@seasonkoh/webaz 0.1.8 → 0.1.10

package/dist/pwa/routes/promoter.js

@@ -0,0 +1,208 @@
+export function registerPromoterRoutes(app, deps) {
+    const { db, auth, isAllowedSponsor } = deps;
+    app.get('/api/promoter/dashboard', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const userId = user.id;
+        const l1 = db.prepare("SELECT COUNT(*) as n FROM users WHERE sponsor_id = ?").get(userId).n;
+        const l2 = db.prepare(`
+      SELECT COUNT(*) as n FROM users
+      WHERE sponsor_id IN (SELECT id FROM users WHERE sponsor_id = ?)
+    `).get(userId).n;
+        const l3 = db.prepare(`
+      SELECT COUNT(*) as n FROM users
+      WHERE sponsor_id IN (
+        SELECT id FROM users WHERE sponsor_id IN (SELECT id FROM users WHERE sponsor_id = ?)
+      )
+    `).get(userId).n;
+        const earned = db.prepare(`
+      SELECT level, COUNT(*) as orders, COALESCE(SUM(amount),0) as total
+      FROM commission_records WHERE beneficiary_id = ?
+      GROUP BY level
+    `).all(userId);
+        const byLevel = { 1: { orders: 0, total: 0 }, 2: { orders: 0, total: 0 }, 3: { orders: 0, total: 0 } };
+        for (const r of earned)
+            byLevel[r.level] = { orders: r.orders, total: r.total };
+        const grand = byLevel[1].total + byLevel[2].total + byLevel[3].total;
+        const recent = db.prepare(`
+      SELECT cr.id, cr.order_id, cr.level, cr.amount, cr.rate, cr.created_at,
+             u.name as source_buyer_name
+      FROM commission_records cr
+      LEFT JOIN users u ON u.id = cr.source_buyer_id
+      WHERE cr.beneficiary_id = ?
+      ORDER BY cr.created_at DESC LIMIT 20
+    `).all(userId);
+        const me = db.prepare("SELECT sponsor_id, sponsor_path, region FROM users WHERE id = ?").get(userId);
+        const mySponsor = me?.sponsor_id ? db.prepare("SELECT name FROM users WHERE id = ?").get(me.sponsor_id) : null;
+        const myUser = db.prepare("SELECT total_left_pv, total_right_pv, left_child_id, right_child_id, placement_id, placement_side FROM users WHERE id = ?").get(userId);
+        const leftChildName = myUser?.left_child_id ? db.prepare("SELECT name FROM users WHERE id = ?").get(myUser.left_child_id)?.name : null;
+        const rightChildName = myUser?.right_child_id ? db.prepare("SELECT name FROM users WHERE id = ?").get(myUser.right_child_id)?.name : null;
+        const myPlacementName = myUser?.placement_id ? db.prepare("SELECT name FROM users WHERE id = ?").get(myUser.placement_id)?.name : null;
+        const scoreAgg = db.prepare(`
+      SELECT
+        COALESCE(SUM(CASE WHEN settled_at IS NULL THEN score ELSE 0 END),0) as pending_score,
+        COALESCE(SUM(CASE WHEN settled_at IS NOT NULL THEN waz_amount ELSE 0 END),0) as settled_waz,
+        COUNT(*) as total_hits
+      FROM binary_score_records WHERE user_id = ?
+    `).get(userId);
+        const recentBinary = db.prepare(`
+      SELECT id, tier, score, settled_at, waz_amount, created_at
+      FROM binary_score_records WHERE user_id = ?
+      ORDER BY created_at DESC LIMIT 10
+    `).all(userId);
+        const tiers = db.prepare("SELECT tier, pv_threshold, score_per_hit FROM binary_tier_config WHERE active=1 ORDER BY tier ASC").all();
+        const canL1Share = isAllowedSponsor(userId);
+        const completedOrders = db.prepare("SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'").get(userId).n;
+        const overrideRow = db.prepare("SELECT l1_share_override FROM users WHERE id = ?").get(userId);
+        const shareableProducts = db.prepare(`
+      SELECT p.id, p.title, p.price, p.category, p.commission_rate,
+        (SELECT COUNT(*) FROM orders o WHERE o.product_id = p.id AND o.status = 'completed') as total_sales,
+        COALESCE((SELECT SUM(cr.amount) FROM commission_records cr
+                  JOIN orders o2 ON o2.id = cr.order_id
+                  WHERE cr.beneficiary_id = ? AND o2.product_id = p.id), 0) as my_earned
+      FROM products p
+      WHERE p.id IN (SELECT DISTINCT product_id FROM orders WHERE buyer_id = ? AND status = 'completed')
+        AND p.commission_rate IS NOT NULL AND p.commission_rate > 0
+        AND p.status = 'active'
+      ORDER BY my_earned DESC, total_sales DESC LIMIT 20
+    `).all(userId, userId);
+        const earnedLast30 = db.prepare(`
+      SELECT COALESCE(SUM(amount),0) as total FROM commission_records
+      WHERE beneficiary_id = ? AND created_at >= datetime('now','-30 days')
+    `).get(userId).total;
+        const earnedPrev30 = db.prepare(`
+      SELECT COALESCE(SUM(amount),0) as total FROM commission_records
+      WHERE beneficiary_id = ? AND created_at >= datetime('now','-60 days')
+        AND created_at < datetime('now','-30 days')
+    `).get(userId).total;
+        const wazLast30 = db.prepare(`
+      SELECT COALESCE(SUM(waz_amount),0) as total FROM binary_score_records
+      WHERE user_id = ? AND settled_at >= datetime('now','-30 days')
+    `).get(userId).total;
+        const projection = {
+            last_30_commission: earnedLast30,
+            prev_30_commission: earnedPrev30,
+            last_30_atomic_waz: wazLast30,
+            growth_rate: earnedPrev30 > 0 ? earnedLast30 / earnedPrev30 - 1 : null,
+            next_30_estimate: earnedLast30 + wazLast30,
+        };
+        const insights = [];
+        const leftPv = Number(myUser?.total_left_pv ?? 0);
+        const rightPv = Number(myUser?.total_right_pv ?? 0);
+        if (leftPv > 0 || rightPv > 0) {
+            const max = Math.max(leftPv, rightPv), min = Math.min(leftPv, rightPv);
+            const ratio = max > 0 ? min / max : 0;
+            const weak = leftPv < rightPv ? '左区' : '右区';
+            if (ratio < 0.5)
+                insights.push({ type: 'weak_leg', level: 'warn', text: `${weak} PV 仅为强腿的 ${(ratio * 100).toFixed(0)}% — 建议主推${weak}，对碰 = min(L,R) × tier_score` });
+            else
+                insights.push({ type: 'balanced', level: 'success', text: `双腿均衡度 ${(ratio * 100).toFixed(0)}% — 对碰节奏健康` });
+        }
+        const lastInvite = db.prepare(`SELECT MAX(created_at) as t FROM users WHERE sponsor_id = ?`).get(userId);
+        if (lastInvite.t) {
+            const days = Math.floor((Date.now() - new Date(lastInvite.t).getTime()) / 86400_000);
+            if (days > 14)
+                insights.push({ type: 'dormancy', level: 'warn', text: `${days} 天没有新直推 — 链接还在裤兜里？` });
+            else if (days < 3)
+                insights.push({ type: 'hot', level: 'success', text: `${days} 天前刚有新直推 — 趁热打铁` });
+        }
+        else if (l1 === 0) {
+            insights.push({ type: 'no_team', level: 'info', text: `还没有直推 — 先分享你买过且好评的商品给好友` });
+        }
+        const pair = Math.min(leftPv, rightPv);
+        const nextTier = tiers.find(t => t.pv_threshold > pair);
+        if (nextTier && pair > 0 && pair / nextTier.pv_threshold > 0.7) {
+            insights.push({ type: 'near_tier', level: 'success', text: `距离 tier ${nextTier.tier} 仅差 ${(nextTier.pv_threshold - pair).toLocaleString()} PV (+${nextTier.score_per_hit} Score / 次)` });
+        }
+        if (!canL1Share && completedOrders === 0) {
+            insights.push({ type: 'unlock', level: 'info', text: `完成首笔购买可解锁分享奖励 — 当前仅可分享 PV 加人扩双轨树` });
+        }
+        if (shareableProducts.length > 0 && grand === 0) {
+            insights.push({ type: 'first_share', level: 'info', text: `你有 ${shareableProducts.length} 个可分享商品但暂无成交 — 试着把链接发给身边的人` });
+        }
+        const treeNode = (uid) => {
+            if (!uid)
+                return null;
+            const u = db.prepare("SELECT id, name, total_left_pv, total_right_pv, left_child_id, right_child_id FROM users WHERE id = ?").get(uid);
+            if (!u)
+                return null;
+            return {
+                id: u.id, name: u.name,
+                lpv: Number(u.total_left_pv ?? 0),
+                rpv: Number(u.total_right_pv ?? 0),
+                left_id: u.left_child_id ?? null,
+                right_id: u.right_child_id ?? null,
+            };
+        };
+        const me_node = treeNode(userId);
+        const left_node = treeNode(myUser?.left_child_id);
+        const right_node = treeNode(myUser?.right_child_id);
+        const binaryTree = {
+            me: me_node,
+            left: left_node,
+            right: right_node,
+            ll: treeNode(left_node?.left_id),
+            lr: treeNode(left_node?.right_id),
+            rl: treeNode(right_node?.left_id),
+            rr: treeNode(right_node?.right_id),
+        };
+        const meCard = db.prepare("SELECT permanent_code, handle FROM users WHERE id = ?").get(userId);
+        const codeForLink = meCard?.permanent_code || userId;
+        res.json({
+            user_id: userId,
+            permanent_code: meCard?.permanent_code || null,
+            handle: meCard?.handle || null,
+            referral_link: `${req.protocol}://${req.get('host')}/i/${codeForLink}`,
+            region: me?.region || 'global',
+            my_sponsor: mySponsor ? { id: me.sponsor_id, name: mySponsor.name } : null,
+            permissions: {
+                can_l1_share: canL1Share,
+                completed_orders: completedOrders,
+                l1_share_override: overrideRow?.l1_share_override ?? 0,
+                reason: canL1Share
+                    ? (overrideRow?.l1_share_override === 1 ? 'admin_grant' : 'verified_buyer')
+                    : 'need_completed_order',
+            },
+            team: { l1, l2, l3, total: l1 + l2 + l3 },
+            earnings: {
+                grand_total: grand,
+                l1: byLevel[1],
+                l2: byLevel[2],
+                l3: byLevel[3],
+            },
+            recent,
+            shareable_products: shareableProducts,
+            projection,
+            insights,
+            atomic: {
+                left_invite_url: `${req.protocol}://${req.get('host')}/i/${codeForLink}-L`,
+                right_invite_url: `${req.protocol}://${req.get('host')}/i/${codeForLink}-R`,
+                total_left_pv: Number(myUser?.total_left_pv ?? 0),
+                total_right_pv: Number(myUser?.total_right_pv ?? 0),
+                left_child: myUser?.left_child_id ? { id: myUser.left_child_id, name: leftChildName } : null,
+                right_child: myUser?.right_child_id ? { id: myUser.right_child_id, name: rightChildName } : null,
+                my_placement: myUser?.placement_id ? { id: myUser.placement_id, name: myPlacementName, side: myUser.placement_side } : null,
+                score: scoreAgg,
+                recent_binary: recentBinary,
+                tier_config: tiers,
+                binary_tree: binaryTree,
+            },
+        });
+    });
+    // 直推 L1 列表
+    app.get('/api/promoter/team', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const userId = user.id;
+        const rows = db.prepare(`
+      SELECT u.id, u.name, u.created_at, u.region,
+        (SELECT COUNT(*) FROM users WHERE sponsor_id = u.id) as their_l1,
+        COALESCE((SELECT SUM(amount) FROM commission_records WHERE beneficiary_id = ? AND source_buyer_id = u.id), 0) as my_earned_from_them
+      FROM users u WHERE u.sponsor_id = ?
+      ORDER BY u.created_at DESC LIMIT 100
+    `).all(userId, userId);
+        res.json({ team: rows });
+    });
+}

package/dist/pwa/routes/public-utils.js

@@ -0,0 +1,227 @@
+export function registerPublicUtilsRoutes(app, deps) {
+    const { db, MASTER_SEED, NODE_ENV, SERVICE_START_MS, rateLimitOk, generateManifest, getUser, logError, issuerAddress } = deps;
+    app.get('/api/health', (_req, res) => {
+        const t0 = Date.now();
+        let dbOk = false;
+        let dbLatency = 0;
+        try {
+            const t1 = Date.now();
+            const r = db.prepare('SELECT 1 as ok').get();
+            dbLatency = Date.now() - t1;
+            dbOk = r?.ok === 1;
+        }
+        catch {
+            dbOk = false;
+        }
+        const uptime = Math.floor((Date.now() - SERVICE_START_MS) / 1000);
+        const healthy = dbOk;
+        res.status(healthy ? 200 : 503).json({
+            status: healthy ? 'ok' : 'degraded',
+            uptime_sec: uptime,
+            db: { ok: dbOk, latency_ms: dbLatency },
+            seed_strength: MASTER_SEED === 'webaz-dev-seed-changeme' ? 'default' : MASTER_SEED.length >= 32 ? 'strong' : 'weak',
+            env: NODE_ENV,
+            check_ms: Date.now() - t0,
+        });
+    });
+    app.post('/api/mcp-telemetry', (req, res) => {
+        const ip = req.ip || 'unknown';
+        if (!rateLimitOk(ip))
+            return void res.status(429).json({ error: 'rate-limited' });
+        const { tool_name, outcome, latency_ms, user_id_hash, server_version } = req.body ?? {};
+        if (typeof tool_name !== 'string' || tool_name.length === 0 || tool_name.length > 64) {
+            return void res.status(400).json({ error: 'bad tool_name' });
+        }
+        if (outcome !== 'success' && outcome !== 'error') {
+            return void res.status(400).json({ error: 'bad outcome' });
+        }
+        const lat = Number(latency_ms);
+        if (!Number.isFinite(lat) || lat < 0 || lat > 60_000) {
+            return void res.status(400).json({ error: 'bad latency' });
+        }
+        const uih = typeof user_id_hash === 'string' && /^[0-9a-f]{1,32}$/.test(user_id_hash) ? user_id_hash : null;
+        const sv = typeof server_version === 'string' && server_version.length <= 32 ? server_version : null;
+        try {
+            db.prepare(`
+        INSERT INTO mcp_tool_calls (tool_name, user_id_hash, server_version, outcome, latency_ms)
+        VALUES (?, ?, ?, ?, ?)
+      `).run(tool_name, uih, sv, outcome, Math.round(lat));
+        }
+        catch { /* swallow — never fail telemetry */ }
+        res.json({ ok: true });
+    });
+    app.get('/api/system-flags', (_req, res) => {
+        const requireRef = db.prepare("SELECT value FROM system_state WHERE key='require_ref_to_register'").get()?.value === '1';
+        const inviteRotation = db.prepare("SELECT value FROM system_state WHERE key='invite_rotation_enabled'").get()?.value === '1';
+        // #1049 Turnstile 公钥(若启用),前端注册表单 widget 用
+        const turnstileSiteKey = process.env.TURNSTILE_SITE_KEY || null;
+        res.json({
+            require_ref_to_register: requireRef,
+            invite_rotation_enabled: inviteRotation,
+            turnstile_site_key: turnstileSiteKey,
+        });
+    });
+    // #1045 + #1048 整合 — 公开诚实化 manifest
+    //   /.well-known/webaz-protocol.json  — 标准 well-known URL,任何 HTTP 客户端可发现
+    //   /api/protocol-status              — JSON API 别名(同份内容)
+    // 内容:network_state(协议处于哪一阶段 + 诚实免责) + issuers(信任锚地址 + 轮换历史)
+    // 信任锚是 Phase 4 凭证(/api/me/agents/:prefix/passport)的验签依据,陌生第三方靠这个端点找到"webaz 官方地址"。
+    function buildProtocolManifest() {
+        const phase = db.prepare("SELECT value FROM system_state WHERE key='protocol_phase'").get()?.value || 'pre_launch';
+        // real_users = 已绑 Passkey 的账号数(我们的"真人"定义);pre-launch 应当 ≈0
+        const realUsers = db.prepare("SELECT COUNT(DISTINCT user_id) AS n FROM webauthn_credentials").get()?.n ?? 0;
+        const issuerActiveSince = db.prepare("SELECT value FROM system_state WHERE key='issuer_active_since'").get()?.value || '2026-05-30';
+        return {
+            name: 'WebAZ Protocol',
+            schema_version: 1,
+            network_state: {
+                phase,
+                real_users_on_canonical: realUsers,
+                canonical_endpoint: 'https://webaz.xyz',
+                economic_flow: 'simulated WAZ (test currency, 1 WAZ ≈ 1 USDC peg is a模拟基准, not a real exchange rate). No fiat/crypto settlement yet.',
+                disclaimer: {
+                    zh: '本协议尚未公开上线,真实用户(已绑 Passkey 的账号)数实时反映在 real_users_on_canonical。无真实经济流转。请勿据此评估市场规模、做投资决策、或替终端用户承诺任何经济关系。',
+                    en: 'Protocol is pre-launch; real_users_on_canonical reflects live count of Passkey-bound accounts. No real economic settlement yet. Do not use this data to evaluate market size, make investment decisions, or commit to third parties on a user\'s behalf.',
+                },
+            },
+            issuers: {
+                // 数组结构 — 将来轮换/泄露时往里追加新条目并把旧的设 revoked_at,验真方按签发时间判落在哪个有效区间
+                agent_passport: [
+                    {
+                        address: issuerAddress(),
+                        did_web: 'did:web:webaz.xyz', // W3C DID method,resolve at /.well-known/did.json
+                        did_legacy: 'did:webaz:' + issuerAddress(), // 原自定义形态,Phase 4 webaz_format 仍用
+                        scheme: 'eip191',
+                        purpose: 'Phase 4 Agent Passport signing (custodian_fingerprint + risk_score + engagement_depth + behavior_profile)',
+                        active_since: issuerActiveSince,
+                        revoked_at: null,
+                        verify: 'verifyMessage(address, passport.canonical, passport.signature) — any party can ecrecover without calling WebAZ',
+                    },
+                ],
+            },
+            // 公开披露文档(#1050) — 协议层"钱怎么流"的源真理(协议外可读)
+            disclosures: {
+                economic_model: 'https://github.com/seasonsagents-art/webaz/blob/main/docs/ECONOMIC-MODEL.md',
+                mlm_compliance: 'https://github.com/seasonsagents-art/webaz/blob/main/docs/MLM-COMPLIANCE.md',
+                agent_governance: 'https://github.com/seasonsagents-art/webaz/blob/main/docs/AGENT-GOVERNANCE.md',
+                protocol_compatibility: 'https://github.com/seasonsagents-art/webaz/blob/main/docs/PROTOCOL-COMPATIBILITY-AUDIT-2026-05-30.md',
+                changelog: 'https://github.com/seasonsagents-art/webaz/blob/main/CHANGELOG.md',
+            },
+            // 路线图 — 回应"知道还有哪些没做"的诚实化第三层。哲学:公开当前到达点 + 已知未做项,不承诺时间表。
+            roadmap: {
+                philosophy: 'Disclose what is done + what is known-not-yet-done. We do not commit to deadlines (pre-launch). We DO commit to honest enumeration.',
+                completed: [
+                    'Phase 1-4 Agent Passport: custodian + risk + behavior + signed portable export (cross-protocol ecrecover verifiable)',
+                    'Phase 3a-3d access control: registration rate-limit + invite-required + declared-scope reads/writes + non-Passkey writers must declare',
+                    'Iron-Rule: arbitrate / vote / agent_revoke / delete_passkey / large withdraw all require live WebAuthn ceremony',
+                    'Integrity disclosure: MCP descriptions + /.well-known + pre-launch banner + protocol-status endpoint',
+                    'Cross-user read daily cap — distinct other-user-id per day, Passkey humans capped too (#1043, 2026-05-30)',
+                    'AP2 Mandate dual-output — verify_price + place_order emit signed AP2 Intent/Cart/Payment Mandate alongside webaz format (B.4 b, 2026-05-30)',
+                    'Public economic model document — docs/ECONOMIC-MODEL.md (#1050, 2026-05-30)',
+                ],
+                known_next: [
+                    'Registration captcha or email verification (anti-sybil last mile) — task #1049, pre-launch follow-up',
+                    'Phase 5 ZK privacy L2/L3 — long-term research; triggered when real cross-protocol consumers appear',
+                ],
+                deliberate_deferrals: [
+                    'Model B (independent sub-agent keys with delegated scope) — destination locked; not building until real multi-agent demand surfaces',
+                    'Parameterized fee rates (settleOrder currently hardcodes) — wire when fee governance launches',
+                    'Binary/PV referral region MLM-term cleanup — region-gated to max=3 areas; deferred until structural decision on tree',
+                ],
+                rationale_for_no_dates: 'pre-launch protocols that commit to dates either lie or rush. We commit only to a published list and to honesty about its state.',
+            },
+        };
+    }
+    app.get('/.well-known/webaz-protocol.json', (_req, res) => {
+        res.setHeader('Cache-Control', 'public, max-age=300'); // 5min 边缘缓存,降轮询
+        res.json(buildProtocolManifest());
+    });
+    app.get('/api/protocol-status', (_req, res) => {
+        res.setHeader('Cache-Control', 'public, max-age=300');
+        res.json(buildProtocolManifest());
+    });
+    // W3C DID Document(B.6 b DID 短期 mapping,2026-05-30):
+    //   did:web:webaz.xyz 通过 HTTPS 解析到这里(W3C did:web spec §3.2)
+    //   verificationMethod 用 EcdsaSecp256k1RecoveryMethod2020 + CAIP-10 blockchainAccountId
+    //   任何标准 DID resolver(Veramo / SpruceID / KILT / web5 ...)可 GET → 解出 issuer key → 验 Phase 4 凭证签名
+    app.get('/.well-known/did.json', (_req, res) => {
+        const addr = issuerAddress();
+        res.setHeader('Cache-Control', 'public, max-age=300');
+        res.json({
+            '@context': [
+                'https://www.w3.org/ns/did/v1',
+                'https://w3id.org/security/suites/secp256k1recovery-2020/v2',
+            ],
+            id: 'did:web:webaz.xyz',
+            verificationMethod: [
+                {
+                    id: 'did:web:webaz.xyz#key-1',
+                    type: 'EcdsaSecp256k1RecoveryMethod2020',
+                    controller: 'did:web:webaz.xyz',
+                    // CAIP-10:eip155 namespace + Base mainnet chain id (8453) + 同把 hot wallet 地址(Phase 4 同款)
+                    // 注:WAZ peg USDC,真链 Base/Base Sepolia,但 issuer key 是协议级,链中立,这里只标声明绑定到 Base 用于消费者发现
+                    blockchainAccountId: `eip155:8453:${addr}`,
+                },
+            ],
+            assertionMethod: ['did:web:webaz.xyz#key-1'],
+            authentication: ['did:web:webaz.xyz#key-1'],
+            // 自描述 — 让 resolver 知道这个 DID 用来签 webaz agent passport
+            service: [
+                {
+                    id: 'did:web:webaz.xyz#agent-passport-endpoint',
+                    type: 'WebAZAgentPassportEndpoint',
+                    serviceEndpoint: 'https://webaz.xyz/api/me/agents/:apiKeyPrefix/passport',
+                },
+                {
+                    id: 'did:web:webaz.xyz#protocol-manifest',
+                    type: 'WebAZProtocolManifest',
+                    serviceEndpoint: 'https://webaz.xyz/.well-known/webaz-protocol.json',
+                },
+            ],
+        });
+    });
+    app.get('/api/editor-picks', (_req, res) => {
+        const products = db.prepare(`
+      SELECT ep.id, ep.target_id, ep.title, ep.note, ep.starts_at, ep.ends_at, ep.sort_order,
+        p.title as product_title, p.price, p.images, p.category,
+        u.handle as seller_handle
+      FROM editor_picks ep
+      JOIN products p ON p.id = ep.target_id AND p.status = 'active'
+      JOIN users u ON u.id = p.seller_id
+      WHERE ep.kind = 'product' AND ep.starts_at <= datetime('now') AND ep.ends_at > datetime('now')
+      ORDER BY ep.sort_order ASC, ep.created_at DESC LIMIT 20
+    `).all();
+        const sellers = db.prepare(`
+      SELECT ep.id, ep.target_id, ep.title, ep.note, ep.starts_at, ep.ends_at, ep.sort_order,
+        u.handle, u.name, u.shop_banner_url, u.bio
+      FROM editor_picks ep
+      JOIN users u ON u.id = ep.target_id AND u.role = 'seller'
+      WHERE ep.kind = 'seller' AND ep.starts_at <= datetime('now') AND ep.ends_at > datetime('now')
+      ORDER BY ep.sort_order ASC, ep.created_at DESC LIMIT 20
+    `).all();
+        res.json({ products, sellers });
+    });
+    app.get('/api/manifest', (_req, res) => {
+        res.json(generateManifest(db));
+    });
+    const _errorReportLimiter = new Map();
+    app.post('/api/error-report', (req, res) => {
+        const ip = req.ip || 'unknown';
+        const now = Date.now();
+        const bucket = _errorReportLimiter.get(ip) || { count: 0, reset: now + 60_000 };
+        if (now > bucket.reset) {
+            bucket.count = 0;
+            bucket.reset = now + 60_000;
+        }
+        bucket.count++;
+        _errorReportLimiter.set(ip, bucket);
+        if (bucket.count > 30)
+            return void res.status(429).json({ error: 'rate_limited' });
+        const { message, stack, url } = req.body || {};
+        if (!message || typeof message !== 'string')
+            return void res.status(400).json({ error: 'message required' });
+        const user = getUser(req);
+        logError('client', message.slice(0, 1000), { stack: String(stack || '').slice(0, 4000), url: String(url || '').slice(0, 500), user_agent: req.headers['user-agent'] || '', user_id: user?.id });
+        res.json({ ok: true });
+    });
+}

package/dist/pwa/routes/push.js

@@ -0,0 +1,54 @@
+/** web-push 失败回调：删除已失效订阅。导出以备 P1-5 任务调用。 */
+export function cleanupStaleSubscription(db, endpoint) {
+    if (!endpoint)
+        return;
+    db.prepare('DELETE FROM push_subscriptions WHERE endpoint = ?').run(endpoint);
+}
+export function registerPushRoutes(app, deps) {
+    const { db, generateId, auth, vapidPublicKey } = deps;
+    app.get('/api/push/vapid-public-key', (_req, res) => {
+        if (!vapidPublicKey)
+            return void res.status(503).json({ error: '推送未配置，请联系管理员设置 VAPID_PUBLIC_KEY' });
+        res.json({ key: vapidPublicKey });
+    });
+    app.post('/api/push/subscribe', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const { endpoint, keys, user_agent } = req.body || {};
+        if (!endpoint || !keys?.p256dh || !keys?.auth) {
+            return void res.status(400).json({ error: '订阅参数不完整（需 endpoint + keys.p256dh + keys.auth）' });
+        }
+        const id = generateId('psub');
+        // 同 user + endpoint 视作重新订阅
+        const existing = db.prepare('SELECT id FROM push_subscriptions WHERE user_id = ? AND endpoint = ?').get(user.id, String(endpoint));
+        if (existing) {
+            db.prepare('UPDATE push_subscriptions SET p256dh = ?, auth = ?, user_agent = ?, enabled = 1 WHERE id = ?')
+                .run(String(keys.p256dh), String(keys.auth), user_agent ? String(user_agent).slice(0, 200) : null, existing.id);
+            return void res.json({ success: true, id: existing.id });
+        }
+        db.prepare(`INSERT INTO push_subscriptions (id, user_id, endpoint, p256dh, auth, user_agent) VALUES (?,?,?,?,?,?)`)
+            .run(id, user.id, String(endpoint), String(keys.p256dh), String(keys.auth), user_agent ? String(user_agent).slice(0, 200) : null);
+        res.json({ success: true, id });
+    });
+    app.delete('/api/push/subscribe', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const { endpoint } = req.body || {};
+        if (endpoint) {
+            db.prepare('DELETE FROM push_subscriptions WHERE user_id = ? AND endpoint = ?').run(user.id, String(endpoint));
+        }
+        else {
+            db.prepare('DELETE FROM push_subscriptions WHERE user_id = ?').run(user.id);
+        }
+        res.json({ success: true });
+    });
+    app.get('/api/push/status', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const cnt = db.prepare('SELECT COUNT(*) as n FROM push_subscriptions WHERE user_id = ? AND enabled = 1').get(user.id).n;
+        res.json({ subscribed: cnt > 0, count: cnt, vapid_configured: !!vapidPublicKey });
+    });
+}