@seasonkoh/webaz 0.1.7 → 0.1.9

package/dist/pwa/routes/arbitrator.js

@@ -0,0 +1,117 @@
+export function registerArbitratorRoutes(app, deps) {
+    const { db, generateId, auth, requireArbitrationAdmin, checkArbitratorEligibility, getArbitratorState, errorRes, logAdminAction, ARB_STAKE_REQUIRED, ARB_APP_REJECT_COOLDOWN_DAYS, } = deps;
+    app.get('/api/arbitrator/eligibility', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        res.json(checkArbitratorEligibility(user.id));
+    });
+    app.get('/api/arbitrator/status', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        res.json(getArbitratorState(user.id));
+    });
+    app.post('/api/arbitrator/apply', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (user.role !== 'buyer') {
+            return void errorRes(res, 403, 'ROLE_NOT_BUYER', '外部仲裁员仅 buyer 角色可申请（卖家 / 受信角色请联系管理员）');
+        }
+        const userId = user.id;
+        const wl = db.prepare("SELECT 1 FROM arbitrator_whitelist WHERE user_id = ?").get(userId);
+        if (wl)
+            return void res.json({ error: '你已经是仲裁员，无需重新申请' });
+        const pending = db.prepare("SELECT 1 FROM arbitrator_applications WHERE user_id = ? AND status = 'pending'").get(userId);
+        if (pending)
+            return void res.json({ error: '你已有待审申请' });
+        const lastReject = db.prepare("SELECT reviewed_at FROM arbitrator_applications WHERE user_id = ? AND status = 'rejected' ORDER BY reviewed_at DESC LIMIT 1").get(userId);
+        if (lastReject?.reviewed_at) {
+            const cooldownEnd = new Date(new Date(lastReject.reviewed_at).getTime() + ARB_APP_REJECT_COOLDOWN_DAYS * 86400_000);
+            if (cooldownEnd > new Date()) {
+                return void res.json({ error: `申请冷却期未结束，可在 ${cooldownEnd.toISOString().slice(0, 10)} 后重新申请` });
+            }
+        }
+        const elig = checkArbitratorEligibility(userId);
+        if (!elig.eligible)
+            return void res.json({ error: '信誉指标未达标', eligibility: elig });
+        if (ARB_STAKE_REQUIRED > 0) {
+            const wallet = db.prepare("SELECT balance, staked FROM wallets WHERE user_id = ?").get(userId);
+            if (!wallet || wallet.balance < ARB_STAKE_REQUIRED) {
+                return void res.json({ error: `质押需 ${ARB_STAKE_REQUIRED} WAZ，钱包余额不足` });
+            }
+            db.prepare("UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ?")
+                .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, userId);
+        }
+        db.prepare("INSERT INTO arbitrator_applications (id, user_id, status, snapshot) VALUES (?,?,?,?)")
+            .run(generateId('aapp'), userId, 'pending', JSON.stringify(elig.items));
+        res.json({ success: true, stake_locked: ARB_STAKE_REQUIRED });
+    });
+    app.post('/api/arbitrator/withdraw-application', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const userId = user.id;
+        const pending = db.prepare("SELECT id FROM arbitrator_applications WHERE user_id = ? AND status = 'pending' LIMIT 1").get(userId);
+        if (!pending)
+            return void res.json({ error: '没有待审申请' });
+        db.prepare("UPDATE arbitrator_applications SET status='withdrawn', reviewed_at=datetime('now') WHERE id = ?").run(pending.id);
+        if (ARB_STAKE_REQUIRED > 0) {
+            db.prepare("UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?")
+                .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, userId);
+        }
+        res.json({ success: true });
+    });
+    // Admin
+    app.get('/api/admin/arbitrator-applications', (req, res) => {
+        const admin = requireArbitrationAdmin(req, res);
+        if (!admin)
+            return;
+        const status = String(req.query.status || 'pending');
+        const items = db.prepare(`
+      SELECT aa.*, u.name as user_name, u.handle, u.region
+      FROM arbitrator_applications aa
+      JOIN users u ON u.id = aa.user_id
+      WHERE aa.status = ?
+      ORDER BY aa.applied_at DESC LIMIT 100
+    `).all(status);
+        res.json({ items });
+    });
+    app.post('/api/admin/arbitrator-applications/:id/approve', (req, res) => {
+        const admin = requireArbitrationAdmin(req, res);
+        if (!admin)
+            return;
+        const { note } = req.body;
+        const appRow = db.prepare("SELECT id, user_id, status FROM arbitrator_applications WHERE id = ?").get(req.params.id);
+        if (!appRow)
+            return void res.json({ error: '申请不存在' });
+        if (appRow.status !== 'pending')
+            return void res.json({ error: '该申请不在待审状态' });
+        db.prepare("UPDATE arbitrator_applications SET status='approved', reviewed_at=datetime('now'), reviewed_by=?, decision_note=? WHERE id=?")
+            .run(admin.id, note || null, appRow.id);
+        db.prepare(`INSERT OR REPLACE INTO arbitrator_whitelist (user_id, note, is_system, granted_by, stake_amount) VALUES (?,?,0,?,?)`)
+            .run(appRow.user_id, note || '外部仲裁员批准', admin.id, ARB_STAKE_REQUIRED);
+        logAdminAction(admin.id, 'approve_arbitrator', 'user', appRow.user_id, { note });
+        res.json({ success: true });
+    });
+    app.post('/api/admin/arbitrator-applications/:id/reject', (req, res) => {
+        const admin = requireArbitrationAdmin(req, res);
+        if (!admin)
+            return;
+        const { note } = req.body;
+        const appRow = db.prepare("SELECT id, user_id, status FROM arbitrator_applications WHERE id = ?").get(req.params.id);
+        if (!appRow)
+            return void res.json({ error: '申请不存在' });
+        if (appRow.status !== 'pending')
+            return void res.json({ error: '该申请不在待审状态' });
+        db.prepare("UPDATE arbitrator_applications SET status='rejected', reviewed_at=datetime('now'), reviewed_by=?, decision_note=? WHERE id=?")
+            .run(admin.id, note || null, appRow.id);
+        if (ARB_STAKE_REQUIRED > 0) {
+            db.prepare("UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?")
+                .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, appRow.user_id);
+        }
+        logAdminAction(admin.id, 'reject_arbitrator', 'user', appRow.user_id, { note });
+        res.json({ success: true });
+    });
+}

package/dist/pwa/routes/auction.js

@@ -0,0 +1,436 @@
+// ─── 拍卖常量（域内）──────────────────────────────────────────
+const AUC_MAX_WINDOW_MIN = 14 * 24 * 60; // 14 天上限
+const AUC_MIN_WINDOW_MIN = 5;
+const AUC_DEFAULT_WINDOW_MIN = 60;
+const AUC_DEFAULT_INCREMENT = 1;
+const AUC_DEFAULT_SNIPER_MIN = 5;
+const AUC_SELLER_STAKE_PCT = 0.05;
+const AUC_BUYER_STAKE_PCT = 0.05;
+const AUC_DAILY_CAP_PER_SELLER = 20;
+function aucSellerStake(startingPrice) {
+    return Math.max(1, Math.round(startingPrice * AUC_SELLER_STAKE_PCT * 100) / 100);
+}
+function aucBuyerStake(price, qty) {
+    return Math.max(0.5, Math.round(price * qty * AUC_BUYER_STAKE_PCT * 100) / 100);
+}
+// 2026-05-24 #959：拍卖「⏰ 提醒我」3 个 endpoint
+// 默认订阅 = deadline 前 60min + 10min 各 1 条通知
+const AUCTION_REMINDER_LEADS = [60, 10];
+// ─── 提醒 cron — 60s 扫一次，派发 due 提醒 + 标记 sent_at ────
+export function fireDueAuctionReminders(db, generateId) {
+    const due = db.prepare(`
+    SELECT r.id, r.auction_id, r.user_id, r.lead_minutes,
+           a.title as auction_title, a.current_price, a.deadline_at, a.status as auction_status
+    FROM auction_reminders r
+    JOIN auctions a ON a.id = r.auction_id
+    WHERE r.sent_at IS NULL AND r.fire_at <= datetime('now')
+    LIMIT 200
+  `).all();
+    let fired = 0;
+    for (const r of due) {
+        try {
+            // 拍卖已不是 open（结束/取消）→ 跳过通知但标 sent_at 避免重复扫
+            if (r.auction_status !== 'open') {
+                db.prepare("UPDATE auction_reminders SET sent_at=datetime('now') WHERE id=?").run(r.id);
+                continue;
+            }
+            const title = `⏰ 拍卖${r.lead_minutes >= 60 ? Math.round(r.lead_minutes / 60) + 'h' : r.lead_minutes + 'min'}后结束`;
+            const body = `${r.auction_title} · 当前价 ${r.current_price} WAZ`;
+            const tx = db.transaction(() => {
+                db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, actions)
+                    VALUES (?, ?, 'auction_reminder', ?, ?, ?)`).run(generateId('ntf'), r.user_id, title, body, JSON.stringify([{ label: '去出价', hash: '#auction/' + r.auction_id }]));
+                db.prepare("UPDATE auction_reminders SET sent_at=datetime('now') WHERE id=?").run(r.id);
+            });
+            tx();
+            fired++;
+        }
+        catch (e) {
+            console.error('[cron auction-reminder]', r.id, e);
+        }
+    }
+    return { fired };
+}
+export function registerAuctionRoutes(app, deps) {
+    const { db, auth, generateId, RFQ_MAX_QTY, RFQ_MAX_PRICE, LISTING_CATEGORIES, isListingCategoryKey, requireProtocolAdmin } = deps;
+    // 卖家发起拍卖
+    app.post('/api/auctions', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (user.role !== 'seller')
+            return void res.json({ error: '仅卖家可发起拍卖' });
+        const body = req.body;
+        const title = String(body.title || '').trim();
+        if (title.length < 2)
+            return void res.json({ error: '标题至少 2 字' });
+        const qty = Math.max(1, Math.floor(Number(body.qty) || 1));
+        if (qty > RFQ_MAX_QTY)
+            return void res.json({ error: `qty 超出上限 ${RFQ_MAX_QTY}` });
+        const cat = String(body.category || 'general');
+        if (!isListingCategoryKey(cat))
+            return void res.json({ error: '类目无效' });
+        const startingPrice = Number(body.starting_price);
+        if (!Number.isFinite(startingPrice) || startingPrice <= 0)
+            return void res.json({ error: 'starting_price 必须 > 0' });
+        if (startingPrice > RFQ_MAX_PRICE)
+            return void res.json({ error: `starting_price 超出上限 ${RFQ_MAX_PRICE} WAZ` });
+        const minIncrement = Number(body.min_increment ?? AUC_DEFAULT_INCREMENT);
+        if (!Number.isFinite(minIncrement) || minIncrement <= 0)
+            return void res.json({ error: 'min_increment 必须 > 0' });
+        const reservePrice = body.reserve_price != null ? Number(body.reserve_price) : null;
+        if (reservePrice != null) {
+            if (!Number.isFinite(reservePrice) || reservePrice <= 0)
+                return void res.json({ error: 'reserve_price 无效' });
+            if (reservePrice < startingPrice)
+                return void res.json({ error: 'reserve_price 不可低于 starting_price' });
+        }
+        const windowMin = Math.max(AUC_MIN_WINDOW_MIN, Math.min(AUC_MAX_WINDOW_MIN, Math.floor(Number(body.window_min || AUC_DEFAULT_WINDOW_MIN))));
+        const sniperExtend = Math.max(0, Math.min(60, Math.floor(Number(body.sniper_extend_min ?? AUC_DEFAULT_SNIPER_MIN))));
+        // 频率限制
+        const today = db.prepare("SELECT COUNT(1) as n FROM auctions WHERE seller_id = ? AND created_at > datetime('now','-1 day')").get(user.id).n;
+        if (today >= AUC_DAILY_CAP_PER_SELLER)
+            return void res.json({ error: `今日已达上限 ${AUC_DAILY_CAP_PER_SELLER} 场拍卖` });
+        // 卖家担保金
+        const sellerStake = aucSellerStake(startingPrice);
+        const wallet = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(user.id);
+        if (!wallet || Number(wallet.balance) < sellerStake) {
+            return void res.json({ error: `余额不足，卖家担保金 ${sellerStake} WAZ（5% × 起拍价）` });
+        }
+        // product_id 引用（可选）：若提供，校验属于本人 + stock>=qty
+        let productId = null;
+        if (body.product_id) {
+            productId = String(body.product_id);
+            const p = db.prepare("SELECT seller_id, stock, status FROM products WHERE id = ?").get(productId);
+            if (!p)
+                return void res.json({ error: '关联商品不存在' });
+            if (p.seller_id !== user.id)
+                return void res.json({ error: '关联商品归属不匹配' });
+            if (p.status !== 'active')
+                return void res.json({ error: '关联商品未上架' });
+            if (Number(p.stock) < qty)
+                return void res.json({ error: `库存不足（${p.stock} < ${qty}）` });
+        }
+        const id = generateId('auc');
+        db.transaction(() => {
+            db.prepare(`
+        INSERT INTO auctions (id, seller_id, listing_id, product_id, title, spec_json, qty, category,
+          starting_price, current_price, min_increment, reserve_price, deadline_at, sniper_extend_min,
+          seller_stake_locked, notes)
+        VALUES (?,?,?,?,?,?,?,?,?,?,?,?,datetime('now', '+' || ? || ' minutes'),?,?,?)
+      `).run(id, user.id, body.listing_id ? String(body.listing_id) : null, productId, title, body.spec_json ? JSON.stringify(body.spec_json) : null, qty, cat, startingPrice, startingPrice, minIncrement, reservePrice, windowMin, sniperExtend, sellerStake, body.notes ? String(body.notes).slice(0, 500) : null);
+            db.prepare('UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ?').run(sellerStake, sellerStake, user.id);
+            if (productId)
+                db.prepare("UPDATE products SET status = 'auction_pending', updated_at = datetime('now') WHERE id = ?").run(productId);
+        })();
+        // QA 轮 12 P1：返回完整 echo 字段 + ISO deadline_at 与 detail 一致
+        const created = db.prepare('SELECT deadline_at, status FROM auctions WHERE id = ?').get(id);
+        res.json({
+            id,
+            seller_stake: sellerStake,
+            window_min: windowMin,
+            deadline_at_minutes: windowMin, // 保留以兼容老客户端
+            deadline_at: created.deadline_at, // 与 detail 一致的 ISO
+            status: created.status,
+            starting_price: startingPrice,
+            current_price: startingPrice,
+            reserve_price: reservePrice,
+            min_increment: minIncrement,
+            sniper_extend_min: sniperExtend,
+            qty,
+            category: cat,
+            notes: body.notes ? String(body.notes).slice(0, 500) : null,
+        });
+    });
+    // 看板：浏览公开拍卖（匿名可访问）
+    app.get('/api/auctions', (req, res) => {
+        const where = ["a.status = 'open'", "a.deadline_at > datetime('now')"];
+        const args = [];
+        if (req.query.category) {
+            where.push('a.category = ?');
+            args.push(String(req.query.category));
+        }
+        if (req.query.q) {
+            const qE = String(req.query.q).replace(/[\\%_]/g, '\\$&');
+            where.push("(a.title LIKE ? ESCAPE '\\' OR a.notes LIKE ? ESCAPE '\\')");
+            const like = '%' + qE + '%';
+            args.push(like, like);
+        }
+        const limit = Math.min(100, Math.max(1, Number(req.query.limit) || 30));
+        const rows = db.prepare(`
+      SELECT a.id, a.seller_id, a.title, a.qty, a.category, a.starting_price, a.current_price,
+             a.min_increment, a.reserve_price, a.deadline_at, a.bid_count, a.sniper_extend_min, a.created_at,
+             u.handle as seller_handle, u.region as seller_region
+      FROM auctions a
+      LEFT JOIN users u ON u.id = a.seller_id
+      WHERE ${where.join(' AND ')}
+      ORDER BY a.deadline_at ASC
+      LIMIT ?
+    `).all(...args, limit);
+        res.json({ items: rows, categories: LISTING_CATEGORIES });
+    });
+    // 我的：买家=我出过价的，卖家=我发起的
+    app.get('/api/auctions/mine', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const seller = db.prepare(`SELECT * FROM auctions WHERE seller_id = ? ORDER BY created_at DESC LIMIT 50`).all(user.id);
+        const buyer = db.prepare(`
+      SELECT DISTINCT a.*, (SELECT b.price FROM auction_bids b WHERE b.auction_id = a.id AND b.buyer_id = ? ORDER BY b.submitted_at DESC LIMIT 1) as my_last_bid,
+        (SELECT b.status FROM auction_bids b WHERE b.auction_id = a.id AND b.buyer_id = ? ORDER BY b.submitted_at DESC LIMIT 1) as my_last_status
+      FROM auctions a
+      JOIN auction_bids b ON b.auction_id = a.id
+      WHERE b.buyer_id = ? ORDER BY a.created_at DESC LIMIT 50
+    `).all(user.id, user.id, user.id);
+        res.json({ as_seller: seller, as_buyer: buyer });
+    });
+    // 详情：含 bid 历史（buyer 身份脱敏；卖家+出价人本人 可见全名）
+    app.get('/api/auctions/:id', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const auc = db.prepare('SELECT * FROM auctions WHERE id = ?').get(req.params.id);
+        if (!auc)
+            return void res.status(404).json({ error: '拍卖不存在' });
+        const isSellerSelf = auc.seller_id === user.id;
+        const isSettled = auc.status !== 'open';
+        const bids = db.prepare(`
+      SELECT b.id, b.buyer_id, b.price, b.stake_locked, b.status, b.submitted_at, b.resolved_at,
+        u.handle as buyer_handle
+      FROM auction_bids b
+      LEFT JOIN users u ON u.id = b.buyer_id
+      WHERE b.auction_id = ?
+      ORDER BY b.price DESC, b.submitted_at ASC
+    `).all(req.params.id);
+        // 脱敏：非 (卖家/拍卖结束/出价人本人) 时，buyer_id 用后 6 位 + handle 隐藏
+        const safeBids = bids.map(b => {
+            const isMine = b.buyer_id === user.id;
+            if (isSellerSelf || isSettled || isMine)
+                return b;
+            return {
+                ...b,
+                buyer_id: '买家 #' + String(b.buyer_id || '').slice(-6),
+                buyer_handle: null,
+            };
+        });
+        res.json({ auction: auc, bids: safeBids, is_seller: isSellerSelf });
+    });
+    // 拍卖「⏰ 提醒我」(#959)
+    app.post('/api/auctions/:id/remind', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const aucRow = db.prepare("SELECT id, deadline_at, status, seller_id FROM auctions WHERE id = ?").get(req.params.id);
+        if (!aucRow)
+            return void res.status(404).json({ error: '拍卖不存在' });
+        if (aucRow.seller_id === user.id)
+            return void res.status(400).json({ error: '卖家本人无需订阅自己的拍卖' });
+        if (aucRow.status !== 'open')
+            return void res.status(400).json({ error: '该拍卖已结束，无需提醒' });
+        // SQLite datetime('now') 是 UTC，但 JS Date 解析无 Z 的字符串当本地时间 — 强制按 UTC 解析
+        const deadlineMs = new Date(aucRow.deadline_at.replace(' ', 'T') + 'Z').getTime();
+        if (deadlineMs <= Date.now())
+            return void res.status(400).json({ error: '拍卖已截止' });
+        const tx = db.transaction(() => {
+            for (const lead of AUCTION_REMINDER_LEADS) {
+                const fireAtMs = deadlineMs - lead * 60_000;
+                if (fireAtMs <= Date.now())
+                    continue; // 已过该提醒时间，跳过该 lead
+                const fireAtIso = new Date(fireAtMs).toISOString().replace('T', ' ').slice(0, 19);
+                db.prepare(`INSERT OR IGNORE INTO auction_reminders (id, auction_id, user_id, lead_minutes, fire_at)
+                    VALUES (?, ?, ?, ?, ?)`).run(generateId('arm'), aucRow.id, user.id, lead, fireAtIso);
+            }
+        });
+        tx();
+        res.json({ ok: true, subscribed: true, leads_minutes: AUCTION_REMINDER_LEADS });
+    });
+    app.delete('/api/auctions/:id/remind', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const r = db.prepare("DELETE FROM auction_reminders WHERE auction_id = ? AND user_id = ?").run(req.params.id, user.id);
+        res.json({ ok: true, deleted: r.changes });
+    });
+    app.get('/api/auctions/:id/remind', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const rows = db.prepare("SELECT lead_minutes, fire_at, sent_at FROM auction_reminders WHERE auction_id = ? AND user_id = ? ORDER BY lead_minutes DESC").all(req.params.id, user.id);
+        res.json({ subscribed: rows.length > 0, reminders: rows });
+    });
+    // 买家：出价
+    app.post('/api/auctions/:id/bids', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (user.role !== 'buyer')
+            return void res.json({ error: '仅买家可出价' });
+        const auc = db.prepare('SELECT * FROM auctions WHERE id = ?').get(req.params.id);
+        if (!auc)
+            return void res.status(404).json({ error: '拍卖不存在' });
+        if (auc.status !== 'open')
+            return void res.json({ error: `当前状态 ${auc.status} 不接受出价` });
+        if (auc.seller_id === user.id)
+            return void res.json({ error: '卖家不能自拍自买' });
+        // deadline 校验（cron 可能未及时翻状态）
+        if (String(auc.deadline_at) <= new Date().toISOString().replace('T', ' ').slice(0, 19)) {
+            return void res.json({ error: '拍卖已到期，等待结算' });
+        }
+        const price = Number(req.body.price);
+        if (!Number.isFinite(price) || price <= 0)
+            return void res.json({ error: 'price 必须 > 0' });
+        if (price > RFQ_MAX_PRICE)
+            return void res.json({ error: `price 超出上限 ${RFQ_MAX_PRICE} WAZ` });
+        const minNextPrice = Math.round((Number(auc.current_price) + Number(auc.min_increment)) * 100) / 100;
+        const curPrice = Number(auc.current_price);
+        const startingPrice = Number(auc.starting_price);
+        // 首次出价：≥ starting_price；之后：≥ current_price + min_increment
+        const isFirst = Number(auc.bid_count) === 0;
+        if (isFirst) {
+            if (price < startingPrice)
+                return void res.json({ error: `首次出价不能低于起拍价 ${startingPrice}` });
+        }
+        else {
+            if (price < minNextPrice)
+                return void res.json({ error: `下一口价至少 ${minNextPrice}（当前 ${curPrice} + 加价 ${auc.min_increment}）` });
+        }
+        const qty = Math.max(1, Math.floor(Number(auc.qty || 1)));
+        const stake = aucBuyerStake(price, qty);
+        const wallet = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(user.id);
+        // QA 轮 12 P1：自我加价 affordability check 应含已锁旧 stake（会在 tx 内释放）
+        // 否则用户必须 ≥ 2× stake 余额才能加价，UX 卡。
+        const myExisting = db.prepare("SELECT stake_locked FROM auction_bids WHERE auction_id = ? AND buyer_id = ? AND status = 'active'").get(req.params.id, user.id);
+        const myExistingStake = Number(myExisting?.stake_locked || 0);
+        const availableForBid = Number(wallet?.balance || 0) + myExistingStake;
+        if (!wallet || availableForBid < stake) {
+            return void res.json({ error: `余额不足，出价押金 ${stake} WAZ（被超越后立即释放）` });
+        }
+        // 上一个最高 active bid（如果是别人的）→ outbid + 释放 stake
+        // 自己的旧 active bid（同 auction 同 buyer）→ outbid + 释放 stake
+        const id = generateId('abid');
+        let newDeadlineExt = null;
+        let sellerTopup = 0;
+        let closedErr = '';
+        db.transaction(() => {
+            // P1 #4：TX 内重读 auction 状态 + deadline 防 TOCTOU
+            const fresh = db.prepare('SELECT status, deadline_at, current_price, bid_count, seller_stake_locked, max_extends, extends_used, sniper_extend_min FROM auctions WHERE id = ?').get(req.params.id);
+            if (!fresh) {
+                closedErr = 'not_found';
+                return;
+            }
+            if (fresh.status !== 'open') {
+                closedErr = `closed_${fresh.status}`;
+                return;
+            }
+            if (fresh.deadline_at <= new Date().toISOString().replace('T', ' ').slice(0, 19)) {
+                closedErr = 'expired';
+                return;
+            }
+            // 价格重判（中间可能有别人插队）
+            const curFresh = Number(fresh.current_price);
+            const isFirstFresh = Number(fresh.bid_count) === 0;
+            if (isFirstFresh) {
+                if (price < startingPrice) {
+                    closedErr = `below_starting_${startingPrice}`;
+                    return;
+                }
+            }
+            else {
+                const minNeed = Math.round((curFresh + Number(auc.min_increment)) * 100) / 100;
+                if (price < minNeed) {
+                    closedErr = `below_min_${minNeed}`;
+                    return;
+                }
+            }
+            // 释放本人之前的 active bid
+            const myPrev = db.prepare("SELECT id, stake_locked FROM auction_bids WHERE auction_id = ? AND buyer_id = ? AND status = 'active'").get(req.params.id, user.id);
+            if (myPrev) {
+                db.prepare("UPDATE auction_bids SET status = 'outbid', resolved_at = datetime('now') WHERE id = ?").run(myPrev.id);
+                if (myPrev.stake_locked > 0)
+                    db.prepare('UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?').run(myPrev.stake_locked, myPrev.stake_locked, user.id);
+            }
+            // 释放别人的最高 active bid
+            const others = db.prepare("SELECT id, buyer_id, stake_locked FROM auction_bids WHERE auction_id = ? AND status = 'active' AND buyer_id != ?").all(req.params.id, user.id);
+            for (const o of others) {
+                db.prepare("UPDATE auction_bids SET status = 'outbid', resolved_at = datetime('now') WHERE id = ?").run(o.id);
+                if (o.stake_locked > 0)
+                    db.prepare('UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?').run(o.stake_locked, o.stake_locked, o.buyer_id);
+            }
+            // 插入新 bid
+            db.prepare(`INSERT INTO auction_bids (id, auction_id, buyer_id, price, stake_locked) VALUES (?,?,?,?,?)`)
+                .run(id, req.params.id, user.id, price, stake);
+            db.prepare('UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ?').run(stake, stake, user.id);
+            // P1 #9：卖家 stake 动态补足（5% × current_price，余额不足则尽量补）
+            const targetSellerStake = Math.max(1, Math.round(price * AUC_SELLER_STAKE_PCT * 100) / 100);
+            const curSellerStake = Number(fresh.seller_stake_locked) || 0;
+            if (targetSellerStake > curSellerStake) {
+                const delta = Math.round((targetSellerStake - curSellerStake) * 100) / 100;
+                const sWal = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(auc.seller_id);
+                const canTopup = sWal ? Math.min(delta, Number(sWal.balance)) : 0;
+                if (canTopup > 0) {
+                    db.prepare('UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ?').run(canTopup, canTopup, auc.seller_id);
+                    db.prepare('UPDATE auctions SET seller_stake_locked = seller_stake_locked + ? WHERE id = ?').run(canTopup, req.params.id);
+                    sellerTopup = canTopup;
+                }
+            }
+            // P1 #5：反狙击延长（max_extends 上限保护）
+            const sniperMin = Number(fresh.sniper_extend_min || 0);
+            const deadlineMs = Date.parse(String(fresh.deadline_at).replace(' ', 'T') + 'Z');
+            const nowMs = Date.now();
+            const inSnipeWindow = sniperMin > 0 && deadlineMs - nowMs < sniperMin * 60_000;
+            const canExtend = Number(fresh.extends_used) < Number(fresh.max_extends || 10);
+            if (inSnipeWindow && canExtend) {
+                newDeadlineExt = sniperMin;
+                db.prepare(`UPDATE auctions SET current_price = ?, bid_count = bid_count + 1,
+                    deadline_at = datetime(deadline_at, '+' || ? || ' minutes'),
+                    extends_used = extends_used + 1,
+                    updated_at = datetime('now') WHERE id = ?`).run(price, sniperMin, req.params.id);
+            }
+            else {
+                db.prepare(`UPDATE auctions SET current_price = ?, bid_count = bid_count + 1, updated_at = datetime('now') WHERE id = ?`).run(price, req.params.id);
+            }
+        })();
+        if (closedErr) {
+            const ce = closedErr;
+            return void res.json({ error: ce === 'expired' ? '拍卖已到期' : ce === 'not_found' ? '拍卖不存在' : ce.startsWith('below_') ? '出价不足，请刷新页面查看当前最高价' : `拍卖已结束（${ce}）` });
+        }
+        // 通知卖家 + 被超越的买家
+        try {
+            db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, created_at)
+                  VALUES (?,?,'auction_new_bid',?,?,datetime('now'))`)
+                .run(generateId('ntf'), auc.seller_id, `🔨 新出价 ${price} WAZ`, `拍卖：${String(auc.title).slice(0, 30)}`);
+        }
+        catch { }
+        res.json({ id, stake_locked: stake, current_price: price, sniper_extended_min: newDeadlineExt, seller_topup: sellerTopup || undefined });
+    });
+    // 卖家：取消（仅未出价时）
+    app.delete('/api/auctions/:id', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const auc = db.prepare('SELECT * FROM auctions WHERE id = ?').get(req.params.id);
+        if (!auc)
+            return void res.status(404).json({ error: '拍卖不存在' });
+        if (auc.seller_id !== user.id)
+            return void res.status(403).json({ error: '仅卖家本人可取消' });
+        if (auc.status !== 'open')
+            return void res.json({ error: `当前状态 ${auc.status} 不可取消` });
+        if (Number(auc.bid_count) > 0)
+            return void res.json({ error: '已有买家出价，无法取消' });
+        const sellerStake = Number(auc.seller_stake_locked) || 0;
+        db.transaction(() => {
+            db.prepare("UPDATE auctions SET status = 'cancelled', updated_at = datetime('now') WHERE id = ?").run(req.params.id);
+            if (sellerStake > 0)
+                db.prepare('UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?').run(sellerStake, sellerStake, user.id);
+            if (auc.product_id)
+                db.prepare("UPDATE products SET status = 'active', updated_at = datetime('now') WHERE id = ? AND status = 'auction_pending'").run(auc.product_id);
+        })();
+        res.json({ success: true, stake_released: sellerStake });
+    });
+    // Admin 手动跑提醒派发
+    app.post('/api/admin/auction-reminders/run', (req, res) => {
+        const admin = requireProtocolAdmin(req, res);
+        if (!admin)
+            return;
+        res.json(fireDueAuctionReminders(db, generateId));
+    });
+}

package/dist/pwa/routes/auth-login.js

@@ -0,0 +1,40 @@
+export function registerAuthLoginRoutes(app, deps) {
+    const { db, INTERNAL_AUDITOR_ID, isLocked, verifyPassword, recordFailure, resetFailures, recordSession } = deps;
+    app.post('/api/login', (req, res) => {
+        const { name, password } = req.body;
+        if (!name?.trim() || !password)
+            return void res.json({ error: '请填写用户名 / 昵称和密码' });
+        const ref = name.trim().replace(/^@/, '').toLowerCase();
+        let matches = db.prepare("SELECT * FROM users WHERE handle = ? AND id NOT IN ('sys_protocol', ?)").all(ref, INTERNAL_AUDITOR_ID);
+        if (matches.length === 0) {
+            matches = db.prepare("SELECT * FROM users WHERE name = ? AND id NOT IN ('sys_protocol', ?)").all(name.trim(), INTERNAL_AUDITOR_ID);
+        }
+        if (matches.length === 0)
+            return void res.json({ error: '账号或密码错误' });
+        if (matches.length > 1)
+            return void res.json({ error: '该昵称对应多个账户，请改用 @用户名 或 API Key 登录' });
+        const user = matches[0];
+        if (isLocked(user)) {
+            const minutes = Math.ceil((new Date(user.locked_until).getTime() - Date.now()) / 60_000);
+            return void res.json({ error: `账户已临时锁定，约 ${minutes} 分钟后再试` });
+        }
+        if (!user.password_hash)
+            return void res.json({ error: '该账户未设置密码，请使用 API Key 登录' });
+        if (!verifyPassword(String(password), user.password_hash)) {
+            recordFailure(user.id, user.failed_attempts || 0);
+            return void res.json({ error: '名称或密码错误' });
+        }
+        resetFailures(user.id);
+        try {
+            recordSession(user.id, user.api_key, req);
+        }
+        catch { }
+        res.json({
+            success: true,
+            api_key: user.api_key,
+            user_id: user.id,
+            name: user.name,
+            role: user.role,
+        });
+    });
+}

package/dist/pwa/routes/auth-read.js

@@ -0,0 +1,66 @@
+export function registerAuthReadRoutes(app, deps) {
+    const { db, auth, safeRoles, getRegionMaxLevels, userMlmGate, getUserLevel } = deps;
+    app.get('/api/me', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const wallet = db.prepare('SELECT * FROM wallets WHERE user_id = ?').get(user.id);
+        let roles = [];
+        try {
+            roles = JSON.parse(user.roles || JSON.stringify([user.role]));
+        }
+        catch {
+            roles = [user.role];
+        }
+        const region = user.region || 'global';
+        const maxLevels = getRegionMaxLevels(region);
+        res.json({ ...user, api_key: undefined, roles, wallet: wallet || null, region_max_levels: maxLevels });
+    });
+    app.get('/api/profile', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const wallet = db.prepare('SELECT balance, staked, escrowed, earned FROM wallets WHERE user_id = ?').get(user.id);
+        const roles = safeRoles(user);
+        const pv = db.prepare("SELECT total_left_pv, total_right_pv FROM users WHERE id = ?").get(user.id);
+        const pendingScore = db.prepare("SELECT COALESCE(SUM(score),0) as s FROM binary_score_records WHERE user_id = ? AND settled_at IS NULL").get(user.id).s;
+        res.json({
+            id: user.id, name: user.name, role: user.role, roles, api_key: user.api_key, wallet: wallet || null,
+            permanent_code: user.permanent_code ?? null,
+            handle: user.handle ?? null,
+            handle_last_created_at: user.handle_last_created_at ?? null,
+            handle_change_log: (() => { try {
+                return JSON.parse(user.handle_change_log || '[]');
+            }
+            catch {
+                return [];
+            } })(),
+            email: user.email ?? null,
+            email_verified: !!user.email_verified,
+            phone: user.phone ?? null,
+            phone_verified: !!user.phone_verified,
+            has_password: !!user.password_hash,
+            region: user.region ?? 'global',
+            region_max_levels: getRegionMaxLevels(user.region || 'global'),
+            ...(() => { const g = userMlmGate(user.region || 'global'); return { mlm_ui_visible: g.mlmUiVisible, mlm_payout_levels: g.payoutLevels }; })(),
+            bio: user.bio ?? null,
+            search_anchor: user.search_anchor ?? null,
+            feed_visible: user.feed_visible == null ? 1 : Number(user.feed_visible),
+            default_address_text: user.default_address_text ?? null,
+            default_address_region: user.default_address_region ?? null,
+            default_address: (() => {
+                try {
+                    return user.default_address_json ? JSON.parse(user.default_address_json) : null;
+                }
+                catch {
+                    return null;
+                }
+            })(),
+            pending_score: Number(pendingScore),
+            total_left_pv: Number(pv?.total_left_pv ?? 0),
+            total_right_pv: Number(pv?.total_right_pv ?? 0),
+            lifetime_score: Number(user.lifetime_score ?? 0),
+            user_level: getUserLevel(Number(user.lifetime_score ?? 0)),
+        });
+    });
+}