@seasonkoh/webaz 0.1.8 → 0.1.9

package/dist/pwa/routes/feedback.js

@@ -0,0 +1,270 @@
+const VALID_FEEDBACK_CAT = new Set(['bug', 'abuse', 'feature', 'account', 'other']);
+const VALID_FEEDBACK_SEV = new Set(['low', 'medium', 'high']);
+export function registerFeedbackRoutes(app, deps) {
+    const { db, generateId, auth, broadcastSystemEvent, detectFraud, anthropic } = deps;
+    app.post('/api/feedback', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const { category, severity, subject, body } = req.body || {};
+        if (!VALID_FEEDBACK_CAT.has(String(category)))
+            return void res.status(400).json({ error: '无效类别' });
+        const sev = VALID_FEEDBACK_SEV.has(String(severity)) ? String(severity) : 'medium';
+        const sub = String(subject || '').trim();
+        const bod = String(body || '').trim();
+        if (sub.length < 4 || sub.length > 80)
+            return void res.status(400).json({ error: '标题 4-80 字' });
+        if (bod.length < 10 || bod.length > 2000)
+            return void res.status(400).json({ error: '正文 10-2000 字' });
+        const recent = db.prepare(`SELECT COUNT(*) as n FROM feedback_tickets WHERE user_id = ? AND created_at > datetime('now', '-1 hour')`).get(user.id).n;
+        if (recent >= 5)
+            return void res.status(429).json({ error: '提交过于频繁，请稍后再试' });
+        const id = generateId('fbk');
+        db.prepare(`INSERT INTO feedback_tickets (id, user_id, category, severity, subject, body) VALUES (?,?,?,?,?,?)`)
+            .run(id, user.id, String(category), sev, sub, bod);
+        try {
+            broadcastSystemEvent('feedback', '💬', `反馈工单 ${id} · ${category}/${sev}`, id);
+        }
+        catch { }
+        // G-4: 异步 AI 草拟回复（不阻塞）
+        ;
+        (async () => {
+            try {
+                const message = await anthropic.messages.create({
+                    model: 'claude-haiku-4-5-20251001',
+                    max_tokens: 400,
+                    messages: [{
+                            role: 'user',
+                            content: `你是 WebAZ 客服 AI。用户提交了工单，你先草拟一份回复（admin 会审核后再发出）。客气专业，2-4 句，无前后缀：
+类别: ${category}
+紧急: ${sev}
+标题: ${sub}
+正文: ${bod}`,
+                        }],
+                });
+                const text = message.content[0]?.text || '';
+                db.prepare(`UPDATE feedback_tickets SET ai_suggested_reply = ?, ai_generated_at = datetime('now') WHERE id = ?`)
+                    .run(text.trim(), id);
+            }
+            catch (e) {
+                console.error('[ai feedback draft]', e.message);
+            }
+        })();
+        res.json({ success: true, id });
+    });
+    app.get('/api/feedback/mine', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const rows = db.prepare(`SELECT id, category, severity, subject, body, status, admin_reply, replied_at, user_seen_reply_at, created_at, updated_at
+      FROM feedback_tickets WHERE user_id = ? ORDER BY created_at DESC LIMIT 100`).all(user.id);
+        // 派生 has_unread_reply
+        let unreadReplyCount = 0;
+        for (const r of rows) {
+            const hasReply = !!r.admin_reply;
+            const repliedAt = r.replied_at;
+            const seenAt = r.user_seen_reply_at;
+            const isUnread = hasReply && (!seenAt || (repliedAt && repliedAt > seenAt));
+            r.has_unread_reply = isUnread ? 1 : 0;
+            if (isUnread)
+                unreadReplyCount++;
+        }
+        res.json({ items: rows, unread_reply_count: unreadReplyCount });
+    });
+    app.post('/api/feedback/seen', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        db.prepare(`UPDATE feedback_tickets SET user_seen_reply_at = datetime('now')
+      WHERE user_id = ? AND admin_reply IS NOT NULL AND (user_seen_reply_at IS NULL OR replied_at > user_seen_reply_at)`).run(user.id);
+        res.json({ success: true });
+    });
+    // admin 列出工单
+    app.get('/api/admin/feedback', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (user.role !== 'admin')
+            return void res.status(403).json({ error: '仅 admin 可访问' });
+        const status = req.query.status ? String(req.query.status) : null;
+        const category = req.query.category ? String(req.query.category) : null;
+        const where = [];
+        const params = [];
+        if (status) {
+            where.push('f.status = ?');
+            params.push(status);
+        }
+        if (category) {
+            where.push('f.category = ?');
+            params.push(category);
+        }
+        const whereClause = where.length > 0 ? `WHERE ${where.join(' AND ')}` : '';
+        const rows = db.prepare(`
+      SELECT f.*, u.name as user_name, u.handle as user_handle, u.role as user_role
+      FROM feedback_tickets f
+      JOIN users u ON u.id = f.user_id
+      ${whereClause}
+      ORDER BY
+        CASE f.status WHEN 'open' THEN 1 WHEN 'in_progress' THEN 2 WHEN 'resolved' THEN 3 ELSE 4 END,
+        CASE f.severity WHEN 'high' THEN 1 WHEN 'medium' THEN 2 ELSE 3 END,
+        f.created_at DESC
+      LIMIT 200
+    `).all(...params);
+        res.json({ items: rows });
+    });
+    // admin 回复 + 切状态
+    app.post('/api/admin/feedback/:id/reply', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (user.role !== 'admin')
+            return void res.status(403).json({ error: '仅 admin 可回复' });
+        const ticket = db.prepare('SELECT user_id, status FROM feedback_tickets WHERE id = ?').get(req.params.id);
+        if (!ticket)
+            return void res.status(404).json({ error: '工单不存在' });
+        const { reply, status } = req.body || {};
+        const replyStr = reply ? String(reply).slice(0, 2000).trim() : null;
+        if (!replyStr)
+            return void res.status(400).json({ error: '回复内容必填' });
+        const newStatus = status && ['open', 'in_progress', 'resolved', 'closed'].includes(String(status)) ? String(status) : 'resolved';
+        // 跨窗反诈一致性
+        const adminReasons = detectFraud(replyStr);
+        db.transaction(() => {
+            db.prepare(`INSERT INTO feedback_messages (id, ticket_id, sender_id, sender_role, body, flagged, flag_reasons) VALUES (?,?,?,?,?,?,?)`)
+                .run(generateId('fmsg'), req.params.id, user.id, 'admin', replyStr, adminReasons.length ? 1 : 0, adminReasons.length ? JSON.stringify(adminReasons) : null);
+            db.prepare(`UPDATE feedback_tickets SET admin_reply = ?, replied_by = ?, replied_at = datetime('now'), status = ?, updated_at = datetime('now') WHERE id = ?`)
+                .run(replyStr, user.id, newStatus, req.params.id);
+        })();
+        try {
+            const actions = JSON.stringify([{ kind: 'navigate', label: '查看工单', href: `#ticket/${req.params.id}`, style: 'primary' }]);
+            db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, order_id, actions) VALUES (?,?,?,?,?,?,?)`)
+                .run(generateId('ntf'), ticket.user_id, 'ticket_reply', `💬 客服回复了你的工单`, replyStr.slice(0, 100), null, actions);
+        }
+        catch (e) {
+            console.warn('[notif ticket_reply]', e.message);
+        }
+        res.json({ success: true });
+    });
+    // ─── W7 ticket-thread ────────────────────────────────────
+    // 工单详情 + timeline
+    app.get('/api/feedback/:id', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const t = db.prepare(`
+      SELECT f.*, u.name as user_name, u.handle as user_handle, u.role as user_role
+      FROM feedback_tickets f JOIN users u ON u.id = f.user_id WHERE f.id = ?
+    `).get(req.params.id);
+        if (!t)
+            return void res.status(404).json({ error: '工单不存在' });
+        const isOwner = t.user_id === user.id;
+        const isAdmin = user.role === 'admin';
+        if (!isOwner && !isAdmin)
+            return void res.status(403).json({ error: '无权查看' });
+        const messages = db.prepare(`
+      SELECT m.*, u.name as sender_name, u.handle as sender_handle
+      FROM feedback_messages m LEFT JOIN users u ON u.id = m.sender_id
+      WHERE m.ticket_id = ? ORDER BY m.created_at ASC
+    `).all(t.id);
+        const events = [];
+        events.push({
+            id: `create-${t.id}`,
+            type: 'created',
+            ts: String(t.created_at || ''),
+            actor_id: String(t.user_id),
+            actor_role: 'user',
+            body: String(t.body || ''),
+            meta: { subject: t.subject, category: t.category, severity: t.severity },
+        });
+        for (const m of messages) {
+            let fr = [];
+            try {
+                fr = m.flag_reasons ? JSON.parse(String(m.flag_reasons)) : [];
+            }
+            catch { }
+            events.push({
+                id: `msg-${m.id}`,
+                type: 'message',
+                ts: String(m.created_at || ''),
+                actor_id: m.sender_id ? String(m.sender_id) : null,
+                actor_role: (m.sender_role || 'user'),
+                body: String(m.body || ''),
+                flagged: Number(m.flagged || 0),
+                flag_reasons: fr,
+            });
+        }
+        if ((t.status === 'resolved' || t.status === 'closed') && t.replied_at) {
+            events.push({
+                id: `done-${t.id}`,
+                type: t.status === 'closed' ? 'closed' : 'resolved',
+                ts: String(t.replied_at),
+                actor_id: t.replied_by ? String(t.replied_by) : null,
+                actor_role: 'admin',
+                body: '',
+            });
+        }
+        events.sort((a, b) => a.ts.localeCompare(b.ts));
+        if (isOwner) {
+            try {
+                db.prepare(`UPDATE feedback_tickets SET user_seen_reply_at = datetime('now') WHERE id = ? AND admin_reply IS NOT NULL`).run(t.id);
+            }
+            catch { }
+        }
+        if (isAdmin) {
+            try {
+                db.prepare(`UPDATE feedback_tickets SET admin_seen_at = datetime('now') WHERE id = ?`).run(t.id);
+            }
+            catch { }
+        }
+        res.json({ item: t, timeline: events, is_admin: isAdmin });
+    });
+    // 工单内追加消息（user 或 admin）
+    app.post('/api/feedback/:id/messages', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const t = db.prepare(`SELECT id, user_id, status FROM feedback_tickets WHERE id = ?`).get(req.params.id);
+        if (!t)
+            return void res.status(404).json({ error: '工单不存在' });
+        const isOwner = t.user_id === user.id;
+        const isAdmin = user.role === 'admin';
+        if (!isOwner && !isAdmin)
+            return void res.status(403).json({ error: '无权操作' });
+        if (t.status === 'closed')
+            return void res.status(400).json({ error: '工单已关闭' });
+        const body = String(req.body?.body || '').trim();
+        if (body.length < 1 || body.length > 2000)
+            return void res.status(400).json({ error: '消息长度 1-2000 字' });
+        const reasons = detectFraud(body);
+        const mid = generateId('fmsg');
+        db.transaction(() => {
+            db.prepare(`INSERT INTO feedback_messages (id, ticket_id, sender_id, sender_role, body, flagged, flag_reasons) VALUES (?,?,?,?,?,?,?)`)
+                .run(mid, t.id, user.id, isAdmin ? 'admin' : 'user', body, reasons.length ? 1 : 0, reasons.length ? JSON.stringify(reasons) : null);
+            // user 追问 → 状态重新打开
+            if (isOwner && t.status === 'resolved') {
+                db.prepare(`UPDATE feedback_tickets SET status = 'in_progress', updated_at = datetime('now') WHERE id = ?`).run(t.id);
+            }
+            else {
+                db.prepare(`UPDATE feedback_tickets SET updated_at = datetime('now') WHERE id = ?`).run(t.id);
+            }
+        })();
+        try {
+            const tktAction = JSON.stringify([{ kind: 'navigate', label: '查看工单', href: `#ticket/${t.id}`, style: 'primary' }]);
+            if (isOwner) {
+                const admins = db.prepare(`SELECT id FROM users WHERE role = 'admin'`).all();
+                for (const a of admins) {
+                    db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, order_id, actions) VALUES (?,?,?,?,?,?,?)`)
+                        .run(generateId('ntf'), a.id, 'ticket_followup', '💬 用户追问了工单', body.slice(0, 100), null, tktAction);
+                }
+            }
+            else {
+                db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, order_id, actions) VALUES (?,?,?,?,?,?,?)`)
+                    .run(generateId('ntf'), t.user_id, 'ticket_reply', '💬 客服回复了你的工单', body.slice(0, 100), null, tktAction);
+            }
+        }
+        catch (e) {
+            console.warn('[notif ticket_msg]', e.message);
+        }
+        res.json({ success: true, id: mid });
+    });
+}

package/dist/pwa/routes/flash-sales.js

@@ -0,0 +1,130 @@
+/** 拿商品（含 variant）当前生效的 flash sale；多重叠时取价最低。orders 下单也会用。 */
+export function getActiveFlashSale(db, productId, variantId) {
+    const variantClause = variantId
+        ? `AND (variant_id IS NULL OR variant_id = ?)`
+        : `AND variant_id IS NULL`;
+    const sql = `
+    SELECT id, sale_price, ends_at, max_qty, sold_count
+    FROM flash_sales
+    WHERE product_id = ? AND is_active = 1
+      AND starts_at <= datetime('now') AND ends_at > datetime('now')
+      AND (max_qty = 0 OR sold_count < max_qty)
+      ${variantClause}
+    ORDER BY sale_price ASC LIMIT 1
+  `;
+    const args = [productId];
+    if (variantId)
+        args.push(variantId);
+    return db.prepare(sql).get(...args);
+}
+export function registerFlashSalesRoutes(app, deps) {
+    const { db, generateId, auth, broadcastSystemEvent } = deps;
+    app.post('/api/products/:product_id/flash-sale', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const product = db.prepare('SELECT id, seller_id, price, has_variants FROM products WHERE id = ? AND status = \'active\'').get(req.params.product_id);
+        if (!product)
+            return void res.status(404).json({ error: '商品不存在或已下架' });
+        if (product.seller_id !== user.id)
+            return void res.status(403).json({ error: '仅商品卖家可创建限时促销' });
+        const { variant_id, sale_price, starts_at, ends_at, max_qty } = req.body || {};
+        const salePrice = Number(sale_price);
+        if (!Number.isFinite(salePrice) || salePrice <= 0 || salePrice >= Number(product.price)) {
+            return void res.status(400).json({ error: 'sale_price 必须 > 0 且 < 商品原价' });
+        }
+        if (!starts_at || !ends_at)
+            return void res.status(400).json({ error: 'starts_at / ends_at 必填（ISO 8601）' });
+        const startsT = new Date(starts_at).getTime();
+        const endsT = new Date(ends_at).getTime();
+        const now = Date.now();
+        if (!Number.isFinite(startsT) || !Number.isFinite(endsT))
+            return void res.status(400).json({ error: '时间格式无效' });
+        if (endsT <= startsT)
+            return void res.status(400).json({ error: '结束时间必须晚于开始时间' });
+        if (endsT - startsT > 30 * 86400 * 1000)
+            return void res.status(400).json({ error: '单次促销最多 30 天' });
+        if (endsT < now)
+            return void res.status(400).json({ error: '结束时间已过' });
+        let variantId = null;
+        if (variant_id) {
+            if (!product.has_variants)
+                return void res.status(400).json({ error: '该商品无规格，不可绑定 variant' });
+            const v = db.prepare('SELECT id FROM product_variants WHERE id = ? AND product_id = ? AND is_active = 1').get(variant_id, product.id);
+            if (!v)
+                return void res.status(400).json({ error: 'variant 不存在' });
+            variantId = String(variant_id);
+        }
+        else if (Number(product.has_variants) === 1) {
+            return void res.status(400).json({ error: '该商品有规格，请指定 variant_id' });
+        }
+        const maxQty = Number.isFinite(Number(max_qty)) ? Math.max(0, Number(max_qty)) : 0;
+        // 防重叠：同 product+variant 不能有进行中的促销
+        const conflict = db.prepare(`
+      SELECT id FROM flash_sales WHERE product_id = ? AND ${variantId ? 'variant_id = ?' : 'variant_id IS NULL'}
+        AND is_active = 1 AND ends_at > datetime('now') LIMIT 1
+    `).get(...(variantId ? [product.id, variantId] : [product.id]));
+        if (conflict)
+            return void res.status(409).json({ error: '已有进行中的促销，请先结束', existing_id: conflict.id });
+        const id = generateId('fls');
+        db.prepare(`INSERT INTO flash_sales (id, seller_id, product_id, variant_id, sale_price, original_price, max_qty, starts_at, ends_at) VALUES (?,?,?,?,?,?,?,?,?)`)
+            .run(id, user.id, product.id, variantId, salePrice, Number(product.price), maxQty, new Date(startsT).toISOString(), new Date(endsT).toISOString());
+        try {
+            broadcastSystemEvent('flash_sale', '⚡', `限时促销创建 ${product.id} · ${salePrice}/${product.price} WAZ`, product.id);
+        }
+        catch { }
+        res.json({ success: true, id });
+    });
+    // 公开：商品当前生效的 flash sale
+    app.get('/api/products/:product_id/flash-sale', (req, res) => {
+        const variantId = req.query.variant_id ? String(req.query.variant_id) : null;
+        const sale = getActiveFlashSale(db, req.params.product_id, variantId);
+        res.json({ sale });
+    });
+    // seller 自己的 flash sales（全部状态）
+    app.get('/api/sellers/me/flash-sales', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const rows = db.prepare(`
+      SELECT f.*, p.title as product_title
+      FROM flash_sales f
+      JOIN products p ON p.id = f.product_id
+      WHERE f.seller_id = ?
+      ORDER BY f.ends_at DESC LIMIT 100
+    `).all(user.id);
+        res.json({ items: rows });
+    });
+    // 取消（仅 seller 自己，且未开始）
+    app.delete('/api/flash-sales/:id', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const f = db.prepare('SELECT seller_id, starts_at FROM flash_sales WHERE id = ?').get(req.params.id);
+        if (!f)
+            return void res.status(404).json({ error: 'flash sale 不存在' });
+        if (f.seller_id !== user.id)
+            return void res.status(403).json({ error: '仅卖家可操作' });
+        if (new Date(f.starts_at).getTime() <= Date.now()) {
+            return void res.status(400).json({ error: '已开始的促销不可取消，请设置 is_active=0 提前结束' });
+        }
+        db.prepare('DELETE FROM flash_sales WHERE id = ?').run(req.params.id);
+        res.json({ success: true });
+    });
+    // buyer 视角：当前全平台正在进行的 flash sales（首屏 discovery）
+    app.get('/api/flash-sales/live', (req, res) => {
+        const rows = db.prepare(`
+      SELECT f.id, f.product_id, f.variant_id, f.sale_price, f.original_price, f.ends_at, f.max_qty, f.sold_count,
+             p.title, p.images, p.category,
+             u.handle as seller_handle, u.name as seller_name
+      FROM flash_sales f
+      JOIN products p ON p.id = f.product_id AND p.status = 'active'
+      JOIN users u ON u.id = f.seller_id
+      WHERE f.is_active = 1
+        AND f.starts_at <= datetime('now') AND f.ends_at > datetime('now')
+        AND (f.max_qty = 0 OR f.sold_count < f.max_qty)
+      ORDER BY f.ends_at ASC LIMIT 100
+    `).all();
+        res.json({ items: rows });
+    });
+}

package/dist/pwa/routes/follows.js

@@ -0,0 +1,103 @@
+export function registerFollowsRoutes(app, deps) {
+    const { db, auth, generateId } = deps;
+    app.get('/api/follows/:user_id/status', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const r = db.prepare("SELECT 1 FROM follows WHERE follower_id=? AND followee_id=?").get(user.id, req.params.user_id);
+        const followers = db.prepare("SELECT COUNT(*) as n FROM follows WHERE followee_id=?").get(req.params.user_id).n;
+        const following = db.prepare("SELECT COUNT(*) as n FROM follows WHERE follower_id=?").get(req.params.user_id).n;
+        res.json({ following: !!r, followers, following_count: following });
+    });
+    app.post('/api/follows/:user_id', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (user.id === req.params.user_id)
+            return void res.json({ error: '不能关注自己' });
+        const target = db.prepare("SELECT id FROM users WHERE id=?").get(req.params.user_id);
+        if (!target)
+            return void res.json({ error: '用户不存在' });
+        const result = db.prepare("INSERT OR IGNORE INTO follows (follower_id, followee_id) VALUES (?, ?)").run(user.id, req.params.user_id);
+        // 2026-05-24 新关注 → 通知被关注者（仅首次关注时；重复点击不重发）
+        if (result.changes > 0) {
+            try {
+                const followerName = db.prepare("SELECT name, handle FROM users WHERE id = ?").get(user.id);
+                const display = followerName?.handle ? '@' + followerName.handle : followerName?.name || 'someone';
+                db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, order_id) VALUES (?,?,?,?,?,?)`)
+                    .run(generateId('ntf'), req.params.user_id, 'social', `🤝 新关注`, `${display} 关注了你`, null);
+            }
+            catch (e) {
+                console.error('[follow notif]', e);
+            }
+        }
+        res.json({ ok: true, following: true });
+    });
+    app.delete('/api/follows/:user_id', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        db.prepare("DELETE FROM follows WHERE follower_id=? AND followee_id=?").run(user.id, req.params.user_id);
+        res.json({ ok: true, following: false });
+    });
+    app.get('/api/follows/me', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const followers = db.prepare(`
+      SELECT u.id, u.name, u.role, f.created_at
+      FROM follows f JOIN users u ON u.id = f.follower_id
+      WHERE f.followee_id = ? ORDER BY f.created_at DESC LIMIT 100
+    `).all(user.id);
+        const following = db.prepare(`
+      SELECT u.id, u.name, u.role, f.created_at
+      FROM follows f JOIN users u ON u.id = f.followee_id
+      WHERE f.follower_id = ? ORDER BY f.created_at DESC LIMIT 100
+    `).all(user.id);
+        res.json({ followers, following });
+    });
+    // Wave D-1: 关注卖家动态 feed — new_product + restock 合并 + 去重
+    app.get('/api/follows/feed', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const limit = Math.min(100, Math.max(10, Number(req.query.limit) || 50));
+        const followees = db.prepare(`SELECT followee_id FROM follows WHERE follower_id = ?`).all(user.id);
+        if (followees.length === 0)
+            return void res.json({ items: [] });
+        const ids = followees.map(f => f.followee_id);
+        const placeholders = ids.map(() => '?').join(',');
+        // 新品（近 30 天 active）
+        const newProducts = db.prepare(`
+      SELECT 'new_product' as type, p.created_at as ts, p.id as product_id, p.title, p.price, p.stock, p.category, p.images,
+             u.id as seller_id, u.name as seller_name, u.handle as seller_handle
+      FROM products p JOIN users u ON u.id = p.seller_id
+      WHERE p.seller_id IN (${placeholders}) AND p.status = 'active'
+        AND p.created_at > datetime('now', '-30 days')
+      ORDER BY p.created_at DESC LIMIT 100
+    `).all(...ids);
+        // 重新上架 / 补货（近 7 天 updated_at > created_at + 1 天，stock > 0）
+        const restocks = db.prepare(`
+      SELECT 'restock' as type, p.updated_at as ts, p.id as product_id, p.title, p.price, p.stock, p.category, p.images,
+             u.id as seller_id, u.name as seller_name, u.handle as seller_handle
+      FROM products p JOIN users u ON u.id = p.seller_id
+      WHERE p.seller_id IN (${placeholders}) AND p.status = 'active'
+        AND p.stock > 0
+        AND p.updated_at > datetime('now', '-7 days')
+        AND p.updated_at > datetime(p.created_at, '+1 days')
+      ORDER BY p.updated_at DESC LIMIT 30
+    `).all(...ids);
+        // 合并 + 去重（同 product 同时 new + restock → 优先 new）
+        const seen = new Set();
+        const merged = [];
+        for (const item of [...newProducts, ...restocks]) {
+            const prodKey = String(item.product_id);
+            if (seen.has(prodKey))
+                continue;
+            seen.add(prodKey);
+            merged.push(item);
+        }
+        merged.sort((a, b) => String(b.ts).localeCompare(String(a.ts)));
+        res.json({ items: merged.slice(0, limit) });
+    });
+}