@seasonkoh/webaz 0.1.29 → 0.1.31

package/dist/pwa/routes/seller-directpay-report.js

@@ -0,0 +1,110 @@
+import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js';
+// 直付订单状态桶(与状态机一致):已完成(计提平台费)/ 在途 / 已取消·退款。
+const COMPLETED = ['completed', 'confirmed'];
+const IN_FLIGHT = ['pending_accept', 'direct_pay_window', 'accepted', 'shipped', 'picked_up', 'in_transit', 'delivered', 'payment_query', 'direct_expired_unconfirmed'];
+const CLOSED_NEG = ['cancelled', 'expired', 'refunded_full', 'refunded_partial', 'dispute_dismissed', 'resolved_for_seller', 'fault_seller', 'fault_buyer', 'fault_logistics'];
+const inList = (col, arr) => `${col} IN (${arr.map(() => '?').join(',')})`;
+export function registerSellerDirectPayReportRoutes(app, deps) {
+    const { db, auth } = deps;
+    function requireSeller(req, res) {
+        const user = auth(req, res);
+        if (!user)
+            return null;
+        const roles = (() => { try {
+            return JSON.parse(String(user.roles ?? '[]'));
+        }
+        catch {
+            return [];
+        } })();
+        if (user.role !== 'seller' && !(Array.isArray(roles) && roles.includes('seller'))) {
+            res.status(403).json({ error: '仅卖家可查看', error_code: 'SELLER_ONLY' });
+            return null;
+        }
+        return user;
+    }
+    // GET /api/sellers/me/direct-pay-report?from=YYYY-MM-DD&to=YYYY-MM-DD
+    //   from/to 均可选(闭区间,按日期比较 substr(created_at,1,10));返回汇总 + 按月 + 逐单(含平台费明细)。
+    app.get('/api/sellers/me/direct-pay-report', async (req, res) => {
+        const user = requireSeller(req, res);
+        if (!user)
+            return;
+        const sellerId = user.id;
+        const from = typeof req.query.from === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(req.query.from) ? req.query.from : null;
+        const to = typeof req.query.to === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(req.query.to) ? req.query.to : null;
+        const range = [];
+        const rp = [];
+        if (from) {
+            range.push('substr(o.created_at,1,10) >= ?');
+            rp.push(from);
+        }
+        if (to) {
+            range.push('substr(o.created_at,1,10) <= ?');
+            rp.push(to);
+        }
+        const rangeClause = range.length ? ' AND ' + range.join(' AND ') : '';
+        // ① 汇总(单查:订单数 / 销售额 / 各桶计数与已完成销售额)
+        const summary = (await dbOne(`
+      SELECT
+        COUNT(*) as order_count,
+        COALESCE(SUM(o.total_amount), 0) as gross_order_total,
+        SUM(CASE WHEN ${inList('o.status', COMPLETED)} THEN 1 ELSE 0 END) as completed_count,
+        COALESCE(SUM(CASE WHEN ${inList('o.status', COMPLETED)} THEN o.total_amount ELSE 0 END), 0) as completed_sales,
+        SUM(CASE WHEN ${inList('o.status', IN_FLIGHT)} THEN 1 ELSE 0 END) as in_flight_count,
+        SUM(CASE WHEN ${inList('o.status', CLOSED_NEG)} THEN 1 ELSE 0 END) as closed_count
+      FROM orders o
+      WHERE o.seller_id = ? AND o.payment_rail = 'direct_p2p'${rangeClause}
+    `, [...COMPLETED, ...COMPLETED, ...IN_FLIGHT, ...CLOSED_NEG, sellerId, ...rp]));
+        // ② 区间内已计提平台费合计(逐单应收 join 订单,按订单下单日筛)
+        const feeAgg = (await dbOne(`
+      SELECT COALESCE(SUM(r.amount), 0) as fee_accrued, COUNT(*) as fee_count
+      FROM direct_pay_fee_receivables r JOIN orders o ON o.id = r.order_id
+      WHERE o.seller_id = ? AND o.payment_rail = 'direct_p2p'${rangeClause}
+    `, [sellerId, ...rp]));
+        // ③ 按月(最多 24 个月)—— 订单总额(含各状态)与完成单销售额分列,不混
+        const byMonth = await dbAll(`
+      SELECT substr(o.created_at, 1, 7) as month, COUNT(*) as order_count,
+             COALESCE(SUM(o.total_amount), 0) as gross_order_total,
+             COALESCE(SUM(CASE WHEN ${inList('o.status', COMPLETED)} THEN o.total_amount ELSE 0 END), 0) as completed_sales
+      FROM orders o
+      WHERE o.seller_id = ? AND o.payment_rail = 'direct_p2p'${rangeClause}
+      GROUP BY month ORDER BY month DESC LIMIT 24
+    `, [...COMPLETED, sellerId, ...rp]);
+        // ④ 逐单明细(含平台费:LEFT JOIN 应收表 —— 未完成单尚无 fee 行,fee 为 null)。上限 500。
+        const LIMIT = 500;
+        const rows = await dbAll(`
+      SELECT o.id, o.created_at, o.status, o.total_amount, o.ship_to_region, p.title as product_title,
+             r.amount as fee_amount, r.accrued_at as fee_accrued_at
+      FROM orders o
+      LEFT JOIN products p ON p.id = o.product_id
+      LEFT JOIN direct_pay_fee_receivables r ON r.order_id = o.id
+      WHERE o.seller_id = ? AND o.payment_rail = 'direct_p2p'${rangeClause}
+      ORDER BY o.created_at DESC LIMIT ?
+    `, [sellerId, ...rp, LIMIT + 1]);
+        const truncated = rows.length > LIMIT;
+        if (truncated)
+            rows.length = LIMIT;
+        res.setHeader('Cache-Control', 'no-store');
+        res.json({
+            range: { from, to },
+            currency_note: '销售额=下单计价币(买家应付金额);平台服务费=USDC。两者不同币种,分列展示。',
+            summary: {
+                order_count: Number(summary.order_count) || 0,
+                gross_order_total: Number(summary.gross_order_total) || 0, // 所有状态订单总额(含在途/已关闭)—— 非真实销售
+                completed_count: Number(summary.completed_count) || 0,
+                completed_sales: Number(summary.completed_sales) || 0, // 真实销售(仅 completed/confirmed)
+                in_flight_count: Number(summary.in_flight_count) || 0,
+                closed_count: Number(summary.closed_count) || 0,
+                fee_accrued_total: Number(feeAgg.fee_accrued) || 0, // 区间已计提平台费(USDC)
+                fee_order_count: Number(feeAgg.fee_count) || 0,
+            },
+            by_month: byMonth.map(m => ({ month: m.month, order_count: Number(m.order_count) || 0, gross_order_total: Number(m.gross_order_total) || 0, completed_sales: Number(m.completed_sales) || 0 })),
+            orders: rows.map(r => ({
+                id: r.id, created_at: r.created_at, status: r.status, total_amount: Number(r.total_amount) || 0,
+                ship_to_region: r.ship_to_region || null, product_title: r.product_title || null,
+                fee_amount: r.fee_amount == null ? null : Number(r.fee_amount), // null=未完成尚未计提
+                fee_accrued_at: r.fee_accrued_at || null,
+            })),
+            truncated,
+        });
+    });
+}

package/dist/pwa/routes/seller-quota.js

@@ -45,7 +45,7 @@ export function registerSellerQuotaRoutes(app, deps) {
         const d30 = fmt(new Date(now - 30 * 86400000));
         const d60 = fmt(new Date(now - 60 * 86400000));
         const orders = await dbAll(`
-      SELECT o.id, o.product_id, o.buyer_id, o.status, o.total_amount, o.created_at,
+      SELECT o.id, o.product_id, o.buyer_id, o.status, o.total_amount, o.created_at, o.payment_rail,
              COALESCE(p.title, '已下架商品') as product_title,
              COALESCE(ub.name, '匿名') as buyer_name
       FROM orders o
@@ -60,6 +60,8 @@ export function registerSellerQuotaRoutes(app, deps) {
         const inLast30 = orders.filter(o => o.created_at >= d30);
         const inPrev30 = orders.filter(o => o.created_at < d30);
         const gmv = (arr) => arr.filter(o => completedStatuses.has(o.status)).reduce((s, o) => s + Number(o.total_amount || 0), 0);
+        // GMV 按支付轨拆分:托管=平台真实托管收入,直接收款=场外收款(平台不经手)—— 不再混算(诚实口径)
+        const gmvRail = (arr, rail) => arr.filter(o => completedStatuses.has(o.status) && (rail === 'direct_p2p' ? o.payment_rail === 'direct_p2p' : (o.payment_rail || 'escrow') === 'escrow')).reduce((s, o) => s + Number(o.total_amount || 0), 0);
         const curGmv = gmv(inLast30);
         const prevGmv = gmv(inPrev30);
         const curCount = inLast30.length;
@@ -116,6 +118,8 @@ export function registerSellerQuotaRoutes(app, deps) {
             period_days: 30,
             summary: {
                 gmv: curGmv,
+                gmv_escrow: gmvRail(inLast30, 'escrow'),
+                gmv_direct_pay: gmvRail(inLast30, 'direct_p2p'),
                 order_count: curCount,
                 completed_count: completedOrders30.length,
                 aov,

package/dist/pwa/routes/shipping-templates.js

@@ -0,0 +1,219 @@
+import { parseShippingTemplate, loadTemplateJson, resolveShipping } from '../../shipping-templates.js';
+import { validateSaleRegionsInput, parseSaleRegionsRule, regionAllowedByRule, parsePlatformBlocklist } from '../../sale-regions.js'; // S1 可售区域(店铺+单品写入;gate 在 orders-create;S5 只读披露复用判定 + 与建单门同一 blocklist parser)
+import { validateFreeShippingThreshold } from '../../free-shipping.js'; // 营销域满额免邮(S2 返工:写入口暂列本设置面,规则/判定在 free-shipping.ts)
+import { validateImportDutyTerms, validateTaxLines, effectiveImportDutyTerms, effectiveTaxLines, parseTaxLines, taxLinesForRegion } from '../../trade-tax.js'; // S3 跨境税费/进口责任声明层(seller-declared,平台不算不收)
+import { dbOne, dbRun } from '../../layer0-foundation/L0-1-database/db.js';
+export function registerShippingTemplateRoutes(app, deps) {
+    const { auth, errorRes } = deps;
+    app.post('/api/seller/shipping-template', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (user.role !== 'seller')
+            return void errorRes(res, 403, 'SELLER_ONLY', '仅卖家可设置运费模板');
+        const b = req.body || {};
+        const touched = {};
+        if ('store_template' in b) {
+            const p = parseShippingTemplate(b.store_template);
+            if (!p.ok)
+                return void errorRes(res, 400, 'BAD_SHIPPING_TEMPLATE', p.error);
+            await dbRun('UPDATE users SET store_shipping_template = ? WHERE id = ?', [p.entries ? JSON.stringify(p.entries) : null, user.id]);
+            touched.store_template = p.entries;
+        }
+        if ('store_quote_ok' in b) { // PR-3:模板外地区询价 opt-in(店铺默认;直付轨生效)
+            if (b.store_quote_ok !== null && typeof b.store_quote_ok !== 'boolean')
+                return void errorRes(res, 400, 'BAD_QUOTE_OK', 'store_quote_ok 只允许 true|false|null');
+            await dbRun('UPDATE users SET store_shipping_quote_ok = ? WHERE id = ?', [b.store_quote_ok === null ? null : (b.store_quote_ok ? 1 : 0), user.id]);
+            touched.store_quote_ok = b.store_quote_ok;
+        }
+        if ('store_sale_regions' in b) { // S1 可售区域(店铺默认):{mode:'all'|'list', include?, exclude?};null=清除(不限)
+            const v = validateSaleRegionsInput(b.store_sale_regions);
+            if ('error' in v)
+                return void errorRes(res, 400, 'BAD_SALE_REGIONS', v.error);
+            await dbRun('UPDATE users SET store_sale_regions = ? WHERE id = ?', [v.json, user.id]);
+            touched.store_sale_regions = v.json ? JSON.parse(v.json) : null;
+        }
+        if ('product_id' in b && 'sale_regions' in b) { // S1 单品覆盖(优先于店铺;null=回落店铺)
+            const v = validateSaleRegionsInput(b.sale_regions);
+            if ('error' in v)
+                return void errorRes(res, 400, 'BAD_SALE_REGIONS', v.error);
+            const prodS = await dbOne('SELECT seller_id FROM products WHERE id = ?', [b.product_id]);
+            if (!prodS)
+                return void errorRes(res, 404, 'PRODUCT_NOT_FOUND', '商品不存在');
+            if (prodS.seller_id !== user.id)
+                return void errorRes(res, 403, 'NOT_PRODUCT_OWNER', '只能设置自己商品');
+            await dbRun('UPDATE products SET sale_regions = ? WHERE id = ?', [v.json, b.product_id]);
+            touched.product_sale_regions = v.json ? JSON.parse(v.json) : null;
+        }
+        if ('store_free_shipping_threshold' in b) { // 营销:满额免邮(店铺默认;null=清除)。券后货款≥阈值→运费商家承担
+            const v = validateFreeShippingThreshold(b.store_free_shipping_threshold);
+            if ('error' in v)
+                return void errorRes(res, 400, 'BAD_FREE_SHIPPING_THRESHOLD', v.error);
+            await dbRun('UPDATE users SET store_free_shipping_threshold = ? WHERE id = ?', [v.value, user.id]);
+            touched.store_free_shipping_threshold = v.value;
+        }
+        if ('product_id' in b && 'free_shipping_threshold' in b) { // 营销:单品覆盖(null=回落店铺)
+            const v = validateFreeShippingThreshold(b.free_shipping_threshold);
+            if ('error' in v)
+                return void errorRes(res, 400, 'BAD_FREE_SHIPPING_THRESHOLD', v.error);
+            const prodF = await dbOne('SELECT seller_id FROM products WHERE id = ?', [b.product_id]);
+            if (!prodF)
+                return void errorRes(res, 404, 'PRODUCT_NOT_FOUND', '商品不存在');
+            if (prodF.seller_id !== user.id)
+                return void errorRes(res, 403, 'NOT_PRODUCT_OWNER', '只能设置自己商品');
+            await dbRun('UPDATE products SET free_shipping_threshold = ? WHERE id = ?', [v.value, b.product_id]);
+            touched.product_free_shipping_threshold = v.value;
+        }
+        if ('store_import_duty_terms' in b) { // S3:DDP/DDU 进口责任声明(店铺默认;null=清除)
+            const v = validateImportDutyTerms(b.store_import_duty_terms);
+            if ('error' in v)
+                return void errorRes(res, 400, 'BAD_IMPORT_DUTY_TERMS', v.error);
+            await dbRun('UPDATE users SET store_import_duty_terms = ? WHERE id = ?', [v.value, user.id]);
+            touched.store_import_duty_terms = v.value;
+        }
+        if ('product_id' in b && 'import_duty_terms' in b) { // S3:单品覆盖(null=回落店铺)
+            const v = validateImportDutyTerms(b.import_duty_terms);
+            if ('error' in v)
+                return void errorRes(res, 400, 'BAD_IMPORT_DUTY_TERMS', v.error);
+            const prodD = await dbOne('SELECT seller_id FROM products WHERE id = ?', [b.product_id]);
+            if (!prodD)
+                return void errorRes(res, 404, 'PRODUCT_NOT_FOUND', '商品不存在');
+            if (prodD.seller_id !== user.id)
+                return void errorRes(res, 403, 'NOT_PRODUCT_OWNER', '只能设置自己商品');
+            await dbRun('UPDATE products SET import_duty_terms = ? WHERE id = ?', [v.value, b.product_id]);
+            touched.product_import_duty_terms = v.value;
+        }
+        if ('store_tax_lines' in b) { // S3:价内已含税声明(店铺默认;仅 'included';null=清除)
+            const v = validateTaxLines(b.store_tax_lines);
+            if ('error' in v)
+                return void errorRes(res, 400, 'BAD_TAX_LINES', v.error);
+            await dbRun('UPDATE users SET store_tax_lines = ? WHERE id = ?', [v.value, user.id]);
+            touched.store_tax_lines = v.value ? JSON.parse(v.value) : null;
+        }
+        if ('product_id' in b && 'tax_lines' in b) { // S3:单品覆盖(null=回落店铺)
+            const v = validateTaxLines(b.tax_lines);
+            if ('error' in v)
+                return void errorRes(res, 400, 'BAD_TAX_LINES', v.error);
+            const prodT = await dbOne('SELECT seller_id FROM products WHERE id = ?', [b.product_id]);
+            if (!prodT)
+                return void errorRes(res, 404, 'PRODUCT_NOT_FOUND', '商品不存在');
+            if (prodT.seller_id !== user.id)
+                return void errorRes(res, 403, 'NOT_PRODUCT_OWNER', '只能设置自己商品');
+            await dbRun('UPDATE products SET tax_lines = ? WHERE id = ?', [v.value, b.product_id]);
+            touched.product_tax_lines = v.value ? JSON.parse(v.value) : null;
+        }
+        if ('product_id' in b && 'quote_ok' in b) {
+            if (b.quote_ok !== null && typeof b.quote_ok !== 'boolean')
+                return void errorRes(res, 400, 'BAD_QUOTE_OK', 'quote_ok 只允许 true|false|null');
+            const prodQ = await dbOne('SELECT seller_id FROM products WHERE id = ?', [b.product_id]);
+            if (!prodQ)
+                return void errorRes(res, 404, 'PRODUCT_NOT_FOUND', '商品不存在');
+            if (prodQ.seller_id !== user.id)
+                return void errorRes(res, 403, 'NOT_PRODUCT_OWNER', '只能设置自己商品');
+            await dbRun('UPDATE products SET shipping_quote_ok = ? WHERE id = ?', [b.quote_ok === null ? null : (b.quote_ok ? 1 : 0), b.product_id]);
+            touched.product_quote_ok = b.quote_ok;
+        }
+        if ('template' in b) { // 单品运费模板:仅在显式带 template 时进入 —— 关闭整类隐患(此前 'product_id' in b 会让 {product_id, store_*} 等组合尾随进来把模板静默清成 NULL;审计 P2)。清除走 {product_id, template:null}('template' in b 成立)
+            if (!b.product_id)
+                return void errorRes(res, 400, 'MISSING_PRODUCT_ID', '设置单品运费模板须带 product_id');
+            const p = parseShippingTemplate(b.template);
+            if (!p.ok)
+                return void errorRes(res, 400, 'BAD_SHIPPING_TEMPLATE', p.error);
+            const prod = await dbOne('SELECT seller_id FROM products WHERE id = ?', [b.product_id]);
+            if (!prod)
+                return void errorRes(res, 404, 'PRODUCT_NOT_FOUND', '商品不存在');
+            if (prod.seller_id !== user.id)
+                return void errorRes(res, 403, 'NOT_PRODUCT_OWNER', '只能设置自己商品的运费模板');
+            await dbRun('UPDATE products SET shipping_template = ? WHERE id = ?', [p.entries ? JSON.stringify(p.entries) : null, b.product_id]);
+            touched.product_template = p.entries;
+        }
+        if (Object.keys(touched).length === 0)
+            return void errorRes(res, 400, 'NOTHING_TO_SET', '未提供任何设置项');
+        return void res.json({ success: true, ...touched });
+    });
+    // 卖家读自己的店铺级设置(设置 UI 回显):接单模式 + 运费模板 + 询价开关。
+    app.get('/api/seller/shipping-settings', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (user.role !== 'seller')
+            return void errorRes(res, 403, 'SELLER_ONLY', '仅卖家');
+        const row = await dbOne('SELECT store_accept_mode, store_shipping_template, store_shipping_quote_ok, store_sale_regions, store_free_shipping_threshold, store_import_duty_terms, store_tax_lines FROM users WHERE id = ?', [user.id]);
+        return void res.json({
+            store_accept_mode: row?.store_accept_mode ?? null,
+            store_sale_regions: parseSaleRegionsRule(row?.store_sale_regions ?? null),
+            store_free_shipping_threshold: row?.store_free_shipping_threshold ?? null,
+            store_import_duty_terms: (row?.store_import_duty_terms === 'ddu' || row?.store_import_duty_terms === 'ddp') ? row.store_import_duty_terms : null,
+            store_tax_lines: parseTaxLines(row?.store_tax_lines ?? null),
+            store_template: loadTemplateJson(row?.store_shipping_template),
+            store_quote_ok: row?.store_shipping_quote_ok == null ? null : Number(row.store_shipping_quote_ok) === 1,
+        });
+    });
+    // 公开读:买家下单前查配送范围。生效 = 单品覆盖 ?? 店铺默认;template=null → 不按地区计费(下单不要求选地区)。
+    app.get('/api/products/:id/shipping-options', async (req, res) => {
+        const prod = await dbOne('SELECT id, seller_id, shipping_template, shipping_quote_ok, import_duty_terms, tax_lines, sale_regions, free_shipping_threshold FROM products WHERE id = ?', [req.params.id]);
+        if (!prod)
+            return void errorRes(res, 404, 'PRODUCT_NOT_FOUND', '商品不存在');
+        let entries = loadTemplateJson(prod.shipping_template);
+        let source = entries ? 'product' : null;
+        const seller = await dbOne('SELECT store_shipping_template, store_shipping_quote_ok, store_import_duty_terms, store_tax_lines, store_sale_regions, store_free_shipping_threshold FROM users WHERE id = ?', [prod.seller_id]);
+        if (!entries) {
+            entries = loadTemplateJson(seller?.store_shipping_template);
+            if (entries)
+                source = 'store';
+        }
+        const quoteOk = prod.shipping_quote_ok != null ? Number(prod.shipping_quote_ok) === 1 : Number(seller?.store_shipping_quote_ok) === 1;
+        // S3 税费/进口责任披露(买家下单前可见;卖家 seller-declared,平台不算不收)。
+        //   价内含税【按收货地区过滤】(?ship_to_region):目的区匹配项 + '*' 通用项;无地区参数=仅 '*'(只披露必然适用的,
+        //   不把不属于该目的地的税误示给买家)。DDP/DDU 是整单单一声明,不按区分。
+        const importDuty = effectiveImportDutyTerms(prod.import_duty_terms, seller?.store_import_duty_terms);
+        const shipToRegion = typeof req.query.ship_to_region === 'string' && req.query.ship_to_region.trim() ? req.query.ship_to_region.trim().toUpperCase() : null;
+        const taxLines = taxLinesForRegion(effectiveTaxLines(prod.tax_lines, seller?.store_tax_lines), shipToRegion);
+        // S5 买家下单前聚合(只读,复用 S1-S4 判定;不动订单金额/不收税)。
+        const saleRule = parseSaleRegionsRule(prod.sale_regions) ?? parseSaleRegionsRule(seller?.store_sale_regions ?? null); // 可售规则(商品??店铺)
+        // 平台合规名单:与建单门 gateSaleRegionForCreate 共用 parsePlatformBlocklist,坏配置 fail-closed 一致(建单 503 ⇄ 预检 platform_policy_invalid),
+        //   不再把坏配置当空名单静默放行(否则预检显示"可买"、提交才 503,与 create gate 不一致)。缺省 '[]'/无行=空名单=可售。
+        const pr = await dbOne("SELECT value FROM protocol_params WHERE key = 'trade.platform_region_blocklist'").catch(() => null);
+        const parsedBlock = parsePlatformBlocklist(pr ? pr.value : '[]');
+        const policyInvalid = !parsedBlock.ok;
+        const platformBlock = parsedBlock.ok ? parsedBlock.list : [];
+        const freeThreshold = (prod.free_shipping_threshold != null && Number(prod.free_shipping_threshold) > 0) ? Number(prod.free_shipping_threshold)
+            : (seller?.store_free_shipping_threshold != null && Number(seller.store_free_shipping_threshold) > 0 ? Number(seller.store_free_shipping_threshold) : null);
+        // 可售裁定(镜像建单 gateSaleRegionForCreate 的判定,只读不抛):平台配置异常 > 平台合规 > 商家意愿。
+        const restricted = policyInvalid || !!saleRule || platformBlock.length > 0;
+        let sellable = { ok: true, reason: 'ok' };
+        if (policyInvalid)
+            sellable = { ok: false, reason: 'platform_policy_invalid' }; // 坏配置 fail-closed:显示不可下单,不诱导买家提交后才 503
+        else if (restricted) {
+            if (!shipToRegion)
+                sellable = { ok: false, reason: 'region_required' };
+            else if (platformBlock.includes(shipToRegion))
+                sellable = { ok: false, reason: 'product_restricted' }; // 平台合规,商家不可放宽
+            else if (saleRule && !regionAllowedByRule(saleRule, shipToRegion))
+                sellable = { ok: false, reason: 'region_not_for_sale' }; // 商家不销往
+        }
+        // 目的区运费裁定(有模板时;免邮阈值仅回传数值供 UI 提示"满 X 免邮",实际是否免取决于买家券后货款,建单时定)
+        let resolvedShipping = null;
+        if (entries && shipToRegion) {
+            const r = resolveShipping(entries, shipToRegion);
+            resolvedShipping = { covered: r.covered, fee: r.covered ? r.fee : null, est_days: r.est_days, quote_required: !r.covered && quoteOk };
+        }
+        return void res.json({
+            product_id: prod.id,
+            region_required: !!entries || restricted, // S5:可售/合规限制也需买家指定目的地(与建单 SHIP_REGION_REQUIRED 一致)
+            template: entries,
+            source,
+            sellable, // S5:{ ok, reason: ok|region_required|product_restricted|region_not_for_sale|platform_policy_invalid }
+            sale_regions: saleRule, // S5:生效可售规则(商品??店铺){mode:'list',include:[...]} | {mode:'all',exclude:[...]} | null —— UI 据此在无运费模板时也能生成地区入口
+            resolved_shipping: resolvedShipping, // S5:目的区运费裁定(covered/fee/est_days/quote_required)| null(无模板或未选区)
+            free_shipping_threshold: freeThreshold, // S5:生效满额免邮阈值(UI 提示"满 X 免邮";实际免取决于建单时券后货款)
+            import_duty_terms: importDuty, // 'ddu'(买家到境自付关税/税)| 'ddp'(卖家已含)| null(未声明)
+            tax_included_lines: taxLines, // 价内已含税声明(如 [{region:'SG',label:'GST',rate_pct:9,kind:'included'}])
+            tax_disclosure: 'seller_declared_platform_no_collect', // S5:税费/进口责任均为卖家声明,平台不代收代缴(直付非托管)
+            quote_outside_template: !!entries && quoteOk, // 直付轨:模板外地区可询价(卖家报运费/时效,确认后付款)
+            note: entries
+                ? (quoteOk ? '下单须选择收货地区;模板内地区运费自动计入,模板外地区(直付)可先询价再付款。' : '下单须选择收货地区;运费按模板计入总额(快照)。未覆盖地区暂不可下单。')
+                : (restricted ? '该商品设有可售地区限制,请选择收货地区确认。' : '该商品不按地区计运费。'),
+        });
+    });
+}

package/dist/pwa/routes/snf.js

@@ -1,5 +1,6 @@
 import { dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 import { snfSend, snfPullInbox, snfListInbox, snfAck, snfPendingCount, snfVerify, snfDesignate, snfGetDesignation, snfNack, snfListDeadLetter, snfRevive, } from '../../layer2-business/L2-7-snf/snf-engine.js';
+import { isEligibleArbitrator } from '../arbitrator-lifecycle.js'; // 仲裁能力唯一源=active 白名单(verify 是争议证据面,不认 legacy role)
 export function registerSnfRoutes(app, deps) {
     const { db, auth } = deps;
     app.post('/api/snf/send', (req, res) => {
@@ -105,7 +106,9 @@ export function registerSnfRoutes(app, deps) {
         if (!r)
             return void res.status(404).json({ error: '消息不存在' });
         const uid = user.id;
-        if (uid !== r.sender_id && uid !== r.recipient_id && user.role !== 'arbitrator' && user.role !== 'admin') {
+        // 仲裁员认 active 白名单(争议证据验签是仲裁工作面);legacy role 旁路移除 —— 否则 role-only/已吊销账号可按 id
+        //   探测任意用户间私信的存在性+签名有效性,而真·白名单仲裁员(role=buyer)反被 403。admin 保持原样。
+        if (uid !== r.sender_id && uid !== r.recipient_id && !isEligibleArbitrator(db, uid).ok && user.role !== 'admin') {
             return void res.status(403).json({ error: '无权验证' });
         }
         res.json(await snfVerify(db, req.params.id));

package/dist/pwa/routes/webauthn.js

@@ -74,13 +74,13 @@ export function registerWebauthnRoutes(app, deps) {
         if (!user)
             return;
         const purpose = String(req.body?.purpose || '').trim();
-        const allowed = new Set(['withdraw', 'change-password', 'reveal-key', 'region', 'delete_passkey', 'governance_apply', 'governance_activate', 'governance_resign', 'governance_appeal_resolve', 'rewards_apply', 'rewards_deactivate', 'identity_claim', 'operator_claim_unlink', 'direct_pay_disclosure_ack', 'direct_pay_order_action', 'direct_receive_production_confirm', 'direct_pay_aml_review', 'direct_pay_kyb_ingress', 'direct_pay_sanctions_ingress', 'direct_pay_aml_ingress', 'direct_pay_admin_readiness', 'direct_pay_deferral_approve', 'direct_pay_deferral_reject', 'direct_pay_product_verify', 'direct_pay_store_verify', 'direct_pay_fee_prepay_record', 'direct_pay_fee_adjust', 'direct_pay_fee_refund', 'direct_receive_account_manage']);
+        const allowed = new Set(['withdraw', 'change-password', 'reveal-key', 'region', 'delete_passkey', 'governance_apply', 'governance_activate', 'governance_resign', 'governance_appeal_resolve', 'rewards_apply', 'rewards_deactivate', 'identity_claim', 'operator_claim_unlink', 'direct_pay_disclosure_ack', 'direct_pay_order_action', 'direct_receive_production_confirm', 'direct_receive_bond_refund', 'direct_pay_bond_slash', 'direct_pay_aml_review', 'direct_pay_kyb_ingress', 'direct_pay_sanctions_ingress', 'direct_pay_aml_ingress', 'direct_pay_admin_readiness', 'direct_pay_deferral_approve', 'direct_pay_deferral_reject', 'direct_pay_product_verify', 'direct_pay_store_verify', 'direct_pay_fee_prepay_record', 'direct_pay_fee_adjust', 'direct_pay_fee_refund', 'direct_receive_account_manage', 'platform_receive_account_manage', 'direct_pay_fee_prepay_reject', 'direct_pay_fee_prepay_request_approve', 'direct_pay_payment_info_reveal', 'arbitrator_grant', 'arbitrator_suspend', 'arbitrator_reinstate', 'arbitrator_revoke', 'arbitrate', 'agent_pair_approve', 'agent_permission_approve']);
         if (!allowed.has(purpose))
             return void res.status(400).json({ error: 'invalid purpose' });
         const purpose_data = req.body?.purpose_data ?? null;
         const creds = await dbAll('SELECT id, transports FROM webauthn_credentials WHERE user_id = ?', [user.id]);
         if (creds.length === 0)
-            return void res.status(403).json({ error: '尚未注册任何 Passkey' });
+            return void res.status(403).json({ error: '尚未注册任何 Passkey', error_code: 'NO_PASSKEY_REGISTERED' }); // 前端据此才提示注册;已注册者的取消/设备失败不误导去注册
         const opts = await generateAuthenticationOptions({
             rpID: rpId,
             // H-1: 闸门必须真正 UV，不接受 "硬件按一下" 兜底
@@ -196,5 +196,5 @@ export function registerWebauthnRoutes(app, deps) {
     // RFC-020 PR-B — agent delegation grants (issue/read/revoke). Co-registered with the
     // Passkey security routes so the money-dense server.ts stays untouched. Safe scopes
     // only; risk scopes default-hard-reject. Reuses db/auth/generateId from WebauthnDeps.
-    registerAgentGrantsRoutes(app, { db, auth, generateId, rateLimitOk });
+    registerAgentGrantsRoutes(app, { db, auth, generateId, rateLimitOk, requireHumanPresence, createProductDraftHandler: deps.createProductDraftHandler });
 }