@seasonkoh/webaz 0.1.29 → 0.1.30

package/dist/layer0-foundation/L0-1-database/schema.js

@@ -253,6 +253,21 @@ export function initDatabase() {
       updated_at    TEXT DEFAULT (datetime('now'))
     );
 
+    -- 平台(WebAZ)收款方式(admin 管理,可多个 active):卖家申请充值【平台服务费】时看到、据此线下付款。
+    -- ⚠️ 这是【平台侧】收款配置,不是卖家账号。改它 = 改平台收款流向 → 端点 root + Passkey 门。
+    --   instruction 是平台公开收款明细,给卖家看(非披露门)。qr 内联存(admin 精选、少量;写时 validateQrDataUri 校验 png/webp≤64KB)。
+    CREATE TABLE IF NOT EXISTS platform_receive_accounts (
+      id            TEXT PRIMARY KEY,
+      label         TEXT,                          -- 短标签(如 "PayNow-主" / "USDC-Base")
+      method        TEXT,                          -- 收款方式(PayNow / Bank / USDC…)
+      currency      TEXT,                          -- 币种(卖家据此付)
+      instruction   TEXT NOT NULL,                 -- 平台收款明细(账号 / 钱包地址 / 链接),展示给卖家
+      qr_data_uri   TEXT,                          -- 可选收款码,内联 data:image/(png|webp);base64(写时校验;≤64KB)
+      status        TEXT NOT NULL DEFAULT 'active',-- active | inactive
+      created_at    TEXT DEFAULT (datetime('now')),
+      updated_at    TEXT DEFAULT (datetime('now'))
+    );
+
     -- 直付收款二维码图(Phase C):卖家收款码原始字节。【不可变、按内容寻址(per-seller)】—— ref = sha256(bytes),
     -- replace = 插新行,旧行永不改/删(触发器强制),这样订单可在建单时快照 (ref, seller_id) 并在 D1/D2 ack 后取回【当时那一版】QR。
     -- ⚠️ 主键 = (ref, seller_id):内容寻址【按卖家隔离】。两个卖家上传【相同】字节时各得一行(否则 INSERT OR IGNORE
@@ -445,6 +460,26 @@ export function initDatabase() {
     );
     CREATE INDEX IF NOT EXISTS idx_dp_fee_payments_seller ON direct_pay_fee_payments(seller_id);
 
+    -- 平台服务费【预充值申请】(卖家发起 → admin 核实真实到账后确认入账)。留痕:凭据必填、状态流转、关联入账 payment。
+    --   ⚠️ 申请【不动钱】—— 只有 admin 确认(PR3)才调 recordFeePrepay 记入余额。amount_units = base units(1 WAZ=1e6)。
+    --   platform_account_id = 付给哪个平台收款方式(见 platform_receive_accounts)。杜绝"场外直接付、无据可查"。
+    CREATE TABLE IF NOT EXISTS direct_pay_fee_prepay_requests (
+      id                   TEXT PRIMARY KEY,
+      seller_id            TEXT NOT NULL REFERENCES users(id),
+      amount_units         INTEGER NOT NULL,          -- 申请充值额(base units)
+      currency             TEXT,                      -- 卖家声明的付款币种(展示;以实际到账为准)
+      platform_account_id  TEXT NOT NULL REFERENCES platform_receive_accounts(id),  -- 付给哪个平台收款方式(必选;admin 据此核对到账来源)
+      evidence_ref         TEXT NOT NULL,             -- 付款凭证号/流水(必填 —— 不能无据)
+      evidence_note        TEXT,
+      status               TEXT NOT NULL DEFAULT 'pending',  -- pending | approved | rejected | cancelled
+      created_at           TEXT DEFAULT (datetime('now')),
+      reviewed_by          TEXT REFERENCES users(id), -- admin(PR3 approve/reject 时填,Passkey)
+      reviewed_at          TEXT,
+      review_note          TEXT,
+      resulting_payment_id TEXT REFERENCES direct_pay_fee_payments(id)   -- approve 时关联的入账记录
+    );
+    CREATE INDEX IF NOT EXISTS idx_dp_fee_prepay_req_seller ON direct_pay_fee_prepay_requests(seller_id, status);
+
     -- ⏸ DORMANT(早先"AR 信用上限"模型预留;当前 = 首单宽限 + 预充值续用,额度即商家实际预付余额,无固定上限)。
     --   本表与 ceiling_requests/invoices/invoice_items/invoice_events 当前【不写不读】;保留待将来需要时复用或清理。
     CREATE TABLE IF NOT EXISTS direct_pay_fee_ar_seller_overrides (
@@ -631,6 +666,14 @@ export function initDatabase() {
         db.exec(`ALTER TABLE orders ADD COLUMN direct_grace_deadline TEXT`);
     }
     catch { /* 已存在 */ } // Rail1 paid-but-timeout 宽限期:系统在此之前绝不关单(买家 →disputed 窗口)
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN payment_query_deadline TEXT`);
+    }
+    catch { /* 已存在 */ } // Rail1 货款协商:卖家报未收款后买家响应宽限(过期→卖家可请求取消)
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN payment_query_cancel_deadline TEXT`);
+    }
+    catch { /* 已存在 */ } // Rail1 货款协商:卖家请求取消后买家 7 天申诉窗(过期→cron 关单;窗内买家可升举证仲裁)
     try {
         db.exec(`ALTER TABLE orders ADD COLUMN direct_pay_instruction_snapshot TEXT`);
     }
@@ -668,6 +711,158 @@ export function initDatabase() {
         db.exec(`ALTER TABLE orders ADD COLUMN direct_pay_decision_code TEXT`);
     }
     catch { /* 已存在 */ }
+    // 手动接单模式(v16):卖家可选 auto/manual(单品覆盖 ?? 店铺默认 ?? auto);manual 直付单先进 pending_accept。
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN accept_mode TEXT`);
+    }
+    catch { /* 已存在 */ } // 'auto'|'manual'|NULL(=继承店铺默认)
+    try {
+        db.exec(`ALTER TABLE users ADD COLUMN store_accept_mode TEXT`);
+    }
+    catch { /* 已存在 */ } // 店铺级默认 'auto'|'manual'|NULL(=auto)
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN accept_mode_snapshot TEXT`);
+    }
+    catch { /* 已存在 */ } // 下单时快照(卖家事后改不影响在途单)
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN pending_accept_deadline TEXT`);
+    }
+    catch { /* 已存在 */ } // 接单窗(专属 cron 读;超时无责取消+回补库存)
+    // 运费模板(PR-2):按收货地区预设运费/时效;下单命中 → 运费并入总额并快照(卖家改模板不影响在途单)。
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN shipping_template TEXT`);
+    }
+    catch { /* 已存在 */ } // JSON [{region,fee,est_days}];NULL=继承店铺默认
+    try {
+        db.exec(`ALTER TABLE users ADD COLUMN store_shipping_template TEXT`);
+    }
+    catch { /* 已存在 */ } // 店铺级默认模板
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN ship_to_region TEXT`);
+    }
+    catch { /* 已存在 */ } // 买家下单所选收货地区(结构化,非自由文本地址)
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN shipping_fee DECIMAL(18,2)`);
+    }
+    catch { /* 已存在 */ } // 下单快照运费(已并入 total_amount;NULL=无模板旧单)
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN shipping_est_days TEXT`);
+    }
+    catch { /* 已存在 */ } // 下单快照预计时效(展示;不接判责钟)
+    // 询价握手(PR-3,直付轨):模板外地区先报价后接单。quote_ok=卖家 opt-in(单品??店铺,默认关)。
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN shipping_quote_ok INTEGER`);
+    }
+    catch { /* 已存在 */ } // 1|0|NULL(=继承店铺)
+    try {
+        db.exec(`ALTER TABLE users ADD COLUMN store_shipping_quote_ok INTEGER`);
+    }
+    catch { /* 已存在 */ } // 店铺级默认(NULL=关)
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN shipping_quote_required INTEGER`);
+    }
+    catch { /* 已存在 */ } // 1=本单须先报价(pending_accept 内子流)
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN shipping_quote_fee DECIMAL(18,2)`);
+    }
+    catch { /* 已存在 */ } // 卖家报价运费(买家确认后并入 total_amount)
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN shipping_quote_est_days TEXT`);
+    }
+    catch { /* 已存在 */ }
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN shipping_quote_note TEXT`);
+    }
+    catch { /* 已存在 */ }
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN shipping_quote_at TEXT`);
+    }
+    catch { /* 已存在 */ }
+    // 跨境交易条款骨架(S0):清关/物流证据字段(即时开放,展示+快照证据,零计费逻辑=守 ERP 边界)+
+    //   结构化规则列(sale_regions/tax_lines/import_duty_terms 先建列【不开 API】—— 不上假开关:S1 带可售 gate、
+    //   S3 带税费明细进 total 时才各自开放;既有 ship_regions 是自由文本仅展示,真相源=这些结构化列)。
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN weight_kg REAL`);
+    }
+    catch { /* 已存在 */ } // 重量(S0 起 products-update 也写此列 → 收进 base schema,不再只靠 server.ts 迁移;裸 init 路径一致有列)
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN package_size TEXT`);
+    }
+    catch { /* 已存在 */ } // 长x宽x高 cm 文本(证据/报价参考)
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN origin_country TEXT`);
+    }
+    catch { /* 已存在 */ } // 发货国(ISO 区码)
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN country_of_origin TEXT`);
+    }
+    catch { /* 已存在 */ } // 原产国(清关申报)
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN customs_description TEXT`);
+    }
+    catch { /* 已存在 */ } // 报关品名(英文)
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN hs_code TEXT`);
+    }
+    catch { /* 已存在 */ } // HS 编码(可选)
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN sale_regions TEXT`);
+    }
+    catch { /* 已存在 */ } // S1 gate 消费:{mode,include,exclude} JSON(NULL=继承店铺)
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN tax_lines TEXT`);
+    }
+    catch { /* 已存在 */ } // S3 消费:按目的区税费科目 JSON(NULL=继承店铺)
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN import_duty_terms TEXT`);
+    }
+    catch { /* 已存在 */ } // 'ddu'|'ddp'|NULL(=继承店铺;跨境进口税责声明)
+    try {
+        db.exec(`ALTER TABLE users ADD COLUMN store_sale_regions TEXT`);
+    }
+    catch { /* 已存在 */ }
+    try {
+        db.exec(`ALTER TABLE users ADD COLUMN store_tax_lines TEXT`);
+    }
+    catch { /* 已存在 */ }
+    try {
+        db.exec(`ALTER TABLE users ADD COLUMN store_import_duty_terms TEXT`);
+    }
+    catch { /* 已存在 */ }
+    try {
+        db.exec(`ALTER TABLE orders ADD COLUMN trade_terms_snapshot TEXT`);
+    }
+    catch { /* 已存在 */ } // 下单冻结的交易条款 JSON(运费来源/时效/退货/清关字段/税责声明;商家事后改设置不影响旧订单,争议依据)
+    // 营销域满额免邮(S2 返工:从运费模板移出 —— 模板=成本结构,免邮=促销;供应商报价期规则不搬家)
+    try {
+        db.exec(`ALTER TABLE products ADD COLUMN free_shipping_threshold DECIMAL(18,2)`);
+    }
+    catch { /* 已存在 */ }
+    try {
+        db.exec(`ALTER TABLE users ADD COLUMN store_free_shipping_threshold DECIMAL(18,2)`);
+    }
+    catch { /* 已存在 */ }
+    // ── 商品【非钱路】扩展列收敛到 base(测试 schema 初始化单一来源;与 weight_kg S4 同法)──
+    //   products-create/update/read 写这些属性/溯源/物流/退货/i18n/库存/信誉计数列;历史上只在 server.ts 迁移段(或 MCP register-list-search 助手),
+    //   裸 initDatabase / bridge / 测试缺列 → 各测试各自手动补 ALTER(band-aid)。收进 base 后每条 init 路径一致有列,band-aid 可删。
+    //   server.ts 内联迁移【保留不动】(byte-identical guarded ALTER,生产迁移序不变;非 wholesale 抽取,不碰钱/单/状态迁移)。
+    //   刻意排除:commission_rate(佣金=钱路,不进);stake_amount / images 已在 CREATE TABLE products。
+    for (const col of [
+        'specs TEXT', 'brand TEXT', 'model TEXT', 'source_price REAL', 'ship_regions TEXT DEFAULT "全国"', // 属性 + 溯源参考 + 既有自由文本运费地区
+        'handling_hours INTEGER DEFAULT 24', 'estimated_days TEXT', 'fragile INTEGER DEFAULT 0', // 履约:处理时长/预计时效/易碎
+        'return_days INTEGER DEFAULT 7', 'return_condition TEXT', 'warranty_days INTEGER DEFAULT 0', // 退货/保修承诺
+        'source_url TEXT', 'source_price_at TEXT', // 溯源链接 + 采价时间
+        'commitment_hash TEXT', 'description_hash TEXT', 'price_hash TEXT', 'hashed_at TEXT', // 承诺哈希(内容/描述/价格),非价格数值本身
+        'origin_claims TEXT', 'i18n_titles TEXT', 'i18n_descs TEXT', `product_type TEXT DEFAULT 'retail'`, 'has_variants INTEGER DEFAULT 0', // 声明/多语言/分型
+        'last_sold_at TEXT', 'first_sold_at TEXT', // 销售生命周期时间戳(展示/排序)
+        'completion_count INTEGER DEFAULT 0', 'dispute_loss_count INTEGER DEFAULT 0', 'claim_loss_count INTEGER DEFAULT 0', 'value_badge INTEGER DEFAULT 0', // 信誉/价值计数(纯列,不含状态机/结算逻辑)
+        'low_stock_threshold INTEGER DEFAULT 3', 'auto_delist_on_zero INTEGER DEFAULT 1', 'low_stock_alerted_at TEXT', // 低库存提醒/自动下架(库存运营)
+    ]) {
+        try {
+            db.exec(`ALTER TABLE products ADD COLUMN ${col}`);
+        }
+        catch { /* 已存在 */ }
+    }
     try {
         db.exec(`ALTER TABLE wallets ADD COLUMN fee_staked REAL DEFAULT 0`);
     }
@@ -689,6 +884,57 @@ export function initDatabase() {
         db.exec(`ALTER TABLE direct_receive_deposits ADD COLUMN production_policy_version TEXT`);
     }
     catch { /* 已存在 */ }
+    try {
+        db.exec(`ALTER TABLE direct_receive_deposits ADD COLUMN reject_note TEXT`);
+    }
+    catch { /* 已存在 */ } // B1:admin 驳回申报说明(卖家可见)
+    try {
+        db.exec(`ALTER TABLE direct_receive_deposits ADD COLUMN refund_requested_at TEXT`);
+    }
+    catch { /* 已存在 */ } // B2:退出申请时间(冷静期锚点)
+    try {
+        db.exec(`ALTER TABLE direct_receive_deposits ADD COLUMN refund_evidence_ref TEXT`);
+    }
+    catch { /* 已存在 */ } // B2:场外退还凭据(admin 执行时记录)
+    try {
+        db.exec(`ALTER TABLE direct_receive_deposits ADD COLUMN terms_version TEXT`);
+    }
+    catch { /* 已存在 */ } // 条款同意版本快照(缴纳前强制同意;罚没/退还的合同依据)
+    try {
+        db.exec(`ALTER TABLE direct_receive_deposits ADD COLUMN platform_account_id TEXT`);
+    }
+    catch { /* 已存在 */ } // 缴到哪个平台收款账户(多币种;币种由账户推导)
+    // B3:保证金罚没提案(人工铁律:仲裁裁定卖家责的直付争议 → admin 提案 → 冷静期 → ROOT+Passkey 执行;绝不自动)。
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS bond_slash_proposals (
+      id            TEXT PRIMARY KEY,
+      deposit_id    TEXT NOT NULL,
+      seller_id     TEXT NOT NULL,
+      dispute_id    TEXT NOT NULL,                -- 依据争议(须 resolved 且 ruling ∈ 卖家责;direct_p2p 单)
+      reason        TEXT,
+      status        TEXT NOT NULL DEFAULT 'proposed' CHECK (status IN ('proposed','executed','cancelled')),
+      cooling_until TEXT NOT NULL,                -- 绝对截止(propose 时按 param 计算;执行须晚于此)
+      proposed_by   TEXT NOT NULL,
+      proposed_at   TEXT DEFAULT (datetime('now')),
+      executed_at   TEXT,
+      executed_txn_id TEXT,
+      cancelled_at  TEXT,
+      cancel_note   TEXT
+    );
+  `);
+    try {
+        db.exec('CREATE INDEX IF NOT EXISTS idx_bond_slash_seller ON bond_slash_proposals(seller_id, status)');
+    }
+    catch { /* 已存在 */ }
+    // B4:缓交收口 —— 到期前提醒去重锚点 + 缴清转正式时间戳(ALTER after CREATE 铁律)。
+    try {
+        db.exec(`ALTER TABLE direct_receive_deferrals ADD COLUMN reminder_sent_at TEXT`);
+    }
+    catch { /* 已存在 */ }
+    try {
+        db.exec(`ALTER TABLE direct_receive_deferrals ADD COLUMN satisfied_at TEXT`);
+    }
+    catch { /* 已存在 */ }
     // PR-6A: sanctions 结论有有效期(过期 → fail-closed)。additive nullable;NULL = 无期限(不过期)。
     try {
         db.exec(`ALTER TABLE sanctions_screening ADD COLUMN expires_at TEXT`);

package/dist/layer0-foundation/L0-2-state-machine/engine.js

@@ -478,6 +478,7 @@ function getActiveDeadline(order, db) {
     // 修：picked_up 状态视为"已揽收，等运输/投递"，下一个 deadline 是 delivery_deadline
     // QA 轮 7 P1（另一条）：disputed 状态下没读 dispute_cases 的 arbitrate_deadline → agent 不知道仲裁还有多久
     const deadlineMapMarket = {
+        pending_accept: 'pending_accept_deadline', // 手动接单(v16):等卖家确认,超时无责取消
         created: 'pay_deadline',
         paid: 'accept_deadline',
         accepted: 'ship_deadline',

package/dist/layer0-foundation/L0-2-state-machine/transitions.js

@@ -28,6 +28,28 @@ export const VALID_TRANSITIONS = {
         requiresEvidence: false,
         description: 'Rail1 直付:卖家已质押平台费、展示收款方式,进入付款窗口'
     },
+    // ── 手动接单模式(accept_mode='manual',v16):付款前先等卖家确认接单 ──────────
+    //   直付轨:created→pending_accept(替代 created→direct_pay_window),卖家接单才进付款窗口 ——
+    //   非托管无 hold 可言,时序门(接单前不出示收款信息)是唯一正确的付款风控。
+    //   escrow 轨不用本状态:escrow 本身就是条件中间态(付款进托管,接单才继续,超时自动全额退回)。
+    'created→pending_accept': {
+        allowedRoles: ['system'], // 建单路由按 accept_mode 快照以 system 推进(与 created→direct_pay_window 同模式)
+        requiresEvidence: false,
+        description: '手动接单:订单等待卖家确认接单(付款前,不展示收款信息)'
+    },
+    'pending_accept→direct_pay_window': {
+        allowedRoles: ['seller', 'system'],
+        requiresEvidence: false,
+        description: '卖家确认接单 → 进入直付付款窗口(此刻起买家方可见收款信息)'
+    },
+    'pending_accept→cancelled': {
+        // deadlineField 供专属 cron(direct-pay-timeouts.ts)读取;故意不设 autoFaultState →
+        // 通用 engine.checkTimeouts 绝不触发本转移(会漏库存回补等副作用)。超时=无责取消(没人付过钱)。
+        allowedRoles: ['seller', 'buyer', 'system'],
+        deadlineField: 'pending_accept_deadline',
+        requiresEvidence: false,
+        description: '接单前取消:卖家谢绝 / 买家撤单 / 超时未接单(system) → 无责取消 + 回补库存'
+    },
     'direct_pay_window→accepted': {
         allowedRoles: ['buyer'],
         requiresEvidence: false,
@@ -57,6 +79,53 @@ export const VALID_TRANSITIONS = {
         requiresEvidence: false,
         description: 'Rail1 直付:买家确认未付 / 宽限期后系统关单(终态)'
     },
+    // ── Direct Pay (Rail 1) 取消退款握手(审计项 C):买家已付款、卖家未发货 → 三步握手无责关单 ──────────
+    //   request(买家)→ mark_refunded(卖家声明已场外退款)→ confirm(买家确认收到,Passkey)→ 本边(system 执行)。
+    //   仅 system:买家不能单方取消已付款订单,必须经握手(域模块 src/direct-pay-cancel-refund.ts 收口,非托管零资金)。
+    'accepted→cancelled': {
+        allowedRoles: ['system'],
+        requiresEvidence: false,
+        description: 'Rail1 直付:取消退款握手完成(卖家已场外退款+买家确认收到)→ 系统无责关单,恢复库存'
+    },
+    // ── Direct Pay (Rail 1) 货款协商(争议≠仲裁):卖家报未收款 → 双方先协商,谈不拢才升举证仲裁 ──────────
+    'accepted→payment_query': {
+        allowedRoles: ['seller'],
+        requiresEvidence: false,
+        description: 'Rail1 直付:卖家报告未收到货款 → 进入协商(非仲裁),暂停履约。买家可取消/主张已付,卖家可确认已收/(宽限后)取消'
+    },
+    'payment_query→accepted': {
+        allowedRoles: ['seller'],
+        requiresEvidence: false,
+        description: 'Rail1 直付:卖家确认已收到货款 → 恢复原订单继续履约'
+    },
+    'payment_query→cancelled': {
+        // buyer=主动取消(承认未付);seller=买家静默宽限后请求取消;system=cron 在 7 天买家申诉窗口后终结。时序/窗口由路由+cron 守。
+        allowedRoles: ['buyer', 'seller', 'system'],
+        requiresEvidence: false,
+        description: 'Rail1 直付:协商关单(买家承认未付 / 卖家宽限后取消 / 系统申诉窗口后终结)'
+    },
+    'payment_query→disputed': {
+        allowedRoles: ['buyer', 'seller'],
+        requiresEvidence: true,
+        evidenceHint: '上传付款/未收款凭证(链上 tx / 银行回执 / 截图)',
+        description: 'Rail1 直付:协商未果(买家主张已付 + 卖家否认)→ 升级举证仲裁(证据制信誉裁决,不涉资金)'
+    },
+    'disputed→payment_query': {
+        // 裁定前回到协商的两条路径:①买卖任一方【撤回仲裁申请】(pq_withdraw);②仲裁员【驳回仲裁,退回协商】——
+        //   协议(sys_protocol)在仲裁员现场 Passkey 授权后代执行,故加 'system'。均仅裁定前有效(裁定后 disputed 已终结),时序/授权由路由守。
+        allowedRoles: ['buyer', 'seller', 'system'],
+        requiresEvidence: false,
+        description: 'Rail1 直付:回到协商(裁定前)—— 买卖双方撤回仲裁,或仲裁员驳回仲裁退回协商(system 代执行)'
+    },
+    'disputed→confirmed': {
+        // 争议协商收口(买家侧):买家撤诉并确认收货 —— 包裹晚到/放代收点后来找到等场景,不必只剩仲裁一条收口。
+        //   限定【delivered 来源的履约争议 + 争议发起人本人 + 裁定前】,来源/发起人/时序由路由权威门守
+        //   (orders-action dispute_withdraw_confirm,与 disputed→payment_query 的 pq_withdraw 同模式);
+        //   同一事务内争议 dismissed + confirmed→completed + settleOrder(与既有 confirm 结算完全同链)。
+        allowedRoles: ['buyer'],
+        requiresEvidence: false,
+        description: '买家撤诉并确认收货(裁定前,限履约争议):争议无责关闭,订单正常完成结算'
+    },
     // ── 卖家接单 ──────────────────────────────────────────────
     'paid→accepted': {
         allowedRoles: ['seller'],
@@ -282,6 +351,8 @@ export const CURRENT_RESPONSIBLE = {
     disputed: 'arbitrator', // 等仲裁处理
     direct_pay_window: 'buyer', // Rail1: 等买家付款并标记
     direct_expired_unconfirmed: 'buyer', // Rail1: 等买家确认未付 或 升级争议
+    payment_query: 'buyer', // Rail1: 卖家报未收款,等买家协商响应(取消/主张已付)
+    pending_accept: 'seller', // 手动接单:等卖家确认接单(超时无责取消)
 };
 /** Phase 1 self-fulfill 覆盖表：seller 一人承担 shipped/picked_up/in_transit 全程 */
 export const CURRENT_RESPONSIBLE_SELF_FULFILL = {
@@ -316,6 +387,8 @@ export const ORDER_STATE_MEANINGS = {
     expired: { zh: '订单超时自动失败(通用兜底,终态)', en: 'order expired (generic timeout, terminal)' },
     direct_pay_window: { zh: 'Rail1 直付:已质押平台费,等买家付款(协议不持货款)', en: 'Rail1 direct-pay: fee-staked, awaiting buyer off-protocol payment (protocol holds no funds)' },
     direct_expired_unconfirmed: { zh: 'Rail1 直付:付款窗口超时未标记(不静默关单,留争议/确认窗口)', en: 'Rail1 direct-pay: payment window expired unmarked (not silently closed; dispute/confirm window open)' },
+    payment_query: { zh: 'Rail1 直付:卖家报未收货款,双方协商中(非仲裁;暂停履约)', en: 'Rail1 direct-pay: seller reported non-receipt, buyer↔seller negotiating (not arbitration; fulfillment paused)' },
+    pending_accept: { zh: '手动接单:等待卖家确认接单(付款前;直付轨此阶段不展示收款信息,超时无责取消)', en: 'manual accept: awaiting seller acceptance (pre-payment; direct-pay hides payment info at this stage; times out to no-fault cancel)' },
 };
 /** 订单/争议生命周期契约 —— 集成方 agent 读它即懂"订单怎么流转 + 每步谁驱动 + 何时 + 含义"。 */
 export function orderLifecycleContract() {

package/dist/layer1-agent/L1-1-mcp-server/server.js

@@ -31,7 +31,8 @@ import { join as pathJoin } from 'node:path';
 import { existsSync as fsExists, mkdirSync, writeFileSync, readFileSync, unlinkSync, chmodSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { transition, getOrderStatus, initSystemUser, } from '../../layer0-foundation/L0-2-state-machine/engine.js';
-import { initDisputeSchema, createDispute, respondToDispute, getDisputeDetails, getOrderDispute, getOpenDisputes, } from '../../layer3-trust/L3-1-dispute-engine/dispute-engine.js';
+import { initDisputeSchema, createDispute, respondToDispute, getDisputeDetails, getOrderDispute, getOpenDisputes, isActiveWhitelistArbitrator, // 仲裁能力唯一源=active 白名单;legacy user.role==='arbitrator' 旁路已移除
+ } from '../../layer3-trust/L3-1-dispute-engine/dispute-engine.js';
 import { initNotificationSchema, notifyTransition, getNotifications, getUnreadCount, markRead, } from '../../layer2-business/L2-6-notifications/notification-engine.js';
 import { initSkillSchema, publishSkill, listSkills, getMySkills, subscribeSkill, unsubscribeSkill, getMySubscriptions, formatSkillForAgent, shouldAutoAccept, SKILL_TYPE_META, } from '../../layer4-economics/L4-4-skill-market/skill-engine.js';
 import { initReputationSchema, recordOrderReputation, getReputation, getSearchBoost, getStakeDiscount, } from '../../layer4-economics/L4-3-reputation/reputation-engine.js';
@@ -325,7 +326,51 @@ export async function handlePair(args) {
             note: 'Grant verified LIVE by the server (per-call: active/expiry/revoked/subject-suspension/scope + audited). `grant` is authoritative; `local_cache` is advisory. Safe scopes only; no business tool or risk scope consumes this grant.',
         };
     }
-    return { error: `unknown action "${action}" — use "start" | "complete" | "verify"`, error_code: 'BAD_ACTION' };
+    if (action === 'request') {
+        // The agent asks the human to EXPAND this grant with more SAFE scope / a permission bundle. Uses the
+        // stored grant bearer; the server binds the request to (human, grant). Approval is Passkey-gated on the
+        // human's side. Only SAFE scopes — risk/never-delegable are structurally rejected.
+        const cred = resolveGrantCredential();
+        if (!cred)
+            return { status: 'not_paired', error_code: 'NO_GRANT_CREDENTIAL', hint: 'No stored grant. Pair first: webaz_pair action="start" → human approves → action="complete".' };
+        const bundle = typeof args.bundle === 'string' ? args.bundle : undefined;
+        const scopes = Array.isArray(args.scopes) ? args.scopes.map(String).filter(Boolean) : undefined;
+        if (!bundle && (!scopes || !scopes.length))
+            return { error: 'provide a bundle (e.g. "catalog_agent") OR a scopes[] array of SAFE scopes', error_code: 'NO_SCOPES' };
+        const resp = await apiCall('/api/agent-grants/permission-requests', {
+            method: 'POST', apiKey: cred.token,
+            body: { bundle, scopes, reason: typeof args.reason === 'string' ? args.reason : undefined, duration: typeof args.duration === 'string' ? args.duration : undefined },
+        });
+        if (resp.error)
+            return resp;
+        return {
+            status: 'requested',
+            approval_id: resp.approval_id,
+            approval_url: `${WEBAZ_API_URL}${String(resp.approval_url || '')}`,
+            requested_scopes: resp.requested_scopes,
+            permission_bundle: resp.permission_bundle,
+            risk_level: resp.risk_level,
+            suggested_duration: resp.suggested_duration,
+            next: 'Ask the human to open approval_url (logged in at webaz.xyz) and approve with their Passkey. Then simply RETRY your original call — on approval your grant carries the new scope. Use action="requests" to poll status.',
+            note: 'Only SAFE (read/draft) scopes can be requested; risk actions are never delegated to a persistent grant.',
+        };
+    }
+    if (action === 'requests') {
+        // Poll THIS grant's own permission requests + their status (pending/approved/rejected) without hitting the
+        // target surface. Grant-authed, grant-scoped (you see only your own requests). Server audits every call.
+        const cred = resolveGrantCredential();
+        if (!cred)
+            return { status: 'not_paired', error_code: 'NO_GRANT_CREDENTIAL', hint: 'No stored grant. Pair first: webaz_pair action="start" → human approves → action="complete".' };
+        const resp = await apiCall('/api/agent-grants/my-permission-requests', { method: 'GET', apiKey: cred.token });
+        if (resp.error)
+            return resp;
+        return {
+            status: 'ok',
+            requests: resp.requests,
+            note: 'Your grant\'s own permission requests + status. On "approved", just retry your original call — the grant now carries the scope. "pending" → the human has not approved yet.',
+        };
+    }
+    return { error: `unknown action "${action}" — use "start" | "complete" | "verify" | "request" | "requests"`, error_code: 'BAD_ACTION' };
 }
 // 启动 banner(stderr)+ status 声明用 —— 让用户/agent 一眼知道现在是真网络还是沙盒
 function modeBanner() {
@@ -398,8 +443,12 @@ db.exec(`
     error_msg  TEXT
   )
 `);
-db.exec(`CREATE INDEX IF NOT EXISTS idx_mcp_tool_calls_ts   ON mcp_tool_calls(ts)`);
-db.exec(`CREATE INDEX IF NOT EXISTS idx_mcp_tool_calls_tool ON mcp_tool_calls(tool_name, ts)`);
+// 索引命名与 runtime bridge(apply-webaz-runtime-schema)统一 —— 两组合根曾各自命名(idx_mcp_tool_calls_* vs idx_mcp_tc_*)
+//   → 同库跑过两根就出现同列重复索引,且 pg 产物逐列/索引 parity 因根不同而漂移。老名幂等清除。
+db.exec(`DROP INDEX IF EXISTS idx_mcp_tool_calls_ts`);
+db.exec(`DROP INDEX IF EXISTS idx_mcp_tool_calls_tool`);
+db.exec(`CREATE INDEX IF NOT EXISTS idx_mcp_tc_ts   ON mcp_tool_calls(ts)`);
+db.exec(`CREATE INDEX IF NOT EXISTS idx_mcp_tc_tool ON mcp_tool_calls(tool_name, ts)`);
 // ─── 4 层身份模型 helpers（与 PWA server 同源逻辑）───────────────
 const PERMA_ALPHABET_MCP = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
 function mcpGeneratePermanentCode() {
@@ -486,14 +535,21 @@ No auth required, no parameters needed.
 2. action="complete" → retrieves the credential ONCE (PKCE) and stores it in your OS secret store (macOS Keychain → ~/.webaz/credentials 0600 fallback). Returns only a credential_handle + status — the raw token is never shown.
 3. action="verify" → uses the stored grant against a safe read endpoint to confirm it is still valid. The server re-checks active/expiry/revoked/suspension/scope and audits the call every time. Returns the grant principal/status; never the raw token.
 
-Scopes: SAFE only (read_public, profile_read, search, list_product_draft, product_publish_request, draft_order). Risk scopes (place_order/wallet/refund/...) and never-delegable actions (withdraw/key-change/vote/...) are hard-rejected.
+Need MORE scope later? If a call returns error_code="PERMISSION_REQUIRED", do NOT re-pair:
+4. action="request" (bundle="catalog_agent" OR scopes=[...]) → asks the human to expand THIS grant. Returns an approval_id + approval_url; the human approves with a Passkey, then you simply RETRY your original call.
+5. action="requests" → lists your grant's own requests + status (pending/approved/rejected) so you can poll instead of hitting the target surface.
+
+Scopes: SAFE only (read_public, profile_read, search, list_product_draft, product_publish_request, draft_order + seller_*_read / seller_product_draft / seller_pricing_suggestion; bundle "catalog_agent"). Risk scopes (place_order/wallet/refund/...) and never-delegable actions (withdraw/key-change/vote/...) are hard-rejected.
 
 NOTE: this consumes the grant only on safe read paths; no business tool and no risk scope is wired to grants. No account is created (registration stays human-only at webaz.xyz).`,
         inputSchema: {
             type: 'object',
             properties: {
-                action: { type: 'string', enum: ['start', 'complete', 'verify'], description: 'start a pairing, complete it after the human approves, or verify the stored grant (default: start)' },
-                capabilities: { type: 'array', items: { type: 'string' }, description: 'Requested SAFE scopes (default: read_public, search). Non-safe scopes are rejected.' },
+                action: { type: 'string', enum: ['start', 'complete', 'verify', 'request', 'requests'], description: 'start a pairing, complete it after the human approves, verify the stored grant, request MORE scope (bundle/scopes), or list your requests (default: start)' },
+                capabilities: { type: 'array', items: { type: 'string' }, description: 'action="start": requested SAFE scopes (default: read_public, search). Non-safe scopes are rejected.' },
+                bundle: { type: 'string', description: 'action="request": a permission bundle key (e.g. "catalog_agent") — a named all-safe scope set the human approves as one thing.' },
+                scopes: { type: 'array', items: { type: 'string' }, description: 'action="request": individual SAFE scopes to request (alternative to bundle).' },
+                duration: { type: 'string', enum: ['once', '1h', '24h', '7d', '30d'], description: 'action="request": how long the expanded grant should last (safe scopes may be long-term; the server caps by risk).' },
                 agent_label: { type: 'string', description: 'Human-friendly name for this agent (shown in the consent screen)' },
                 reason: { type: 'string', description: 'Free-text reason shown to the human (you cannot relabel the scopes)' },
             },
@@ -810,9 +866,9 @@ Actions:
 - list_open     pending disputes (arbitrators only)
 - respond       respondent rebuttal (before 48h deadline)
 - add_evidence  any participant supplements
-- arbitrate     ruling + fund disposition (assigned arbitrator only)
+- arbitrate     ruling (assigned arbitrator only). ESCROW: fund disposition. DIRECT PAY (payment_rail=direct_p2p, non-custodial): reputation-only ruling — NO refund/release/arbitration-fee, NO amounts.
 
-Ruling options: refund_buyer | release_seller | partial_refund (needs refund_amount; optional liable_party → 3rd-party fault, seller settled full + deducted from liable) | liability_split (needs liability_parties[]={user_id,amount}).
+Ruling options — ESCROW: refund_buyer | release_seller | partial_refund (needs refund_amount; optional liable_party → 3rd-party fault, seller settled full + deducted from liable) | liability_split (needs liability_parties[]={user_id,amount}). DIRECT PAY: refund_buyer=买家胜诉 | release_seller=卖家胜诉 | partial_refund=部分责任 — reputation verdict only, do NOT pass refund_amount/liability_parties (protocol holds no funds). Check \`view\`→payment_rail/ruling_options first.
 
 Protocol auto-judges (no human): respondent silent 48h → favor initiator; arbitrator silent 120h → refund_buyer. Executed rulings are instant + irreversible.
 
@@ -2785,7 +2841,7 @@ async function handleUpdateOrder(args) {
     const isParticipant = order.buyer_id === user.id ||
         order.seller_id === user.id ||
         order.logistics_id === user.id;
-    if (!isParticipant && user.role !== 'arbitrator') {
+    if (!isParticipant && !isActiveWhitelistArbitrator(db, user.id)) { // 白名单(非 legacy role):role-only/已吊销不可越权;下游 transition 仍按 actor.role 守边
         return { error: '你不是这笔订单的参与方，无法操作' };
     }
     // action → 状态映射
@@ -3088,10 +3144,13 @@ async function handleDispute(args) {
         WHERE e.order_id = ? AND u.role = ?
         ORDER BY e.created_at ASC
       `).all(orderId, uploaderRole);
+        const dpNonCustodial = dispute.payment_rail === 'direct_p2p'; // 直付=非托管:仅信誉裁决,无退款/放款/仲裁费/金额
         return {
             dispute_id: dispute.id,
             order_id: dispute.order_id,
             status: dispute.status,
+            payment_rail: dispute.payment_rail || 'escrow',
+            non_custodial: dpNonCustodial,
             initiator: `${dispute.initiator_name}（${dispute.initiator_role}）`,
             defendant: `${dispute.defendant_name}（${dispute.defendant_role}）`,
             reason: dispute.reason,
@@ -3101,21 +3160,27 @@ async function handleDispute(args) {
             defendant_notes: dispute.defendant_notes ?? '（被诉方尚未提交回应）',
             defendant_evidence: JSON.parse(dispute.defendant_evidence_ids || '[]'),
             ruling: dispute.ruling_type
-                ? { type: dispute.ruling_type, refund_amount: dispute.refund_amount, reason: dispute.verdict_reason }
+                ? (dpNonCustodial
+                    ? { type: dispute.ruling_type, reason: dispute.verdict_reason, note: '非托管信誉裁决:无退款/放款金额' }
+                    : { type: dispute.ruling_type, refund_amount: dispute.refund_amount, reason: dispute.verdict_reason })
                 : null,
-            // QA 轮 15 P1：未裁定时暴露可选 ruling 列表（与 PWA disputes-write.ts validRulings 对齐）
-            ruling_options: dispute.ruling_type ? undefined : [
+            // 未裁定时暴露可选 ruling 列表。direct_p2p:仅信誉裁决(胜负/责任,无金额);escrow:含金额/责任分配。
+            ruling_options: dispute.ruling_type ? undefined : (dpNonCustodial ? [
+                { type: 'refund_buyer', desc: '判买家胜诉（信誉裁决;非托管:无退款/放款/仲裁费）' },
+                { type: 'release_seller', desc: '判卖家胜诉（信誉裁决;无退款/放款）' },
+                { type: 'partial_refund', desc: '判部分责任（信誉裁决;无金额）' },
+            ] : [
                 { type: 'refund_buyer', desc: '全额退款给买家（卖家败诉）' },
                 { type: 'release_seller', desc: '放款给卖家（买家败诉）' },
                 { type: 'partial_refund', desc: '部分退款（需传 refund_amount）' },
                 { type: 'liability_split', desc: '按责任分配（需传 liability_parties 数组）' },
-            ],
+            ]),
             resolved_at: dispute.resolved_at,
         };
     }
     // ── 仲裁员查看所有待处理争议 ───────────────────────────────
     if (action === 'list_open') {
-        if (user.role !== 'arbitrator') {
+        if (!isActiveWhitelistArbitrator(db, user.id)) { // 白名单(非 legacy role):whitelist-only 真人可用,role-only/已吊销 403
             return { error: '只有仲裁员可以查看所有待处理争议' };
         }
         const disputes = await getOpenDisputes(db);
@@ -3128,7 +3193,7 @@ async function handleDispute(args) {
                 initiator: `${d.initiator_name}（${d.initiator_role}）`,
                 defendant: `${d.defendant_name}（${d.defendant_role}）`,
                 reason: d.reason,
-                amount: `${d.total_amount} WAZ`,
+                amount: d.payment_rail === 'direct_p2p' ? `${d.total_amount} USDC（非托管·信誉裁决）` : `${d.total_amount} WAZ`,
                 respond_deadline: d.respond_deadline,
                 arbitrate_deadline: d.arbitrate_deadline,
                 created_at: d.created_at,