@seasonkoh/webaz 0.1.29 → 0.1.31

package/dist/pwa/server.js

@@ -41,6 +41,14 @@ import { ensureEvidenceColumns, uploadEvidence, listEvidence as listEvidenceFile
 import { cleanupOrphanNotePhotos, } from '../layer2-business/L2-notes/note-photo-storage.js';
 import { initAnchorRegistrySchema, retireAnchorsByTarget, reclaimRetiredAnchors, retireIdleAnchors, userReferralVolume, computeTierLetter, } from '../layer2-business/L2-anchor-registry/anchor-registry.js';
 import { initDisputeSchema, createDispute, respondToDispute, arbitrateDispute, getOrderDispute, getDisputeDetails, getOpenDisputes, checkDisputeTimeouts, initEvidenceRequestSchema, requestEvidence, getEvidenceRequests, addPartyEvidence, } from '../layer3-trust/L3-1-dispute-engine/dispute-engine.js';
+import { initMutualCancelSchema } from '../layer3-trust/L3-1-dispute-engine/mutual-cancel.js';
+import { registerMutualCancelRoutes } from './routes/mutual-cancel.js';
+import { initDirectPayCancelRefundSchema } from '../direct-pay-cancel-refund.js';
+import { registerDirectPayCancelRefundRoutes } from './routes/direct-pay-cancel-refund.js';
+import { registerDirectPayReturnsRoutes } from './routes/direct-pay-returns.js';
+import { registerDirectPayPendingAcceptRoutes } from './routes/direct-pay-pending-accept.js';
+import { registerShippingTemplateRoutes } from './routes/shipping-templates.js';
+import { registerBondSellerRoutes } from './routes/bond-seller.js'; // 协商取消(disputed) + 直付取消退款握手(accepted):域 schema + 端点
 import { initNotificationSchema, notifyTransition, setPushCallback, scanDeadlineReminders, } from '../layer2-business/L2-6-notifications/notification-engine.js';
 import { initSkillMarketSchema } from '../layer4-economics/L4-4-skill-market/skill-listing-engine.js';
 import { computeAgentPassport } from '../layer1-agent/L1-2-identity/agent-passport.js';
@@ -154,6 +162,7 @@ import { registerExternalAnchorsRoutes } from './routes/external-anchors.js';
 import { registerAnchorsRoutes } from './routes/anchors.js';
 // 仲裁员申请 (#1013 Phase 44) — 4 user + 3 admin endpoints
 import { registerArbitratorRoutes } from './routes/arbitrator.js';
+import { isEligibleArbitrator as isEligibleArbitratorImpl } from './arbitrator-lifecycle.js'; // PR-B: active-whitelist-only 授权源
 // Governance onboarding (W3.5-B 实施 #1093 阶段 1) — 2 user endpoints
 import { registerGovernanceOnboardingRoutes } from './routes/governance-onboarding.js';
 import { startAutoDeactivateCron, runAutoDeactivateSweep } from './routes/governance-auto-deactivate.js';
@@ -250,11 +259,15 @@ import { registerOrdersActionRoutes } from './routes/orders-action.js';
 import { registerOrdersCreateRoutes } from './routes/orders-create.js';
 import { registerDirectPayDisclosureAckRoutes } from './routes/direct-pay-disclosure-acks.js'; // PR-4d: Direct Pay 风险披露 ack 端点(薄 adapter)
 import { registerDirectReceivePaymentInstructionRoutes } from './routes/direct-receive-payment-instructions.js';
-import { registerDirectReceiveAccountsRoutes } from './routes/direct-receive-accounts.js'; // PR-4f-a instruction CRUD + Phase C1 multi-account+QR
-import { registerDirectPayAvailabilityRoutes } from './routes/direct-pay-availability.js'; // PR-4a: Direct Pay 可用性只读(控制面 SSOT)
-import { registerAdminDirectReceiveDepositsRoutes } from './routes/admin-direct-receive-deposits.js'; // PR-4b-3: ROOT 生产保证金 receipt 确认(fail-closed scaffold)
+import { registerDirectReceiveAccountsRoutes } from './routes/direct-receive-accounts.js';
+import { registerFeePrepayRequestRoutes } from './routes/fee-prepay-requests.js'; // PR-4f-a instruction CRUD + Phase C1 multi-account+QR + 平台服务费预充值申请(卖家侧)
+import { registerDirectPayAvailabilityRoutes } from './routes/direct-pay-availability.js';
+import { registerSellerDirectPayReportRoutes } from './routes/seller-directpay-report.js'; // PR-4a 可用性 + 卖家直付销售统计/对账/平台费明细(只读)
+import { registerAdminDirectReceiveDepositsRoutes } from './routes/admin-direct-receive-deposits.js';
+import { registerPlatformReceiveAccountsRoutes } from './routes/platform-receive-accounts.js'; // PR-4b-3 ROOT 生产保证金 + 平台多收款方式 admin 管理(fee 预充值申请流前置)
 // Disputes 读端点 (#1013 Phase 86) — 5 endpoints (list/similar/detail/evidence-list/parties)
 import { registerDisputesReadRoutes } from './routes/disputes-read.js';
+import { isArbitrationReadAdmin } from './arbitration-read-admin.js'; // 争议详情只读 admin 门(与后台列表授权一致)
 // Disputes 写端点 (#1013 Phase 87) — 5 endpoints (respond/arbitrate/add-evidence/evidence-blob/request-evidence)
 import { registerDisputesWriteRoutes } from './routes/disputes-write.js';
 // Products 声明 (#1013 Phase 88) — 2 endpoints (POST claim + GET claims)
@@ -270,7 +283,7 @@ import { registerProductsCrudRoutes } from './routes/products-crud.js';
 // Products PUT update (#1013 Phase 93) — 1 endpoint (123 行)
 import { registerProductsUpdateRoutes } from './routes/products-update.js';
 // Products POST create (#1013 Phase 94) — 1 endpoint (232 行)
-import { registerProductsCreateRoutes } from './routes/products-create.js';
+import { registerProductsCreateRoutes, makeCreateProductHandler } from './routes/products-create.js';
 // Products GET list (#1013 Phase 95) — 1 endpoint (399 行)
 import { registerProductsListRoutes } from './routes/products-list.js';
 // P2P 商品 (#1013 Phase 96) — 5 endpoints
@@ -395,6 +408,8 @@ const settleClaimTask = (taskId) => settleClaimTaskRaw(db, generateId, taskId);
 const notifyEligibleVerifiers = (args) => notifyEligibleVerifiersRaw(db, generateId, args);
 initSystemUser(db);
 initDisputeSchema(db);
+initMutualCancelSchema(db);
+initDirectPayCancelRefundSchema(db); // + mutual_cancel_proposals / direct_pay_cancel_requests 表
 initNotificationSchema(db);
 initSkillSchema(db);
 initSkillMarketSchema(db);
@@ -843,10 +858,10 @@ const DEFAULT_PARAMS = [
     // ⚠️ Codex #111:stake-required 模式(=1)【尚未实现】—— 下单不锁 stake、settleFault 仍按 stake_backing=0 不没收,
     //   开启会给出虚假"真没收"协议语义。故 max 锁 0(不可开启);待 Phase 3 钱路径迁移实现真锁(下单原子锁 balance→staked)再放开。
     { key: 'require_seller_stake', value: '0', type: 'number', description: 'RFC-008 是否要求卖家质押(0=起步免赔付/零门槛)。⚠️ stake-required(=1)未实现、暂锁 0 不可开启,见 Phase 3', category: 'fee', min: 0, max: 0 },
-    // RFC-008 stage 2:违约罚没率,【与质押率解耦】(低质押=低摩擦 + 高罚没=强威慑,单一费率做不到)。
-    //   背书订单:penalty = fault_penalty_rate × total,先扣 staked(封顶背书)再扣自由 balance(责任自负,真可执行)。
+    // RFC-008 stage 2:违约罚没率,【与质押率解耦】(低质押=低摩擦+高罚没=强威慑)。背书订单:penalty=rate×total,先扣 staked(封顶背书)再扣自由 balance(责任自负)。
     //   起步免赔付(stake_backing=0):仍 0 没收,绝不碰新商家自由余额。settleFault 按订单 stake_backing 判定。
     { key: 'fault_penalty_rate', value: '0.30', type: 'number', description: 'RFC-008 违约罚没率(与质押率解耦;背书订单 staked 不足扣自由 balance;起步免赔付订单不适用)', category: 'fee', min: 0, max: 0.50 },
+    { key: 'trade.platform_region_blocklist', value: '[]', type: 'json', description: '跨境 S1 平台合规禁售地区(JSON 数组大写区码,如 ["KP"]):建单 PRODUCT_RESTRICTED 硬拒,商家不可放宽;默认空。admin PATCH 有 JSON+区码校验', category: 'system' },
     // RFC-007 stage 3：客观理由拒单的【举证窗口】小时数。卖家声称客观无责拒单 → 临时判责,此窗口内可开仲裁(stage 5)举证;
     //   到期无人仲裁 → 自动终结为违约。窗口内买家 escrow 暂不退(随终结/翻案一次性结算),0=不给窗口(直接违约)。
     { key: 'decline_contest_window_hours', value: '24', type: 'number', description: 'RFC-007 客观拒单举证窗口(小时);到期未仲裁则终结为违约', category: 'limit', min: 0, max: 168 },
@@ -1373,11 +1388,7 @@ try {
 }
 catch { }
 // 2026-05-22: 复合索引 — GET /api/shares/dashboard bought_products 5 子查询性能优化
-// note_count / first_note_id 用：owner_id + related_order_id + type + status
-try {
-    db.exec("CREATE INDEX IF NOT EXISTS idx_share_owner_order_type ON shareables(owner_id, related_order_id, type, status)");
-}
-catch { }
+// note_count / first_note_id 用的 idx_share_owner_order_type 已移至下方 related_order_id ALTER 之后(此处列尚不存在,先建=fresh 库永缺该索引)
 // product_share_count 用：owner_id + related_product_id + status（避免回表）
 try {
     db.exec("CREATE INDEX IF NOT EXISTS idx_share_owner_product ON shareables(owner_id, related_product_id, status)");
@@ -1423,6 +1434,10 @@ try {
     db.exec("CREATE INDEX IF NOT EXISTS idx_share_order ON shareables(related_order_id) WHERE related_order_id IS NOT NULL");
 }
 catch { }
+try {
+    db.exec("CREATE INDEX IF NOT EXISTS idx_share_owner_order_type ON shareables(owner_id, related_order_id, type, status)");
+}
+catch { }
 // 笔记图片 hash 索引 / Wave A 购物表（心愿单 · 商品Q&A · 优惠券）→ server-schema.ts
 // 纯幂等建表/建索引 DDL，原位调用保持 boot 顺序不变
 initNotePhotoIndexSchema(db);
@@ -1668,13 +1683,12 @@ catch { }
 for (const stmt of [
     'ALTER TABLE products ADD COLUMN claim_loss_count INTEGER DEFAULT 0',
     'ALTER TABLE secondhand_items ADD COLUMN claim_loss_count INTEGER DEFAULT 0',
-    'ALTER TABLE auctions ADD COLUMN claim_loss_count INTEGER DEFAULT 0',
 ]) {
     try {
         db.exec(stmt);
     }
     catch { }
-}
+} // auctions 的同名 ALTER 在 auctions CREATE 之后(此处表尚不存在,先跑=fresh 库永缺列 — 铁律:ALTER AFTER CREATE)
 // P2P 原生商店 — 卖家本地节点存详情，WebAZ 只锚定 hash + 关键字段
 for (const stmt of [
     'ALTER TABLE products ADD COLUMN p2p_mode INTEGER DEFAULT 0',
@@ -2019,10 +2033,10 @@ try {
           read       INTEGER DEFAULT 0,
           created_at TEXT DEFAULT (datetime('now')),
           wish_id    TEXT,
-          actions    TEXT
+          actions    TEXT, template_key TEXT, params TEXT
         );
-        INSERT INTO notifications_new (id, user_id, order_id, type, title, body, read, created_at, wish_id, actions)
-          SELECT id, user_id, order_id, type, title, body, read, created_at, wish_id, actions FROM notifications;
+        INSERT INTO notifications_new (id, user_id, order_id, type, title, body, read, created_at, wish_id, actions, template_key, params)
+          SELECT id, user_id, order_id, type, title, body, read, created_at, wish_id, actions, template_key, params FROM notifications;
         DROP TABLE notifications;
         ALTER TABLE notifications_new RENAME TO notifications;
         CREATE INDEX IF NOT EXISTS idx_notif_user ON notifications(user_id, read, created_at DESC);
@@ -2420,11 +2434,15 @@ try {
     db.exec('CREATE INDEX IF NOT EXISTS idx_auctions_deadline ON auctions(status, deadline_at)');
 }
 catch { }
-// AUC P1：反狙击延长上限
+// AUC P1：反狙击延长上限;claim_loss_count 从 Sprint 4 数组移来(那里先于本表 CREATE,fresh 库静默失败)
 try {
     db.exec('ALTER TABLE auctions ADD COLUMN max_extends INTEGER DEFAULT 10');
 }
 catch { }
+try {
+    db.exec('ALTER TABLE auctions ADD COLUMN claim_loss_count INTEGER DEFAULT 0');
+}
+catch { }
 try {
     db.exec('ALTER TABLE auctions ADD COLUMN extends_used INTEGER DEFAULT 0');
 }
@@ -4073,8 +4091,8 @@ app.use((req, res, next) => {
     if (req.method === 'GET' && /^\/api\/(info|leaderboard|payment-methods|governance|openapi)/.test(req.path))
         return next();
     const apiKey = req.headers.authorization?.replace('Bearer ', '');
-    if (!apiKey)
-        return next(); // 无 key 走原 IP 速率
+    if (!apiKey || apiKey.startsWith('gtk_'))
+        return next(); // 无 key→IP 速率;gtk_* 委托凭证(RFC-020)是独立自守 auth 通道(requireAgentGrantScope/resolveActiveGrantByBearer 管 safe-scope+active/expiry/revoked+audit),非 api_key,不进下面 agent 声明/风控/strike;否则合法 safe-scope grant 写(如 POST /api/agent-grants/permission-requests)被误判 AGENT_SCOPE_UNDECLARED。gtk_* 只命中 grant-aware 路由,别处 auth() 自然 401。
     // 2026-05-23 P1 fix：被封禁用户仍可走以下路径（看自己 agent 状态 + 申诉）
     // - GET /api/me/agents 系列（看强 / 申诉前必查）
     // - POST /api/me/agents/strikes/:id/appeal（申诉权不能被封禁阻断）
@@ -4121,15 +4139,15 @@ app.use((req, res, next) => {
                 action, cap: capCheck.cap, used: capCheck.used, level: lvlForCap,
             });
         }
-        // Phase 3c：风险闸 — 高风险 agent 敏感写降速/暂停(只罚高风险,无责零成本)
+        // Phase 3c:风险闸 — 高风险 agent 敏感写降速/暂停。真人豁免(Tina 案二连,同 #241 原则):绑 Passkey=真人,敏感操作已有 Passkey 仪式把守;风险分含结构罚(同 IP 注册簇)+30 天半衰期,"30 秒重试"对真人=死锁
         const agentRisk = riskInfo.risk;
-        if (agentRisk >= 100) {
+        if (agentRisk >= 100 && !riskInfo.hasPasskey) {
             return void res.status(403).json({
                 error: 'agent 风险分已达上限，敏感操作已暂停 — 请在「我的 Agents」查看并申诉',
                 error_code: 'AGENT_RISK_SUSPENDED', action, risk: agentRisk,
             });
         }
-        if (agentRisk >= 70) {
+        if (agentRisk >= 70 && !riskInfo.hasPasskey) {
             res.setHeader('Retry-After', '30');
             return void res.status(429).json({
                 error: `agent 风险分偏高(${agentRisk}/100)，敏感操作已降速，请 30 秒后重试`,
@@ -4169,7 +4187,8 @@ app.use((req, res, next) => {
             }
         }
     }
-    // 分档 rate limit
+    if (riskInfo.hasPasskey || req.path === '/api/signaling/poll' || req.path === '/api/snf/pending')
+        return next(); // 分档 rate limit 前的真人豁免(Tina 案修复):绑 Passkey=真人本人/监护(PWA 页面加载+轮询天然高频,agent 约束原则=真人豁免,不进速率桶不触发 rate_limit_abuse strike);高频轮询端点亦不计 agent 配额
     const repRow = db.prepare(`SELECT level FROM agent_reputation WHERE api_key = ?`).get(apiKey);
     const level = repRow?.level || 'new';
     const cap = getAgentRateCap(level);
@@ -4475,9 +4494,12 @@ registerAgentReputationRoutes(app, {
 registerUsersPublicRoutes(app, { db, auth, noteAuthenticityBadges });
 registerDirectPayDisclosureAckRoutes(app, { db, auth, generateId, consumeGateToken }); // PR-4d
 registerDirectReceivePaymentInstructionRoutes(app, { db, auth, generateId });
-registerDirectReceiveAccountsRoutes(app, { db, auth, generateId, consumeGateToken }); // PR-4f-a + Phase C1
-registerDirectPayAvailabilityRoutes(app, { db, auth, getProtocolParam, generateId }); // PR-4a + 缓交 apply/status
-registerAdminDirectReceiveDepositsRoutes(app, { db, requireRootAdmin: (req, res) => requireRootAdmin(req, res), consumeGateToken, logAdminAction, getProtocolParam }); // PR-4b-3 + readiness
+registerDirectReceiveAccountsRoutes(app, { db, auth, generateId, consumeGateToken });
+registerFeePrepayRequestRoutes(app, { db, auth, generateId }); // PR-4f-a + Phase C1 + fee 预充值申请
+registerDirectPayAvailabilityRoutes(app, { db, auth, getProtocolParam, generateId });
+registerSellerDirectPayReportRoutes(app, { db, auth }); // PR-4a + 缓交 + 卖家直付销售统计/对账/平台费明细(只读)
+registerAdminDirectReceiveDepositsRoutes(app, { db, requireRootAdmin: (req, res) => requireRootAdmin(req, res), consumeGateToken, logAdminAction, getProtocolParam });
+registerPlatformReceiveAccountsRoutes(app, { db, requireRootAdmin: (req, res) => requireRootAdmin(req, res), generateId, consumeGateToken, logAdminAction }); // PR-4b-3 + readiness + 平台多收款方式 admin CRUD(root+Passkey)
 // RFC-004 build_feedback — agent-native "use → build" 反馈管道
 registerBuildFeedbackRoutes(app, {
     db, auth,
@@ -5845,25 +5867,20 @@ function getArbitratorState(userId) {
         state = 'rejected';
     if (wl)
         state = 'approved';
-    return { state, application: app ?? null, whitelist: wl ?? null };
+    // PR-E:真实运行时能力字段。前端必须以 can_arbitrate 为准(state='approved' 不区分 suspended/revoked)。
+    const arbitrator_status = wl ? (wl.status ?? 'active') : 'none'; // active / suspended / revoked / none
+    return { state, can_arbitrate: isEligibleArbitrator(userId).ok, arbitrator_status, application: app ?? null, whitelist: wl ?? null };
 }
-// 仲裁员身份判定（内部 role + 外部 whitelist 双通道）— 用于 /api/disputes/:id/arbitrate 守门
+// 仲裁员身份判定 — PR-B:唯一授权源 = active arbitrator_whitelist(role='arbitrator' 旁路已移除)。域逻辑见 arbitrator-lifecycle.ts。
 function isEligibleArbitrator(userId) {
-    const u = db.prepare("SELECT role FROM users WHERE id = ?").get(userId);
-    if (!u)
-        return { ok: false, reason: '用户不存在' };
-    if (u.role === 'arbitrator')
-        return { ok: true, via: 'role' };
-    const wl = db.prepare("SELECT user_id FROM arbitrator_whitelist WHERE user_id = ?").get(userId);
-    if (wl)
-        return { ok: true, via: 'whitelist' };
-    return { ok: false, reason: '非仲裁员 — 需 role=arbitrator（内部）或 arbitrator_whitelist（外部）' };
+    return isEligibleArbitratorImpl(db, userId);
 }
 // #1013 Phase 44: 4 user + 3 admin arbitrator endpoints 已迁出到 routes/arbitrator.ts
 registerArbitratorRoutes(app, {
     db, generateId, auth,
     requireArbitrationAdmin: (req, res) => requireAdminPermission(req, res, 'arbitration'),
     checkArbitratorEligibility, getArbitratorState, errorRes, logAdminAction,
+    consumeGateToken, // PR-B: grant/suspend/reinstate/revoke 的 purpose-bound 真人 Passkey
     ARB_STAKE_REQUIRED, ARB_APP_REJECT_COOLDOWN_DAYS,
 });
 // Governance onboarding (W3.5-B #1093) — apply + quiz + cases + admin activation + resign/appeal + auto_deactivate audit
@@ -6061,7 +6078,7 @@ registerSellerQuotaRoutes(app, {
 registerDisputesReadRoutes(app, {
     db, auth, errorRes,
     getOpenDisputes, getDisputeDetails, getEvidenceRequests, listEvidenceFiles,
-    isEligibleArbitrator,
+    isEligibleArbitrator, isArbitrationAdmin: isArbitrationReadAdmin, // 后者=争议详情只读 admin 门,与后台列表 /admin/disputes 同款授权(单一真相源 arbitration-read-admin.ts)
 });
 // #1013 Phase 87: 5 disputes 写端点已迁出（包括 234 行 arbitrate）
 // FUND_BASE_RATE 是 const 函数在文件下游定义；用 getter 包一层避免 TDZ
@@ -6074,8 +6091,14 @@ registerDisputesWriteRoutes(app, {
     FUND_BASE_RATE: () => FUND_BASE_RATE(),
     settleCommission, depositToFund, calculatePv,
     recordDisputeReputation, issueAgentStrike, publishDisputeCase, logAdminAction, snfSend,
-    getProtocolParam,
+    getProtocolParam, notifyTransition,
 });
+registerMutualCancelRoutes(app, { db, auth, generateId, errorRes });
+registerDirectPayCancelRefundRoutes(app, { db, auth, generateId, errorRes, consumeGateToken });
+registerDirectPayReturnsRoutes(app, { db, auth, generateId, errorRes, consumeGateToken });
+registerDirectPayPendingAcceptRoutes(app, { db, auth, errorRes, getProtocolParam });
+registerShippingTemplateRoutes(app, { db, auth, errorRes });
+registerBondSellerRoutes(app, { db, auth, generateId, errorRes, getProtocolParam }); // 协商取消(disputed)+ 直付取消退款握手(accepted):关单手术均内部 db.transaction 原子
 // lightAuthGuard：轻量 Authorization 头守门（在 raw 解析之前挡掉无 auth 请求）
 // 被 Phase 13 shareables（视频上传）+ Phase 87 disputes evidence-blob 共享
 function lightAuthGuard(req, res, next) {
@@ -7847,7 +7870,7 @@ registerWebauthnRoutes(app, {
     origin: WEBAUTHN_ORIGIN,
     challengeTtlMs: WEBAUTHN_CHALLENGE_TTL_MS,
     gateTtlMs: WEBAUTHN_GATE_TTL_MS,
-    invalidateAgentRiskCacheForUser,
+    invalidateAgentRiskCacheForUser, createProductDraftHandler: makeCreateProductHandler({ db, auth, generateId, checkSellerCanList, getStakeDiscount, VALID_PRODUCT_TYPES, parsePlatformUrl, makeCommitmentHash, makeDescriptionHash, makePriceHash }), // RFC-020 PR-4: grant-gated warehouse draft reuses the human create logic
     requireHumanPresence, // #1044 — DELETE passkey 自身需 token
 });
 // consumeGateToken / requireHumanPresence 已抽出到 ./human-presence.ts(PR-F0,behavior-zero,

package/dist/runtime/agent-grant-scopes.js

@@ -27,6 +27,13 @@ export const SAFE_SCOPES = [
     'list_product_draft',
     'product_publish_request',
     'draft_order',
+    // Seller-scoped read/draft surfaces (Catalog Agent role) — read the seller's own catalog + propose
+    //   drafts/pricing/publish-REQUESTS. NONE of these publish, accept orders, ship, or move money.
+    'seller_profile_read',
+    'seller_products_read',
+    'seller_inventory_read',
+    'seller_product_draft',
+    'seller_pricing_suggestion',
 ];
 /**
  * Real actions that WILL require a live Passkey each time — but are NOT yet gated
@@ -119,10 +126,71 @@ export function grantIsActive(grant, nowIso) {
 }
 /** Short-lived bearer policy for SAFE scopes (RFC-020 bearer-first; PoP before risk/longer). */
 export const GRANT_TTL_DEFAULT_SEC = 3600; // 1h
-export const GRANT_TTL_MAX_SEC = 24 * 3600; // 24h cap — short-lived only
+export const GRANT_TTL_MAX_SEC = 24 * 3600; // 24h cap — short-lived only (legacy webaz_pair bearer)
 export function clampTtlSeconds(requested) {
     const n = Number(requested);
     if (!Number.isFinite(n) || n <= 0)
         return GRANT_TTL_DEFAULT_SEC;
     return Math.min(Math.floor(n), GRANT_TTL_MAX_SEC);
 }
+export const PERMISSION_BUNDLES = {
+    catalog_agent: {
+        key: 'catalog_agent',
+        label: 'Catalog Agent',
+        scopes: ['read_public', 'profile_read', 'search', 'seller_profile_read', 'seller_products_read', 'seller_inventory_read', 'seller_product_draft', 'seller_pricing_suggestion', 'product_publish_request'],
+        human_summary: '选品、商品草稿、库存字段检查、价格建议、上架请求。它不能发布商品、不能接单、不能发货、不能动用资金。',
+        human_summary_en: 'Sourcing, product drafts, inventory-field checks, pricing suggestions, and publish REQUESTS. It cannot publish products, accept orders, ship, or move funds.',
+    },
+};
+/** Resolve a bundle key → its safe scopes + human summary, or null if unknown. */
+export function resolveBundle(key) {
+    return (typeof key === 'string' && Object.prototype.hasOwnProperty.call(PERMISSION_BUNDLES, key)) ? PERMISSION_BUNDLES[key] : null;
+}
+/** INVARIANT check (acceptance #7): a bundle must be all-safe. Returns the offending non-safe scopes. */
+export function bundleNonSafeScopes(bundle) {
+    return bundle.scopes.filter(s => classifyScope(s) !== 'safe');
+}
+// Load-time assertion: no bundle may ship with a risk/never/unknown scope (fail LOUD at import, not runtime).
+for (const b of Object.values(PERMISSION_BUNDLES)) {
+    const bad = bundleNonSafeScopes(b);
+    if (bad.length)
+        throw new Error(`Permission bundle '${b.key}' contains non-safe scope(s): ${bad.join(', ')} — bundles are safe-only (RFC-020)`);
+}
+export const DURATION_SECONDS = { '1h': 3600, '24h': 86400, '7d': 604800, '30d': 2592000 };
+/**
+ * Which durations a set of scopes may be granted for, capped by the HIGHEST risk tier present:
+ *   - never-delegable / unknown  → []            (cannot be granted at all)
+ *   - risk (high)                → ['once']       (single Passkey each time; NEVER long-term)
+ *   - safe (low/medium)          → once…30d       (long-term ok)
+ */
+export function allowedDurationsForScopes(scopes) {
+    const tiers = scopes.map(classifyScope);
+    if (tiers.some(t => t === 'never_delegable' || t === 'unknown'))
+        return [];
+    if (tiers.some(t => t === 'risk'))
+        return ['once'];
+    return ['once', '1h', '24h', '7d', '30d'];
+}
+export function durationAllowedForScopes(scopes, duration) {
+    return typeof duration === 'string' && allowedDurationsForScopes(scopes).includes(duration);
+}
+/** Suggested default: 7d for long-term-eligible safe scopes; else the safest available (once). */
+export function suggestedDurationForScopes(scopes) {
+    const a = allowedDurationsForScopes(scopes);
+    return a.includes('7d') ? '7d' : (a[0] ?? 'once');
+}
+/** Grant lifetime in seconds for an approved (non-'once') duration. 'once' handled separately (single-use). */
+export function durationToSeconds(duration) {
+    return duration === 'once' ? 0 : DURATION_SECONDS[duration];
+}
+/** Coarse risk label for the human-facing request card. */
+export function riskLevelForScopes(scopes) {
+    const tiers = scopes.map(classifyScope);
+    if (tiers.some(t => t === 'never_delegable' || t === 'unknown'))
+        return 'blocked';
+    if (tiers.some(t => t === 'risk'))
+        return 'high';
+    if (scopes.includes('product_publish_request'))
+        return 'medium'; // request-only (still human-gated to publish), flag as medium
+    return 'low';
+}

package/dist/runtime/webaz-schema-helpers.js

@@ -784,6 +784,17 @@ export function initArbitratorReviewSchema(db) {
     stake_amount    INTEGER DEFAULT 0
   )
 `);
+    // PR-B 生产仲裁员生命周期字段(ADD COLUMN 必在 CREATE 后 —— schema 铁律)。legacy 行 status NULL 视为 active。
+    for (const alter of [
+        `ALTER TABLE arbitrator_whitelist ADD COLUMN status TEXT DEFAULT 'active'`, // active | suspended | revoked
+        `ALTER TABLE arbitrator_whitelist ADD COLUMN suspended_at TEXT`,
+        `ALTER TABLE arbitrator_whitelist ADD COLUMN revoked_at TEXT`,
+    ]) {
+        try {
+            db.exec(alter);
+        }
+        catch { /* 列已存在 */ }
+    }
     try {
         db.exec('CREATE INDEX IF NOT EXISTS idx_arb_apps_status ON arbitrator_applications(status)');
     }
@@ -1220,7 +1231,7 @@ export function initReturnRequestsSchema(db) {
     reason               TEXT NOT NULL,          -- 'quality' | 'wrong_item' | 'damaged' | 'no_longer_needed' | 'other'
     reason_text          TEXT,
     refund_amount        DECIMAL(18,2),          -- 默认 = order.total_amount
-    status               TEXT NOT NULL DEFAULT 'pending', -- pending | accepted | rejected | refunded | escalated | cancelled
+    status               TEXT NOT NULL DEFAULT 'pending', -- pending | accepted | rejected | refunded | escalated | cancelled | (direct_p2p) await_refund | refund_marked
     seller_response      TEXT,
     escalated_dispute_id TEXT,
     created_at           TEXT DEFAULT (datetime('now')),
@@ -1239,6 +1250,15 @@ export function initReturnRequestsSchema(db) {
         db.exec('CREATE INDEX IF NOT EXISTS idx_returns_order ON return_requests(order_id)');
     }
     catch { }
+    // 直付(direct_p2p)送达后退货·场外退款握手(src/direct-pay-returns.ts)。ALTER 必须在 CREATE 之后(fresh DB silent-fail 铁律)。
+    try {
+        db.exec('ALTER TABLE return_requests ADD COLUMN refund_reference TEXT');
+    }
+    catch { /* 已存在 */ }
+    try {
+        db.exec('ALTER TABLE return_requests ADD COLUMN await_refund_since TEXT');
+    }
+    catch { /* 已存在 */ }
 }
 // ─── W2 售后协商时间线（flagged/flag_reasons ALTER 刻意留 server.ts 原位）──
 export function initReturnMessagesSchema(db) {
@@ -1784,13 +1804,47 @@ export function initAgentDelegationGrantsSchema(db) {
       created_at      TEXT NOT NULL DEFAULT (datetime('now')),
       expires_at      TEXT NOT NULL,                    -- short-lived (clamped, RFC-020 bearer-first)
       revoked_at      TEXT,
-      revoked_reason  TEXT
+      revoked_reason  TEXT,
+      permission_bundle TEXT                            -- named bundle key if issued/expanded via a bundle (e.g. 'catalog_agent'); NULL = ad-hoc scopes
     )
   `);
+    try {
+        db.exec(`ALTER TABLE agent_delegation_grants ADD COLUMN permission_bundle TEXT`);
+    }
+    catch { /* existing DB: column already added */ }
     db.exec(`CREATE INDEX IF NOT EXISTS idx_adg_human  ON agent_delegation_grants(human_id, status)`);
     db.exec(`CREATE INDEX IF NOT EXISTS idx_adg_token  ON agent_delegation_grants(token_hash)`);
     db.exec(`CREATE INDEX IF NOT EXISTS idx_adg_expiry ON agent_delegation_grants(status, expires_at)`);
 }
+/**
+ * RFC-020 — Agent Permission Requests (JIT + bundle authorization). An already-connected agent (holds a
+ * grant) that hits a missing scope, or wants a job bundle, lodges a REQUEST here; the human sees it in
+ * #agent-approvals and approves/rejects. Approval expands the agent's existing grant (safe scopes only,
+ * duration-capped). Bound to (human_id, grant_id). NO money/order/status columns; a request grants nothing
+ * until a human approves it.
+ */
+export function initAgentPermissionRequestsSchema(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS agent_permission_requests (
+      id               TEXT PRIMARY KEY,                 -- apr_xxx
+      human_id         TEXT NOT NULL,                    -- resolved from the requesting agent's grant
+      grant_id         TEXT NOT NULL,                    -- the agent's existing grant that approval expands
+      agent_label      TEXT,
+      requested_scopes TEXT NOT NULL DEFAULT '[]',       -- JSON string[] — resolved (bundle expanded) safe scopes
+      permission_bundle TEXT,                            -- bundle key if requested as a bundle; NULL = ad-hoc
+      reason           TEXT,                             -- agent free-text (display only, unverified)
+      task_context     TEXT,                             -- agent free-text about the task (display only)
+      risk_level       TEXT NOT NULL DEFAULT 'low',      -- low | medium | high (derived, not agent-supplied)
+      duration         TEXT NOT NULL DEFAULT '7d',       -- once | 1h | 24h | 7d | 30d (capped by risk tier)
+      status           TEXT NOT NULL DEFAULT 'pending',  -- pending | approved | rejected | expired | revoked
+      created_at       TEXT NOT NULL DEFAULT (datetime('now')),
+      expires_at       TEXT NOT NULL,                    -- request TTL (auto-expire if unanswered)
+      approved_at      TEXT
+    )
+  `);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_apr_human  ON agent_permission_requests(human_id, status)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_apr_status ON agent_permission_requests(status, expires_at)`);
+}
 /**
  * RFC-020 PR-C1 — agent pairing sessions (OAuth device-flow + PKCE shape).
  *
@@ -1812,7 +1866,7 @@ export function initAgentPairingSchema(db) {
       agent_pubkey    TEXT,                             -- RESERVED (PoP); stored if sent, NOT verified in C1
       reason          TEXT,                             -- agent free-text reason (shown in consent)
       capabilities    TEXT NOT NULL DEFAULT '[]',       -- requested SAFE scopes (validated safe-only at start)
-      status          TEXT NOT NULL DEFAULT 'pending',  -- pending | approved | consumed | expired | revoked
+      status          TEXT NOT NULL DEFAULT 'pending',  -- pending | approved | consumed | expired | revoked | rejected(human declined)
       human_id        TEXT,                             -- set on approve
       grant_id        TEXT,                             -- set on approve (issued grant; token_hash filled at retrieve)
       created_at      TEXT NOT NULL DEFAULT (datetime('now')),

package/dist/sale-regions.js

@@ -0,0 +1,116 @@
+const REGION_RE = /^[A-Z0-9-]{2,8}$/;
+/** parse-don't-validate:坏 JSON/坏形状 → null(= 不限,fail-open 到原行为;写入侧另有严校验)。 */
+export function parseSaleRegionsRule(raw) {
+    if (typeof raw !== 'string' || !raw)
+        return null;
+    try {
+        const r = JSON.parse(raw);
+        if (!r || (r.mode !== 'all' && r.mode !== 'list'))
+            return null;
+        const norm = (a) => Array.isArray(a) ? a.map(x => String(x).toUpperCase()).filter(x => REGION_RE.test(x)) : undefined;
+        return { mode: r.mode, include: norm(r.include), exclude: norm(r.exclude) };
+    }
+    catch {
+        return null;
+    }
+}
+/** 写入侧严校验:返回规范化 JSON 串,或 {error}。null/空 = 清除(继承上层)。 */
+export function validateSaleRegionsInput(raw) {
+    if (raw === null || raw === undefined || raw === '')
+        return { json: null };
+    const r = raw;
+    if (typeof r !== 'object' || (r.mode !== 'all' && r.mode !== 'list'))
+        return { error: "sale_regions.mode 必须是 'all' 或 'list'" };
+    const norm = (a, name) => {
+        if (a === undefined || a === null)
+            return undefined;
+        if (!Array.isArray(a) || a.length > 64)
+            return { error: `sale_regions.${name} 须为 ≤64 项数组` };
+        const out = [];
+        for (const x of a) {
+            const code = String(x).trim().toUpperCase();
+            if (!REGION_RE.test(code))
+                return { error: `sale_regions.${name} 含非法地区码:${String(x).slice(0, 12)}(2-8 位大写字母/数字/-)` };
+            out.push(code);
+        }
+        return [...new Set(out)];
+    };
+    const inc = norm(r.include, 'include');
+    if (inc && 'error' in inc)
+        return inc;
+    const exc = norm(r.exclude, 'exclude');
+    if (exc && 'error' in exc)
+        return exc;
+    if (r.mode === 'list' && (!inc || inc.length === 0))
+        return { error: "mode='list' 时 include 不能为空(否则等于全不可卖 —— 想全不可卖请直接下架)" };
+    return { json: JSON.stringify({ mode: r.mode, ...(inc ? { include: inc } : {}), ...(exc ? { exclude: exc } : {}) }) };
+}
+/** 生效规则:商品 ?? 店铺(与 accept_mode/运费模板同层级约定)。 */
+export function effectiveSaleRegionsRule(db, product, sellerId) {
+    const own = parseSaleRegionsRule(product.sale_regions);
+    if (own)
+        return own;
+    try {
+        const row = db.prepare('SELECT store_sale_regions FROM users WHERE id = ?').get(sellerId);
+        return parseSaleRegionsRule(row?.store_sale_regions);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * 平台合规名单解析(单一真相源:建单门 gateSaleRegionForCreate + S5 预检 shipping-options 共用)。
+ *   坏配置(非 JSON / 非数组)→ { ok:false },由调用方 fail-closed(建单 503;预检 sellable=platform_policy_invalid)。
+ *   缺省 '[]' → { ok:true, list:[] }。区码统一大写。
+ */
+export function parsePlatformBlocklist(raw) {
+    try {
+        const p = JSON.parse(String(raw ?? '[]'));
+        if (!Array.isArray(p))
+            return { ok: false };
+        return { ok: true, list: p.map(x => String(x).toUpperCase()) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+export function regionAllowedByRule(rule, region) {
+    const r = region.toUpperCase();
+    if (rule.exclude?.includes(r))
+        return false;
+    if (rule.mode === 'list')
+        return !!rule.include?.includes(r);
+    return true;
+}
+/**
+ * 建单可售门(orders-create 单行调用,两轨共用,运费 gate 之前、任何写之前)。
+ * 返回 false = 已写错误响应。平台 overlay 先裁(商家规则不可放宽合规);规则存在但买家没给地区 → fail-closed 要求补选。
+ */
+export function gateSaleRegionForCreate(db, res, product, sellerId, rawRegion, getProtocolParam) {
+    const region = (typeof rawRegion === 'string' && rawRegion.trim()) ? rawRegion.trim().toUpperCase() : null;
+    // ① 平台合规 overlay(protocol param,DEFAULT_PARAMS 已 seed '[]';admin PATCH 有 JSON+区码校验)。
+    //   坏配置【fail-closed】:合规名单读不懂时放行 = 静默解除平台禁售(审计 P2) —— 宁可挡单也不裸奔;
+    //   admin 写入侧已强校验,坏值只可能来自手改 DB,错误信息直接指路。
+    const parsedBlock = parsePlatformBlocklist(getProtocolParam('trade.platform_region_blocklist', '[]'));
+    if (!parsedBlock.ok) {
+        res.status(503).json({ error: '平台合规配置异常,暂无法下单(运营侧需修复 trade.platform_region_blocklist 参数)', error_code: 'PLATFORM_REGION_POLICY_INVALID' });
+        return false;
+    }
+    const platformBlock = parsedBlock.list;
+    const rule = effectiveSaleRegionsRule(db, product, sellerId);
+    if (platformBlock.length === 0 && !rule)
+        return true; // 无任何限制 = 原行为(地区可选)
+    if (!region) {
+        res.status(400).json({ error: '该商品设有可售地区限制,请选择收货国家/地区', error_code: 'SHIP_REGION_REQUIRED' });
+        return false;
+    }
+    if (platformBlock.includes(region)) {
+        res.status(409).json({ error: '平台合规限制:该商品暂不支持销售到该地区', error_code: 'PRODUCT_RESTRICTED', region });
+        return false;
+    }
+    if (rule && !regionAllowedByRule(rule, region)) {
+        res.status(409).json({ error: '卖家未将该地区设为可售范围(与运费无关,不适用询价)', error_code: 'REGION_NOT_FOR_SALE', region });
+        return false;
+    }
+    return true;
+}