对账辅助 —— 同买家·同金额其它在途直付单计数(与 mark_paid D2 预警同口径,发货前每次打开订单页都能看到)。
+            //   仅卖家视角计算;买家/第三方不下发(无对账用途,少一分敞口)。
+            if (order.seller_id === user.id) {
+                const dupRow = await dbOne(`SELECT COUNT(*) n FROM orders WHERE buyer_id = ? AND seller_id = ? AND payment_rail = 'direct_p2p' AND total_amount = ? AND id != ? AND status IN ('accepted','shipped','picked_up','in_transit','delivered')`, [order.buyer_id, order.seller_id, order.total_amount, req.params.id]);
+                order.duplicate_amount_alert = dupRow?.n || 0;
+            }
+        }
+        // S0 交易条款快照:parse-don't-validate 后下放(坏 JSON/pre-S0 旧单 → null;原始串不下放)
+        order.trade_terms = readTradeTermsSnapshot(order.trade_terms_snapshot);
+        delete order.trade_terms_snapshot;
         res.json({ ...statusInfo, history, product, dispute, trackingInfo });
     });
+    // Rail1 D2:直付订单收款二维码(硬化转发)。仅【订单买家】+ 两次披露 both-acked 后可取;按建单时快照的 (qr_ref, seller_id)
+    //   取【当时那一版】图字节。未 ack / 非买家 / 无 QR / 非 direct_p2p → 统一 404(不枚举,不泄露)。图字节不入 order JSON。
+    app.get('/api/orders/:id/direct-pay-qr', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const orderId = String(req.params.id);
+        const order = await dbOne('SELECT buyer_id, seller_id, payment_rail, status, direct_pay_account_snapshot FROM orders WHERE id = ?', [orderId]);
+        if (!order || order.payment_rail !== 'direct_p2p' || order.buyer_id !== user.id)
+            return void res.status(404).end();
+        if (order.status === 'pending_accept')
+            return void res.status(404).end(); // 手动接单待确认:状态门,接单前不出示收款码(v16)
+        if (!requireBothDisclosuresAcked(db, orderId).ok)
+            return void res.status(404).end(); // 未 ack:与"无 QR"同样 404,不泄露存在性
+        let snap = {};
+        try {
+            snap = order.direct_pay_account_snapshot ? JSON.parse(order.direct_pay_account_snapshot) : {};
+        }
+        catch {
+            snap = {};
+        }
+        if (!snap.qr_ref)
+            return void res.status(404).end();
+        const img = getQrImageForOwner(db, snap.qr_ref, order.seller_id); // (ref, seller_id) 域内取字节;seller_id 取自订单,非用户输入
+        if (!img)
+            return void res.status(404).end();
+        res.setHeader('Content-Type', img.mime);
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('Cache-Control', 'private, no-store');
+        res.send(img.buf);
+    });
 }

package/dist/pwa/routes/p2p-products.js

@@ -51,8 +51,8 @@ export function registerP2pProductsRoutes(app, deps) {
         await dbRun(`
       INSERT INTO products (id, seller_id, title, description, price, stock, status, images, ship_regions,
         handling_hours, commission_rate, category_id, stake_amount, p2p_mode, content_hash, peer_endpoint,
-        content_signature, content_signed_at)
-      VALUES (?,?,?,?,?,?,'active',?,?,24,0.10,'cat_default',0,1,?,?,?,?)
+        content_signature, content_signed_at, currency)
+      VALUES (?,?,?,?,?,?,'active',?,?,24,0.10,'cat_default',0,1,?,?,?,?,'WAZ')
     `, [
             id, user.id, title,
             `[P2P] ${title}（完整详情见卖家节点）`,

package/dist/pwa/routes/platform-receive-accounts.js

@@ -0,0 +1,111 @@
+import { createHash } from 'node:crypto';
+import { listPlatformAccounts, getPlatformAccount, addPlatformAccount, updatePlatformAccount, deactivatePlatformAccount } from '../../platform-receive-accounts.js';
+import { requireDirectPayHumanPasskey } from '../direct-pay-guards.js';
+const sha256hex = (s) => createHash('sha256').update(s).digest('hex');
+/** 稳定序列化(键排序)—— purpose_data 与请求体重算 payload 逐字比对,不受键序影响。 */
+function stable(o) {
+    return JSON.stringify(Object.keys(o).sort().reduce((a, k) => { a[k] = o[k]; return a; }, {}));
+}
+const GATE_PURPOSE = 'platform_receive_account_manage';
+export function registerPlatformReceiveAccountsRoutes(app, deps) {
+    const { db, requireRootAdmin, generateId, consumeGateToken, logAdminAction } = deps;
+    /** 从请求体重算【本次写入内容】的 canonical gate payload —— Passkey token 必须绑定它,证明 admin 确认的就是这份收款内容。
+     *  绑定字段:action, account_id?, instruction/method/currency/label(原文,与 body 逐字一致), qr_mode(keep|clear|set)+qr_sha256(set 时;绑 QR 内容而非塞 64KB 原文)。 */
+    function gateContentPayload(req, action, accountId) {
+        const b = req.body || {};
+        const p = { action };
+        if (accountId)
+            p.account_id = accountId;
+        if (action === 'add' || action === 'update') {
+            p.instruction = String(b.instruction ?? '');
+            p.method = String(b.method ?? '');
+            p.currency = String(b.currency ?? '');
+            p.label = String(b.label ?? '');
+            if (!('qr_data_uri' in b))
+                p.qr_mode = 'keep';
+            else if (b.qr_data_uri == null || String(b.qr_data_uri).trim() === '')
+                p.qr_mode = 'clear';
+            else {
+                p.qr_mode = 'set';
+                p.qr_sha256 = sha256hex(String(b.qr_data_uri));
+            }
+        }
+        return p;
+    }
+    /** ROOT + 现场真人 Passkey(写操作)。token 的 purpose_data 必须与本次请求体重算的 canonical payload 逐字相等
+     *  —— 否则(如用批 A 的 token 写 B 的收款地址,或 body 被篡改)拒。返回 true=通过(否则已写 403)。 */
+    function passkeyOk(req, res, adminId, action, accountId) {
+        const expected = stable(gateContentPayload(req, action, accountId));
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: adminId, webauthnToken: req.body?.webauthn_token,
+            purpose: GATE_PURPOSE,
+            validate: (data) => !!data && typeof data === 'object' && stable(data) === expected,
+        });
+        if (!gate.ok) {
+            res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+            return false;
+        }
+        return true;
+    }
+    const bodyInput = (req) => {
+        const b = req.body || {};
+        const out = { instruction: b.instruction, label: b.label, method: b.method, currency: b.currency };
+        if ('qr_data_uri' in b)
+            out.qrDataUri = b.qr_data_uri; // 缺省不改;给了(含 null/'')才动 qr
+        return out;
+    };
+    /** 审计摘要(canonical,不含 raw QR):便于事后还原"当时展示给卖家的收款内容"。instruction/qr 用 sha256。 */
+    const summarize = (a) => a == null ? null : { method: a.method ?? null, currency: a.currency ?? null, label: a.label ?? null, instruction_sha256: a.instruction ? sha256hex(a.instruction) : null, qr_sha256: a.qr_data_uri ? sha256hex(a.qr_data_uri) : null, had_qr: !!a.qr_data_uri };
+    // ── list(ROOT 读;含 inactive + qr_data_uri)──
+    app.get('/api/admin/platform-receive-accounts', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        res.json({ accounts: listPlatformAccounts(db, { includeInactive: true }) });
+    });
+    // ── add(ROOT + Passkey)──
+    app.post('/api/admin/platform-receive-accounts', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        if (!passkeyOk(req, res, admin.id, 'add'))
+            return;
+        const r = addPlatformAccount(db, bodyInput(req), generateId);
+        if (!r.ok)
+            return void res.status(400).json({ error: r.reason, error_code: 'PLATFORM_ACCOUNT_INPUT_INVALID' });
+        logAdminAction?.(admin.id, 'platform_receive_account_add', 'platform_receive_account', r.account.id, { new: summarize(r.account) });
+        res.json({ ok: true, account: r.account });
+    });
+    // ── update(ROOT + Passkey + 存在性)──
+    app.put('/api/admin/platform-receive-accounts/:id', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const id = String(req.params.id);
+        const before = getPlatformAccount(db, id);
+        if (!before)
+            return void res.status(404).json({ error: '平台收款方式不存在', error_code: 'PLATFORM_ACCOUNT_NOT_FOUND' });
+        if (!passkeyOk(req, res, admin.id, 'update', id))
+            return;
+        const r = updatePlatformAccount(db, id, bodyInput(req));
+        if (!r.ok)
+            return void res.status(400).json({ error: r.reason, error_code: 'PLATFORM_ACCOUNT_INPUT_INVALID' });
+        logAdminAction?.(admin.id, 'platform_receive_account_update', 'platform_receive_account', id, { old: summarize(before), new: summarize(getPlatformAccount(db, id)) });
+        res.json({ ok: true, changed: r.changed });
+    });
+    // ── deactivate(ROOT + Passkey + 存在性)──
+    app.delete('/api/admin/platform-receive-accounts/:id', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const id = String(req.params.id);
+        const before = getPlatformAccount(db, id);
+        if (!before)
+            return void res.status(404).json({ error: '平台收款方式不存在', error_code: 'PLATFORM_ACCOUNT_NOT_FOUND' });
+        if (!passkeyOk(req, res, admin.id, 'deactivate', id))
+            return;
+        const changed = deactivatePlatformAccount(db, id);
+        logAdminAction?.(admin.id, 'platform_receive_account_deactivate', 'platform_receive_account', id, { old: summarize(before) });
+        res.json({ ok: true, changed });
+    });
+}

package/dist/pwa/routes/products-create.js

@@ -23,9 +23,10 @@ export function registerProductsCreateRoutes(app, deps) {
         const quotaCheck = checkSellerCanList(user);
         if (!quotaCheck.ok)
             return void res.json({ error: quotaCheck.reason });
-        const { title, description, price, stock = 1, category = '', specs, brand, model, source_url, source_price, external_title, weight_kg, ship_regions = '全国', handling_hours = 24, estimated_days, fragile = 0, return_days = 7, return_condition = '', warranty_days = 0, commission_rate, product_type = 'retail', // 里程碑 6
+        const { title, description, price, stock = 1, category = '', specs, brand, model, source_url, source_price, external_title, weight_kg, ship_regions = '全国', handling_hours = 24, estimated_days, fragile = 0, return_days = 7, return_condition = '', warranty_days = 0, low_stock_threshold = 3, auto_delist_on_zero = 1, commission_rate, product_type = 'retail', create_status, // 里程碑 6 / S4:create_status='warehouse' 让含单品覆盖的新品先落仓库,覆盖全落定再激活(避免公开 active 但缺可售/税费声明)
         aliases = [], // 里程碑 7.2：上架时同步声明的 alias 集合
         image_hashes = [], // 商品图片 — 只存 hash（64 hex），实际 blob 在卖家节点 IDB
+        package_size, origin_country, country_of_origin, customs_description, hs_code, // S0 跨境清关/物流证据字段(全可选,零计费逻辑;进条款快照)
          } = req.body;
         // 协议化原则：服务端只存 hash 引用，不存图片字节。校验仅做格式 + 数量。
         let imagesJsonForInsert = null;
@@ -69,6 +70,12 @@ export function registerProductsCreateRoutes(app, deps) {
         const priceNum = Number(price);
         const stakeDiscount = await getStakeDiscount(db, user.id);
         const stakeRate = Math.max(0.05, 0.15 - stakeDiscount);
+        // S0 清关字段轻校验(可选;长度界 + 区码大写 + HS 编码字符集)
+        const _cc = (x) => (typeof x === 'string' && x.trim()) ? x.trim().toUpperCase().slice(0, 8) : null;
+        const _tx = (x, n) => (typeof x === 'string' && x.trim()) ? x.trim().slice(0, n) : null;
+        const _hs = _tx(hs_code, 12);
+        if (_hs && !/^[0-9.]{4,12}$/.test(_hs))
+            return void res.status(400).json({ error: 'hs_code 须为 4-12 位数字(可含 .)', error_code: 'INVALID_HS_CODE' });
         const stakeAmount = Math.round(priceNum * stakeRate * 100) / 100;
         const now = new Date().toISOString();
         const id = generateId('prd');
@@ -80,17 +87,21 @@ export function registerProductsCreateRoutes(app, deps) {
       specs, brand, model, source_url, source_price, source_price_at,
       weight_kg, ship_regions, handling_hours, estimated_days, fragile,
       return_days, return_condition, warranty_days,
+      low_stock_threshold, auto_delist_on_zero,
       commitment_hash, description_hash, price_hash, hashed_at,
-      commission_rate, product_type, images
-    ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`, [
+      commission_rate, product_type, images, currency,
+      package_size, origin_country, country_of_origin, customs_description, hs_code, status
+    ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'WAZ',?,?,?,?,?,?)`, [
             id, user.id, title, description, priceNum, Number(stock), category, stakeAmount,
             specsJson, brand ?? null, model ?? null,
             source_url ?? null, source_price ? Number(source_price) : null, source_price ? now : null,
             weight_kg ? Number(weight_kg) : null, ship_regions, Number(handling_hours), estJson, fragile ? 1 : 0,
             Number(return_days), return_condition, Number(warranty_days),
+            Math.max(0, Math.floor(Number(low_stock_threshold) || 0)), auto_delist_on_zero ? 1 : 0,
             makeCommitmentHash(pFields), makeDescriptionHash({ title, description, specs: specsJson }),
             makePriceHash(priceNum, now), now,
-            commissionRateNum, product_type, imagesJsonForInsert
+            commissionRateNum, product_type, imagesJsonForInsert,
+            _tx(package_size, 40), _cc(origin_country), _cc(country_of_origin), _tx(customs_description, 120), _hs, create_status === 'warehouse' ? 'warehouse' : 'active'
         ]);
         // M7.2.6：免质押上架 — 不再扣 stake；首单成交时 settleOrder 自动从订单 escrow 锁定
         // M7.2-6: 上架时同步入 aliases（卖家已勾选的 candidates）

package/dist/pwa/routes/products-links.js

@@ -1,4 +1,5 @@
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { invalidateProductVerification } from '../../product-verification.js';
 export function registerProductsLinksRoutes(app, deps) {
     // 只读/单写站点走 RFC-016 异步 seam;db 保留:认领冲突分支是 fee-lock 资金路径,
     // INSERT 链接 + INSERT 验证任务 + 钱包扣费必须原子(db.transaction + 守恒/dup guard),Phase 3 迁 pg 行锁。
@@ -15,6 +16,21 @@ export function registerProductsLinksRoutes(app, deps) {
         const links = await dbAll(`SELECT id, url, source, verified, revoked, verify_note, added_at, platform, external_id, external_title FROM product_external_links WHERE product_id = ? ORDER BY added_at ASC`, [req.params.id]);
         res.json(links);
     });
+    // Buyer-facing read for the product detail page: VERIFIED + non-revoked links only, shape { links }.
+    // NOT owner-gated (any logged-in viewer) — separate from the owner-only /links above (which returns a bare
+    // array the seller workbench consumes; that stays untouched). Only public-safe columns are returned.
+    app.get('/api/products/:id/external-links', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        // Mirror product-detail visibility (products-crud GET /:id): others see active only; the seller sees own
+        // non-active. Otherwise 404 — never leak source URLs of a warehouse/deleted product to non-owners.
+        const product = await dbOne("SELECT id FROM products WHERE id = ? AND (status = 'active' OR seller_id = ?)", [req.params.id, user.id]);
+        if (!product)
+            return void res.status(404).json({ error: 'not_found' });
+        const links = await dbAll(`SELECT url, platform, external_title FROM product_external_links WHERE product_id = ? AND verified = 1 AND revoked = 0 ORDER BY added_at ASC`, [req.params.id]);
+        res.json({ links });
+    });
     // 新链接（无人认领）直接 verified=1；已被他人认领则发起众包验证任务
     app.post('/api/products/:id/links', async (req, res) => {
         const user = auth(req, res);
@@ -69,6 +85,12 @@ export function registerProductsLinksRoutes(app, deps) {
             await dbRun(`INSERT INTO product_external_links
         (id, product_id, url, source, verified, verified_at, platform, external_id, external_title)
         VALUES (?, ?, ?, 'manual', 1, datetime('now'), ?, ?, ?)`, [linkId, req.params.id, url, meta?.platform ?? null, meta?.external_id ?? null, linkExternalTitle]);
+            try {
+                invalidateProductVerification(db, String(req.params.id));
+            }
+            catch (e) {
+                console.error('[product-verify invalidate]', e);
+            } // PR-⑥ 反作弊:外链变更 → 作废直付逐品验证
             return void res.json({ link_id: linkId, verified: 1, external_title: linkExternalTitle, message: '链接已关联' });
         }
         // 已被他人认领：发起众包验证任务
@@ -129,6 +151,12 @@ export function registerProductsLinksRoutes(app, deps) {
             console.error('[products-links claim tx]', msg);
             return void res.status(500).json({ error: '发起认领失败,请重试' });
         }
+        try {
+            invalidateProductVerification(db, String(req.params.id));
+        }
+        catch (e) {
+            console.error('[product-verify invalidate]', e);
+        } // PR-⑥ 反作弊:外链变更 → 作废直付逐品验证
         res.json({
             link_id: linkId,
             task_id: taskId,
@@ -147,6 +175,12 @@ export function registerProductsLinksRoutes(app, deps) {
         if (!product || product.seller_id !== user.id)
             return void res.status(403).json({ error: '无权限' });
         await dbRun('DELETE FROM product_external_links WHERE id = ? AND product_id = ?', [req.params.linkId, req.params.id]);
+        try {
+            invalidateProductVerification(db, String(req.params.id));
+        }
+        catch (e) {
+            console.error('[product-verify invalidate]', e);
+        } // PR-⑥ 反作弊:外链变更 → 作废直付逐品验证
         res.json({ success: true });
     });
 }

package/dist/pwa/routes/products-list.js

@@ -1,5 +1,6 @@
 import { createHmac } from 'crypto';
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { genuineSalePredicate } from '../../layer0-foundation/L0-2-state-machine/genuine-sale.js'; // RFC-018 PR4: 真实成交(排除全额退货)
 export function registerProductsListRoutes(app, deps) {
     // db 已走 RFC-016 异步 seam(dbOne/dbAll),不再直接用 deps.db
     const { getUser, VALID_PRODUCT_TYPES, RAW_MODE_MIN_TRUST, getAgentTrustCached, VALID_SORTS, PRODUCT_LIMITS, TRENDING_SCORE_EXPR, findProductsByAlias, decodeProductCursor, encodeProductCursor, MASTER_SEED, formatProductForAgent } = deps;
@@ -52,7 +53,7 @@ export function registerProductsListRoutes(app, deps) {
       COALESCE(rs.total_points, 0) as rep_points, COALESCE(rs.level, 'new') as rep_level,
       COALESCE(rs.transactions_done, 0) as seller_tx_count,
       pc.seasonal_months as seasonal_months,
-      (SELECT COUNT(1) FROM orders o WHERE o.product_id = p.id AND o.status = 'completed') as sales_count,
+      (SELECT COUNT(1) FROM orders o WHERE o.product_id = p.id AND ${genuineSalePredicate('o')}) as sales_count,
       (SELECT COUNT(DISTINCT buyer_id) FROM order_ratings r WHERE r.product_id = p.id AND r.stars >= 4) as recommend_count,
       (SELECT COUNT(*) FROM dispute_cases dc WHERE dc.seller_id = p.seller_id) as seller_dispute_count,
       -- 卖家仲裁胜率：无案件视为 0.8 中性（未经检验）；有案件按真实比率

package/dist/pwa/routes/products-update.js

@@ -1,7 +1,8 @@
 import { dbOne, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { invalidateProductVerification } from '../../product-verification.js';
 export function registerProductsUpdateRoutes(app, deps) {
-    // db 已走 RFC-016 异步 seam(dbOne/dbRun),不再直接用 deps.db
-    const { auth, makeCommitmentHash, makeDescriptionHash, makePriceHash, notifyWaitlist, notifyWishlistPriceDrop, checkStockAndMaybeDelist } = deps;
+    // db 已走 RFC-016 异步 seam(dbOne/dbRun);deps.db 仅用于 direct-pay 逐品验证作废(sync helper,反作弊生命周期)
+    const { db, auth, makeCommitmentHash, makeDescriptionHash, makePriceHash, notifyWaitlist, notifyWishlistPriceDrop, checkStockAndMaybeDelist } = deps;
     app.put('/api/products/:id', async (req, res) => {
         const user = auth(req, res);
         if (!user)
@@ -9,7 +10,8 @@ export function registerProductsUpdateRoutes(app, deps) {
         const product = await dbOne('SELECT * FROM products WHERE id = ? AND seller_id = ?', [req.params.id, user.id]);
         if (!product)
             return void res.status(404).json({ error: '商品不存在或无权限' });
-        const { title, description, price, stock, specs, brand, model, handling_hours, ship_regions, estimated_days, fragile, return_days, return_condition, warranty_days, low_stock_threshold, auto_delist_on_zero, origin_claims, i18n_titles, i18n_descs, } = req.body;
+        const { title, description, price, stock, specs, brand, model, handling_hours, ship_regions, estimated_days, fragile, return_days, return_condition, warranty_days, low_stock_threshold, auto_delist_on_zero, origin_claims, i18n_titles, i18n_descs, weight_kg, package_size, origin_country, country_of_origin, customs_description, hs_code, // S0 跨境清关/物流证据字段(可选;进后续订单条款快照,不影响在途单)
+         } = req.body;
         const now = new Date().toISOString();
         const specsJson = specs != null ? (typeof specs === 'object' ? JSON.stringify(specs) : specs) : product.specs;
         const estJson = estimated_days != null ? (typeof estimated_days === 'object' ? JSON.stringify(estimated_days) : String(estimated_days)) : product.estimated_days;
@@ -79,6 +81,12 @@ export function registerProductsUpdateRoutes(app, deps) {
             }
             return Object.keys(out).length > 0 ? JSON.stringify(out) : null;
         };
+        // S0 清关字段(可选;与 create 同校验;null 显式清除,undefined 保留)
+        const _cc = (x) => x === undefined ? undefined : ((typeof x === 'string' && x.trim()) ? x.trim().toUpperCase().slice(0, 8) : null);
+        const _tx = (x, n) => x === undefined ? undefined : ((typeof x === 'string' && x.trim()) ? x.trim().slice(0, n) : null);
+        const _hs = _tx(hs_code, 12);
+        if (typeof _hs === 'string' && !/^[0-9.]{4,12}$/.test(_hs))
+            return void res.status(400).json({ error: 'hs_code 须为 4-12 位数字(可含 .)', error_code: 'INVALID_HS_CODE' });
         const titlesResult = validateI18n(i18n_titles);
         const descsResult = validateI18n(i18n_descs);
         const newI18nTitles = titlesResult === undefined ? product.i18n_titles : titlesResult;
@@ -91,6 +99,7 @@ export function registerProductsUpdateRoutes(app, deps) {
       low_stock_alerted_at = CASE WHEN ?=1 THEN NULL ELSE low_stock_alerted_at END,
       origin_claims=?,
       i18n_titles=?, i18n_descs=?,
+      weight_kg=?, package_size=?, origin_country=?, country_of_origin=?, customs_description=?, hs_code=?,
       commitment_hash=?, description_hash=?, price_hash=?, hashed_at=?,
       updated_at=datetime('now')
       WHERE id=?`, [
@@ -101,6 +110,12 @@ export function registerProductsUpdateRoutes(app, deps) {
             newLowThreshold, newAutoDelist, resetAlert,
             newOriginClaims,
             newI18nTitles, newI18nDescs,
+            weight_kg === undefined ? product.weight_kg : (weight_kg === null || weight_kg === '' ? null : Number(weight_kg)),
+            _tx(package_size, 40) === undefined ? product.package_size : _tx(package_size, 40),
+            _cc(origin_country) === undefined ? product.origin_country : _cc(origin_country),
+            _cc(country_of_origin) === undefined ? product.country_of_origin : _cc(country_of_origin),
+            _tx(customs_description, 120) === undefined ? product.customs_description : _tx(customs_description, 120),
+            _hs === undefined ? product.hs_code : _hs,
             makeCommitmentHash(pFields),
             makeDescriptionHash({ title: newTitle, description: newDesc, specs: specsJson }),
             makePriceHash(newPrice, now), now,
@@ -134,6 +149,25 @@ export function registerProductsUpdateRoutes(app, deps) {
                 console.error('[wishlist price-drop notify]', e);
             }
         }
+        // 反作弊(PR-⑥):任何【买家可见的商品身份字段】变更 → 作废该商品的直付逐品验证,强制重新验证,防"先验证商品 A,
+        //   再改成商品 B"绕过逐品硬门。external-link 变更在 products-links 路由另行作废。fail-soft,不阻断编辑。
+        //   ⚠️ 必须含 i18n_titles/i18n_descs:formatProductForAgent 按 Accept-Language 把 title/description 换成对应语言,
+        //      只改 en/ja/ko 标题描述同样是"换货"(非中文买家看到的就变了);并含 brand/model(商品身份)。
+        const newBrand = brand ?? product.brand;
+        const newModel = model ?? product.model;
+        const eq = (a, b) => String(a ?? '') === String(b ?? '');
+        const materialChanged = !eq(newTitle, product.title) || !eq(newDesc, product.description)
+            || Number(newPrice) !== Number(product.price) || !eq(specsJson, product.specs)
+            || !eq(newI18nTitles, product.i18n_titles) || !eq(newI18nDescs, product.i18n_descs)
+            || !eq(newBrand, product.brand) || !eq(newModel, product.model);
+        if (materialChanged) {
+            try {
+                invalidateProductVerification(db, String(req.params.id));
+            }
+            catch (e) {
+                console.error('[product-verify invalidate]', e);
+            }
+        }
         res.json({ success: true });
     });
 }

package/dist/pwa/routes/profile-identity.js

@@ -59,8 +59,10 @@ export function registerProfileIdentityRoutes(app, deps) {
         const roles = safeRoles(user);
         if (!roles.includes(role))
             return void res.json({ error: '你还没有该角色，请先添加' });
-        // 防御：已是 admin/verifier 的用户不能切到 buyer/seller（防遗留多角色账户绕过）
-        if (roles.some(r => ROLE_LOCKED_ROLES.includes(r)) && !ROLE_LOCKED_ROLES.includes(role)) {
+        // 防御：已是 admin/verifier 的用户不能切到 buyer/seller（防遗留多角色账户绕过）。
+        //   锁的是【交易面目标】,不是一切切换 —— 此前 `!ROLE_LOCKED_ROLES.includes(role)` 连 verifier→arbitrator/logistics
+        //   (同为受信/治理身份,零交易能力)都拦 → 切到审核员后被永久卡死在审核员(梦想者1号案:回不到仲裁员)。
+        if (roles.some(r => ROLE_LOCKED_ROLES.includes(r)) && ['buyer', 'seller'].includes(role)) {
             return void res.json({
                 error: '受信角色不能切换为 buyer / seller',
                 hint: '权责分离原则；如需买卖请用其他账号。'

package/dist/pwa/routes/promoter.js

@@ -28,6 +28,8 @@ export function registerPromoterRoutes(app, deps) {
         for (const r of earned)
             byLevel[r.level] = { orders: r.orders, total: r.total };
         const grand = byLevel[1].total + byLevel[2].total + byLevel[3].total;
+        // RFC-018: commission accrued but still in the clearing window (matures into grand_total). Pure read.
+        const clearing = (await dbOne("SELECT COALESCE(SUM(amount),0) as s FROM pending_commission_escrow WHERE recipient_user_id = ? AND matures_at IS NOT NULL AND status = 'pending'", [userId])).s;
         const recent = await dbAll(`
       SELECT cr.id, cr.order_id, cr.level, cr.amount, cr.rate, cr.created_at,
              u.name as source_buyer_name
@@ -142,6 +144,7 @@ export function registerPromoterRoutes(app, deps) {
             team: { l1, l2, l3, total: l1 + l2 + l3 },
             earnings: {
                 grand_total: grand,
+                clearing_total: clearing, // RFC-018: accrued, maturing after the return window (not yet paid)
                 l1: byLevel[1],
                 l2: byLevel[2],
                 l3: byLevel[3],

package/dist/pwa/routes/referral.js

@@ -23,6 +23,9 @@ export function registerReferralRoutes(app, deps) {
     `, [user.id]));
         const todayEarnings = (await dbOne(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-1 day')`, [user.id])).t;
         const monthEarnings = (await dbOne(`SELECT COALESCE(SUM(amount), 0) as t FROM commission_records WHERE beneficiary_id = ? AND created_at > datetime('now', '-30 days')`, [user.id])).t;
+        // RFC-018: commission accrued but still in the clearing window (pending → matures into total_waz).
+        // Pure read; surfaced so earnings don't appear to vanish during clearing (Option A keeps total_waz = paid).
+        const clearingWaz = (await dbOne(`SELECT COALESCE(SUM(amount), 0) as t FROM pending_commission_escrow WHERE recipient_user_id = ? AND matures_at IS NOT NULL AND status = 'pending'`, [user.id])).t;
         res.json({
             invite_code: code,
             invite_link: code ? `${req.protocol}://${req.get('host')}/i/${code}` : null,
@@ -34,6 +37,7 @@ export function registerReferralRoutes(app, deps) {
                 total_waz: earnings.total,
                 today_waz: todayEarnings,
                 month_waz: monthEarnings,
+                clearing_waz: clearingWaz, // RFC-018: accrued, maturing after the return window (not yet paid)
             },
         });
     });