@seasonkoh/webaz 0.1.8 → 0.1.9

package/dist/pwa/routes/dispute-cases.js

@@ -0,0 +1,267 @@
+export function registerDisputeCasesRoutes(app, deps) {
+    const { db, auth, getUser, generateId, piiSanitize, detectFraud, commentBlocklistHit, llmModerateComment } = deps;
+    // 公共发言门槛 — 防新号/小号刷评论/投票
+    // 至少满足其一：账户 >= 3 天 / 完成过 >= 1 单 / lifetime_score >= 5
+    function meetsPublicSpeechThreshold(user) {
+        const lifetime = Number(user.lifetime_score || 0);
+        if (lifetime >= 5)
+            return { ok: true };
+        const completed = db.prepare(`SELECT COUNT(*) as n FROM orders WHERE (buyer_id = ? OR seller_id = ?) AND status = 'completed'`).get(user.id, user.id).n;
+        if (completed >= 1)
+            return { ok: true };
+        const created = user.created_at ? new Date(String(user.created_at).replace(' ', 'T') + 'Z').getTime() : 0;
+        if (created > 0 && (Date.now() - created) > 3 * 86400_000)
+            return { ok: true };
+        return { ok: false, reason: '账号需 ≥ 3 天 或 完成 ≥ 1 单 或 lifetime_score ≥ 5 才能公开发言（防小号刷量）' };
+    }
+    // 公开列表（全网）— 判例库总览
+    app.get('/api/disputes/cases', (req, res) => {
+        const limit = Math.min(50, Math.max(5, Number(req.query.limit) || 20));
+        const category = req.query.category ? String(req.query.category) : null;
+        const winner = req.query.winner ? String(req.query.winner) : null;
+        // 2026-05-22 A1：全文搜索 — ruling_text + buyer_argument + seller_argument + product_title
+        const q = req.query.q ? String(req.query.q).trim().slice(0, 80) : null;
+        // 排序选项 — newest（默认） / discussed（评论多）/ fair（公平评价高）
+        const sort = String(req.query.sort || 'newest');
+        const where = [];
+        const args = [];
+        if (category) {
+            where.push('category_tag = ?');
+            args.push(category);
+        }
+        if (winner) {
+            where.push('winner = ?');
+            args.push(winner);
+        }
+        if (q) {
+            where.push(`(
+        ruling_text LIKE ? OR buyer_argument LIKE ? OR seller_argument LIKE ? OR resolution LIKE ?
+        OR EXISTS (SELECT 1 FROM products p WHERE p.id = dispute_cases.product_id AND p.title LIKE ?)
+      )`);
+            const pat = '%' + q.replace(/[%_]/g, '\\$&') + '%';
+            args.push(pat, pat, pat, pat, pat);
+        }
+        const whereSql = where.length ? `WHERE ${where.join(' AND ')}` : '';
+        let orderSql = 'published_at DESC';
+        if (sort === 'discussed')
+            orderSql = 'comment_count DESC, fairness_yes DESC, published_at DESC';
+        else if (sort === 'fair')
+            orderSql = 'fairness_yes DESC, comment_count DESC, published_at DESC';
+        const rows = db.prepare(`
+      SELECT id, product_id, category_tag, winner, resolution, amount_bucket,
+        fairness_yes, fairness_no, comment_count, published_at,
+        (SELECT title FROM products WHERE id = dispute_cases.product_id) as product_title,
+        (SELECT category FROM products WHERE id = dispute_cases.product_id) as product_category
+      FROM dispute_cases
+      ${whereSql}
+      ORDER BY ${orderSql}
+      LIMIT ?
+    `).all(...args, limit);
+        // 类目统计（侧栏过滤用）— 受 q 影响（搜索时只显匹配 q 的类目计数）
+        const catCountWhere = q ? `WHERE (ruling_text LIKE ? OR buyer_argument LIKE ? OR seller_argument LIKE ? OR resolution LIKE ?
+      OR EXISTS (SELECT 1 FROM products p WHERE p.id = dispute_cases.product_id AND p.title LIKE ?))` : '';
+        const catCountArgs = q ? Array(5).fill('%' + q.replace(/[%_]/g, '\\$&') + '%') : [];
+        const categoryCounts = db.prepare(`SELECT category_tag, COUNT(*) as n FROM dispute_cases ${catCountWhere} GROUP BY category_tag ORDER BY n DESC`).all(...catCountArgs);
+        res.json({ items: rows, category_counts: categoryCounts, total: rows.length, query: q, sort });
+    });
+    // 公开列表（按商品）
+    app.get('/api/disputes/cases/by-product/:product_id', (req, res) => {
+        const rows = db.prepare(`
+      SELECT id, category_tag, winner, resolution, amount_bucket, ruling_text,
+        fairness_yes, fairness_no, comment_count, published_at
+      FROM dispute_cases
+      WHERE product_id = ?
+      ORDER BY published_at DESC
+      LIMIT 50
+    `).all(req.params.product_id);
+        res.json({ items: rows });
+    });
+    // 案件详情（含评论 + 评论者身份标签）
+    app.get('/api/disputes/cases/:case_id', (req, res) => {
+        const me = getUser(req);
+        const c = db.prepare(`SELECT * FROM dispute_cases WHERE id = ?`).get(req.params.case_id);
+        if (!c)
+            return void res.status(404).json({ error: '判例不存在' });
+        // 不外露内部 ID（buyer_id/dispute_id/order_id 不返回给前端）
+        const safeCase = {
+            id: c.id, category_tag: c.category_tag, winner: c.winner, resolution: c.resolution,
+            amount_bucket: c.amount_bucket, buyer_argument: c.buyer_argument, seller_argument: c.seller_argument,
+            ruling_text: c.ruling_text, fairness_yes: c.fairness_yes, fairness_no: c.fairness_no,
+            comment_count: c.comment_count, published_at: c.published_at,
+            product_id: c.product_id, seller_id: c.seller_id,
+        };
+        // 评论 + 自动身份标签
+        const rawComments = db.prepare(`
+      SELECT dc.*, u.handle, u.name, u.role, u.lifetime_score,
+        (SELECT COUNT(*) FROM orders o
+         WHERE o.buyer_id = dc.commenter_id AND o.product_id = ? AND o.status = 'completed') as bought_count,
+        (SELECT COUNT(*) FROM products p
+         WHERE p.seller_id = dc.commenter_id AND p.category = (SELECT category FROM products WHERE id = ?) AND p.status = 'active') as same_cat_seller_count
+      FROM dispute_comments dc
+      JOIN users u ON u.id = dc.commenter_id
+      WHERE dc.case_id = ? AND dc.flagged = 0
+      ORDER BY
+        (bought_count > 0) DESC,
+        (u.role IN ('verifier','arbitrator')) DESC,
+        dc.created_at DESC
+      LIMIT 50
+    `).all(c.product_id, c.product_id, c.id);
+        // 脱敏：anonymous=1 时清除 handle/name/commenter_id（保留贡献标签字段：bought/same_cat/role/lifetime）
+        // 验证员/仲裁员角色在脱敏时降级为 'staff'（避免小池子反推身份）
+        const anonymize = (row) => {
+            if (!row.anonymous)
+                return row;
+            return { ...row, commenter_id: '__anon__', handle: null, name: null,
+                role: (row.role === 'verifier' || row.role === 'arbitrator') ? 'staff' : 'user' };
+        };
+        // W5: 取所有子回复，按 parent_comment_id 分组挂在 comments 下
+        const commentIds = rawComments.map(r => r.id);
+        const rawReplies = commentIds.length > 0 ? db.prepare(`
+      SELECT r.*, u.handle, u.name, u.role, u.lifetime_score
+      FROM dispute_comment_replies r LEFT JOIN users u ON u.id = r.replier_id
+      WHERE r.parent_comment_id IN (${commentIds.map(() => '?').join(',')})
+      ORDER BY r.created_at ASC
+    `).all(...commentIds) : [];
+        const repliesByParent = new Map();
+        for (const r of rawReplies) {
+            const pid = String(r.parent_comment_id);
+            const arr = repliesByParent.get(pid) || [];
+            arr.push(anonymize(r));
+            repliesByParent.set(pid, arr);
+        }
+        const comments = rawComments.map(c => ({
+            ...anonymize(c),
+            replies: repliesByParent.get(c.id) || [],
+        }));
+        // 我的公正度投票（如已投）
+        let myVote = null;
+        if (me) {
+            const v = db.prepare('SELECT vote FROM dispute_fairness_votes WHERE case_id = ? AND voter_id = ?').get(c.id, me.id);
+            myVote = v?.vote || null;
+        }
+        // 我是否当事人（决定能否评论 / 投票）
+        const isParty = !!me && (me.id === c.buyer_id || me.id === c.seller_id || me.id === c.arbitrator_id);
+        res.json({ case: safeCase, comments, my_vote: myVote, is_party: isParty });
+    });
+    // 写评论 — 当事人禁评，一人一案一次
+    app.post('/api/disputes/cases/:case_id/comment', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const gate = meetsPublicSpeechThreshold(user);
+        if (!gate.ok)
+            return void res.status(403).json({ error: gate.reason, error_code: 'SPEECH_THRESHOLD' });
+        const c = db.prepare(`SELECT id, buyer_id, seller_id, arbitrator_id FROM dispute_cases WHERE id = ?`).get(req.params.case_id);
+        if (!c)
+            return void res.status(404).json({ error: '判例不存在' });
+        if (user.id === c.buyer_id || user.id === c.seller_id || user.id === c.arbitrator_id) {
+            return void res.status(403).json({ error: '当事人禁止评论', error_code: 'PARTY_NO_COMMENT' });
+        }
+        const rawBody = String(req.body?.body || '').trim();
+        if (rawBody.length < 5)
+            return void res.status(400).json({ error: '评论至少 5 字' });
+        if (rawBody.length > 500)
+            return void res.status(400).json({ error: '评论最多 500 字' });
+        // P2 评论审核：blocklist → PII 脱敏 → LLM 兜底
+        const blocked = commentBlocklistHit(rawBody);
+        if (blocked)
+            return void res.status(400).json({ error: blocked, error_code: 'COMMENT_BLOCKED' });
+        const body = piiSanitize(rawBody);
+        const llm = await llmModerateComment(body);
+        if (!llm.ok)
+            return void res.status(400).json({ error: llm.reason || '内容不符合社区规范', error_code: 'COMMENT_MODERATED' });
+        const anonymous = req.body?.anonymous ? 1 : 0;
+        // 注：仲裁评论的 flagged 列保留给管理员"隐藏"语义；fraud detect 仅写 flag_reasons
+        // 前端按 flag_reasons.length > 0 显示反诈 banner，按 flagged=1 隐藏
+        // detectFraud 用 rawBody — piiSanitize 已脱敏的 body 会让电话/银行卡 regex miss
+        const reasons = detectFraud(rawBody);
+        try {
+            db.transaction(() => {
+                db.prepare(`INSERT INTO dispute_comments (id, case_id, commenter_id, body, anonymous, flag_reasons) VALUES (?,?,?,?,?,?)`)
+                    .run(generateId('dcom'), c.id, user.id, body, anonymous, reasons.length ? JSON.stringify(reasons) : null);
+                db.prepare(`UPDATE dispute_cases SET comment_count = comment_count + 1 WHERE id = ?`).run(c.id);
+            })();
+        }
+        catch (e) {
+            if (e.message?.includes('UNIQUE'))
+                return void res.status(400).json({ error: '你已评论过此判例（一案一次）' });
+            throw e;
+        }
+        res.json({ success: true, flag_reasons: reasons });
+    });
+    // W5 子回复 — 任意人可对顶层评论回复多次（不受"一人一案一次"限制）
+    app.post('/api/disputes/cases/:case_id/comments/:comment_id/reply', async (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const gate = meetsPublicSpeechThreshold(user);
+        if (!gate.ok)
+            return void res.status(403).json({ error: gate.reason, error_code: 'SPEECH_THRESHOLD' });
+        const c = db.prepare(`SELECT id, buyer_id, seller_id, arbitrator_id FROM dispute_cases WHERE id = ?`).get(req.params.case_id);
+        if (!c)
+            return void res.status(404).json({ error: '判例不存在' });
+        if (user.id === c.buyer_id || user.id === c.seller_id || user.id === c.arbitrator_id) {
+            return void res.status(403).json({ error: '当事人禁止评论', error_code: 'PARTY_NO_COMMENT' });
+        }
+        const parent = db.prepare(`SELECT id FROM dispute_comments WHERE id = ? AND case_id = ?`).get(req.params.comment_id, c.id);
+        if (!parent)
+            return void res.status(404).json({ error: '父评论不存在' });
+        const rawBody = String(req.body?.body || '').trim();
+        if (rawBody.length < 2)
+            return void res.status(400).json({ error: '回复至少 2 字' });
+        if (rawBody.length > 300)
+            return void res.status(400).json({ error: '回复最多 300 字' });
+        const blocked = commentBlocklistHit(rawBody);
+        if (blocked)
+            return void res.status(400).json({ error: blocked, error_code: 'COMMENT_BLOCKED' });
+        const body = piiSanitize(rawBody);
+        const llm = await llmModerateComment(body);
+        if (!llm.ok)
+            return void res.status(400).json({ error: llm.reason || '内容不符合社区规范', error_code: 'COMMENT_MODERATED' });
+        const anonymous = req.body?.anonymous ? 1 : 0;
+        // 同上：flagged 给管理员，flag_reasons 给反诈；用 rawBody
+        const repReasons = detectFraud(rawBody);
+        const rid = generateId('drep');
+        db.transaction(() => {
+            db.prepare(`INSERT INTO dispute_comment_replies (id, parent_comment_id, case_id, replier_id, body, anonymous, flag_reasons) VALUES (?,?,?,?,?,?,?)`)
+                .run(rid, parent.id, c.id, user.id, body, anonymous, repReasons.length ? JSON.stringify(repReasons) : null);
+            db.prepare(`UPDATE dispute_cases SET comment_count = comment_count + 1 WHERE id = ?`).run(c.id);
+        })();
+        res.json({ success: true, id: rid, flag_reasons: repReasons });
+    });
+    // 公正度投票（👍 / 👎）— 一人一案一票
+    app.post('/api/disputes/cases/:case_id/fairness', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const gate = meetsPublicSpeechThreshold(user);
+        if (!gate.ok)
+            return void res.status(403).json({ error: gate.reason, error_code: 'SPEECH_THRESHOLD' });
+        const vote = req.body?.vote;
+        if (vote !== 'yes' && vote !== 'no')
+            return void res.status(400).json({ error: 'vote 必须是 yes 或 no' });
+        const c = db.prepare(`SELECT id, buyer_id, seller_id, arbitrator_id FROM dispute_cases WHERE id = ?`).get(req.params.case_id);
+        if (!c)
+            return void res.status(404).json({ error: '判例不存在' });
+        if (user.id === c.buyer_id || user.id === c.seller_id || user.id === c.arbitrator_id) {
+            return void res.status(403).json({ error: '当事人禁止投票' });
+        }
+        db.transaction(() => {
+            // 若已投过，先回滚旧票计数再插新票
+            const old = db.prepare('SELECT vote FROM dispute_fairness_votes WHERE case_id = ? AND voter_id = ?').get(c.id, user.id);
+            if (old) {
+                if (old.vote === vote)
+                    return; // 重复投同一票 no-op
+                const dec = old.vote === 'yes' ? 'fairness_yes' : 'fairness_no';
+                db.prepare(`UPDATE dispute_cases SET ${dec} = MAX(0, ${dec} - 1) WHERE id = ?`).run(c.id);
+                db.prepare("UPDATE dispute_fairness_votes SET vote = ?, created_at = datetime('now') WHERE case_id = ? AND voter_id = ?").run(vote, c.id, user.id);
+            }
+            else {
+                db.prepare('INSERT INTO dispute_fairness_votes (case_id, voter_id, vote) VALUES (?,?,?)').run(c.id, user.id, vote);
+            }
+            const inc = vote === 'yes' ? 'fairness_yes' : 'fairness_no';
+            db.prepare(`UPDATE dispute_cases SET ${inc} = ${inc} + 1 WHERE id = ?`).run(c.id);
+        })();
+        res.json({ success: true, vote });
+    });
+}

package/dist/pwa/routes/disputes-read.js

@@ -0,0 +1,358 @@
+export function registerDisputesReadRoutes(app, deps) {
+    const { db, auth, errorRes, getOpenDisputes, getDisputeDetails, getEvidenceRequests, listEvidenceFiles, isEligibleArbitrator } = deps;
+    // 仲裁员：查看所有开放争议
+    app.get('/api/disputes', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const elig = isEligibleArbitrator(user.id);
+        if (!elig.ok)
+            return void errorRes(res, 403, 'NOT_ARBITRATOR', elig.reason || '仅限仲裁员访问');
+        res.json(getOpenDisputes(db));
+    });
+    // A2 同类判例推荐
+    app.get('/api/disputes/:id/similar-cases', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const dispute = db.prepare('SELECT id, order_id, reason, initiator_id, defendant_id FROM disputes WHERE id = ?').get(req.params.id);
+        if (!dispute)
+            return void res.status(404).json({ error: '争议不存在' });
+        const role = user.role;
+        if (dispute.initiator_id !== user.id && dispute.defendant_id !== user.id && role !== 'arbitrator') {
+            return void res.status(403).json({ error: '无权查看' });
+        }
+        const order = db.prepare('SELECT product_id FROM orders WHERE id = ?').get(dispute.order_id);
+        const productCategory = order ? db.prepare('SELECT category FROM products WHERE id = ?').get(order.product_id)?.category : null;
+        const reasonWords = (dispute.reason || '').split(/[\s,，。；\n]+/).filter(w => w.length >= 2).slice(0, 3);
+        const results = [];
+        const seen = new Set();
+        const pushIfNew = (r) => {
+            if (!seen.has(String(r.id))) {
+                seen.add(String(r.id));
+                results.push(r);
+            }
+        };
+        // ① 同 product 类目
+        if (productCategory) {
+            const r1 = db.prepare(`
+        SELECT dc.id, dc.product_id, dc.category_tag, dc.winner, dc.resolution,
+          dc.amount_bucket, dc.fairness_yes, dc.comment_count, dc.published_at,
+          (SELECT title FROM products WHERE id = dc.product_id) as product_title,
+          'same_category' as match_reason
+        FROM dispute_cases dc
+        JOIN products p ON p.id = dc.product_id
+        WHERE p.category = ? AND (dc.dispute_id IS NULL OR dc.dispute_id != ?)
+        ORDER BY dc.published_at DESC LIMIT 3
+      `).all(productCategory, dispute.id);
+            r1.forEach(pushIfNew);
+        }
+        // ② reason 关键词命中 ruling_text / 双方陈述
+        if (results.length < 3 && reasonWords.length > 0) {
+            for (const w of reasonWords) {
+                if (results.length >= 3)
+                    break;
+                const pat = '%' + w.replace(/[%_]/g, '\\$&') + '%';
+                const r2 = db.prepare(`
+          SELECT dc.id, dc.product_id, dc.category_tag, dc.winner, dc.resolution,
+            dc.amount_bucket, dc.fairness_yes, dc.comment_count, dc.published_at,
+            (SELECT title FROM products WHERE id = dc.product_id) as product_title,
+            'keyword_match' as match_reason
+          FROM dispute_cases dc
+          WHERE (dc.dispute_id IS NULL OR dc.dispute_id != ?)
+            AND (dc.ruling_text LIKE ? OR dc.buyer_argument LIKE ? OR dc.seller_argument LIKE ?)
+          ORDER BY dc.published_at DESC LIMIT 3
+        `).all(dispute.id, pat, pat, pat);
+                r2.forEach(pushIfNew);
+            }
+        }
+        // ③ 兜底：最近 3 条已发布判例
+        if (results.length < 3) {
+            const r3 = db.prepare(`
+        SELECT dc.id, dc.product_id, dc.category_tag, dc.winner, dc.resolution,
+          dc.amount_bucket, dc.fairness_yes, dc.comment_count, dc.published_at,
+          (SELECT title FROM products WHERE id = dc.product_id) as product_title,
+          'recent' as match_reason
+        FROM dispute_cases dc
+        WHERE (dc.dispute_id IS NULL OR dc.dispute_id != ?)
+        ORDER BY dc.published_at DESC LIMIT 3
+      `).all(dispute.id);
+            r3.forEach(pushIfNew);
+        }
+        res.json({ items: results.slice(0, 3), product_category: productCategory, reason_keywords: reasonWords });
+    });
+    // 详情聚合（含 W4 timeline + chain ruling）
+    app.get('/api/disputes/:id', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const dispute = getDisputeDetails(db, req.params.id);
+        if (!dispute)
+            return void res.status(404).json({ error: '争议不存在' });
+        const role = user.role;
+        // 允许：发起方、被告方、物流方、仲裁员
+        const orderForAuth = db.prepare('SELECT logistics_id FROM orders WHERE id = ?')
+            .get(dispute.order_id);
+        const isLogisticsParty = orderForAuth?.logistics_id === user.id;
+        if (dispute.initiator_id !== user.id && dispute.defendant_id !== user.id
+            && !isLogisticsParty && role !== 'arbitrator') {
+            return void res.status(403).json({ error: '无权查看此争议' });
+        }
+        // 原告证据 — 从状态机历史中取 disputed 转移时附带的
+        const hist = db.prepare(`SELECT evidence_ids FROM order_state_history WHERE order_id = ? AND to_status = 'disputed'`).get(dispute.order_id);
+        // P1 fix: 单条脏 JSON 不应封死整个 dispute 详情
+        const safeJsonArr = (s) => {
+            try {
+                const p = JSON.parse(s || '[]');
+                return Array.isArray(p) ? p : [];
+            }
+            catch {
+                return [];
+            }
+        };
+        const plaintiffEvidenceIds = hist ? safeJsonArr(hist.evidence_ids) : [];
+        const defEvidenceIds = safeJsonArr(dispute.defendant_evidence_ids);
+        const fetchEvidence = (ids) => ids.length
+            ? db.prepare(`SELECT * FROM evidence WHERE id IN (${ids.map(() => '?').join(',')})`).all(...ids)
+            : [];
+        const evidenceRequests = getEvidenceRequests(db, req.params.id);
+        const myPendingRequests = evidenceRequests.filter((r) => r.requested_from_id === user.id && r.status === 'pending');
+        const order = db.prepare('SELECT buyer_id, seller_id, logistics_id FROM orders WHERE id = ?')
+            .get(dispute.order_id);
+        const partyIds = [dispute.initiator_id, dispute.defendant_id, order?.logistics_id].filter(Boolean);
+        const parties = [...new Set(partyIds)].map(id => db.prepare('SELECT id, name, role FROM users WHERE id = ?').get(id)).filter(Boolean);
+        const partyEvidenceIds = safeJsonArr(dispute.party_evidence_ids);
+        const orderParties = db.prepare('SELECT buyer_id, seller_id, logistics_id FROM orders WHERE id = ?')
+            .get(dispute.order_id);
+        const allPartyIds = [
+            orderParties?.buyer_id, orderParties?.seller_id, orderParties?.logistics_id,
+            dispute.initiator_id, dispute.defendant_id
+        ].filter(Boolean);
+        const isParty = allPartyIds.includes(user.id);
+        const plaintiffEvidence = fetchEvidence(plaintiffEvidenceIds);
+        const defendantEvidence = fetchEvidence(defEvidenceIds);
+        const partyEvidence = fetchEvidence(partyEvidenceIds);
+        // W4 timeline 归一化
+        const partyMap = new Map();
+        partyMap.set(dispute.initiator_id, 'plaintiff');
+        if (dispute.defendant_id)
+            partyMap.set(dispute.defendant_id, 'defendant');
+        const orderRole = (uid) => {
+            if (!uid || !order)
+                return 'unknown';
+            if (uid === order.buyer_id)
+                return 'buyer';
+            if (uid === order.seller_id)
+                return 'seller';
+            if (uid === order.logistics_id)
+                return 'logistics';
+            return 'unknown';
+        };
+        const userById = new Map();
+        const loadUser = (uid) => {
+            if (!uid || userById.has(uid))
+                return;
+            const u = db.prepare('SELECT id, name, handle, role FROM users WHERE id = ?').get(uid);
+            if (u)
+                userById.set(uid, u);
+        };
+        loadUser(dispute.initiator_id);
+        loadUser(dispute.defendant_id);
+        const events = [];
+        // 1) open
+        events.push({
+            id: `open-${dispute.id}`,
+            type: 'open',
+            ts: String(dispute.created_at || ''),
+            actor_id: dispute.initiator_id,
+            actor_role: 'plaintiff',
+            body: String(dispute.reason || ''),
+            meta: {
+                stake_deposit: dispute.stake_deposit,
+                respond_deadline: dispute.respond_deadline,
+                arbitrate_deadline: dispute.arbitrate_deadline,
+            },
+        });
+        // 2) plaintiff evidence
+        const evToEvent = (ev, role) => {
+            loadUser(ev.uploader_id);
+            let fr = [];
+            try {
+                fr = ev.flag_reasons ? JSON.parse(String(ev.flag_reasons)) : [];
+            }
+            catch { }
+            return {
+                id: `ev-${ev.id}`,
+                type: 'evidence',
+                ts: String(ev.created_at || ''),
+                actor_id: ev.uploader_id || null,
+                actor_role: role,
+                body: String(ev.description || ''),
+                flagged: fr.length > 0 ? 1 : 0,
+                flag_reasons: fr,
+                meta: {
+                    evidence_id: ev.id,
+                    evidence_type: ev.type,
+                    file_hash: ev.file_hash,
+                    mime: ev.mime || null,
+                    size: ev.size || null,
+                    filename: ev.filename || null,
+                    sig: ev.sig || null,
+                    has_blob: !!ev.file_path,
+                    withdrawn_at: ev.withdrawn_at || null,
+                },
+            };
+        };
+        for (const ev of plaintiffEvidence)
+            events.push(evToEvent(ev, 'plaintiff'));
+        // 3) defendant response — 用 defendant 第一条证据时间逼近 respond_at
+        if (dispute.defendant_notes) {
+            const firstDefTs = defendantEvidence[0]?.created_at;
+            events.push({
+                id: `resp-${dispute.id}`,
+                type: 'response',
+                ts: firstDefTs || String(dispute.created_at || ''),
+                actor_id: dispute.defendant_id,
+                actor_role: 'defendant',
+                body: String(dispute.defendant_notes || ''),
+            });
+        }
+        for (const ev of defendantEvidence)
+            events.push(evToEvent(ev, 'defendant'));
+        // 4) party evidence (物流等)
+        for (const ev of partyEvidence) {
+            const r = orderRole(ev.uploader_id);
+            events.push(evToEvent(ev, r === 'unknown' ? 'party' : r));
+        }
+        // 5) evidence requests + submitted_items
+        for (const r of evidenceRequests) {
+            let evidenceTypes = [];
+            try {
+                evidenceTypes = JSON.parse(String(r.evidence_types || '[]'));
+            }
+            catch { }
+            loadUser(r.requested_from_id);
+            events.push({
+                id: `req-${r.id}`,
+                type: 'evidence_request',
+                ts: String(r.created_at || ''),
+                actor_id: null,
+                actor_role: 'arbitrator',
+                body: String(r.description || ''),
+                meta: {
+                    request_id: r.id,
+                    requested_from_id: r.requested_from_id,
+                    requested_from_name: r.requested_from_name,
+                    requested_from_role: orderRole(r.requested_from_id),
+                    evidence_types: evidenceTypes,
+                    deadline: r.deadline,
+                    status: r.status,
+                },
+            });
+            const submitted = (r.submitted_items || []);
+            for (const si of submitted) {
+                const role = orderRole(si.uploader_id);
+                const ev = evToEvent(si, role === 'unknown' ? 'party' : role);
+                ev.meta = { ...(ev.meta || {}), in_response_to: r.id };
+                events.push(ev);
+            }
+        }
+        // 6) ruling — 从 order_events 签名链取
+        try {
+            const chainRows = db.prepare(`SELECT actor_id, signed_at, payload_json FROM order_events WHERE order_id = ? ORDER BY seq ASC`).all(dispute.order_id);
+            for (const row of chainRows) {
+                let payload = {};
+                try {
+                    payload = JSON.parse(row.payload_json);
+                }
+                catch {
+                    continue;
+                }
+                const extra = (payload.extra || {});
+                if (extra.action === 'arbitration_ruling' && extra.dispute_id === dispute.id) {
+                    loadUser(row.actor_id);
+                    events.push({
+                        id: `rule-${row.signed_at}`,
+                        type: 'ruling',
+                        ts: row.signed_at,
+                        actor_id: row.actor_id,
+                        actor_role: 'arbitrator',
+                        body: String(extra.reason || ''),
+                        meta: {
+                            ruling: extra.ruling,
+                            refund_amount: extra.refund_amount,
+                            liable_party_id: extra.liable_party_id,
+                            liability_parties: extra.liability_parties,
+                        },
+                    });
+                }
+            }
+        }
+        catch (e) {
+            console.warn('[timeline] chain query failed:', e.message);
+        }
+        // 7) resolved/dismissed marker
+        if (dispute.resolved_at) {
+            const hasRulingEvent = events.some(e => e.type === 'ruling');
+            events.push({
+                id: `done-${dispute.id}`,
+                type: 'resolved',
+                ts: String(dispute.resolved_at),
+                actor_id: null,
+                actor_role: 'system',
+                body: hasRulingEvent ? '' : String(dispute.verdict_reason || ''),
+                meta: {
+                    status: dispute.status,
+                    ruling_type: dispute.ruling_type,
+                    refund_amount: dispute.refund_amount,
+                    liability_parties: dispute.liability_parties,
+                },
+            });
+        }
+        events.sort((a, b) => String(a.ts).localeCompare(String(b.ts)));
+        res.json({
+            ...dispute,
+            plaintiff_evidence: plaintiffEvidence,
+            defendant_evidence: defendantEvidence,
+            party_evidence: partyEvidence,
+            evidence_requests: evidenceRequests,
+            my_pending_requests: myPendingRequests,
+            parties,
+            is_party: isParty,
+            timeline: events,
+            actors: Object.fromEntries([...userById].map(([id, u]) => [id, u])),
+        });
+    });
+    // 当事人 + 仲裁员可查（meta only，blob 单独拉）
+    app.get('/api/disputes/:id/evidence-list', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        try {
+            const rows = listEvidenceFiles(db, req.params.id, user.id);
+            res.json(rows);
+        }
+        catch (e) {
+            const msg = e.message;
+            res.status(msg === 'not_dispute_party' ? 403 : 404).json({ error: msg });
+        }
+    });
+    // 涉案三方（仲裁员选择发证据请求的对象）
+    app.get('/api/disputes/:id/parties', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const dispute = getDisputeDetails(db, req.params.id);
+        if (!dispute)
+            return void res.status(404).json({ error: '争议不存在' });
+        const order = db.prepare('SELECT buyer_id, seller_id, logistics_id FROM orders WHERE id = ?')
+            .get(dispute.order_id);
+        const partyIds = [dispute.initiator_id, dispute.defendant_id, order?.logistics_id].filter(Boolean);
+        const uniqueIds = [...new Set(partyIds)];
+        const parties = uniqueIds.map(id => {
+            const u = db.prepare('SELECT id, name, role FROM users WHERE id = ?').get(id);
+            return u;
+        }).filter(Boolean);
+        res.json(parties);
+    });
+}