@seasonkoh/webaz 0.1.29 → 0.1.31

package/dist/pwa/public/style.css

@@ -516,6 +516,9 @@ code, kbd, .mono { word-break: break-all; overflow-wrap: anywhere }
   animation: slide-up 0.3s ease-out;
 }
 @keyframes slide-up { from { opacity: 0; transform: translate(-50%, 20px) } to { opacity: 1; transform: translate(-50%, 0) } }
+/* 走查批次2:浮条悬在内容上方会盖住页面底部操作(如争议页上传控件)— 浮条在场时给内容区让位。
+   数值构成:banner bottom 70px + banner 自高 ~64px + 余量 16px = 150px(.main 默认 padding-bottom 80px 不够,曾误设 96px 实际只多让 16px) */
+body:has(#install-banner) .main { padding-bottom: 150px }
 .install-banner-icon { font-size: 22px; line-height: 1 }
 .install-banner-body { flex: 1; min-width: 0 }
 .install-banner-title { font-size: 13px; font-weight: 600; line-height: 1.2 }

package/dist/pwa/routes/admin-direct-receive-deposits.js

@@ -1,17 +1,176 @@
-import { confirmProductionReceipt } from '../../direct-receive-deposits.js';
+import { confirmProductionReceipt, rejectDeposit, executeBondRefund } from '../../direct-receive-deposits.js';
+import { enumerateBondRefundBlockers } from '../../bond-refund-blockers.js'; // B2:执行前复核(冷静期内可能新增退货等责任)
+import { proposeBondSlash, cancelBondSlashProposal, executeBondSlashProposal, listBondSlashProposals } from '../../bond-slash.js'; // B3:罚没提案/冷静期/执行(人工铁律)
+import { dbAll, dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // B1:保证金申报队列/通知收件人只读(async seam)
 import { reviewAmlFlag } from '../../direct-pay-aml-review.js';
 import { recordKybReview, recordSanctionsScreening, recordAmlFlagIngress, amlDetailHash } from '../../direct-pay-compliance-ingress.js';
 import { readDirectPayLaunchReadiness } from '../../direct-pay-launch-readiness.js';
-import { approveDeferral, rejectDeferral, listDeferrals } from '../../direct-receive-deferral.js';
+import { approveDeferral, rejectDeferral, listDeferrals, satisfyDeferralOnBond } from '../../direct-receive-deferral.js';
 import { listProductVerifications, reviewProductVerification } from '../../product-verification.js';
 import { listStoreVerifications, reviewStoreVerification } from '../../store-verification.js';
 import { requireDirectPayHumanPasskey } from '../direct-pay-guards.js';
 import { recordFeePrepayTopup, recordFeePrepayAdjustment, recordFeePrepayRefund, getDirectPayFeeAccount } from '../../direct-pay-fee-ar.js';
+import { listAllRequests, getRequest as getFeePrepayRequest, approveFeePrepayRequest, rejectFeePrepayRequest } from '../../direct-pay-fee-prepay-request.js';
+// N3:审批结果通知卖家(approve 入账/reject 驳回;此前审批后卖家无任何未读信号)。
+import { createNotification } from '../../layer2-business/L2-6-notifications/notification-engine.js';
 export function registerAdminDirectReceiveDepositsRoutes(app, deps) {
     const { db, requireRootAdmin, consumeGateToken, logAdminAction, getProtocolParam } = deps;
+    // GET /api/admin/direct-receive/deposits?status=pending — ROOT 只读:保证金申报队列(核对到账用)。B1。
+    app.get('/api/admin/direct-receive/deposits', async (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const status = req.query?.status != null ? String(req.query.status) : '';
+        const rows = await dbAll(`
+      SELECT d.id, d.user_id, d.tier, d.required_amount, d.amount, d.currency, d.deposit_rail, d.status,
+             d.external_ref, d.reject_note, d.production_receipt_confirmed_at, d.created_at, d.locked_at,
+             u.name AS seller_name, u.handle AS seller_handle
+      FROM direct_receive_deposits d JOIN users u ON u.id = d.user_id
+      ${status ? 'WHERE d.status = ?' : ''} ORDER BY d.created_at DESC LIMIT 200`, status ? [status] : []);
+        return void res.json({ deposits: rows });
+    });
+    // POST /api/admin/direct-receive/deposits/:id/reject — ROOT 驳回申报(未 lock 的申报;不动钱,留说明通知卖家)。B1。
+    //   不 Passkey:驳回不授予/不移动任何东西(与缓交 reject 不同 —— 那是资格决定;这里只是"到账核不上"退回重报)。
+    app.post('/api/admin/direct-receive/deposits/:id/reject', async (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const note = req.body?.note != null ? String(req.body.note).slice(0, 300) : '';
+        const r = rejectDeposit(db, { depositId: req.params.id, note });
+        logAdminAction(admin.id, 'direct_receive.bond_deposit_reject', 'direct_receive_deposit', req.params.id, { ok: r.ok, note_present: !!note, outcome: r.ok ? r.status : r.reason });
+        if (!r.ok)
+            return void res.status(409).json({ error: r.reason, error_code: 'BOND_REJECT_FAILED' });
+        try {
+            const dep = await dbOne('SELECT user_id FROM direct_receive_deposits WHERE id = ?', [req.params.id]);
+            if (dep)
+                createNotification(db, dep.user_id, null, 'bond_deposit_rejected', '❌ 保证金申报未通过核实', `你的保证金缴纳申报未通过核实${note ? `(${note})` : ''}。请核对付款凭据后重新提交,或联系平台。`, { templateKey: 'bond_deposit_rejected', params: { note: note ? `(${note})` : '' } });
+        }
+        catch { /* 不阻断 */ }
+        return void res.json({ ok: true, status: r.status });
+    });
+    // ── B3:保证金罚没(人工铁律:仲裁裁定卖家责的直付争议 → 提案 → 冷静期 → ROOT+Passkey 执行;绝不自动)──
+    app.get('/api/admin/direct-receive/bond-slash', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const status = req.query?.status != null ? String(req.query.status) : '';
+        return void res.json({ proposals: listBondSlashProposals(db, status ? { status } : {}) });
+    });
+    // 提案(ROOT,审计留痕,不 Passkey —— 提案不动任何东西;执行才是终局动作)。通知卖家(冷静期=申诉窗)。
+    app.post('/api/admin/direct-receive/bond-slash/propose', async (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const depositId = String(req.body?.deposit_id || '');
+        const disputeId = String(req.body?.dispute_id || '');
+        if (!depositId || !disputeId)
+            return void res.status(400).json({ error: '须提供 deposit_id 与依据 dispute_id', error_code: 'MISSING_BASIS' });
+        const coolingDays = Math.max(0, Number(getProtocolParam('direct_pay.bond_slash_cooling_days', 7)) || 7);
+        const proposalId = 'bslash_' + Math.random().toString(36).slice(2, 10);
+        const r = proposeBondSlash(db, { proposalId, depositId, disputeId, reason: req.body?.reason != null ? String(req.body.reason) : null, proposedBy: admin.id, coolingDays });
+        logAdminAction(admin.id, 'direct_receive.bond_slash_propose', 'direct_receive_deposit', depositId, { ok: r.ok, dispute_id: disputeId, outcome: r.ok ? proposalId : r.reason });
+        if (!r.ok)
+            return void res.status(409).json({ error: r.reason, error_code: 'SLASH_PROPOSE_REJECTED' });
+        try {
+            const dep = await dbOne('SELECT user_id FROM direct_receive_deposits WHERE id = ?', [depositId]);
+            if (dep)
+                createNotification(db, dep.user_id, null, 'bond_slash_proposed', '⚠️ 保证金罚没提案(待复核)', `因争议 ${disputeId} 裁定卖家责任,平台已发起保证金罚没提案。冷静期 ${coolingDays} 天内如有异议请联系平台并提供依据;冷静期满后将复核执行(全额罚没,进入处罚金专户,平台不获益)。`, { templateKey: 'bond_slash_proposed', params: { dispute: disputeId, days: coolingDays } });
+        }
+        catch { /* 不阻断 */ }
+        return void res.json({ ok: true, proposal_id: proposalId, cooling_days: coolingDays });
+    });
+    app.post('/api/admin/direct-receive/bond-slash/:id/cancel', async (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const r = cancelBondSlashProposal(db, { proposalId: req.params.id, note: req.body?.note != null ? String(req.body.note) : null });
+        logAdminAction(admin.id, 'direct_receive.bond_slash_cancel', 'bond_slash_proposal', req.params.id, { ok: r.ok, outcome: r.ok ? 'cancelled' : r.reason });
+        if (!r.ok)
+            return void res.status(409).json({ error: r.reason, error_code: 'SLASH_CANCEL_REJECTED' });
+        try {
+            const p = await dbOne('SELECT seller_id FROM bond_slash_proposals WHERE id = ?', [req.params.id]);
+            if (p)
+                createNotification(db, p.seller_id, null, 'bond_slash_cancelled', '✅ 保证金罚没提案已撤销', '此前的罚没提案经复核已撤销,你的保证金不受影响。', { templateKey: 'bond_slash_cancelled', params: {} });
+        }
+        catch { /* 不阻断 */ }
+        return void res.json({ ok: true, status: r.status, already: !!r.already });
+    });
+    // 执行(ROOT + 真人 Passkey,purpose direct_pay_bond_slash 绑 proposal_id;冷静期由域内绝对截止校验)。
+    app.post('/api/admin/direct-receive/bond-slash/:id/execute', async (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const proposalId = req.params.id;
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: admin.id, webauthnToken: req.body?.webauthn_token, purpose: 'direct_pay_bond_slash',
+            validate: (data) => { const d = data; return !!d && d.proposal_id === proposalId; },
+        });
+        if (!gate.ok) {
+            logAdminAction(admin.id, 'direct_receive.bond_slash_execute', 'bond_slash_proposal', proposalId, { ok: false, error_code: gate.error_code });
+            return void res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+        }
+        const txnId = 'bslashtxn_' + Math.random().toString(36).slice(2, 10);
+        let r;
+        try {
+            r = executeBondSlashProposal(db, { proposalId, txnId, nowIso: new Date().toISOString() });
+        }
+        catch (e) {
+            r = { ok: false, reason: e.message };
+        }
+        logAdminAction(admin.id, 'direct_receive.bond_slash_execute', 'bond_slash_proposal', proposalId, { ok: r.ok, txn_id: txnId, outcome: r.ok ? (r.already ? 'already' : 'executed') : r.reason });
+        if (!r.ok)
+            return void res.status(409).json({ error: r.reason, error_code: 'SLASH_EXECUTE_REJECTED' });
+        if (!r.already) {
+            try {
+                const p = await dbOne('SELECT seller_id, dispute_id FROM bond_slash_proposals WHERE id = ?', [proposalId]);
+                if (p)
+                    createNotification(db, p.seller_id, null, 'bond_slash_executed', '❌ 保证金已罚没', `依据争议 ${p.dispute_id} 的卖家责任裁定,你的履约保证金已全额罚没(进入处罚金专户,平台不获益),直付资格已吊销。重新缴纳保证金并通过审核后可再次申请开通。`, { templateKey: 'bond_slash_executed', params: { dispute: p.dispute_id } });
+            }
+            catch { /* 不阻断 */ }
+        }
+        return void res.json({ ok: true, status: r.status, already: !!r.already });
+    });
+    // POST /api/admin/direct-receive/deposits/:id/execute-refund — ROOT + 真人 Passkey:记录已完成的【场外】保证金退还(B2)。
+    //   前置:refunding + 冷静期满(param direct_pay.bond_refund_cooling_days,默认 14d,域内校验)+ 【执行时复核】
+    //   unlock blockers(冷静期内可能新增退货/欠费等责任 —— 有任一即拒)。凭据必填;真实退款发生在协议外,此处只记录。
+    app.post('/api/admin/direct-receive/deposits/:id/execute-refund', async (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        const depositId = req.params.id;
+        const evidenceRef = String(req.body?.evidence_ref || '').trim();
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId: admin.id, webauthnToken: req.body?.webauthn_token, purpose: 'direct_receive_bond_refund',
+            validate: (data) => { const d = data; return !!d && d.deposit_id === depositId && d.evidence_ref === evidenceRef; },
+        });
+        if (!gate.ok) {
+            logAdminAction(admin.id, 'direct_receive.bond_refund_execute', 'direct_receive_deposit', depositId, { ok: false, error_code: gate.error_code });
+            return void res.status(403).json({ error: gate.reason, error_code: gate.error_code });
+        }
+        const dep = await dbOne('SELECT user_id FROM direct_receive_deposits WHERE id = ?', [depositId]);
+        if (!dep)
+            return void res.status(404).json({ error: '存款不存在', error_code: 'DEPOSIT_NOT_FOUND' });
+        const blockers = enumerateBondRefundBlockers(db, dep.user_id);
+        if (blockers.length > 0) {
+            logAdminAction(admin.id, 'direct_receive.bond_refund_execute', 'direct_receive_deposit', depositId, { ok: false, outcome: 'blocked', blockers: blockers.map(b => b.code) });
+            return void res.status(409).json({ error: '卖家仍有未了结直付责任,不可退还', error_code: 'REFUND_BLOCKED', blockers });
+        }
+        const coolingDays = Math.max(0, Number(getProtocolParam('direct_pay.bond_refund_cooling_days', 14)) || 14);
+        const r = executeBondRefund(db, { depositId, nowIso: new Date().toISOString(), coolingDays, evidenceRef });
+        logAdminAction(admin.id, 'direct_receive.bond_refund_execute', 'direct_receive_deposit', depositId, { ok: r.ok, evidence_present: !!evidenceRef, outcome: r.ok ? (r.already ? 'already' : 'refunded') : r.reason });
+        if (!r.ok)
+            return void res.status(409).json({ error: r.reason, error_code: 'REFUND_EXECUTE_REJECTED' });
+        if (!r.already) {
+            try {
+                createNotification(db, dep.user_id, null, 'bond_refund_executed', '✅ 履约保证金已退还', `你的保证金已在协议外退还并记录(凭据:${evidenceRef.slice(0, 60)})。直付资格随保证金退出关闭;重新缴纳后可再次开通。`, { templateKey: 'bond_refund_executed', params: { evidence: evidenceRef.slice(0, 60) } });
+            }
+            catch { /* 不阻断 */ }
+        }
+        return void res.json({ ok: true, status: r.status, already: !!r.already });
+    });
     // POST /api/admin/direct-receive/deposits/:id/confirm-production — ROOT + 真人 Passkey 手动确认生产保证金 receipt。
     //   当前恒 fail-closed(无 legal-cleared rail → assert 抛 → PRODUCTION_RAIL_NOT_CLEARED)。
-    app.post('/api/admin/direct-receive/deposits/:id/confirm-production', (req, res) => {
+    app.post('/api/admin/direct-receive/deposits/:id/confirm-production', async (req, res) => {
         const admin = requireRootAdmin(req, res);
         if (!admin)
             return;
@@ -19,6 +178,8 @@ export function registerAdminDirectReceiveDepositsRoutes(app, deps) {
         const railId = String(req.body?.rail_id || '');
         const amountUnits = Number(req.body?.expected_amount_units);
         const receiptRef = String(req.body?.receipt_ref || '');
+        // jurisdiction=【平台收款主体法域】(P2 澄清:非卖家法域;卖家资格由 KYB/制裁/AML 独立把守)。
+        //   自由输入但被域内 DIRECT_PAY_BOND_JURISDICTIONS 严格白名单硬约束(非白名单值必拒),并进 Passkey purpose_data + 审计。
         const jurisdiction = String(req.body?.jurisdiction || '');
         const webauthnToken = req.body?.webauthn_token;
         // 现场真人 Passkey(铁律)。purpose_data 绑定【完整动作字段】:deposit/rail/amount/receipt/jurisdiction 全等才放行,
@@ -43,6 +204,17 @@ export function registerAdminDirectReceiveDepositsRoutes(app, deps) {
             logAdminAction(admin.id, 'direct_receive.production_confirm', 'direct_receive_deposit', depositId, { rail_id: railId, jurisdiction, ok: r.ok, outcome: r.ok ? (r.already ? 'already' : 'confirmed') : r.reason });
             if (!r.ok)
                 return void res.status(409).json({ error: r.reason, error_code: 'PRODUCTION_CONFIRM_REJECTED' });
+            // B1:确认成功 → 通知卖家保证金已生效;B4:缓交期间缴清 → granted 缓交转 satisfied(解除额度压低)+ 告知。best-effort 不阻断。
+            if (!r.already) {
+                try {
+                    const dep = await dbOne('SELECT user_id FROM direct_receive_deposits WHERE id = ?', [depositId]);
+                    if (dep) {
+                        const converted = satisfyDeferralOnBond(db, dep.user_id);
+                        createNotification(db, dep.user_id, null, 'bond_deposit_confirmed', '✅ 履约保证金已确认锁定', `你的保证金已核实到账并正式锁定,直付入场的保证金门已满足。${converted > 0 ? '缓交资格已转正式,额度限制同步解除。' : ''}退出时可申请退还(须无未了结直付责任)。`, { templateKey: 'bond_deposit_confirmed', params: { converted } });
+                    }
+                }
+                catch { /* 通知失败不阻断 */ }
+            }
             return void res.json({ ok: true, status: r.status, already: !!r.already });
         }
         catch (e) {
@@ -158,6 +330,46 @@ export function registerAdminDirectReceiveDepositsRoutes(app, deps) {
             return;
         return void res.json({ ok: true, account: getDirectPayFeeAccount(db, str(req.params.seller_id)) });
     });
+    // GET /api/admin/direct-receive/fee-prepay-requests?status=pending — ROOT 只读:预充值申请队列(核对到账用)。
+    app.get('/api/admin/direct-receive/fee-prepay-requests', (req, res) => {
+        const admin = requireRootAdmin(req, res);
+        if (!admin)
+            return;
+        return void res.json({ ok: true, requests: listAllRequests(db, req.query.status ? str(req.query.status) : undefined) });
+    });
+    // POST /api/admin/direct-receive/fee-prepay-requests/:id/approve — ROOT + Passkey【确认真实到账 → 入账】(唯一动钱)。
+    //   ⚠️ 独立 purpose 'direct_pay_fee_prepay_request_approve'(≠ 手动入账的 'direct_pay_fee_prepay_record')——
+    //   否则"批准申请"的 token 能被拿去打手动 /fee-prepay 记一笔【未关联 fpr】的预充值,原申请仍 pending → 双入账/断链。
+    //   purpose_data 绑 request_id + seller_id + amount_units + method(把入账金额/对象钉进 Passkey)。原子:approved + recordFeePrepay + 关联 payment。
+    app.post('/api/admin/direct-receive/fee-prepay-requests/:id/approve', gatedIngress('direct_pay_fee_prepay_request_approve', (req) => (data) => {
+        const d = data;
+        const fr = getFeePrepayRequest(db, str(req.params.id));
+        return !!d && !!fr && d.request_id === str(req.params.id) && d.seller_id === fr.seller_id && Number(d.amount_units) === Number(fr.amount_units) && str(d.method) === str(req.body?.method);
+    }, (req, adminId) => {
+        const fr = getFeePrepayRequest(db, str(req.params.id));
+        const r = approveFeePrepayRequest(db, { requestId: str(req.params.id), adminId, method: str(req.body?.method), reviewNote: opt(req.body?.note) });
+        if (r.ok && fr) {
+            const amt = Number(fr.amount_units) / 1_000_000;
+            try {
+                createNotification(db, fr.seller_id, null, 'dp_fee_prepay_approved', '✅ 预充值已确认入账', `你的平台服务费预充值 ${amt} USDC 已确认入账,直付新单额度已恢复。`, { templateKey: 'dp_fee_prepay_approved', params: { amount: amt } });
+            }
+            catch { /* 通知失败不阻断入账 */ }
+        }
+        return r.ok ? { ok: true, id: r.paymentId } : { ok: false, error: r.error };
+    }, (req) => { const fr = getFeePrepayRequest(db, str(req.params.id)); return { targetId: fr?.seller_id ?? str(req.params.id), detail: { request_id: str(req.params.id), amount_units: fr?.amount_units, method: str(req.body?.method) } }; }));
+    // POST /api/admin/direct-receive/fee-prepay-requests/:id/reject — ROOT + Passkey(不动钱)。purpose_data 绑 request_id。
+    app.post('/api/admin/direct-receive/fee-prepay-requests/:id/reject', gatedIngress('direct_pay_fee_prepay_reject', (req) => (data) => { const d = data; return !!d && d.request_id === str(req.params.id); }, (req, adminId) => {
+        const fr = getFeePrepayRequest(db, str(req.params.id));
+        const r = rejectFeePrepayRequest(db, { requestId: str(req.params.id), adminId, reviewNote: opt(req.body?.note) });
+        if (r.ok && fr) {
+            const note = opt(req.body?.note) ? `(${opt(req.body?.note)})` : '';
+            try {
+                createNotification(db, fr.seller_id, null, 'dp_fee_prepay_rejected', '❌ 预充值申请未通过', `你的平台服务费预充值申请未通过${note}。请核对付款凭据后重新提交,或联系平台。`, { templateKey: 'dp_fee_prepay_rejected', params: { note } });
+            }
+            catch { /* 通知失败不阻断 */ }
+        }
+        return r;
+    }, (req) => ({ targetId: str(req.params.id), detail: { request_id: str(req.params.id) } })));
     // POST /api/admin/direct-receive/readiness — ROOT + 真人 Passkey:返回【完整】Direct Pay launch readiness(blockers + facts,
     //   含 KYB/sanctions/AML/base-bond/rail clearance 全细节)。只读诊断(不写库、不 flip launch);ROOT 专用,买家/卖家拿不到。
     app.post('/api/admin/direct-receive/readiness', (req, res) => {

package/dist/pwa/routes/admin-protocol-params.js

@@ -75,6 +75,22 @@ export function registerAdminProtocolParamsRoutes(app, deps) {
         if (param.type === 'boolean' && !['true', 'false', '1', '0'].includes(strVal)) {
             return void res.status(400).json({ error: '类型不匹配（需 boolean）' });
         }
+        // S1 审计:json 型参数必须能被 parse(此前只有 number/boolean 校验,json 型能写进任意串 → 消费方 fail-open/closed 两难)
+        if (param.type === 'json') {
+            let parsed;
+            try {
+                parsed = JSON.parse(strVal);
+            }
+            catch {
+                return void res.status(400).json({ error: '类型不匹配(需合法 JSON)' });
+            }
+            // key 专项:平台禁售名单必须是大写区码数组(2-8 位字母/数字/-)—— 该参数直接进建单硬门,坏值会 fail-closed 挡全部下单
+            if (req.params.key === 'trade.platform_region_blocklist') {
+                if (!Array.isArray(parsed) || !parsed.every(x => typeof x === 'string' && /^[A-Z0-9-]{2,8}$/.test(x))) {
+                    return void res.status(400).json({ error: 'trade.platform_region_blocklist 须为大写区码字符串数组,如 ["KP"]', code: 'BAD_REGION_BLOCKLIST' });
+                }
+            }
+        }
         // A-3: 变更前快照旧值
         const oldRow = await dbOne('SELECT value FROM protocol_params WHERE key = ?', [req.params.key]);
         db.transaction(() => {

package/dist/pwa/routes/admin-reports.js

@@ -6,20 +6,29 @@ export function registerAdminReportsRoutes(app, deps) {
         const admin = requireContentAdmin(req, res);
         if (!admin)
             return;
+        // 审计项 G:补 payment_rail 列 + ?rail 过滤 —— admin/AML 此前在订单总览里区分不出 direct_p2p(非托管轨监控盲区)
         const status = req.query.status;
+        const rail = typeof req.query.rail === 'string' ? req.query.rail.trim() : '';
         let sql = `SELECT o.id, o.product_id, o.buyer_id, o.seller_id, o.logistics_id, o.status,
-                      o.total_amount, o.created_at,
+                      o.total_amount, o.created_at, o.payment_rail,
                       p.title as product_title,
                       ub.name as buyer_name, us.name as seller_name
                FROM orders o
                JOIN products p ON o.product_id = p.id
                JOIN users ub ON o.buyer_id = ub.id
                JOIN users us ON o.seller_id = us.id`;
+        const where = [];
         const params = [];
         if (status && status.trim()) {
-            sql += ` WHERE o.status = ?`;
+            where.push('o.status = ?');
             params.push(status);
         }
+        if (rail) {
+            where.push('o.payment_rail = ?');
+            params.push(rail);
+        }
+        if (where.length)
+            sql += ' WHERE ' + where.join(' AND ');
         sql += ` ORDER BY o.created_at DESC LIMIT 100`;
         res.json({ orders: await dbAll(sql, params) });
     });
@@ -27,20 +36,37 @@ export function registerAdminReportsRoutes(app, deps) {
         const admin = requireArbitrationAdmin(req, res);
         if (!admin)
             return;
+        // 区分:按 status(open/in_review/resolved/dismissed)+ rail(direct_p2p/escrow)过滤;附 verdict/ruling_type/
+        //   assigned_arbitrators/payment_rail 让 admin 分辨类型/进度/是否已指派/如何结案。summary 给全量分状态计数。
+        const status = typeof req.query.status === 'string' ? req.query.status.trim() : '';
+        const rail = typeof req.query.rail === 'string' ? req.query.rail.trim() : '';
+        const where = [];
+        const params = [];
+        if (status) {
+            where.push('d.status = ?');
+            params.push(status);
+        }
+        if (rail) {
+            where.push('o.payment_rail = ?');
+            params.push(rail);
+        }
         const rows = await dbAll(`
       SELECT d.id, d.order_id, d.initiator_id, d.defendant_id, d.reason, d.status,
              d.created_at, d.respond_deadline, d.arbitrate_deadline, d.resolved_at,
+             d.verdict, d.ruling_type, d.assigned_arbitrators,
              u1.name as initiator_name, u2.name as defendant_name,
-             o.total_amount, o.status as order_status,
+             o.total_amount, o.status as order_status, o.payment_rail,
              p.title as product_title
       FROM disputes d
       LEFT JOIN users u1 ON d.initiator_id = u1.id
       LEFT JOIN users u2 ON d.defendant_id = u2.id
       LEFT JOIN orders o ON d.order_id = o.id
       LEFT JOIN products p ON o.product_id = p.id
+      ${where.length ? 'WHERE ' + where.join(' AND ') : ''}
       ORDER BY d.created_at DESC LIMIT 100
-    `);
-        res.json({ disputes: rows });
+    `, params);
+        const counts = await dbAll('SELECT status, COUNT(*) n FROM disputes GROUP BY status');
+        res.json({ disputes: rows, counts: Object.fromEntries(counts.map(c => [c.status, c.n])), total: counts.reduce((s, c) => s + c.n, 0) });
     });
     app.get('/api/admin/verify-tasks', async (req, res) => {
         const admin = requireArbitrationAdmin(req, res);

package/dist/pwa/routes/agent-governance.js

@@ -22,7 +22,7 @@ export function registerAgentGovernanceRoutes(app, deps) {
             }
             const calls30d = (await dbOne(`SELECT COUNT(*) as n FROM agent_call_log WHERE api_key = ? AND created_at > datetime('now', '-30 days')`, [k.api_key])).n;
             const last = await dbOne(`SELECT endpoint, method, status_code, created_at FROM agent_call_log WHERE api_key = ? ORDER BY created_at DESC LIMIT 1`, [k.api_key]);
-            const strikes = await dbAll(`SELECT severity, reason_code, issued_at, expires_at, appeal_status FROM agent_strikes WHERE api_key = ? ORDER BY issued_at DESC LIMIT 5`, [k.api_key]);
+            const strikes = await dbAll(`SELECT id, severity, reason_code, reason_detail, issued_at, expires_at, appeal_status FROM agent_strikes WHERE api_key = ? ORDER BY issued_at DESC LIMIT 5`, [k.api_key]); // +id/detail:被封申诉 UI 需要(此端点封禁豁免)
             let passport = null;
             try {
                 passport = computeAgentPassport(db, k.api_key, user.id, custodianFingerprint);