@seasonkoh/webaz 0.1.29 → 0.1.30

package/dist/pwa/routes/orders-read.js

@@ -2,14 +2,26 @@
 import { listOrderEventsSince } from '../../layer0-foundation/L0-2-state-machine/order-chain.js';
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 import { requireBothDisclosuresAcked } from '../../direct-pay-disclosures.js'; // PR-4f-b: direct_p2p 收款说明响应契约门
-import { redactUnackedDirectPayTarget } from '../direct-pay-order-redaction.js'; // 收款目标披露门(共享;所有 orders reader 必过)
+import { projectDirectPayTargetForViewer } from '../direct-pay-order-redaction.js'; // 收款目标披露门:按查看者一次分派(买家=ack 门/卖家=收款方保留/第三方=剥离),所有 orders reader 必过
+import { getMutualCancelState } from '../../layer3-trust/L3-1-dispute-engine/mutual-cancel.js'; // 协商取消(无责合意)可达性 + 当前提议(仅 disputed 计算,UI 便利字段)
+import { getCancelRefundState } from '../../direct-pay-cancel-refund.js'; // 直付取消退款握手状态(仅 direct_p2p+accepted 计算,UI 便利字段)
+import { isEligibleArbitrator } from '../arbitrator-lifecycle.js'; // 白名单仲裁员可查【争议中】订单(裁定所需);不看 legacy role==='arbitrator'
 import { getQrImageForOwner } from '../../direct-receive-account-qr.js'; // Rail1 D2:ack 门后按订单快照 qr_ref 取收款码字节((ref,seller_id) 域内)
+import { readTradeTermsSnapshot } from '../../trade-terms.js'; // S0:下单冻结的交易条款(时效/退货/清关/税责),争议书面依据
 export function registerOrdersReadRoutes(app, deps) {
     const { db, auth, getOrderStatus, getOrderChain, verifyOrderChain, getOrderDispute } = deps;
+    // 仲裁员订单可见性(详情 + 签名链共用同一谓词,防两路漂移):active 白名单(唯一能力源,不看 legacy user.role)
+    //   且【该订单存在争议记录】—— 含已裁定/已驳回:裁定后订单离开 disputed,但仲裁员复盘/申诉处理自己的案件仍需可见,
+    //   与 disputes-read"任意 active 仲裁员可读任意争议(含已结)"同口径。无争议记录的订单一律不可见 → 不可枚举任意订单。
+    const arbitratorCanViewOrder = async (orderId, userId) => isEligibleArbitrator(db, userId).ok && !!(await dbOne('SELECT 1 FROM disputes WHERE order_id = ? LIMIT 1', [orderId]));
     app.get('/api/orders', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
+        // 可选按支付轨筛选(escrow=托管 / direct_p2p=直接收款);非法值忽略。参与方 OR 必须整体括起,否则 AND 优先级会绑错。
+        const rail = req.query.rail === 'direct_p2p' ? 'direct_p2p' : req.query.rail === 'escrow' ? 'escrow' : null;
+        const railClause = rail ? ' AND o.payment_rail = ?' : '';
+        const railParams = rail ? [rail] : [];
         const orders = await dbAll(`
       SELECT o.*, p.title as product_title, p.images,
         ub.name as buyer_name, us.name as seller_name
@@ -17,9 +29,9 @@ export function registerOrdersReadRoutes(app, deps) {
       JOIN products p ON o.product_id = p.id
       JOIN users ub ON o.buyer_id = ub.id
       JOIN users us ON o.seller_id = us.id
-      WHERE o.buyer_id = ? OR o.seller_id = ? OR o.logistics_id = ?
+      WHERE (o.buyer_id = ? OR o.seller_id = ? OR o.logistics_id = ?)${railClause}
       ORDER BY o.created_at DESC LIMIT 50
-    `, [user.id, user.id, user.id]);
+    `, [user.id, user.id, user.id, ...railParams]);
         // B2 隐私购物：列表里也做相同 mask（防 seller/logistics 通过列表绕过详情 mask）
         for (const o of orders) {
             if (Number(o.anonymous_recipient) === 1 && o.buyer_id !== user.id) {
@@ -28,7 +40,8 @@ export function registerOrdersReadRoutes(app, deps) {
                 delete o.recipient_code;
                 o.buyer_name = '🔒 ' + (typeof code === 'string' ? code : 'PR-?????');
             }
-            redactUnackedDirectPayTarget(db, o, user.id); // #179 审计 P1:列表也过披露门,不得旁路
+            projectDirectPayTargetForViewer(db, o, user.id); // #179/#218 审计:收款目标按查看者投影(买家=ack 门/卖家保留/第三方剥离),列表不得旁路
+            delete o.trade_terms_snapshot; // S0:列表不下放条款快照原始串(详情页解析后下放,列表省流量)
         }
         res.json(orders);
     });
@@ -41,6 +54,7 @@ export function registerOrdersReadRoutes(app, deps) {
         const field = role === 'seller' ? 'o.seller_id' : 'o.buyer_id';
         const from = req.query.from ? String(req.query.from) : null;
         const to = req.query.to ? String(req.query.to) : null;
+        const rail = req.query.rail === 'direct_p2p' ? 'direct_p2p' : req.query.rail === 'escrow' ? 'escrow' : null;
         const where = [`${field} = ?`];
         const params = [user.id];
         if (from) {
@@ -51,10 +65,15 @@ export function registerOrdersReadRoutes(app, deps) {
             where.push(`o.created_at <= ?`);
             params.push(to);
         }
+        if (rail) {
+            where.push(`o.payment_rail = ?`);
+            params.push(rail);
+        } // 按支付轨导出(对账:托管 vs 直接收款分开)
         const EXPORT_LIMIT = 5000;
         const rows = await dbAll(`
       SELECT o.id, o.created_at, o.status, o.quantity, o.unit_price, o.total_amount,
              o.coupon_discount, o.variant_options_snapshot, o.shipping_address,
+             COALESCE(o.payment_rail, 'escrow') as payment_rail,
              p.title as product_title, p.category,
              ub.handle as buyer_handle, ub.name as buyer_name,
              us.handle as seller_handle, us.name as seller_name
@@ -76,7 +95,7 @@ export function registerOrdersReadRoutes(app, deps) {
             }
             return s;
         };
-        const headers = ['order_id', 'created_at', 'status', 'product', 'category', 'qty', 'unit_price', 'total', 'coupon_discount', 'variant', 'buyer', 'seller', 'address'];
+        const headers = ['order_id', 'created_at', 'status', 'payment_rail', 'product', 'category', 'qty', 'unit_price', 'total', 'coupon_discount', 'variant', 'buyer', 'seller', 'address'];
         const lines = [headers.join(',')];
         for (const r of rows) {
             let variantStr = '';
@@ -87,7 +106,7 @@ export function registerOrdersReadRoutes(app, deps) {
             }
             catch { }
             lines.push([
-                r.id, r.created_at, r.status, r.product_title, r.category,
+                r.id, r.created_at, r.status, r.payment_rail, r.product_title, r.category,
                 r.quantity, r.unit_price, r.total_amount, r.coupon_discount || 0,
                 variantStr, r.buyer_handle, r.seller_handle, r.shipping_address,
             ].map(csvEscape).join(','));
@@ -103,7 +122,7 @@ export function registerOrdersReadRoutes(app, deps) {
         // UTF-8 BOM 帮 Excel 识别
         res.send('' + lines.join('\n'));
     });
-    // 订单签名链 — 当事人 + arbitrator + admin 可查
+    // 订单签名链 — 当事人 + 白名单仲裁员(涉争议订单) + admin 可查
     app.get('/api/orders/:id/chain', async (req, res) => {
         const user = auth(req, res);
         if (!user)
@@ -112,9 +131,12 @@ export function registerOrdersReadRoutes(app, deps) {
         if (!order)
             return void res.status(404).json({ error: '订单不存在' });
         const uid = user.id;
-        const isParty = uid === order.buyer_id || uid === order.seller_id || uid === order.logistics_id || user.role === 'arbitrator' || user.role === 'admin';
-        if (!isParty)
+        // 仲裁员链访问与订单详情同一谓词(arbitratorCanViewOrder):裁定需验签名链;legacy role==='arbitrator' 旁路已移除
+        //   (否则 role-only/已吊销账号可读任意订单链,而真·白名单仲裁员 role=buyer 反被 403,链徽标在裁定页显示"链异常")。
+        const isParty = uid === order.buyer_id || uid === order.seller_id || uid === order.logistics_id;
+        if (!isParty && user.role !== 'admin' && !(await arbitratorCanViewOrder(req.params.id, uid))) {
             return void res.status(403).json({ error: '无权查看此订单链' });
+        }
         const chain = await getOrderChain(db, req.params.id);
         const verification = await verifyOrderChain(db, req.params.id);
         res.json({ chain, verification });
@@ -145,7 +167,12 @@ export function registerOrdersReadRoutes(app, deps) {
         const order = statusInfo.order;
         const isLogisticsPickup = user.role === 'logistics' &&
             !order.logistics_id && order.status === 'shipped';
-        if (order.buyer_id !== user.id && order.seller_id !== user.id && order.logistics_id !== user.id && user.role !== 'arbitrator' && !isLogisticsPickup) {
+        // 白名单仲裁员(role 可能是 buyer,非 legacy 'arbitrator')需查看涉争议订单以裁定/复盘。能力源【唯一】= active
+        //   arbitrator_whitelist;legacy role 旁路已移除(否则 role-only/已吊销账号可读任意订单)。谓词= arbitratorCanViewOrder:
+        //   订单须【存在争议记录】(含已裁定/已驳回 —— 只放行 disputed 会让仲裁员在裁定落地、订单离开 disputed 的瞬间失去访问,
+        //   已结 tab 的"查看订单"全部 403);无争议记录的订单不可见 → 不可枚举。
+        const isParty = order.buyer_id === user.id || order.seller_id === user.id || order.logistics_id === user.id;
+        if (!isParty && !isLogisticsPickup && !(await arbitratorCanViewOrder(req.params.id, user.id))) {
             return void res.status(403).json({ error: '无权查看此订单' });
         }
         // M8: 二手订单从 secondhand_items 查；商家订单从 products 查
@@ -198,9 +225,42 @@ export function registerOrdersReadRoutes(app, deps) {
                 delete order.recipient_code;
             }
         }
-        // Direct Pay 响应契约门:direct_p2p 收款目标(instruction 快照 + 账号快照 qr_ref),买家在 D1/D2 both-acked 前
-        //   【不得】从 API 拿到(非仅 UI 软门)。与 /api/orders 列表共用同一 redact,防旁路(#179 审计 P1)。
-        redactUnackedDirectPayTarget(db, order, user.id);
+        // Direct Pay 响应契约门:收款目标按查看者投影 —— 买家在 D1/D2 both-acked 前不得拿到(非仅 UI 软门);卖家=收款方保留;
+        //   非买卖双方第三方(disputed-order 仲裁员、logistics-pickup)一律剥离(#179/#218 审计;仲裁若确需看收款目标,
+        //   应另做显式、可审计、受指派/案件/目的约束的 reveal 路径)。与 /api/orders 列表共用同一投影器,防旁路。
+        projectDirectPayTargetForViewer(db, order, user.id);
+        // Rail1 撤回仲裁可达性(与 orders-action pq_withdraw 权威门同谓词):仅当【当前 disputed + 最近一次进入
+        //   disputed 是 from payment_query + 争议未裁定】。前端据此才显示"撤回仲裁"按钮 —— 履约类争议(货损/货不对版
+        //   的 delivered→disputed)不给该按钮。UI 便利字段,真正拦截仍在路由。
+        const disputedFroms = history.filter(h => h.to_status === 'disputed').map(h => h.from_status);
+        order.can_withdraw_payment_query_dispute =
+            order.status === 'disputed' && disputedFroms[disputedFroms.length - 1] === 'payment_query' && !!dispute;
+        // 争议协商收口·买家侧(与 orders-action dispute_withdraw_confirm 权威门同谓词):仅当【当前 disputed +
+        //   最近一次进入 disputed 是 from delivered(履约争议)+ 争议未裁定 + 查看者=买家=争议发起人】。
+        //   前端据此才显示"我已收到货·撤诉并确认收货";UI 便利字段,真正拦截仍在路由。
+        order.can_confirm_receipt_close_dispute =
+            order.status === 'disputed' && disputedFroms[disputedFroms.length - 1] === 'delivered'
+                && !!dispute && dispute.initiator_id === user.id && order.buyer_id === user.id;
+        // 协商取消(无责·双方合意)握手状态 —— 仅 disputed 单计算,供订单页同步渲染 propose/accept/decline/withdraw。真正边界在 mutual-cancel 路由。
+        if (order.status === 'disputed') {
+            const mc = getMutualCancelState(db, req.params.id, user.id);
+            order.mutual_cancel = mc.ok ? { proposal: mc.proposal ?? null, can_propose: !!mc.can_propose, can_accept: !!mc.can_accept, can_decline: !!mc.can_decline, can_withdraw: !!mc.can_withdraw } : null;
+        }
+        // 直付取消退款握手状态(审计项 C)—— 仅 direct_p2p + accepted(付款后·发货前)计算,供订单页同步渲染。
+        //   party-gated(域内);非当事方(仲裁员等)拿 null。真正边界在 direct-pay-cancel-refund 路由。
+        if (order.payment_rail === 'direct_p2p' && order.status === 'accepted') {
+            const cr = getCancelRefundState(db, req.params.id, user.id);
+            order.cancel_refund = cr.ok ? { request: cr.request ?? null, can_request: !!cr.can_request, can_respond: !!cr.can_respond, can_confirm: !!cr.can_confirm, can_withdraw: !!cr.can_withdraw } : null;
+            // 审计项 F:卖家对账辅助 —— 同买家·同金额其它在途直付单计数(与 mark_paid D2 预警同口径,发货前每次打开订单页都能看到)。
+            //   仅卖家视角计算;买家/第三方不下发(无对账用途,少一分敞口)。
+            if (order.seller_id === user.id) {
+                const dupRow = await dbOne(`SELECT COUNT(*) n FROM orders WHERE buyer_id = ? AND seller_id = ? AND payment_rail = 'direct_p2p' AND total_amount = ? AND id != ? AND status IN ('accepted','shipped','picked_up','in_transit','delivered')`, [order.buyer_id, order.seller_id, order.total_amount, req.params.id]);
+                order.duplicate_amount_alert = dupRow?.n || 0;
+            }
+        }
+        // S0 交易条款快照:parse-don't-validate 后下放(坏 JSON/pre-S0 旧单 → null;原始串不下放)
+        order.trade_terms = readTradeTermsSnapshot(order.trade_terms_snapshot);
+        delete order.trade_terms_snapshot;
         res.json({ ...statusInfo, history, product, dispute, trackingInfo });
     });
     // Rail1 D2:直付订单收款二维码(硬化转发)。仅【订单买家】+ 两次披露 both-acked 后可取;按建单时快照的 (qr_ref, seller_id)
@@ -210,9 +270,11 @@ export function registerOrdersReadRoutes(app, deps) {
         if (!user)
             return;
         const orderId = String(req.params.id);
-        const order = await dbOne('SELECT buyer_id, seller_id, payment_rail, direct_pay_account_snapshot FROM orders WHERE id = ?', [orderId]);
+        const order = await dbOne('SELECT buyer_id, seller_id, payment_rail, status, direct_pay_account_snapshot FROM orders WHERE id = ?', [orderId]);
         if (!order || order.payment_rail !== 'direct_p2p' || order.buyer_id !== user.id)
             return void res.status(404).end();
+        if (order.status === 'pending_accept')
+            return void res.status(404).end(); // 手动接单待确认:状态门,接单前不出示收款码(v16)
         if (!requireBothDisclosuresAcked(db, orderId).ok)
             return void res.status(404).end(); // 未 ack:与"无 QR"同样 404,不泄露存在性
         let snap = {};

package/dist/pwa/routes/platform-receive-accounts.js

@@ -0,0 +1,111 @@
+import { createHash } from 'node:crypto';
+import { listPlatformAccounts, getPlatformAccount, addPlatformAccount, updatePlatformAccount, deactivatePlatformAccount } from '../../platform-receive-accounts.js';
+import { requireDirectPayHumanPasskey } from '../direct-pay-guards.js';
+const sha256hex = (s) => createHash('sha256').update(s).digest('hex');
+/** 稳定序列化(键排序)—— purpose_data 与请求体重算 payload 逐字比对,不受键序影响。 */
+function stable(o) {
+    return JSON.stringify(Object.keys(o).sort().reduce((a, k) => { a[k] = o[k]; return a; }, {}));
+}
+const GATE_PURPOSE = 'platform_receive_account_manage';
+export function registerPlatformReceiveAccountsRoutes(app, deps) {
+    const { db, requireRootAdmin, generateId, consumeGateToken, logAdminAction } = deps;
+    /** 从请求体重算【本次写入内容】的 canonical gate payload —— Passkey token 必须绑定它,证明 admin 确认的就是这份收款内容。
+     *  绑定字段:action, account_id?, instruction/method/currency/label(原文,与 body 逐字一致), qr_mode(keep|clear|set)+qr_sha256(set 时;绑 QR 内容而非塞 64KB 原文)。 */
+    function gateContentPayload(req, action, accountId) {
+        const b = req.body || {};
+        const p = { action };
+        if (accountId)
+            p.account_id = accountId;
+        if (action === 'add' || action === 'update') {
+            p.instruction = String(b.instruction ?? '');
+            p.method = String(b.method ?? '');
+            p.currency = String(b.currency ?? '');
+            p.label = String(b.label ?? '');
+            if (!('qr_data_uri' in b))
+                p.qr_mode = 'keep';
+            else if (b.qr_data_uri == null || String(b.qr_data_uri).trim() === '')
+                p.qr_mode = 'clear';
+            else {
+                p.qr_mode = 'set';
+                p.qr_sha256 = sha256hex(String(b.qr_data_uri));
+            }
+        }
+        return p;
+    }
+    /** ROOT + 现场真人 Passkey(写操作)。token 的 purpose_data 必须与本次请求体重算的 canonical payload 逐字相等
+     *  —— 否则(如用批 A 的 token 写 B 的收款地址,或 body 被篡改)拒。返回 true=通过(否则已写 403)。 */
+    function passkeyOk(req, res, adminId, action, accountId) {
+        const expected = stable(gateContentPayload(req, action, accountId));
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: adminId, webauthnToken: req.body?.webauthn_token,
+            purpose: GATE_PURPOSE,
+            validate: (data) => !!data && typeof data === 'object' && stable(data) === expected,
+        });
+        if (!gate.ok) {
+            res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+            return false;
+        }
+        return true;
+    }
+    const bodyInput = (req) => {
+        const b = req.body || {};
+        const out = { instruction: b.instruction, label: b.label, method: b.method, currency: b.currency };
+        if ('qr_data_uri' in b)
+            out.qrDataUri = b.qr_data_uri; // 缺省不改;给了(含 null/'')才动 qr
+        return out;
+    };
+    /** 审计摘要(canonical,不含 raw QR):便于事后还原"当时展示给卖家的收款内容"。instruction/qr 用 sha256。 */
+    const summarize = (a) => a == null ? null : { method: a.method ?? null, currency: a.currency ?? null, label: a.label ?? null, instruction_sha256: a.instruction ? sha256hex(a.instruction) : null, qr_sha256: a.qr_data_uri ? sha256hex(a.qr_data_uri) : null, had_qr: !!a.qr_data_uri };
+    // ── list(ROOT 读;含 inactive + qr_data_uri)──
+    app.get('/api/admin/platform-receive-accounts', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        res.json({ accounts: listPlatformAccounts(db, { includeInactive: true }) });
+    });
+    // ── add(ROOT + Passkey)──
+    app.post('/api/admin/platform-receive-accounts', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        if (!passkeyOk(req, res, admin.id, 'add'))
+            return;
+        const r = addPlatformAccount(db, bodyInput(req), generateId);
+        if (!r.ok)
+            return void res.status(400).json({ error: r.reason, error_code: 'PLATFORM_ACCOUNT_INPUT_INVALID' });
+        logAdminAction?.(admin.id, 'platform_receive_account_add', 'platform_receive_account', r.account.id, { new: summarize(r.account) });
+        res.json({ ok: true, account: r.account });
+    });
+    // ── update(ROOT + Passkey + 存在性)──
+    app.put('/api/admin/platform-receive-accounts/:id', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const id = String(req.params.id);
+        const before = getPlatformAccount(db, id);
+        if (!before)
+            return void res.status(404).json({ error: '平台收款方式不存在', error_code: 'PLATFORM_ACCOUNT_NOT_FOUND' });
+        if (!passkeyOk(req, res, admin.id, 'update', id))
+            return;
+        const r = updatePlatformAccount(db, id, bodyInput(req));
+        if (!r.ok)
+            return void res.status(400).json({ error: r.reason, error_code: 'PLATFORM_ACCOUNT_INPUT_INVALID' });
+        logAdminAction?.(admin.id, 'platform_receive_account_update', 'platform_receive_account', id, { old: summarize(before), new: summarize(getPlatformAccount(db, id)) });
+        res.json({ ok: true, changed: r.changed });
+    });
+    // ── deactivate(ROOT + Passkey + 存在性)──
+    app.delete('/api/admin/platform-receive-accounts/:id', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const id = String(req.params.id);
+        const before = getPlatformAccount(db, id);
+        if (!before)
+            return void res.status(404).json({ error: '平台收款方式不存在', error_code: 'PLATFORM_ACCOUNT_NOT_FOUND' });
+        if (!passkeyOk(req, res, admin.id, 'deactivate', id))
+            return;
+        const changed = deactivatePlatformAccount(db, id);
+        logAdminAction?.(admin.id, 'platform_receive_account_deactivate', 'platform_receive_account', id, { old: summarize(before) });
+        res.json({ ok: true, changed });
+    });
+}

package/dist/pwa/routes/products-create.js

@@ -23,9 +23,10 @@ export function registerProductsCreateRoutes(app, deps) {
         const quotaCheck = checkSellerCanList(user);
         if (!quotaCheck.ok)
             return void res.json({ error: quotaCheck.reason });
-        const { title, description, price, stock = 1, category = '', specs, brand, model, source_url, source_price, external_title, weight_kg, ship_regions = '全国', handling_hours = 24, estimated_days, fragile = 0, return_days = 7, return_condition = '', warranty_days = 0, low_stock_threshold = 3, auto_delist_on_zero = 1, commission_rate, product_type = 'retail', // 里程碑 6
+        const { title, description, price, stock = 1, category = '', specs, brand, model, source_url, source_price, external_title, weight_kg, ship_regions = '全国', handling_hours = 24, estimated_days, fragile = 0, return_days = 7, return_condition = '', warranty_days = 0, low_stock_threshold = 3, auto_delist_on_zero = 1, commission_rate, product_type = 'retail', create_status, // 里程碑 6 / S4:create_status='warehouse' 让含单品覆盖的新品先落仓库,覆盖全落定再激活(避免公开 active 但缺可售/税费声明)
         aliases = [], // 里程碑 7.2：上架时同步声明的 alias 集合
         image_hashes = [], // 商品图片 — 只存 hash（64 hex），实际 blob 在卖家节点 IDB
+        package_size, origin_country, country_of_origin, customs_description, hs_code, // S0 跨境清关/物流证据字段(全可选,零计费逻辑;进条款快照)
          } = req.body;
         // 协议化原则：服务端只存 hash 引用，不存图片字节。校验仅做格式 + 数量。
         let imagesJsonForInsert = null;
@@ -69,6 +70,12 @@ export function registerProductsCreateRoutes(app, deps) {
         const priceNum = Number(price);
         const stakeDiscount = await getStakeDiscount(db, user.id);
         const stakeRate = Math.max(0.05, 0.15 - stakeDiscount);
+        // S0 清关字段轻校验(可选;长度界 + 区码大写 + HS 编码字符集)
+        const _cc = (x) => (typeof x === 'string' && x.trim()) ? x.trim().toUpperCase().slice(0, 8) : null;
+        const _tx = (x, n) => (typeof x === 'string' && x.trim()) ? x.trim().slice(0, n) : null;
+        const _hs = _tx(hs_code, 12);
+        if (_hs && !/^[0-9.]{4,12}$/.test(_hs))
+            return void res.status(400).json({ error: 'hs_code 须为 4-12 位数字(可含 .)', error_code: 'INVALID_HS_CODE' });
         const stakeAmount = Math.round(priceNum * stakeRate * 100) / 100;
         const now = new Date().toISOString();
         const id = generateId('prd');
@@ -82,8 +89,9 @@ export function registerProductsCreateRoutes(app, deps) {
       return_days, return_condition, warranty_days,
       low_stock_threshold, auto_delist_on_zero,
       commitment_hash, description_hash, price_hash, hashed_at,
-      commission_rate, product_type, images, currency
-    ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'WAZ')`, [
+      commission_rate, product_type, images, currency,
+      package_size, origin_country, country_of_origin, customs_description, hs_code, status
+    ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'WAZ',?,?,?,?,?,?)`, [
             id, user.id, title, description, priceNum, Number(stock), category, stakeAmount,
             specsJson, brand ?? null, model ?? null,
             source_url ?? null, source_price ? Number(source_price) : null, source_price ? now : null,
@@ -92,7 +100,8 @@ export function registerProductsCreateRoutes(app, deps) {
             Math.max(0, Math.floor(Number(low_stock_threshold) || 0)), auto_delist_on_zero ? 1 : 0,
             makeCommitmentHash(pFields), makeDescriptionHash({ title, description, specs: specsJson }),
             makePriceHash(priceNum, now), now,
-            commissionRateNum, product_type, imagesJsonForInsert
+            commissionRateNum, product_type, imagesJsonForInsert,
+            _tx(package_size, 40), _cc(origin_country), _cc(country_of_origin), _tx(customs_description, 120), _hs, create_status === 'warehouse' ? 'warehouse' : 'active'
         ]);
         // M7.2.6：免质押上架 — 不再扣 stake；首单成交时 settleOrder 自动从订单 escrow 锁定
         // M7.2-6: 上架时同步入 aliases（卖家已勾选的 candidates）

package/dist/pwa/routes/products-update.js

@@ -10,7 +10,8 @@ export function registerProductsUpdateRoutes(app, deps) {
         const product = await dbOne('SELECT * FROM products WHERE id = ? AND seller_id = ?', [req.params.id, user.id]);
         if (!product)
             return void res.status(404).json({ error: '商品不存在或无权限' });
-        const { title, description, price, stock, specs, brand, model, handling_hours, ship_regions, estimated_days, fragile, return_days, return_condition, warranty_days, low_stock_threshold, auto_delist_on_zero, origin_claims, i18n_titles, i18n_descs, } = req.body;
+        const { title, description, price, stock, specs, brand, model, handling_hours, ship_regions, estimated_days, fragile, return_days, return_condition, warranty_days, low_stock_threshold, auto_delist_on_zero, origin_claims, i18n_titles, i18n_descs, weight_kg, package_size, origin_country, country_of_origin, customs_description, hs_code, // S0 跨境清关/物流证据字段(可选;进后续订单条款快照,不影响在途单)
+         } = req.body;
         const now = new Date().toISOString();
         const specsJson = specs != null ? (typeof specs === 'object' ? JSON.stringify(specs) : specs) : product.specs;
         const estJson = estimated_days != null ? (typeof estimated_days === 'object' ? JSON.stringify(estimated_days) : String(estimated_days)) : product.estimated_days;
@@ -80,6 +81,12 @@ export function registerProductsUpdateRoutes(app, deps) {
             }
             return Object.keys(out).length > 0 ? JSON.stringify(out) : null;
         };
+        // S0 清关字段(可选;与 create 同校验;null 显式清除,undefined 保留)
+        const _cc = (x) => x === undefined ? undefined : ((typeof x === 'string' && x.trim()) ? x.trim().toUpperCase().slice(0, 8) : null);
+        const _tx = (x, n) => x === undefined ? undefined : ((typeof x === 'string' && x.trim()) ? x.trim().slice(0, n) : null);
+        const _hs = _tx(hs_code, 12);
+        if (typeof _hs === 'string' && !/^[0-9.]{4,12}$/.test(_hs))
+            return void res.status(400).json({ error: 'hs_code 须为 4-12 位数字(可含 .)', error_code: 'INVALID_HS_CODE' });
         const titlesResult = validateI18n(i18n_titles);
         const descsResult = validateI18n(i18n_descs);
         const newI18nTitles = titlesResult === undefined ? product.i18n_titles : titlesResult;
@@ -92,6 +99,7 @@ export function registerProductsUpdateRoutes(app, deps) {
       low_stock_alerted_at = CASE WHEN ?=1 THEN NULL ELSE low_stock_alerted_at END,
       origin_claims=?,
       i18n_titles=?, i18n_descs=?,
+      weight_kg=?, package_size=?, origin_country=?, country_of_origin=?, customs_description=?, hs_code=?,
       commitment_hash=?, description_hash=?, price_hash=?, hashed_at=?,
       updated_at=datetime('now')
       WHERE id=?`, [
@@ -102,6 +110,12 @@ export function registerProductsUpdateRoutes(app, deps) {
             newLowThreshold, newAutoDelist, resetAlert,
             newOriginClaims,
             newI18nTitles, newI18nDescs,
+            weight_kg === undefined ? product.weight_kg : (weight_kg === null || weight_kg === '' ? null : Number(weight_kg)),
+            _tx(package_size, 40) === undefined ? product.package_size : _tx(package_size, 40),
+            _cc(origin_country) === undefined ? product.origin_country : _cc(origin_country),
+            _cc(country_of_origin) === undefined ? product.country_of_origin : _cc(country_of_origin),
+            _tx(customs_description, 120) === undefined ? product.customs_description : _tx(customs_description, 120),
+            _hs === undefined ? product.hs_code : _hs,
             makeCommitmentHash(pFields),
             makeDescriptionHash({ title: newTitle, description: newDesc, specs: specsJson }),
             makePriceHash(newPrice, now), now,

package/dist/pwa/routes/profile-identity.js

@@ -59,8 +59,10 @@ export function registerProfileIdentityRoutes(app, deps) {
         const roles = safeRoles(user);
         if (!roles.includes(role))
             return void res.json({ error: '你还没有该角色，请先添加' });
-        // 防御：已是 admin/verifier 的用户不能切到 buyer/seller（防遗留多角色账户绕过）
-        if (roles.some(r => ROLE_LOCKED_ROLES.includes(r)) && !ROLE_LOCKED_ROLES.includes(role)) {
+        // 防御：已是 admin/verifier 的用户不能切到 buyer/seller（防遗留多角色账户绕过）。
+        //   锁的是【交易面目标】,不是一切切换 —— 此前 `!ROLE_LOCKED_ROLES.includes(role)` 连 verifier→arbitrator/logistics
+        //   (同为受信/治理身份,零交易能力)都拦 → 切到审核员后被永久卡死在审核员(梦想者1号案:回不到仲裁员)。
+        if (roles.some(r => ROLE_LOCKED_ROLES.includes(r)) && ['buyer', 'seller'].includes(role)) {
             return void res.json({
                 error: '受信角色不能切换为 buyer / seller',
                 hint: '权责分离原则；如需买卖请用其他账号。'

package/dist/pwa/routes/returns.js

@@ -2,6 +2,9 @@ import { recordRepEvent } from '../../layer4-economics/L4-3-reputation/reputatio
 // RFC-016 Phase 1 — 端点校验读/列表读 + 状态翻转/消息/通知单写 → async seam;
 //   executeReturnRefund 退款 db.transaction(钱+库存)与 escalate 建争议 tx 保持同步(Phase 3 迁 pg)。
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js';
+// 直付(direct_p2p)退货:物流/协商骨架共用,退款执行环节换成场外握手(零资金零库存回补)。
+//   mark-refunded / confirm-refund 端点在 routes/direct-pay-returns.ts。
+import { enterAwaitRefund, directPayReturnEscalatable, returnRefundRespondDays } from '../../direct-pay-returns.js';
 const VALID_RETURN_REASONS = new Set(['quality', 'wrong_item', 'damaged', 'no_longer_needed', 'other']);
 const RETURN_REASON_DEFAULT_LABEL = {
     quality: '质量问题',
@@ -97,12 +100,10 @@ export function registerReturnsRoutes(app, deps) {
             return void res.status(404).json({ error: '订单不存在' });
         if (order.buyer_id !== user.id)
             return void res.status(403).json({ error: '仅买家可申请退货' });
-        // 直付(Rail1)= 非托管、refund:none —— WebAZ 不持货款,退款经现有 escrow 钱包路径会错误移动无关 WAZ。
-        //   故 direct_p2p 不走退货/退款流程(买家不满走争议=信誉处理);平台费应收的冲销由治理/admin 调整处理(非此路径)。
-        if (order.payment_rail === 'direct_p2p') {
-            return void res.status(400).json({ error: '直付(非托管)订单不支持退款流程;如有问题请发起争议', error_code: 'DIRECT_PAY_NO_REFUND' });
-        }
-        // P0-1: 只允许 completed 退货 — escrow 已结算
+        // 直付(Rail1)= 非托管:退货【物流/协商骨架照用】,但退款执行环节换成场外握手(src/direct-pay-returns.ts,
+        //   accept → await_refund → 卖家 mark_refunded → 买家 Passkey confirm → refunded)。零资金零库存回补
+        //   (已出库=B 类,退货验收上架);平台费应收的冲销仍由治理/admin 调整处理(非此路径)。
+        // P0-1: 只允许 completed 退货 — escrow 已结算(直付同口径:确认收货后)
         if (order.status !== 'completed') {
             return void res.status(400).json({ error: '仅订单完成后可申请退货（确认收货后）' });
         }
@@ -115,7 +116,7 @@ export function registerReturnsRoutes(app, deps) {
             return void res.status(400).json({ error: `已超过 ${returnDays} 天退货窗口` });
         }
         const existing = await dbOne(`
-      SELECT id, status FROM return_requests WHERE order_id = ? AND status IN ('pending', 'accepted') LIMIT 1
+      SELECT id, status FROM return_requests WHERE order_id = ? AND status IN ('pending', 'accepted', 'accepted_pickup_pending', 'picked_up', 'await_refund', 'refund_marked') LIMIT 1
     `, [order.id]);
         if (existing)
             return void res.status(400).json({ error: `已存在退货请求 (${existing.status})` });
@@ -221,6 +222,10 @@ export function registerReturnsRoutes(app, deps) {
         const response = req.body?.response ? String(req.body.response).slice(0, 500) : null;
         if (decision === 'reject' && !response)
             return void res.status(400).json({ error: '拒绝时必须填写说明' });
+        // 直付(direct_p2p):同意退货后不走 escrow 钱包退款,进入场外退款握手(await_refund)。取件流照用
+        //   (accepted_pickup_pending → picked_up → received 时再进 await_refund)。
+        const railRow = await dbOne('SELECT payment_rail FROM orders WHERE id = ?', [rr.order_id]);
+        const isDirectPay = railRow?.payment_rail === 'direct_p2p';
         if (decision === 'accept') {
             if (Number(rr.pickup_requested) === 1) {
                 await dbRun(`UPDATE return_requests SET status = 'accepted_pickup_pending', seller_response = ? WHERE id = ?`, [response, rr.id]);
@@ -234,6 +239,16 @@ export function registerReturnsRoutes(app, deps) {
                 catch { }
                 return void res.json({ success: true, status: 'accepted_pickup_pending' });
             }
+            if (isDirectPay) {
+                const r = enterAwaitRefund(db, { returnId: String(rr.id), fromStatus: 'pending', sellerResponse: response, messageId: generateId('rmsg') });
+                if (!r.ok)
+                    return void res.status(409).json({ error: r.error, error_code: r.error_code });
+                try {
+                    await dbRun(`INSERT INTO notifications (id, user_id, type, title, body, order_id) VALUES (?,?,?,?,?,?)`, [generateId('ntf'), rr.buyer_id, 'direct_pay_return_await_refund', '✓ 退货已同意 · 等待卖家场外退款', '直付订单非托管:卖家将在协议外向你退款并声明,请核实到账后在订单页确认(需 Passkey)。卖家超期未退款可升级争议。', rr.order_id]);
+                }
+                catch { }
+                return void res.json({ success: true, status: 'await_refund' });
+            }
             try {
                 executeReturnRefund(rr, response, 'pending');
             }
@@ -402,6 +417,18 @@ export function registerReturnsRoutes(app, deps) {
         if (rr.status !== 'picked_up')
             return void res.status(400).json({ error: `当前状态 ${rr.status}，不可确认（应在 picked_up 状态）` });
         const note = req.body?.note ? String(req.body.note).slice(0, 300) : null;
+        // 直付:收到退货后进入场外退款握手(不走 escrow 钱包退款)
+        const railRow = await dbOne('SELECT payment_rail FROM orders WHERE id = ?', [rr.order_id]);
+        if (railRow?.payment_rail === 'direct_p2p') {
+            const r = enterAwaitRefund(db, { returnId: String(rr.id), fromStatus: 'picked_up', sellerResponse: note, messageId: generateId('rmsg') });
+            if (!r.ok)
+                return void res.status(409).json({ error: r.error, error_code: r.error_code });
+            try {
+                await dbRun(`INSERT INTO notifications (id, user_id, type, title, body, order_id) VALUES (?,?,?,?,?,?)`, [generateId('ntf'), rr.buyer_id, 'direct_pay_return_await_refund', '✓ 卖家已收到退货 · 等待场外退款', '直付订单非托管:卖家将在协议外向你退款并声明,请核实到账后在订单页确认(需 Passkey)。卖家超期未退款可升级争议。', rr.order_id]);
+            }
+            catch { }
+            return void res.json({ success: true, status: 'await_refund' });
+        }
         try {
             executeReturnRefund(rr, note, 'picked_up');
         }
@@ -474,7 +501,11 @@ export function registerReturnsRoutes(app, deps) {
             return void res.status(404).json({ error: '不存在' });
         if (rr.buyer_id !== user.id)
             return void res.status(403).json({ error: '仅买家可升级' });
-        if (rr.status !== 'rejected' && rr.status !== 'pending') {
+        // 直付握手状态可升级:refund_marked 随时(声明≠到账);await_refund 超 respond 窗(卖家同意却不退款)
+        const isDpEsc = ['await_refund', 'refund_marked'].includes(String(rr.status)) && directPayReturnEscalatable(db, rr);
+        if (rr.status !== 'rejected' && rr.status !== 'pending' && !isDpEsc) {
+            if (rr.status === 'await_refund')
+                return void res.status(400).json({ error: `卖家有 ${returnRefundRespondDays(db)} 天场外退款窗口，超期后可升级` });
             return void res.status(400).json({ error: `当前状态 ${rr.status}，无法升级` });
         }
         if (rr.status === 'pending') {

package/dist/pwa/routes/seller-directpay-report.js

@@ -0,0 +1,110 @@
+import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js';
+// 直付订单状态桶(与状态机一致):已完成(计提平台费)/ 在途 / 已取消·退款。
+const COMPLETED = ['completed', 'confirmed'];
+const IN_FLIGHT = ['pending_accept', 'direct_pay_window', 'accepted', 'shipped', 'picked_up', 'in_transit', 'delivered', 'payment_query', 'direct_expired_unconfirmed'];
+const CLOSED_NEG = ['cancelled', 'expired', 'refunded_full', 'refunded_partial', 'dispute_dismissed', 'resolved_for_seller', 'fault_seller', 'fault_buyer', 'fault_logistics'];
+const inList = (col, arr) => `${col} IN (${arr.map(() => '?').join(',')})`;
+export function registerSellerDirectPayReportRoutes(app, deps) {
+    const { db, auth } = deps;
+    function requireSeller(req, res) {
+        const user = auth(req, res);
+        if (!user)
+            return null;
+        const roles = (() => { try {
+            return JSON.parse(String(user.roles ?? '[]'));
+        }
+        catch {
+            return [];
+        } })();
+        if (user.role !== 'seller' && !(Array.isArray(roles) && roles.includes('seller'))) {
+            res.status(403).json({ error: '仅卖家可查看', error_code: 'SELLER_ONLY' });
+            return null;
+        }
+        return user;
+    }
+    // GET /api/sellers/me/direct-pay-report?from=YYYY-MM-DD&to=YYYY-MM-DD
+    //   from/to 均可选(闭区间,按日期比较 substr(created_at,1,10));返回汇总 + 按月 + 逐单(含平台费明细)。
+    app.get('/api/sellers/me/direct-pay-report', async (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        const sellerId = user.id;
+        const from = typeof req.query.from === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(req.query.from) ? req.query.from : null;
+        const to = typeof req.query.to === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(req.query.to) ? req.query.to : null;
+        const range = [];
+        const rp = [];
+        if (from) {
+            range.push('substr(o.created_at,1,10) >= ?');
+            rp.push(from);
+        }
+        if (to) {
+            range.push('substr(o.created_at,1,10) <= ?');
+            rp.push(to);
+        }
+        const rangeClause = range.length ? ' AND ' + range.join(' AND ') : '';
+        // ① 汇总(单查:订单数 / 销售额 / 各桶计数与已完成销售额)
+        const summary = (await dbOne(`
+      SELECT
+        COUNT(*) as order_count,
+        COALESCE(SUM(o.total_amount), 0) as gross_order_total,
+        SUM(CASE WHEN ${inList('o.status', COMPLETED)} THEN 1 ELSE 0 END) as completed_count,
+        COALESCE(SUM(CASE WHEN ${inList('o.status', COMPLETED)} THEN o.total_amount ELSE 0 END), 0) as completed_sales,
+        SUM(CASE WHEN ${inList('o.status', IN_FLIGHT)} THEN 1 ELSE 0 END) as in_flight_count,
+        SUM(CASE WHEN ${inList('o.status', CLOSED_NEG)} THEN 1 ELSE 0 END) as closed_count
+      FROM orders o
+      WHERE o.seller_id = ? AND o.payment_rail = 'direct_p2p'${rangeClause}
+    `, [...COMPLETED, ...COMPLETED, ...IN_FLIGHT, ...CLOSED_NEG, sellerId, ...rp]));
+        // ② 区间内已计提平台费合计(逐单应收 join 订单,按订单下单日筛)
+        const feeAgg = (await dbOne(`
+      SELECT COALESCE(SUM(r.amount), 0) as fee_accrued, COUNT(*) as fee_count
+      FROM direct_pay_fee_receivables r JOIN orders o ON o.id = r.order_id
+      WHERE o.seller_id = ? AND o.payment_rail = 'direct_p2p'${rangeClause}
+    `, [sellerId, ...rp]));
+        // ③ 按月(最多 24 个月)—— 订单总额(含各状态)与完成单销售额分列,不混
+        const byMonth = await dbAll(`
+      SELECT substr(o.created_at, 1, 7) as month, COUNT(*) as order_count,
+             COALESCE(SUM(o.total_amount), 0) as gross_order_total,
+             COALESCE(SUM(CASE WHEN ${inList('o.status', COMPLETED)} THEN o.total_amount ELSE 0 END), 0) as completed_sales
+      FROM orders o
+      WHERE o.seller_id = ? AND o.payment_rail = 'direct_p2p'${rangeClause}
+      GROUP BY month ORDER BY month DESC LIMIT 24
+    `, [...COMPLETED, sellerId, ...rp]);
+        // ④ 逐单明细(含平台费:LEFT JOIN 应收表 —— 未完成单尚无 fee 行,fee 为 null)。上限 500。
+        const LIMIT = 500;
+        const rows = await dbAll(`
+      SELECT o.id, o.created_at, o.status, o.total_amount, o.ship_to_region, p.title as product_title,
+             r.amount as fee_amount, r.accrued_at as fee_accrued_at
+      FROM orders o
+      LEFT JOIN products p ON p.id = o.product_id
+      LEFT JOIN direct_pay_fee_receivables r ON r.order_id = o.id
+      WHERE o.seller_id = ? AND o.payment_rail = 'direct_p2p'${rangeClause}
+      ORDER BY o.created_at DESC LIMIT ?
+    `, [sellerId, ...rp, LIMIT + 1]);
+        const truncated = rows.length > LIMIT;
+        if (truncated)
+            rows.length = LIMIT;
+        res.setHeader('Cache-Control', 'no-store');
+        res.json({
+            range: { from, to },
+            currency_note: '销售额=下单计价币(买家应付金额);平台服务费=USDC。两者不同币种,分列展示。',
+            summary: {
+                order_count: Number(summary.order_count) || 0,
+                gross_order_total: Number(summary.gross_order_total) || 0, // 所有状态订单总额(含在途/已关闭)—— 非真实销售
+                completed_count: Number(summary.completed_count) || 0,
+                completed_sales: Number(summary.completed_sales) || 0, // 真实销售(仅 completed/confirmed)
+                in_flight_count: Number(summary.in_flight_count) || 0,
+                closed_count: Number(summary.closed_count) || 0,
+                fee_accrued_total: Number(feeAgg.fee_accrued) || 0, // 区间已计提平台费(USDC)
+                fee_order_count: Number(feeAgg.fee_count) || 0,
+            },
+            by_month: byMonth.map(m => ({ month: m.month, order_count: Number(m.order_count) || 0, gross_order_total: Number(m.gross_order_total) || 0, completed_sales: Number(m.completed_sales) || 0 })),
+            orders: rows.map(r => ({
+                id: r.id, created_at: r.created_at, status: r.status, total_amount: Number(r.total_amount) || 0,
+                ship_to_region: r.ship_to_region || null, product_title: r.product_title || null,
+                fee_amount: r.fee_amount == null ? null : Number(r.fee_amount), // null=未完成尚未计提
+                fee_accrued_at: r.fee_accrued_at || null,
+            })),
+            truncated,
+        });
+    });
+}