@seasonkoh/webaz 0.1.7 → 0.1.9

package/dist/pwa/routes/trial.js

@@ -0,0 +1,333 @@
+// ─── 评估 cron — 重算 reach_score 决定退款 / 兜底超时 ──────────
+// reach_score = views(unique_click_count)*0.1 + shares(child notes)*1 + conversions(attributed orders)*10
+// 达阈 → 从卖家钱包扣 refund_amount 退给买家；30 天兜底超时
+export function evaluateTrialClaims(db, generateId) {
+    let evaluated = 0, refunded = 0, expired = 0;
+    const candidates = db.prepare(`
+    SELECT c.*,
+           -- 审计 P0-2：优先用 snapshot 字段（claim 时锁定），fallback 到 campaign 当前值
+           COALESCE(c.snap_reach_threshold, camp.reach_threshold) as eval_threshold,
+           COALESCE(c.snap_min_days_live, camp.min_days_live) as eval_min_days_live,
+           COALESCE(c.snap_min_chars, camp.min_chars) as eval_min_chars,
+           o.total_amount as order_amount,
+           -- 审计 P1-3：用 unique_click_count（dedup by IP+UA）而非 raw click_count
+           COALESCE(n.unique_click_count, n.click_count, 0) as views,
+           n.like_count, n.native_text, n.photo_hashes, n.status as note_status
+    FROM product_trial_claims c
+    JOIN product_trial_campaigns camp ON camp.id = c.campaign_id
+    JOIN orders o ON o.id = c.order_id
+    LEFT JOIN shareables n ON n.id = c.note_id
+    WHERE c.status = 'pending_threshold' AND c.note_id IS NOT NULL
+  `).all();
+    for (const r of candidates) {
+        evaluated++;
+        try {
+            // 笔记必须仍存在 + active + 满足最少字数 + 至少 1 张图
+            if (!r.note_status || r.note_status !== 'active')
+                continue;
+            const txtLen = String(r.native_text || '').length;
+            if (txtLen < Number(r.eval_min_chars || 50))
+                continue;
+            const photos = r.photo_hashes ? JSON.parse(String(r.photo_hashes)) : [];
+            if (!Array.isArray(photos) || photos.length === 0)
+                continue;
+            // 检查 note 是否 live 够久
+            const linkedAt = new Date(String(r.note_linked_at)).getTime();
+            const liveDays = (Date.now() - linkedAt) / 86400_000;
+            if (liveDays < Number(r.eval_min_days_live || 7))
+                continue;
+            // 30 天兜底超时
+            if (liveDays > 30) {
+                db.prepare("UPDATE product_trial_claims SET status='expired', expired_at=datetime('now'), last_eval_at=datetime('now') WHERE id=?").run(r.id);
+                expired++;
+                continue;
+            }
+            // 计算 metrics（views 已用 unique 去重）
+            const views = Number(r.views || 0);
+            const sharesRow = db.prepare("SELECT COUNT(*) as n FROM shareables WHERE parent_id = ? AND status='active'").get(r.note_id);
+            const shares = Number(sharesRow?.n || 0);
+            const convRow = db.prepare(`SELECT COUNT(DISTINCT o2.id) as n FROM orders o2
+        JOIN product_share_attribution psa ON psa.product_id = o2.product_id AND psa.recipient_id = o2.buyer_id
+        WHERE psa.shareable_id = ? AND o2.status IN ('confirmed','completed')
+          AND o2.buyer_id != ?
+          AND o2.created_at >= psa.created_at`).get(r.note_id, r.buyer_id);
+            const conversions = Number(convRow?.n || 0);
+            const reachScore = views * 0.1 + shares * 1 + conversions * 10;
+            const metricsJson = JSON.stringify({ views, shares, conversions });
+            if (reachScore >= Number(r.eval_threshold || 50)) {
+                // 达阈 → 退款。卖家钱包扣 refund_amount，买家钱包加（不变 escrow / commission）
+                const amount = Number(r.order_amount || 0);
+                if (amount <= 0) {
+                    db.prepare("UPDATE product_trial_claims SET reach_score=?, metrics_json=?, last_eval_at=datetime('now') WHERE id=?").run(reachScore, metricsJson, r.id);
+                    continue;
+                }
+                const seller = db.prepare("SELECT balance FROM wallets WHERE user_id = ?").get(r.seller_id);
+                if (!seller || Number(seller.balance) < amount) {
+                    // 卖家余额不足 — 暂不退，下次再评（卖家可能补充余额）
+                    db.prepare("UPDATE product_trial_claims SET reach_score=?, metrics_json=?, last_eval_at=datetime('now') WHERE id=?").run(reachScore, metricsJson, r.id);
+                    continue;
+                }
+                const tx = db.transaction(() => {
+                    db.prepare("UPDATE wallets SET balance = balance - ?, updated_at=datetime('now') WHERE user_id = ?").run(amount, r.seller_id);
+                    db.prepare("INSERT INTO wallets (user_id, balance) VALUES (?, ?) ON CONFLICT(user_id) DO UPDATE SET balance = balance + ?, updated_at=datetime('now')").run(r.buyer_id, amount, amount);
+                    db.prepare(`UPDATE product_trial_claims SET status='refunded', refund_amount=?, refunded_at=datetime('now'),
+            reach_score=?, metrics_json=?, last_eval_at=datetime('now') WHERE id=?`).run(amount, reachScore, metricsJson, r.id);
+                    try {
+                        // notifications schema 没有 data 列；用 actions（JSON 数组）存可点击跳转
+                        db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, actions)
+              VALUES (?, ?, 'trial_refunded', ?, ?, ?)`).run(generateId('ntf'), r.buyer_id, '测评免单 · 退款已到账', `reach=${Math.round(reachScore)} 达阈 ${r.eval_threshold}，已退 ${amount} WAZ`, JSON.stringify([{ label: '查看', hash: '#trials' }]));
+                        db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, actions)
+              VALUES (?, ?, 'trial_refunded', ?, ?, ?)`).run(generateId('ntf'), r.seller_id, '测评免单 · 已为买家退款', `claim 完成 reach=${Math.round(reachScore)}，退 ${amount} WAZ`, JSON.stringify([{ label: '查看活动', hash: '#seller-trials' }]));
+                    }
+                    catch { /* notifications 表可能用旧 schema, 忽略 */ }
+                });
+                tx();
+                refunded++;
+            }
+            else {
+                db.prepare("UPDATE product_trial_claims SET reach_score=?, metrics_json=?, last_eval_at=datetime('now') WHERE id=?").run(reachScore, metricsJson, r.id);
+            }
+        }
+        catch (e) {
+            console.error('[cron trial-eval]', r.id, e);
+        }
+    }
+    return { evaluated, refunded, expired };
+}
+export function registerTrialRoutes(app, deps) {
+    const { db, generateId, auth, clientIpHash, clientUaHash, requireProtocolAdmin } = deps;
+    // 卖家：开/更新活动
+    app.post('/api/products/:product_id/trial-campaign', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const product = db.prepare('SELECT id, seller_id, status FROM products WHERE id = ?').get(req.params.product_id);
+        if (!product)
+            return void res.status(404).json({ error: '商品不存在' });
+        if (product.seller_id !== user.id)
+            return void res.status(403).json({ error: '仅商品卖家可开启测评' });
+        const body = req.body || {};
+        const quota = Math.floor(Number(body.quota_total) || 0);
+        const threshold = Math.floor(Number(body.reach_threshold) || 50);
+        const minChars = Math.floor(Number(body.min_chars) || 50);
+        const minDays = Math.floor(Number(body.min_days_live) || 7);
+        if (quota < 1 || quota > 200)
+            return void res.status(400).json({ error: 'quota_total 需在 1-200 之间' });
+        if (threshold < 10 || threshold > 10000)
+            return void res.status(400).json({ error: 'reach_threshold 需在 10-10000 之间' });
+        if (minChars < 20 || minChars > 5000)
+            return void res.status(400).json({ error: 'min_chars 需在 20-5000 之间' });
+        if (minDays < 1 || minDays > 90)
+            return void res.status(400).json({ error: 'min_days_live 需在 1-90 之间' });
+        // B3 修：1 product 1 row（UNIQUE）所以"关闭后再开"必须走 UPDATE 路径，不再 INSERT
+        // 查任意 status 的现存行；存在即 UPDATE，不存在才 INSERT
+        const existing = db.prepare("SELECT id, status, quota_claimed, reach_threshold, min_chars, min_days_live FROM product_trial_campaigns WHERE product_id = ?").get(product.id);
+        if (existing) {
+            if (quota < existing.quota_claimed)
+                return void res.status(400).json({ error: `quota_total 不可低于已申请数 ${existing.quota_claimed}` });
+            // 审计 P0-3：仅 active + 有 claim 时禁止上调阈值（关闭活动重开不限）
+            if (existing.status === 'active' && existing.quota_claimed > 0) {
+                if (threshold > existing.reach_threshold)
+                    return void res.status(400).json({ error: `已有 ${existing.quota_claimed} 个申请，reach_threshold 不可上调（当前 ${existing.reach_threshold}）` });
+                if (minChars > existing.min_chars)
+                    return void res.status(400).json({ error: `已有申请，min_chars 不可上调（当前 ${existing.min_chars}）` });
+                if (minDays > existing.min_days_live)
+                    return void res.status(400).json({ error: `已有申请，min_days_live 不可上调（当前 ${existing.min_days_live}）` });
+            }
+            // 重开：status='closed' → 重置为 active 且清 closed_at
+            db.prepare(`UPDATE product_trial_campaigns
+                  SET quota_total=?, reach_threshold=?, min_chars=?, min_days_live=?,
+                      status='active', closed_at=NULL
+                  WHERE id=?`)
+                .run(quota, threshold, minChars, minDays, existing.id);
+            return void res.json({ ok: true, campaign_id: existing.id, updated: true, reopened: existing.status !== 'active' });
+        }
+        const id = generateId('ptc');
+        db.prepare(`INSERT INTO product_trial_campaigns (id, product_id, seller_id, quota_total, reach_threshold, min_chars, min_days_live)
+                VALUES (?,?,?,?,?,?,?)`).run(id, product.id, user.id, quota, threshold, minChars, minDays);
+        res.json({ ok: true, campaign_id: id, created: true });
+    });
+    // 卖家关闭活动（仍允许 pending claims 完成评估）
+    app.delete('/api/products/:product_id/trial-campaign', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const camp = db.prepare("SELECT id, seller_id FROM product_trial_campaigns WHERE product_id = ? AND status = 'active'").get(req.params.product_id);
+        if (!camp)
+            return void res.status(404).json({ error: '无活跃活动' });
+        if (camp.seller_id !== user.id)
+            return void res.status(403).json({ error: '仅卖家可关闭' });
+        db.prepare("UPDATE product_trial_campaigns SET status='closed', closed_at=datetime('now') WHERE id=?").run(camp.id);
+        res.json({ ok: true, closed: true });
+    });
+    // 公开查询商品的活动状态（任何人）
+    app.get('/api/products/:product_id/trial-campaign', (req, res) => {
+        const camp = db.prepare(`SELECT id, quota_total, quota_claimed, reach_threshold, min_chars, min_days_live, status, created_at
+      FROM product_trial_campaigns WHERE product_id = ? AND status = 'active'`).get(req.params.product_id);
+        if (!camp)
+            return void res.json({ campaign: null });
+        res.json({ campaign: { ...camp, quota_remaining: Number(camp.quota_total) - Number(camp.quota_claimed) } });
+    });
+    // 买家申请名额（必须已 confirmed/completed 该商品订单）
+    // 审计防御：
+    //   P0: 拒绝 buyer_id === seller_id（自买自评）
+    //   P0: 快照 campaign 配置到 claim 行，cron 按快照评估（防卖家中途上调阈值）
+    //   P1: 新账号 < 3 天禁申请；IP/UA 与卖家 session 重叠 → 标 account_link 审计 flag
+    app.post('/api/products/:product_id/trial-claim', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const productId = req.params.product_id;
+        const camp = db.prepare("SELECT * FROM product_trial_campaigns WHERE product_id = ? AND status = 'active'").get(productId);
+        if (!camp)
+            return void res.status(404).json({ error: '该商品当前无测评活动' });
+        if (Number(camp.quota_claimed) >= Number(camp.quota_total))
+            return void res.status(409).json({ error: '名额已满' });
+        // 审计 P0-2：禁止卖家给自己商品申请测评（自买自评最直接的形式）
+        if (user.id === camp.seller_id)
+            return void res.status(403).json({ error: '卖家不能为自己的商品申请测评' });
+        // 审计 P1-1：新账号冷启动锁（注册 < 3 天）
+        const userCreatedAt = String(user.created_at || '');
+        if (userCreatedAt) {
+            const ageDays = (Date.now() - new Date(userCreatedAt).getTime()) / 86400_000;
+            if (ageDays < 3)
+                return void res.status(403).json({ error: `新账号需注册满 3 天才能申请测评（你已注册 ${ageDays.toFixed(1)} 天）` });
+        }
+        // 买家必须有该商品的 confirmed/completed 订单
+        const order = db.prepare(`SELECT id, total_amount FROM orders WHERE product_id = ? AND buyer_id = ? AND status IN ('confirmed','completed') ORDER BY created_at DESC LIMIT 1`).get(productId, user.id);
+        if (!order)
+            return void res.status(400).json({ error: '需先完成订单 (confirmed 或 completed) 才能申请测评' });
+        const dup = db.prepare("SELECT id FROM product_trial_claims WHERE buyer_id = ? AND product_id = ?").get(user.id, productId);
+        if (dup)
+            return void res.status(409).json({ error: '已申请过该商品测评', existing_id: dup.id });
+        // 审计 P1-7（2026-05-25）：单 IP 1h 频次限制 — 防脚本批量小号撞名额
+        // #1016 fix: 实际列名是 claimed_at（datetime('now') default），不是 created_at
+        const buyerIp = clientIpHash(req);
+        const buyerUa = clientUaHash(req);
+        const recentIpClaims = db.prepare(`SELECT COUNT(*) as n FROM product_trial_claims
+      WHERE buyer_ip_hash = ? AND claimed_at > datetime('now', '-1 hour')`).get(buyerIp).n;
+        if (recentIpClaims >= 3) {
+            return void res.status(429).json({ error: '当前网络申请过于频繁，请稍后再试', error_code: 'TRIAL_IP_RATE_LIMITED' });
+        }
+        // 审计 P1-2：IP/UA 重叠检测 — 标记 flag，不阻断（阻断会误伤共享网络的真买家）
+        const linkRow = db.prepare(`SELECT 1 FROM user_sessions
+      WHERE user_id = ? AND (ip = ? OR fingerprint_hash = ?) LIMIT 1`).get(camp.seller_id, buyerIp, buyerUa);
+        const flags = [];
+        if (linkRow)
+            flags.push('account_link_ip_or_ua');
+        const auditFlags = flags.length ? JSON.stringify(flags) : null;
+        const id = generateId('pcl');
+        // R1 修：quota 超卖竞态 — 用条件性 UPDATE 抢名额，原子化
+        // 把 UPDATE 放在 tx 最前面，changes==0 即抛错让 tx 回滚（INSERT 也不会执行）
+        try {
+            const tx = db.transaction(() => {
+                const upd = db.prepare(`UPDATE product_trial_campaigns
+                                SET quota_claimed = quota_claimed + 1
+                                WHERE id = ? AND quota_claimed < quota_total AND status = 'active'`).run(camp.id);
+                if (upd.changes === 0)
+                    throw new Error('QUOTA_FULL');
+                db.prepare(`INSERT INTO product_trial_claims (id, campaign_id, product_id, seller_id, buyer_id, order_id,
+                    snap_reach_threshold, snap_min_chars, snap_min_days_live, buyer_ip_hash, buyer_ua_hash, audit_flags)
+                    VALUES (?,?,?,?,?,?,?,?,?,?,?,?)`).run(id, camp.id, productId, camp.seller_id, user.id, order.id, Number(camp.reach_threshold), Number(camp.min_chars), Number(camp.min_days_live), buyerIp, buyerUa, auditFlags);
+            });
+            tx();
+        }
+        catch (e) {
+            if (e.message === 'QUOTA_FULL')
+                return void res.status(409).json({ error: '名额已满（并发申请抢占）' });
+            throw e;
+        }
+        res.json({ ok: true, claim_id: id, refund_eligible_amount: order.total_amount, audit_flags: flags });
+    });
+    // 买家关联笔记
+    app.post('/api/trial-claims/:claim_id/link-note', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const claim = db.prepare("SELECT * FROM product_trial_claims WHERE id = ?").get(req.params.claim_id);
+        if (!claim)
+            return void res.status(404).json({ error: '申请不存在' });
+        if (claim.buyer_id !== user.id)
+            return void res.status(403).json({ error: '仅本人可关联' });
+        if (claim.status !== 'pending_note')
+            return void res.status(400).json({ error: `当前状态 ${claim.status} 不可关联笔记` });
+        const { note_id } = req.body || {};
+        if (!note_id)
+            return void res.status(400).json({ error: '缺少 note_id' });
+        // 笔记必须存在 + 是 type=note + owner=买家 + related_product_id=该商品
+        const note = db.prepare(`SELECT id, owner_id, type, related_product_id, native_text, photo_hashes, status, created_at
+      FROM shareables WHERE id = ?`).get(note_id);
+        if (!note)
+            return void res.status(404).json({ error: '笔记不存在' });
+        if (note.owner_id !== user.id)
+            return void res.status(403).json({ error: '仅本人笔记可关联' });
+        if (note.type !== 'note')
+            return void res.status(400).json({ error: '仅 type=note 可关联' });
+        if (note.related_product_id !== claim.product_id)
+            return void res.status(400).json({ error: '笔记需绑定该商品（含 anchor）' });
+        if (note.status !== 'active')
+            return void res.status(400).json({ error: '笔记需为 active' });
+        const txtLen = String(note.native_text || '').length;
+        // 审计 P0-2：用 claim 的 snapshot（申请时锁定），非 campaign 当前值
+        const minChars = Number(claim.snap_min_chars || 50);
+        if (txtLen < minChars) {
+            return void res.status(400).json({ error: `笔记字数不足 ${minChars}（当前 ${txtLen}）` });
+        }
+        const photoHashes = note.photo_hashes ? JSON.parse(String(note.photo_hashes)) : [];
+        if (!Array.isArray(photoHashes) || photoHashes.length === 0)
+            return void res.status(400).json({ error: '笔记需至少 1 张图' });
+        db.prepare(`UPDATE product_trial_claims SET note_id=?, note_linked_at=datetime('now'), status='pending_threshold' WHERE id=?`).run(note_id, claim.id);
+        res.json({ ok: true, status: 'pending_threshold' });
+    });
+    // 买家：我的测评列表
+    app.get('/api/me/trial-claims', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const rows = db.prepare(`SELECT c.*, p.title as product_title, p.price as product_price,
+        camp.reach_threshold, camp.min_days_live
+      FROM product_trial_claims c
+      LEFT JOIN products p ON p.id = c.product_id
+      LEFT JOIN product_trial_campaigns camp ON camp.id = c.campaign_id
+      WHERE c.buyer_id = ?
+      ORDER BY c.claimed_at DESC LIMIT 100`).all(user.id);
+        res.json({ items: rows });
+    });
+    // 卖家：我的测评活动列表（含每个的 claims 计数）
+    app.get('/api/me/seller/trial-campaigns', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const rows = db.prepare(`SELECT camp.*, p.title as product_title, p.price as product_price,
+        (SELECT COUNT(*) FROM product_trial_claims WHERE campaign_id = camp.id AND status='refunded') as refunded_count,
+        (SELECT COUNT(*) FROM product_trial_claims WHERE campaign_id = camp.id AND status='pending_threshold') as evaluating_count,
+        (SELECT COUNT(*) FROM product_trial_claims WHERE campaign_id = camp.id AND status='expired') as expired_count
+      FROM product_trial_campaigns camp
+      LEFT JOIN products p ON p.id = camp.product_id
+      WHERE camp.seller_id = ?
+      ORDER BY camp.created_at DESC LIMIT 100`).all(user.id);
+        res.json({ items: rows });
+    });
+    // 卖家：查看某活动的 claims 详情
+    app.get('/api/trial-campaigns/:campaign_id/claims', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const camp = db.prepare("SELECT id, seller_id FROM product_trial_campaigns WHERE id = ?").get(req.params.campaign_id);
+        if (!camp)
+            return void res.status(404).json({ error: '活动不存在' });
+        if (camp.seller_id !== user.id)
+            return void res.status(403).json({ error: '仅卖家可查看' });
+        const rows = db.prepare(`SELECT c.*, u.handle as buyer_handle, u.created_at as buyer_created_at FROM product_trial_claims c
+      LEFT JOIN users u ON u.id = c.buyer_id
+      WHERE c.campaign_id = ? ORDER BY c.claimed_at DESC`).all(camp.id);
+        res.json({ items: rows });
+    });
+    // Admin 手动触发测评评估（测试 + 紧急 + 立即生效）
+    app.post('/api/admin/trial/run-eval', (req, res) => {
+        const admin = requireProtocolAdmin(req, res);
+        if (!admin)
+            return;
+        res.json(evaluateTrialClaims(db, generateId));
+    });
+}

package/dist/pwa/routes/trusted-kpi.js

@@ -0,0 +1,87 @@
+export function registerTrustedKpiRoutes(app, deps) {
+    const { db, auth } = deps;
+    // Verifier KPI（白名单 tier / 配额 / 准确率 / 窗口奖励）
+    app.get('/api/verifier/me/kpi', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const windowDays = Math.max(7, Math.min(365, Number(req.query.window) || 30));
+        const cumul = db.prepare('SELECT tasks_done, tasks_correct, tasks_wrong, verify_rights FROM verifier_stats WHERE user_id = ?').get(user.id);
+        const wl = db.prepare('SELECT tier, daily_quota, tasks_today, is_system FROM verifier_whitelist WHERE user_id = ?').get(user.id);
+        // 窗口内投票数（跨多个 votes 表聚合）
+        const windowVotes = db.prepare(`
+      SELECT
+        (SELECT COUNT(*) FROM claim_verification_votes WHERE verifier_id = ? AND voted_at > datetime('now', '-' || ? || ' days')) +
+        (SELECT COUNT(*) FROM product_claim_votes WHERE verifier_id = ? AND voted_at > datetime('now', '-' || ? || ' days')) +
+        (SELECT COUNT(*) FROM review_claim_votes WHERE verifier_id = ? AND voted_at > datetime('now', '-' || ? || ' days'))
+        as n
+    `).get(user.id, windowDays, user.id, windowDays, user.id, windowDays).n;
+        // 窗口内奖励 (reputation_events: claim_correct 等)
+        const earnedEvents = db.prepare(`
+      SELECT COALESCE(SUM(points), 0) as pts FROM reputation_events
+      WHERE user_id = ? AND event_type IN ('claim_correct', 'claim_upheld_against', 'claim_dismissed_false')
+        AND created_at > datetime('now', '-' || ? || ' days')
+    `).get(user.id, windowDays).pts;
+        const wal = db.prepare('SELECT earned FROM wallets WHERE user_id = ?').get(user.id);
+        const accuracy = cumul && cumul.tasks_done > 0 ? cumul.tasks_correct / cumul.tasks_done : null;
+        res.json({
+            window_days: windowDays,
+            is_external: wl ? wl.is_system === 0 : false,
+            tier: wl?.tier || null,
+            daily_quota: wl?.daily_quota || 0,
+            tasks_today: wl?.tasks_today || 0,
+            verify_rights: cumul?.verify_rights || 0,
+            cumulative: {
+                tasks_done: cumul?.tasks_done || 0,
+                tasks_correct: cumul?.tasks_correct || 0,
+                tasks_wrong: cumul?.tasks_wrong || 0,
+                accuracy,
+            },
+            window: {
+                votes: windowVotes,
+                rep_points: earnedEvents,
+            },
+            total_earned_waz: Number(wal?.earned || 0),
+        });
+    });
+    // Arbitrator KPI（仲裁累计 + 裁决分布 + pending）
+    app.get('/api/arbitrator/me/kpi', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const windowDays = Math.max(7, Math.min(365, Number(req.query.window) || 30));
+        const idLike = `%"${user.id}"%`;
+        const cumul = db.prepare(`
+      SELECT COUNT(*) as total,
+        SUM(CASE WHEN ruling_type = 'refund_buyer' THEN 1 ELSE 0 END) as refund_buyer_cnt,
+        SUM(CASE WHEN ruling_type = 'partial_refund' THEN 1 ELSE 0 END) as partial_cnt,
+        SUM(CASE WHEN ruling_type = 'release_seller' THEN 1 ELSE 0 END) as release_seller_cnt
+      FROM disputes WHERE assigned_arbitrators LIKE ? AND status IN ('resolved','dismissed')
+    `).get(idLike);
+        const windowTotal = db.prepare(`
+      SELECT COUNT(*) as n FROM disputes
+      WHERE assigned_arbitrators LIKE ? AND status IN ('resolved','dismissed')
+        AND resolved_at > datetime('now', '-' || ? || ' days')
+    `).get(idLike, windowDays).n;
+        const pending = db.prepare(`
+      SELECT COUNT(*) as n FROM disputes
+      WHERE assigned_arbitrators LIKE ? AND status NOT IN ('resolved','dismissed')
+    `).get(idLike).n;
+        const wl = db.prepare('SELECT is_system, stake_amount FROM arbitrator_whitelist WHERE user_id = ?').get(user.id);
+        const wal = db.prepare('SELECT earned FROM wallets WHERE user_id = ?').get(user.id);
+        res.json({
+            window_days: windowDays,
+            is_external: wl ? wl.is_system === 0 : false,
+            stake_amount: wl?.stake_amount || 0,
+            cumulative: {
+                total: cumul?.total || 0,
+                refund_buyer: cumul?.refund_buyer_cnt || 0,
+                partial_refund: cumul?.partial_cnt || 0,
+                release_seller: cumul?.release_seller_cnt || 0,
+            },
+            window_total: windowTotal,
+            pending,
+            total_earned_waz: Number(wal?.earned || 0),
+        });
+    });
+}

package/dist/pwa/routes/url-claim.js

@@ -0,0 +1,113 @@
+export function registerUrlClaimRoutes(app, deps) {
+    const { db, auth, safeFetch, generateId, parsePlatformUrl, getStakeDiscount, makeCommitmentHash, makeDescriptionHash, makePriceHash } = deps;
+    app.post('/api/link-challenges/:id/verify', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const challenge = db.prepare(`SELECT * FROM link_challenges WHERE id = ? AND status = 'pending'`)
+            .get(req.params.id);
+        if (!challenge)
+            return void res.json({ error: '验证码不存在或已失效' });
+        if (challenge.product_id !== undefined) {
+            const prod = db.prepare('SELECT seller_id FROM products WHERE id = ?').get(challenge.product_id);
+            if (!prod || prod.seller_id !== user.id)
+                return void res.status(403).json({ error: '无权限' });
+        }
+        if (new Date(challenge.expires_at) < new Date()) {
+            db.prepare(`UPDATE link_challenges SET status='expired' WHERE id = ?`).run(req.params.id);
+            return void res.json({ error: '验证码已过期（48小时有效），请重新添加链接' });
+        }
+        const fullCode = `WebAZ-${challenge.code}`;
+        const chUrl = String(challenge.url || '');
+        try {
+            const ctrl = new AbortController();
+            setTimeout(() => ctrl.abort(), 10000);
+            const resp = await safeFetch(chUrl, { signal: ctrl.signal, headers: { 'User-Agent': 'Mozilla/5.0', 'Accept-Language': 'zh-CN,zh' } });
+            const html = await resp.text();
+            if (!html.includes(fullCode)) {
+                return void res.json({ error: `页面中未找到验证码 "${fullCode}"，请确认已保存到商品标题或描述中` });
+            }
+        }
+        catch (e) {
+            const msg = e.message;
+            if (msg.startsWith('ssrf_'))
+                return void res.json({ error: '链接指向私网/localhost 或经 redirect 触达内部地址，已拦截' });
+            return void res.json({ error: `无法访问页面：${msg}` });
+        }
+        db.prepare(`UPDATE product_external_links SET product_id = ?, verify_note = '通过挑战验证，从原商品转移', verified_at = datetime('now') WHERE url = ?`)
+            .run(challenge.product_id, challenge.url);
+        db.prepare(`UPDATE link_challenges SET status='verified', verified_at=datetime('now') WHERE id=?`).run(req.params.id);
+        res.json({ success: true, message: `验证成功！链接已转移到此商品。` });
+    });
+    app.post('/api/claim-url', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (user.role !== 'seller')
+            return void res.json({ error: '仅卖家可发起认领' });
+        const { url, title, description, price, stock = 1, category = '', specs, handling_hours = 24, return_days = 7, warranty_days = 0, external_title, } = req.body;
+        if (!url || !title || !description || !price) {
+            return void res.json({ error: '请填写链接、商品名、描述和价格' });
+        }
+        const claimExternalTitle = typeof external_title === 'string' && external_title.trim() ? external_title.trim() : null;
+        const otherClaim = db.prepare(`
+      SELECT p.id FROM product_external_links pel
+      JOIN products p ON pel.product_id = p.id
+      WHERE pel.url = ? AND pel.verified = 1 AND p.seller_id != ?
+    `).get(url, user.id);
+        if (!otherClaim) {
+            return void res.json({ error: '该链接当前没有其他商家认领，请直接使用导入上架功能' });
+        }
+        const existingClaim = db.prepare(`
+      SELECT vt.id FROM verify_tasks vt
+      JOIN products p ON vt.product_id = p.id
+      WHERE vt.url = ? AND p.seller_id = ? AND vt.status IN ('code_issued','open')
+    `).get(url, user.id);
+        if (existingClaim) {
+            return void res.json({ error: '您已有针对此链接的进行中认领任务，请在商品编辑页查看并确认', task_id: existingClaim.id });
+        }
+        const VERIFIERS_NEEDED = 1;
+        const REWARD_EACH = 0.1;
+        const feeLocked = VERIFIERS_NEEDED * REWARD_EACH;
+        const wallet = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(user.id);
+        const priceNum = Number(price);
+        const stakeDiscount = getStakeDiscount(db, user.id);
+        const stakeRate = Math.max(0.05, 0.15 - stakeDiscount);
+        const stakeAmount = Math.round(priceNum * stakeRate * 100) / 100;
+        if (wallet.balance < stakeAmount + feeLocked) {
+            return void res.json({ error: `余额不足：需要 ${stakeAmount} WAZ 质押 + ${feeLocked} WAZ 验证费，当前余额 ${wallet.balance} WAZ` });
+        }
+        const now = new Date().toISOString();
+        const productId = generateId('prd');
+        const specsJson = specs ? (typeof specs === 'string' ? specs : JSON.stringify(specs)) : null;
+        const pFields = { ship_regions: '全国', handling_hours, estimated_days: null, return_days, return_condition: '', warranty_days };
+        db.prepare(`INSERT INTO products (
+      id, seller_id, title, description, price, stock, category, stake_amount,
+      specs, source_url, handling_hours, return_days, warranty_days,
+      commitment_hash, description_hash, price_hash, hashed_at, status
+    ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'warehouse')`).run(productId, user.id, title, description, priceNum, Number(stock), category, stakeAmount, specsJson, url, Number(handling_hours), Number(return_days), Number(warranty_days), makeCommitmentHash(pFields), makeDescriptionHash({ title, description, specs: specsJson }), makePriceHash(priceNum, now), now);
+        db.prepare(`UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ?`)
+            .run(stakeAmount, stakeAmount, user.id);
+        db.prepare(`UPDATE products SET stake_locked_at = datetime('now') WHERE id = ?`).run(productId);
+        const linkId = generateId('lnk');
+        const claimUrlMeta = parsePlatformUrl(url);
+        db.prepare(`INSERT INTO product_external_links
+      (id, product_id, url, source, verified, verify_note, platform, external_id, external_title)
+      VALUES (?,?,?,'claim',0,'认领验证进行中',?,?,?)`).run(linkId, productId, url, claimUrlMeta?.platform ?? null, claimUrlMeta?.external_id ?? null, claimExternalTitle);
+        const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+        const code = Array.from({ length: 8 }, () => chars[Math.floor(Math.random() * chars.length)]).join('');
+        const taskId = generateId('vtk');
+        const expiresAt = new Date(Date.now() + 72 * 3600_000).toISOString();
+        db.prepare(`INSERT INTO verify_tasks (id, type, product_id, url, code, verifiers_needed, reward_per_verifier, fee_locked, status, expires_at)
+      VALUES (?,?,?,?,?,?,?,?,'code_issued',?)`).run(taskId, 'code_check', productId, url, code, VERIFIERS_NEEDED, REWARD_EACH, feeLocked, expiresAt);
+        db.prepare(`UPDATE wallets SET balance = balance - ? WHERE user_id = ?`).run(feeLocked, user.id);
+        res.json({
+            success: true,
+            product_id: productId,
+            task_id: taskId,
+            code: `[${code}]`,
+            expires_at: expiresAt,
+            message: `商品已建立，认领任务已创建。请在原平台商品标题或描述中加入验证码 [${code}]，完成后在商品编辑页点击「确认已添加」提交任务，审核通过后链接归属自动转移。`,
+        });
+    });
+}