@seasonkoh/webaz 0.1.8 → 0.1.10

package/dist/pwa/routes/admin-wallet-ops.js

@@ -0,0 +1,66 @@
+export function registerAdminWalletOpsRoutes(app, deps) {
+    const { db, requireProtocolAdmin, adminAuth, getPublicClient, getUsdcAddr, getUsdcAbi, getHotWalletAddr, wazToUsdc, getIsMainnet, getNetwork, executeWithdrawal } = deps;
+    // P2-5: protocol 权限（区域 admin 看不到全局热钱包）
+    app.get('/api/admin/hot-wallet/status', async (req, res) => {
+        const admin = requireProtocolAdmin(req, res);
+        if (!admin)
+            return;
+        try {
+            const pc = getPublicClient();
+            const hw = getHotWalletAddr();
+            const usdcBal = await pc.readContract({
+                address: getUsdcAddr(), abi: getUsdcAbi(), functionName: 'balanceOf', args: [hw],
+            });
+            const ethBal = await pc.getBalance({ address: hw });
+            const pending = db.prepare("SELECT COALESCE(SUM(amount), 0) as t FROM withdrawal_requests WHERE status = 'pending'").get();
+            const pendingUsdc = wazToUsdc(Number(pending.t));
+            res.json({
+                address: hw,
+                usdc_balance: Number(usdcBal) / 1e6,
+                eth_balance: Number(ethBal) / 1e18,
+                pending_withdrawals_waz: pending.t,
+                pending_withdrawals_usdc: pendingUsdc,
+                shortfall_usdc: Math.max(0, pendingUsdc - Number(usdcBal) / 1e6),
+                chain: getIsMainnet() ? 'base-mainnet' : 'base-sepolia',
+                network: getNetwork(),
+            });
+        }
+        catch (e) {
+            res.status(500).json({ error: 'RPC 读取失败: ' + e.message });
+        }
+    });
+    // Legacy x-admin-key 入口：仅余额
+    app.get('/api/admin/hot-wallet', async (req, res) => {
+        if (!adminAuth(req, res))
+            return;
+        const hw = getHotWalletAddr();
+        try {
+            const balance = await getPublicClient().readContract({
+                address: getUsdcAddr(), abi: getUsdcAbi(),
+                functionName: 'balanceOf', args: [hw],
+            });
+            res.json({ address: hw, usdc_balance: Number(balance) / 1e6 });
+        }
+        catch (e) {
+            res.json({ address: hw, usdc_balance: null, error: e.message });
+        }
+    });
+    app.get('/api/admin/withdrawals', (req, res) => {
+        if (!adminAuth(req, res))
+            return;
+        const list = db.prepare(`
+      SELECT wr.*, u.name as user_name
+      FROM withdrawal_requests wr JOIN users u ON wr.user_id = u.id
+      WHERE wr.status = 'pending' ORDER BY wr.created_at ASC
+    `).all();
+        res.json(list);
+    });
+    app.post('/api/admin/withdrawals/:id/approve', async (req, res) => {
+        if (!adminAuth(req, res))
+            return;
+        const result = await executeWithdrawal(req.params.id).catch(e => ({ success: false, error: e.message, txHash: undefined }));
+        if (!result.success)
+            return void res.json({ error: result.error });
+        res.json({ success: true, tx_hash: result.txHash });
+    });
+}

package/dist/pwa/routes/agent-buy.js

@@ -0,0 +1,215 @@
+export function registerAgentBuyRoutes(app, deps) {
+    const { db, auth, safeFetch, rateLimitOk, generateId, anthropic, AnthropicCtor, formatProductForAgent, checkStockAndMaybeDelist, addHours, transition, notifyTransition, shouldAutoAccept } = deps;
+    app.post('/api/agent-buy', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (user.role !== 'buyer')
+            return void res.json({ error: '仅买家可使用智能下单' });
+        const { source_url, shipping_address, auto_buy = false, user_api_key } = req.body;
+        if (!source_url)
+            return void res.json({ error: '请提供商品链接' });
+        if (auto_buy && !shipping_address)
+            return void res.json({ error: '自动下单需提供收货地址' });
+        if (!rateLimitOk(req.ip || 'unknown', 6, 60_000))
+            return void res.status(429).json({ error: '请求过于频繁，请稍后再试' });
+        let html = '';
+        try {
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), 10000);
+            const resp = await safeFetch(String(source_url), {
+                signal: ctrl.signal,
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (compatible; WebAZ/1.0; +https://webaz.xyz)',
+                    'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8',
+                },
+            });
+            clearTimeout(timer);
+            html = (await resp.text()).slice(0, 20000);
+        }
+        catch (e) {
+            const msg = e.message;
+            if (msg.startsWith('ssrf_'))
+                return void res.json({ error: '链接指向私网/localhost 或经 redirect 触达内部地址，已拦截' });
+            return void res.json({ error: `无法访问该链接：${msg}` });
+        }
+        const client = (typeof user_api_key === 'string' && user_api_key.trim().startsWith('sk-ant-'))
+            ? new AnthropicCtor({ apiKey: user_api_key.trim() })
+            : anthropic;
+        let source;
+        try {
+            const msg = await client.messages.create({
+                model: 'claude-haiku-4-5-20251001',
+                max_tokens: 512,
+                messages: [{ role: 'user', content: `从以下网页提取商品关键信息，仅返回JSON：
+{
+  "title": "商品全名",
+  "price_cny": 数字或null,
+  "category": "分类",
+  "search_terms": ["独立短词1","独立短词2","独立短词3"]
+}
+search_terms 是3-5个独立的中文短词（每个2-4个汉字），用于在数据库里搜索同类商品。
+例：九阳炒菜机器人 → ["炒菜机","九阳","炒菜机器人","自动炒菜"]
+HTML：${html}` }],
+            });
+            const text = msg.content[0].type === 'text' ? msg.content[0].text : '';
+            const m = text.match(/\{[\s\S]*\}/);
+            if (!m)
+                throw new Error('no json');
+            source = JSON.parse(m[0]);
+        }
+        catch {
+            return void res.json({ error: '无法从链接提取商品信息，请尝试其他链接' });
+        }
+        if (!source.title)
+            return void res.json({ error: '链接无法提取商品信息（可能需要登录或动态渲染）' });
+        const urlMatchIds = db.prepare(`
+      SELECT DISTINCT product_id FROM product_external_links WHERE url = ? AND verified = 1
+    `).all(source_url).map(r => r.product_id);
+        const urlMatchProducts = urlMatchIds.length > 0
+            ? db.prepare(`
+          SELECT p.*, u.name as seller_name,
+            COALESCE(rs.total_points, 0) as rep_points, COALESCE(rs.level, 'new') as rep_level
+          FROM products p
+          JOIN users u ON p.seller_id = u.id
+          LEFT JOIN reputation_scores rs ON rs.user_id = p.seller_id
+          WHERE p.id IN (${urlMatchIds.map(() => '?').join(',')}) AND p.status = 'active' AND p.stock > 0
+        `).all(...urlMatchIds)
+            : [];
+        let keywordProducts = [];
+        if (urlMatchProducts.length < 3) {
+            const rawTerms = Array.isArray(source.search_terms) ? source.search_terms : [];
+            if (rawTerms.length === 0) {
+                const t = source.title;
+                for (let i = 0; i + 2 <= t.length && rawTerms.length < 4; i += 2)
+                    rawTerms.push(t.slice(i, i + 4));
+            }
+            const terms = rawTerms.filter((t) => t && t.length >= 2).slice(0, 6);
+            if (terms.length > 0) {
+                const termClauses = terms.map(() => `p.title LIKE ? ESCAPE '\\' OR p.description LIKE ? ESCAPE '\\'`).join(' OR ');
+                const termParams = terms.flatMap((t) => { const e = t.replace(/[\\%_]/g, '\\$&'); return [`%${e}%`, `%${e}%`]; });
+                const catClause = source.category ? ` OR p.category = ?` : '';
+                const catParam = source.category ? [source.category] : [];
+                const alreadyIds = urlMatchProducts.map(p => p.id);
+                const excludeClause = alreadyIds.length > 0 ? ` AND p.id NOT IN (${alreadyIds.map(() => '?').join(',')})` : '';
+                keywordProducts = db.prepare(`
+          SELECT p.*, u.name as seller_name,
+            COALESCE(rs.total_points, 0) as rep_points, COALESCE(rs.level, 'new') as rep_level
+          FROM products p
+          JOIN users u ON p.seller_id = u.id
+          LEFT JOIN reputation_scores rs ON rs.user_id = p.seller_id
+          WHERE p.status = 'active' AND p.stock > 0
+            AND (${termClauses}${catClause})${excludeClause}
+          ORDER BY rep_points DESC, p.price ASC LIMIT ${5 - urlMatchProducts.length}
+        `).all(...termParams, ...catParam, ...alreadyIds);
+            }
+        }
+        const webazProducts = [...urlMatchProducts, ...keywordProducts];
+        const webazFormatted = webazProducts.map(p => ({
+            ...formatProductForAgent(p),
+            url_match: urlMatchIds.includes(p.id),
+        }));
+        let decision;
+        try {
+            const msg = await client.messages.create({
+                model: 'claude-haiku-4-5-20251001',
+                max_tokens: 512,
+                messages: [{ role: 'user', content: `你是一个购物助手。用户想买以下商品，我们找到了 WebAZ 平台上的替代选项，请做出购买建议。
+
+原商品：
+- 标题：${source.title}
+- 原平台价格：${source.price_cny ? `¥${source.price_cny} CNY` : '未知'}
+- 链接：${source_url}
+
+WebAZ 平台替代方案（WAZ ≈ CNY）：
+${webazFormatted.length > 0 ? JSON.stringify(webazFormatted.map(p => ({
+                            id: p.id,
+                            title: p.title,
+                            price: p.price,
+                            agent_summary: p.agent_summary,
+                            seller: p.seller_name,
+                            rep: p.rep_level,
+                        })), null, 2) : '暂无匹配商品'}
+
+仅返回JSON（不要其他文字）：
+{
+  "recommendation": "buy_webaz" | "buy_source" | "no_match",
+  "best_product_id": "WebAZ商品ID（recommendation=buy_webaz时填写，否则null）",
+  "reason": "一句话购买建议，说明为什么选这个方案（包含价格对比、售后优势等）",
+  "savings_note": "省了多少或更优在哪（简短，可null）"
+}` }],
+            });
+            const text = msg.content[0].type === 'text' ? msg.content[0].text : '';
+            const m = text.match(/\{[\s\S]*\}/);
+            if (!m)
+                throw new Error('no json');
+            decision = JSON.parse(m[0]);
+        }
+        catch {
+            decision = { recommendation: 'no_match', reason: '无法完成比价分析，请手动选购' };
+        }
+        let orderId = null;
+        let sessionToken = null;
+        let verifiedPrice = null;
+        if (auto_buy && decision.recommendation === 'buy_webaz' && decision.best_product_id) {
+            const product = db.prepare(`SELECT * FROM products WHERE id = ? AND status = 'active'`)
+                .get(decision.best_product_id);
+            if (product && Number(product.has_variants) === 1) {
+                decision.reason = (decision.reason || '') + ' · 该商品需手动选规格，跳过 auto_buy';
+            }
+            else if (product && product.stock > 0) {
+                const wallet = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(user.id);
+                if (wallet.balance >= product.price) {
+                    const now = new Date();
+                    const expiresAt = new Date(now.getTime() + 10 * 60_000);
+                    sessionToken = generateId('pst');
+                    db.prepare(`INSERT INTO price_sessions (token, product_id, user_id, price, quantity, created_at, expires_at) VALUES (?,?,?,?,1,?,?)`)
+                        .run(sessionToken, product.id, user.id, product.price, now.toISOString(), expiresAt.toISOString());
+                    verifiedPrice = product.price;
+                    const oId = generateId('ord');
+                    const totalAmount = product.price;
+                    const seller = db.prepare('SELECT id FROM users WHERE id = ?').get(product.seller_id);
+                    db.prepare(`INSERT INTO orders (
+            id, product_id, buyer_id, seller_id, quantity, unit_price, total_amount, escrow_amount,
+            status, shipping_address, notes, pay_deadline, accept_deadline, ship_deadline,
+            pickup_deadline, delivery_deadline, confirm_deadline
+          ) VALUES (?,?,?,?,1,?,?,?,'created',?,?,?,?,?,?,?,?)`).run(oId, product.id, user.id, seller.id, totalAmount, totalAmount, totalAmount, shipping_address, `[智能下单] ${decision.reason}`, addHours(now, 24), addHours(now, 48), addHours(now, 120), addHours(now, 168), addHours(now, 336), addHours(now, 408));
+                    db.prepare('UPDATE wallets SET balance = balance - ?, escrowed = escrowed + ? WHERE user_id = ?')
+                        .run(totalAmount, totalAmount, user.id);
+                    db.prepare('UPDATE products SET stock = stock - 1 WHERE id = ?').run(product.id);
+                    checkStockAndMaybeDelist(String(product.id));
+                    db.prepare(`UPDATE price_sessions SET used_at = datetime('now') WHERE token = ?`).run(sessionToken);
+                    transition(db, oId, 'paid', user.id, [], '智能下单：模拟支付完成');
+                    notifyTransition(db, oId, 'created', 'paid');
+                    if (shouldAutoAccept(db, oId)) {
+                        const sys = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
+                        if (sys) {
+                            const ar = transition(db, oId, 'accepted', sys.id, [], '⚡ auto_accept Skill 自动接单');
+                            if (ar.success)
+                                notifyTransition(db, oId, 'paid', 'accepted');
+                        }
+                    }
+                    orderId = oId;
+                }
+            }
+        }
+        const bestProduct = decision.best_product_id
+            ? webazFormatted.find(p => p.id === decision.best_product_id) ?? null
+            : null;
+        res.json({
+            source: {
+                title: source.title,
+                price_cny: source.price_cny ?? null,
+                url: source_url,
+            },
+            webaz_products: webazFormatted.slice(0, 3),
+            recommendation: decision.recommendation,
+            best_product: bestProduct,
+            reason: decision.reason,
+            savings_note: decision.savings_note ?? null,
+            auto_bought: !!orderId,
+            order_id: orderId,
+            verified_price: verifiedPrice,
+        });
+    });
+}