@seasonkoh/webaz 0.1.8 → 0.1.9

package/dist/pwa/routes/promoter.js

@@ -0,0 +1,208 @@
+export function registerPromoterRoutes(app, deps) {
+    const { db, auth, isAllowedSponsor } = deps;
+    app.get('/api/promoter/dashboard', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const userId = user.id;
+        const l1 = db.prepare("SELECT COUNT(*) as n FROM users WHERE sponsor_id = ?").get(userId).n;
+        const l2 = db.prepare(`
+      SELECT COUNT(*) as n FROM users
+      WHERE sponsor_id IN (SELECT id FROM users WHERE sponsor_id = ?)
+    `).get(userId).n;
+        const l3 = db.prepare(`
+      SELECT COUNT(*) as n FROM users
+      WHERE sponsor_id IN (
+        SELECT id FROM users WHERE sponsor_id IN (SELECT id FROM users WHERE sponsor_id = ?)
+      )
+    `).get(userId).n;
+        const earned = db.prepare(`
+      SELECT level, COUNT(*) as orders, COALESCE(SUM(amount),0) as total
+      FROM commission_records WHERE beneficiary_id = ?
+      GROUP BY level
+    `).all(userId);
+        const byLevel = { 1: { orders: 0, total: 0 }, 2: { orders: 0, total: 0 }, 3: { orders: 0, total: 0 } };
+        for (const r of earned)
+            byLevel[r.level] = { orders: r.orders, total: r.total };
+        const grand = byLevel[1].total + byLevel[2].total + byLevel[3].total;
+        const recent = db.prepare(`
+      SELECT cr.id, cr.order_id, cr.level, cr.amount, cr.rate, cr.created_at,
+             u.name as source_buyer_name
+      FROM commission_records cr
+      LEFT JOIN users u ON u.id = cr.source_buyer_id
+      WHERE cr.beneficiary_id = ?
+      ORDER BY cr.created_at DESC LIMIT 20
+    `).all(userId);
+        const me = db.prepare("SELECT sponsor_id, sponsor_path, region FROM users WHERE id = ?").get(userId);
+        const mySponsor = me?.sponsor_id ? db.prepare("SELECT name FROM users WHERE id = ?").get(me.sponsor_id) : null;
+        const myUser = db.prepare("SELECT total_left_pv, total_right_pv, left_child_id, right_child_id, placement_id, placement_side FROM users WHERE id = ?").get(userId);
+        const leftChildName = myUser?.left_child_id ? db.prepare("SELECT name FROM users WHERE id = ?").get(myUser.left_child_id)?.name : null;
+        const rightChildName = myUser?.right_child_id ? db.prepare("SELECT name FROM users WHERE id = ?").get(myUser.right_child_id)?.name : null;
+        const myPlacementName = myUser?.placement_id ? db.prepare("SELECT name FROM users WHERE id = ?").get(myUser.placement_id)?.name : null;
+        const scoreAgg = db.prepare(`
+      SELECT
+        COALESCE(SUM(CASE WHEN settled_at IS NULL THEN score ELSE 0 END),0) as pending_score,
+        COALESCE(SUM(CASE WHEN settled_at IS NOT NULL THEN waz_amount ELSE 0 END),0) as settled_waz,
+        COUNT(*) as total_hits
+      FROM binary_score_records WHERE user_id = ?
+    `).get(userId);
+        const recentBinary = db.prepare(`
+      SELECT id, tier, score, settled_at, waz_amount, created_at
+      FROM binary_score_records WHERE user_id = ?
+      ORDER BY created_at DESC LIMIT 10
+    `).all(userId);
+        const tiers = db.prepare("SELECT tier, pv_threshold, score_per_hit FROM binary_tier_config WHERE active=1 ORDER BY tier ASC").all();
+        const canL1Share = isAllowedSponsor(userId);
+        const completedOrders = db.prepare("SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'").get(userId).n;
+        const overrideRow = db.prepare("SELECT l1_share_override FROM users WHERE id = ?").get(userId);
+        const shareableProducts = db.prepare(`
+      SELECT p.id, p.title, p.price, p.category, p.commission_rate,
+        (SELECT COUNT(*) FROM orders o WHERE o.product_id = p.id AND o.status = 'completed') as total_sales,
+        COALESCE((SELECT SUM(cr.amount) FROM commission_records cr
+                  JOIN orders o2 ON o2.id = cr.order_id
+                  WHERE cr.beneficiary_id = ? AND o2.product_id = p.id), 0) as my_earned
+      FROM products p
+      WHERE p.id IN (SELECT DISTINCT product_id FROM orders WHERE buyer_id = ? AND status = 'completed')
+        AND p.commission_rate IS NOT NULL AND p.commission_rate > 0
+        AND p.status = 'active'
+      ORDER BY my_earned DESC, total_sales DESC LIMIT 20
+    `).all(userId, userId);
+        const earnedLast30 = db.prepare(`
+      SELECT COALESCE(SUM(amount),0) as total FROM commission_records
+      WHERE beneficiary_id = ? AND created_at >= datetime('now','-30 days')
+    `).get(userId).total;
+        const earnedPrev30 = db.prepare(`
+      SELECT COALESCE(SUM(amount),0) as total FROM commission_records
+      WHERE beneficiary_id = ? AND created_at >= datetime('now','-60 days')
+        AND created_at < datetime('now','-30 days')
+    `).get(userId).total;
+        const wazLast30 = db.prepare(`
+      SELECT COALESCE(SUM(waz_amount),0) as total FROM binary_score_records
+      WHERE user_id = ? AND settled_at >= datetime('now','-30 days')
+    `).get(userId).total;
+        const projection = {
+            last_30_commission: earnedLast30,
+            prev_30_commission: earnedPrev30,
+            last_30_atomic_waz: wazLast30,
+            growth_rate: earnedPrev30 > 0 ? earnedLast30 / earnedPrev30 - 1 : null,
+            next_30_estimate: earnedLast30 + wazLast30,
+        };
+        const insights = [];
+        const leftPv = Number(myUser?.total_left_pv ?? 0);
+        const rightPv = Number(myUser?.total_right_pv ?? 0);
+        if (leftPv > 0 || rightPv > 0) {
+            const max = Math.max(leftPv, rightPv), min = Math.min(leftPv, rightPv);
+            const ratio = max > 0 ? min / max : 0;
+            const weak = leftPv < rightPv ? '左区' : '右区';
+            if (ratio < 0.5)
+                insights.push({ type: 'weak_leg', level: 'warn', text: `${weak} PV 仅为强腿的 ${(ratio * 100).toFixed(0)}% — 建议主推${weak}，对碰 = min(L,R) × tier_score` });
+            else
+                insights.push({ type: 'balanced', level: 'success', text: `双腿均衡度 ${(ratio * 100).toFixed(0)}% — 对碰节奏健康` });
+        }
+        const lastInvite = db.prepare(`SELECT MAX(created_at) as t FROM users WHERE sponsor_id = ?`).get(userId);
+        if (lastInvite.t) {
+            const days = Math.floor((Date.now() - new Date(lastInvite.t).getTime()) / 86400_000);
+            if (days > 14)
+                insights.push({ type: 'dormancy', level: 'warn', text: `${days} 天没有新直推 — 链接还在裤兜里？` });
+            else if (days < 3)
+                insights.push({ type: 'hot', level: 'success', text: `${days} 天前刚有新直推 — 趁热打铁` });
+        }
+        else if (l1 === 0) {
+            insights.push({ type: 'no_team', level: 'info', text: `还没有直推 — 先分享你买过且好评的商品给好友` });
+        }
+        const pair = Math.min(leftPv, rightPv);
+        const nextTier = tiers.find(t => t.pv_threshold > pair);
+        if (nextTier && pair > 0 && pair / nextTier.pv_threshold > 0.7) {
+            insights.push({ type: 'near_tier', level: 'success', text: `距离 tier ${nextTier.tier} 仅差 ${(nextTier.pv_threshold - pair).toLocaleString()} PV (+${nextTier.score_per_hit} Score / 次)` });
+        }
+        if (!canL1Share && completedOrders === 0) {
+            insights.push({ type: 'unlock', level: 'info', text: `完成首笔购买可解锁分享奖励 — 当前仅可分享 PV 加人扩双轨树` });
+        }
+        if (shareableProducts.length > 0 && grand === 0) {
+            insights.push({ type: 'first_share', level: 'info', text: `你有 ${shareableProducts.length} 个可分享商品但暂无成交 — 试着把链接发给身边的人` });
+        }
+        const treeNode = (uid) => {
+            if (!uid)
+                return null;
+            const u = db.prepare("SELECT id, name, total_left_pv, total_right_pv, left_child_id, right_child_id FROM users WHERE id = ?").get(uid);
+            if (!u)
+                return null;
+            return {
+                id: u.id, name: u.name,
+                lpv: Number(u.total_left_pv ?? 0),
+                rpv: Number(u.total_right_pv ?? 0),
+                left_id: u.left_child_id ?? null,
+                right_id: u.right_child_id ?? null,
+            };
+        };
+        const me_node = treeNode(userId);
+        const left_node = treeNode(myUser?.left_child_id);
+        const right_node = treeNode(myUser?.right_child_id);
+        const binaryTree = {
+            me: me_node,
+            left: left_node,
+            right: right_node,
+            ll: treeNode(left_node?.left_id),
+            lr: treeNode(left_node?.right_id),
+            rl: treeNode(right_node?.left_id),
+            rr: treeNode(right_node?.right_id),
+        };
+        const meCard = db.prepare("SELECT permanent_code, handle FROM users WHERE id = ?").get(userId);
+        const codeForLink = meCard?.permanent_code || userId;
+        res.json({
+            user_id: userId,
+            permanent_code: meCard?.permanent_code || null,
+            handle: meCard?.handle || null,
+            referral_link: `${req.protocol}://${req.get('host')}/i/${codeForLink}`,
+            region: me?.region || 'global',
+            my_sponsor: mySponsor ? { id: me.sponsor_id, name: mySponsor.name } : null,
+            permissions: {
+                can_l1_share: canL1Share,
+                completed_orders: completedOrders,
+                l1_share_override: overrideRow?.l1_share_override ?? 0,
+                reason: canL1Share
+                    ? (overrideRow?.l1_share_override === 1 ? 'admin_grant' : 'verified_buyer')
+                    : 'need_completed_order',
+            },
+            team: { l1, l2, l3, total: l1 + l2 + l3 },
+            earnings: {
+                grand_total: grand,
+                l1: byLevel[1],
+                l2: byLevel[2],
+                l3: byLevel[3],
+            },
+            recent,
+            shareable_products: shareableProducts,
+            projection,
+            insights,
+            atomic: {
+                left_invite_url: `${req.protocol}://${req.get('host')}/i/${codeForLink}-L`,
+                right_invite_url: `${req.protocol}://${req.get('host')}/i/${codeForLink}-R`,
+                total_left_pv: Number(myUser?.total_left_pv ?? 0),
+                total_right_pv: Number(myUser?.total_right_pv ?? 0),
+                left_child: myUser?.left_child_id ? { id: myUser.left_child_id, name: leftChildName } : null,
+                right_child: myUser?.right_child_id ? { id: myUser.right_child_id, name: rightChildName } : null,
+                my_placement: myUser?.placement_id ? { id: myUser.placement_id, name: myPlacementName, side: myUser.placement_side } : null,
+                score: scoreAgg,
+                recent_binary: recentBinary,
+                tier_config: tiers,
+                binary_tree: binaryTree,
+            },
+        });
+    });
+    // 直推 L1 列表
+    app.get('/api/promoter/team', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const userId = user.id;
+        const rows = db.prepare(`
+      SELECT u.id, u.name, u.created_at, u.region,
+        (SELECT COUNT(*) FROM users WHERE sponsor_id = u.id) as their_l1,
+        COALESCE((SELECT SUM(amount) FROM commission_records WHERE beneficiary_id = ? AND source_buyer_id = u.id), 0) as my_earned_from_them
+      FROM users u WHERE u.sponsor_id = ?
+      ORDER BY u.created_at DESC LIMIT 100
+    `).all(userId, userId);
+        res.json({ team: rows });
+    });
+}

package/dist/pwa/routes/public-utils.js

@@ -0,0 +1,170 @@
+export function registerPublicUtilsRoutes(app, deps) {
+    const { db, MASTER_SEED, NODE_ENV, SERVICE_START_MS, rateLimitOk, generateManifest, getUser, logError, issuerAddress } = deps;
+    app.get('/api/health', (_req, res) => {
+        const t0 = Date.now();
+        let dbOk = false;
+        let dbLatency = 0;
+        try {
+            const t1 = Date.now();
+            const r = db.prepare('SELECT 1 as ok').get();
+            dbLatency = Date.now() - t1;
+            dbOk = r?.ok === 1;
+        }
+        catch {
+            dbOk = false;
+        }
+        const uptime = Math.floor((Date.now() - SERVICE_START_MS) / 1000);
+        const healthy = dbOk;
+        res.status(healthy ? 200 : 503).json({
+            status: healthy ? 'ok' : 'degraded',
+            uptime_sec: uptime,
+            db: { ok: dbOk, latency_ms: dbLatency },
+            seed_strength: MASTER_SEED === 'webaz-dev-seed-changeme' ? 'default' : MASTER_SEED.length >= 32 ? 'strong' : 'weak',
+            env: NODE_ENV,
+            check_ms: Date.now() - t0,
+        });
+    });
+    app.post('/api/mcp-telemetry', (req, res) => {
+        const ip = req.ip || 'unknown';
+        if (!rateLimitOk(ip))
+            return void res.status(429).json({ error: 'rate-limited' });
+        const { tool_name, outcome, latency_ms, user_id_hash, server_version } = req.body ?? {};
+        if (typeof tool_name !== 'string' || tool_name.length === 0 || tool_name.length > 64) {
+            return void res.status(400).json({ error: 'bad tool_name' });
+        }
+        if (outcome !== 'success' && outcome !== 'error') {
+            return void res.status(400).json({ error: 'bad outcome' });
+        }
+        const lat = Number(latency_ms);
+        if (!Number.isFinite(lat) || lat < 0 || lat > 60_000) {
+            return void res.status(400).json({ error: 'bad latency' });
+        }
+        const uih = typeof user_id_hash === 'string' && /^[0-9a-f]{1,32}$/.test(user_id_hash) ? user_id_hash : null;
+        const sv = typeof server_version === 'string' && server_version.length <= 32 ? server_version : null;
+        try {
+            db.prepare(`
+        INSERT INTO mcp_tool_calls (tool_name, user_id_hash, server_version, outcome, latency_ms)
+        VALUES (?, ?, ?, ?, ?)
+      `).run(tool_name, uih, sv, outcome, Math.round(lat));
+        }
+        catch { /* swallow — never fail telemetry */ }
+        res.json({ ok: true });
+    });
+    app.get('/api/system-flags', (_req, res) => {
+        const requireRef = db.prepare("SELECT value FROM system_state WHERE key='require_ref_to_register'").get()?.value === '1';
+        const inviteRotation = db.prepare("SELECT value FROM system_state WHERE key='invite_rotation_enabled'").get()?.value === '1';
+        res.json({ require_ref_to_register: requireRef, invite_rotation_enabled: inviteRotation });
+    });
+    // #1045 + #1048 整合 — 公开诚实化 manifest
+    //   /.well-known/webaz-protocol.json  — 标准 well-known URL,任何 HTTP 客户端可发现
+    //   /api/protocol-status              — JSON API 别名(同份内容)
+    // 内容:network_state(协议处于哪一阶段 + 诚实免责) + issuers(信任锚地址 + 轮换历史)
+    // 信任锚是 Phase 4 凭证(/api/me/agents/:prefix/passport)的验签依据,陌生第三方靠这个端点找到"webaz 官方地址"。
+    function buildProtocolManifest() {
+        const phase = db.prepare("SELECT value FROM system_state WHERE key='protocol_phase'").get()?.value || 'pre_launch';
+        // real_users = 已绑 Passkey 的账号数(我们的"真人"定义);pre-launch 应当 ≈0
+        const realUsers = db.prepare("SELECT COUNT(DISTINCT user_id) AS n FROM webauthn_credentials").get()?.n ?? 0;
+        const issuerActiveSince = db.prepare("SELECT value FROM system_state WHERE key='issuer_active_since'").get()?.value || '2026-05-30';
+        return {
+            name: 'WebAZ Protocol',
+            schema_version: 1,
+            network_state: {
+                phase,
+                real_users_on_canonical: realUsers,
+                canonical_endpoint: 'https://webaz.xyz',
+                economic_flow: 'simulated WAZ (test currency, 1 WAZ ≈ 1 USDC peg is a模拟基准, not a real exchange rate). No fiat/crypto settlement yet.',
+                disclaimer: {
+                    zh: '本协议尚未公开上线,真实用户(已绑 Passkey 的账号)数实时反映在 real_users_on_canonical。无真实经济流转。请勿据此评估市场规模、做投资决策、或替终端用户承诺任何经济关系。',
+                    en: 'Protocol is pre-launch; real_users_on_canonical reflects live count of Passkey-bound accounts. No real economic settlement yet. Do not use this data to evaluate market size, make investment decisions, or commit to third parties on a user\'s behalf.',
+                },
+            },
+            issuers: {
+                // 数组结构 — 将来轮换/泄露时往里追加新条目并把旧的设 revoked_at,验真方按签发时间判落在哪个有效区间
+                agent_passport: [
+                    {
+                        address: issuerAddress(),
+                        scheme: 'eip191',
+                        purpose: 'Phase 4 Agent Passport signing (custodian_fingerprint + risk_score + engagement_depth + behavior_profile)',
+                        active_since: issuerActiveSince,
+                        revoked_at: null,
+                        verify: 'verifyMessage(address, passport.canonical, passport.signature) — any party can ecrecover without calling WebAZ',
+                    },
+                ],
+            },
+            // 路线图 — 回应"知道还有哪些没做"的诚实化第三层。哲学:公开当前到达点 + 已知未做项,不承诺时间表。
+            roadmap: {
+                philosophy: 'Disclose what is done + what is known-not-yet-done. We do not commit to deadlines (pre-launch). We DO commit to honest enumeration.',
+                completed: [
+                    'Phase 1-4 Agent Passport: custodian + risk + behavior + signed portable export (cross-protocol ecrecover verifiable)',
+                    'Phase 3a-3d access control: registration rate-limit + invite-required + declared-scope reads/writes + non-Passkey writers must declare',
+                    'Iron-Rule: arbitrate / vote / agent_revoke / delete_passkey / large withdraw all require live WebAuthn ceremony',
+                    'Integrity disclosure: MCP descriptions + /.well-known + pre-launch banner + protocol-status endpoint',
+                ],
+                known_next: [
+                    'Cross-user read daily cap (anti-aggregation; applies to Passkey humans too) — task #1043, awaits real usage to calibrate N',
+                    'Registration captcha or email verification (anti-sybil last mile) — task #1049, pre-launch follow-up',
+                    'Public economic model document — task #1050, pre-launch follow-up',
+                    'Phase 5 ZK privacy L2/L3 — long-term research; triggered when real cross-protocol consumers appear',
+                ],
+                deliberate_deferrals: [
+                    'Model B (independent sub-agent keys with delegated scope) — destination locked; not building until real multi-agent demand surfaces',
+                    'Parameterized fee rates (settleOrder currently hardcodes) — wire when fee governance launches',
+                    'Binary/PV referral region MLM-term cleanup — region-gated to max=3 areas; deferred until structural decision on tree',
+                ],
+                rationale_for_no_dates: 'pre-launch protocols that commit to dates either lie or rush. We commit only to a published list and to honesty about its state.',
+            },
+        };
+    }
+    app.get('/.well-known/webaz-protocol.json', (_req, res) => {
+        res.setHeader('Cache-Control', 'public, max-age=300'); // 5min 边缘缓存,降轮询
+        res.json(buildProtocolManifest());
+    });
+    app.get('/api/protocol-status', (_req, res) => {
+        res.setHeader('Cache-Control', 'public, max-age=300');
+        res.json(buildProtocolManifest());
+    });
+    app.get('/api/editor-picks', (_req, res) => {
+        const products = db.prepare(`
+      SELECT ep.id, ep.target_id, ep.title, ep.note, ep.starts_at, ep.ends_at, ep.sort_order,
+        p.title as product_title, p.price, p.images, p.category,
+        u.handle as seller_handle
+      FROM editor_picks ep
+      JOIN products p ON p.id = ep.target_id AND p.status = 'active'
+      JOIN users u ON u.id = p.seller_id
+      WHERE ep.kind = 'product' AND ep.starts_at <= datetime('now') AND ep.ends_at > datetime('now')
+      ORDER BY ep.sort_order ASC, ep.created_at DESC LIMIT 20
+    `).all();
+        const sellers = db.prepare(`
+      SELECT ep.id, ep.target_id, ep.title, ep.note, ep.starts_at, ep.ends_at, ep.sort_order,
+        u.handle, u.name, u.shop_banner_url, u.bio
+      FROM editor_picks ep
+      JOIN users u ON u.id = ep.target_id AND u.role = 'seller'
+      WHERE ep.kind = 'seller' AND ep.starts_at <= datetime('now') AND ep.ends_at > datetime('now')
+      ORDER BY ep.sort_order ASC, ep.created_at DESC LIMIT 20
+    `).all();
+        res.json({ products, sellers });
+    });
+    app.get('/api/manifest', (_req, res) => {
+        res.json(generateManifest(db));
+    });
+    const _errorReportLimiter = new Map();
+    app.post('/api/error-report', (req, res) => {
+        const ip = req.ip || 'unknown';
+        const now = Date.now();
+        const bucket = _errorReportLimiter.get(ip) || { count: 0, reset: now + 60_000 };
+        if (now > bucket.reset) {
+            bucket.count = 0;
+            bucket.reset = now + 60_000;
+        }
+        bucket.count++;
+        _errorReportLimiter.set(ip, bucket);
+        if (bucket.count > 30)
+            return void res.status(429).json({ error: 'rate_limited' });
+        const { message, stack, url } = req.body || {};
+        if (!message || typeof message !== 'string')
+            return void res.status(400).json({ error: 'message required' });
+        const user = getUser(req);
+        logError('client', message.slice(0, 1000), { stack: String(stack || '').slice(0, 4000), url: String(url || '').slice(0, 500), user_agent: req.headers['user-agent'] || '', user_id: user?.id });
+        res.json({ ok: true });
+    });
+}

package/dist/pwa/routes/push.js

@@ -0,0 +1,54 @@
+/** web-push 失败回调：删除已失效订阅。导出以备 P1-5 任务调用。 */
+export function cleanupStaleSubscription(db, endpoint) {
+    if (!endpoint)
+        return;
+    db.prepare('DELETE FROM push_subscriptions WHERE endpoint = ?').run(endpoint);
+}
+export function registerPushRoutes(app, deps) {
+    const { db, generateId, auth, vapidPublicKey } = deps;
+    app.get('/api/push/vapid-public-key', (_req, res) => {
+        if (!vapidPublicKey)
+            return void res.status(503).json({ error: '推送未配置，请联系管理员设置 VAPID_PUBLIC_KEY' });
+        res.json({ key: vapidPublicKey });
+    });
+    app.post('/api/push/subscribe', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const { endpoint, keys, user_agent } = req.body || {};
+        if (!endpoint || !keys?.p256dh || !keys?.auth) {
+            return void res.status(400).json({ error: '订阅参数不完整（需 endpoint + keys.p256dh + keys.auth）' });
+        }
+        const id = generateId('psub');
+        // 同 user + endpoint 视作重新订阅
+        const existing = db.prepare('SELECT id FROM push_subscriptions WHERE user_id = ? AND endpoint = ?').get(user.id, String(endpoint));
+        if (existing) {
+            db.prepare('UPDATE push_subscriptions SET p256dh = ?, auth = ?, user_agent = ?, enabled = 1 WHERE id = ?')
+                .run(String(keys.p256dh), String(keys.auth), user_agent ? String(user_agent).slice(0, 200) : null, existing.id);
+            return void res.json({ success: true, id: existing.id });
+        }
+        db.prepare(`INSERT INTO push_subscriptions (id, user_id, endpoint, p256dh, auth, user_agent) VALUES (?,?,?,?,?,?)`)
+            .run(id, user.id, String(endpoint), String(keys.p256dh), String(keys.auth), user_agent ? String(user_agent).slice(0, 200) : null);
+        res.json({ success: true, id });
+    });
+    app.delete('/api/push/subscribe', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const { endpoint } = req.body || {};
+        if (endpoint) {
+            db.prepare('DELETE FROM push_subscriptions WHERE user_id = ? AND endpoint = ?').run(user.id, String(endpoint));
+        }
+        else {
+            db.prepare('DELETE FROM push_subscriptions WHERE user_id = ?').run(user.id);
+        }
+        res.json({ success: true });
+    });
+    app.get('/api/push/status', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const cnt = db.prepare('SELECT COUNT(*) as n FROM push_subscriptions WHERE user_id = ? AND enabled = 1').get(user.id).n;
+        res.json({ subscribed: cnt > 0, count: cnt, vapid_configured: !!vapidPublicKey });
+    });
+}

package/dist/pwa/routes/ratings.js

@@ -0,0 +1,220 @@
+import { recordRatingReputation } from '../../layer4-economics/L4-3-reputation/reputation-engine.js';
+const RATING_BLIND_DAYS = 14;
+function parseDim(v) {
+    const n = Number(v);
+    return Number.isInteger(n) && n >= 1 && n <= 5 ? n : null;
+}
+export function registerRatingsRoutes(app, deps) {
+    const { db, generateId, auth, isTrustedRole, errorRes, broadcastSystemEvent } = deps;
+    // buyer → seller 评价（一单一评，仅 completed 订单可评）
+    app.post('/api/orders/:order_id/rating', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        if (isTrustedRole(user))
+            return void errorRes(res, 403, 'TRUSTED_ROLE_NO_TRADE', '受信角色无购物功能');
+        const order = db.prepare('SELECT id, buyer_id, seller_id, product_id, status FROM orders WHERE id = ?').get(req.params.order_id);
+        if (!order)
+            return void res.status(404).json({ error: '订单不存在' });
+        if (order.buyer_id !== user.id)
+            return void res.status(403).json({ error: '仅买家可评价' });
+        if (order.status !== 'completed')
+            return void res.status(400).json({ error: '订单完成后才能评价' });
+        const existing = db.prepare('SELECT order_id FROM order_ratings WHERE order_id = ?').get(order.id);
+        if (existing)
+            return void res.status(400).json({ error: '已评价过，每单仅可评一次' });
+        const stars = Number(req.body?.stars);
+        if (!Number.isInteger(stars) || stars < 1 || stars > 5)
+            return void res.status(400).json({ error: '评分需在 1-5 之间' });
+        const comment = req.body?.comment ? String(req.body.comment).slice(0, 1000) : null;
+        const dimQuality = parseDim(req.body?.dim_quality);
+        const dimSpeed = parseDim(req.body?.dim_speed);
+        const dimService = parseDim(req.body?.dim_service);
+        const hiddenUntil = new Date(Date.now() + RATING_BLIND_DAYS * 24 * 3600 * 1000).toISOString();
+        db.transaction(() => {
+            db.prepare(`INSERT INTO order_ratings (order_id, buyer_id, seller_id, product_id, stars, comment, dim_quality, dim_speed, dim_service, hidden_until)
+        VALUES (?,?,?,?,?,?,?,?,?,?)`)
+                .run(order.id, order.buyer_id, order.seller_id, order.product_id, stars, comment, dimQuality, dimSpeed, dimService, hiddenUntil);
+            try {
+                db.prepare(`INSERT INTO notifications (id, user_id, title, body, order_id) VALUES (?,?,?,?,?)`)
+                    .run(generateId('ntf'), order.seller_id, `⭐ 收到 ${stars} 星评价`, comment ? String(comment).slice(0, 100) : '买家未留言', order.id);
+            }
+            catch { }
+            // L2-5 反哺声誉
+            try {
+                recordRatingReputation(db, { orderId: order.id, revieweeId: order.seller_id, revieweeRole: 'seller', stars });
+            }
+            catch (e) {
+                console.warn('[rating→rep] seller delta failed:', e.message);
+            }
+        })();
+        try {
+            broadcastSystemEvent('rating', '⭐', `${stars} 星评价 (订单 ${order.id})`, order.id);
+        }
+        catch { }
+        res.json({ success: true });
+    });
+    // seller → buyer 反向评价
+    app.post('/api/orders/:order_id/buyer-rating', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const order = db.prepare('SELECT id, buyer_id, seller_id, status FROM orders WHERE id = ?').get(req.params.order_id);
+        if (!order)
+            return void res.status(404).json({ error: '订单不存在' });
+        if (order.seller_id !== user.id)
+            return void res.status(403).json({ error: '仅卖家可评价买家' });
+        if (order.status !== 'completed')
+            return void res.status(400).json({ error: '订单完成后才能评价' });
+        const existing = db.prepare('SELECT order_id FROM buyer_ratings WHERE order_id = ?').get(order.id);
+        if (existing)
+            return void res.status(400).json({ error: '已评价过，每单仅可评一次' });
+        const stars = Number(req.body?.stars);
+        if (!Number.isInteger(stars) || stars < 1 || stars > 5)
+            return void res.status(400).json({ error: '评分需在 1-5 之间' });
+        const comment = req.body?.comment ? String(req.body.comment).slice(0, 1000) : null;
+        const dimPay = parseDim(req.body?.dim_payment_speed);
+        const dimCom = parseDim(req.body?.dim_communication);
+        const dimRsp = parseDim(req.body?.dim_responsiveness);
+        const hiddenUntil = new Date(Date.now() + RATING_BLIND_DAYS * 24 * 3600 * 1000).toISOString();
+        db.transaction(() => {
+            db.prepare(`INSERT INTO buyer_ratings (order_id, seller_id, buyer_id, stars, comment, dim_payment_speed, dim_communication, dim_responsiveness, hidden_until)
+        VALUES (?,?,?,?,?,?,?,?,?)`)
+                .run(order.id, order.seller_id, order.buyer_id, stars, comment, dimPay, dimCom, dimRsp, hiddenUntil);
+            try {
+                db.prepare(`INSERT INTO notifications (id, user_id, title, body, order_id) VALUES (?,?,?,?,?)`)
+                    .run(generateId('ntf'), order.buyer_id, `⭐ 卖家给你 ${stars} 星评价`, comment ? String(comment).slice(0, 100) : '卖家未留言', order.id);
+            }
+            catch { }
+            try {
+                recordRatingReputation(db, { orderId: order.id, revieweeId: order.buyer_id, revieweeRole: 'buyer', stars });
+            }
+            catch (e) {
+                console.warn('[buyer-rating→rep] delta failed:', e.message);
+            }
+        })();
+        res.json({ success: true });
+    });
+    // 查 seller → buyer 评价（双盲遮蔽：buyer 看不到，除非自己也评过 OR 窗口到期）
+    app.get('/api/orders/:order_id/buyer-rating', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const order = db.prepare('SELECT buyer_id, seller_id FROM orders WHERE id = ?').get(req.params.order_id);
+        if (!order)
+            return void res.status(404).json({ error: '订单不存在' });
+        if (order.buyer_id !== user.id && order.seller_id !== user.id) {
+            return void res.status(403).json({ error: '无权查看' });
+        }
+        const br = db.prepare(`SELECT stars, comment, dim_payment_speed, dim_communication, dim_responsiveness, hidden_until, created_at FROM buyer_ratings WHERE order_id = ?`).get(req.params.order_id);
+        if (!br)
+            return void res.json({ item: null });
+        const isBuyerView = order.buyer_id === user.id;
+        const buyerAlsoRated = !!db.prepare(`SELECT order_id FROM order_ratings WHERE order_id = ?`).get(req.params.order_id);
+        const blindExpired = br.hidden_until && new Date(br.hidden_until) < new Date();
+        if (isBuyerView && !buyerAlsoRated && !blindExpired) {
+            return void res.json({ item: { masked: true, hidden_until: br.hidden_until, reason: 'blind_until_both_or_expire' } });
+        }
+        res.json({ item: br });
+    });
+    // 查 buyer → seller 评价（双盲遮蔽：seller 视角同样）
+    app.get('/api/orders/:order_id/rating', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const order = db.prepare('SELECT buyer_id, seller_id FROM orders WHERE id = ?').get(req.params.order_id);
+        if (!order)
+            return void res.status(404).json({ error: '订单不存在' });
+        if (order.buyer_id !== user.id && order.seller_id !== user.id) {
+            return void res.status(403).json({ error: '无权查看' });
+        }
+        const r = db.prepare('SELECT stars, comment, reply, replied_at, buyer_followup, buyer_followup_at, dim_quality, dim_speed, dim_service, hidden_until, created_at FROM order_ratings WHERE order_id = ?').get(req.params.order_id);
+        if (!r)
+            return void res.json({ item: null });
+        const isSellerView = order.seller_id === user.id;
+        const sellerAlsoRated = !!db.prepare(`SELECT order_id FROM buyer_ratings WHERE order_id = ?`).get(req.params.order_id);
+        const blindExpired = r.hidden_until && new Date(r.hidden_until) < new Date();
+        if (isSellerView && !sellerAlsoRated && !blindExpired) {
+            return void res.json({ item: { masked: true, hidden_until: r.hidden_until, reason: 'blind_until_both_or_expire' } });
+        }
+        res.json({ item: r });
+    });
+    app.post('/api/orders/:order_id/rating/reply', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const r = db.prepare('SELECT seller_id, reply FROM order_ratings WHERE order_id = ?').get(req.params.order_id);
+        if (!r)
+            return void res.status(404).json({ error: '该订单暂无评价' });
+        if (r.seller_id !== user.id)
+            return void res.status(403).json({ error: '仅卖家可回复' });
+        if (r.reply)
+            return void res.status(400).json({ error: '已回复过，每条评价仅可回复一次' });
+        const reply = req.body?.reply ? String(req.body.reply).slice(0, 500) : null;
+        if (!reply)
+            return void res.status(400).json({ error: '回复不能为空' });
+        db.prepare(`UPDATE order_ratings SET reply = ?, replied_at = datetime('now') WHERE order_id = ?`).run(reply, req.params.order_id);
+        res.json({ success: true });
+    });
+    // W3 买家追问 — 在卖家 reply 后可追问一次
+    app.post('/api/orders/:order_id/rating/followup', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const r = db.prepare('SELECT buyer_id, reply, buyer_followup FROM order_ratings WHERE order_id = ?').get(req.params.order_id);
+        if (!r)
+            return void res.status(404).json({ error: '该订单暂无评价' });
+        if (r.buyer_id !== user.id)
+            return void res.status(403).json({ error: '仅买家可追问' });
+        if (!r.reply)
+            return void res.status(400).json({ error: '卖家尚未回复，无法追问' });
+        if (r.buyer_followup)
+            return void res.status(400).json({ error: '已追问过一次（每条评价最多一次追问）' });
+        const followup = req.body?.followup ? String(req.body.followup).trim().slice(0, 200) : '';
+        if (followup.length < 2)
+            return void res.status(400).json({ error: '追问内容至少 2 字' });
+        db.prepare(`UPDATE order_ratings SET buyer_followup = ?, buyer_followup_at = datetime('now') WHERE order_id = ?`)
+            .run(followup, req.params.order_id);
+        res.json({ success: true });
+    });
+    // 公开：商品评价 + 聚合（仅展示双盲已揭晓的）
+    app.get('/api/products/:product_id/ratings', (req, res) => {
+        const limit = Math.min(50, Math.max(1, Number(req.query.limit) || 20));
+        const blindOpen = `(EXISTS (SELECT 1 FROM buyer_ratings br WHERE br.order_id = r.order_id) OR r.hidden_until IS NULL OR datetime(r.hidden_until) <= datetime('now'))`;
+        const rows = db.prepare(`
+      SELECT r.stars, r.comment, r.reply, r.replied_at, r.buyer_followup, r.buyer_followup_at, r.created_at,
+             r.dim_quality, r.dim_speed, r.dim_service,
+             u.name as buyer_name, u.handle as buyer_handle
+      FROM order_ratings r
+      JOIN users u ON u.id = r.buyer_id
+      WHERE r.product_id = ? AND ${blindOpen}
+      ORDER BY r.created_at DESC LIMIT ?
+    `).all(req.params.product_id, limit);
+        const agg = db.prepare(`
+      SELECT COUNT(*) as cnt, COALESCE(AVG(stars), 0) as avg_stars,
+        SUM(CASE WHEN stars = 5 THEN 1 ELSE 0 END) as s5,
+        SUM(CASE WHEN stars = 4 THEN 1 ELSE 0 END) as s4,
+        SUM(CASE WHEN stars = 3 THEN 1 ELSE 0 END) as s3,
+        SUM(CASE WHEN stars = 2 THEN 1 ELSE 0 END) as s2,
+        SUM(CASE WHEN stars = 1 THEN 1 ELSE 0 END) as s1
+      FROM order_ratings r WHERE product_id = ? AND ${blindOpen}
+    `).get(req.params.product_id);
+        res.json({ items: rows, agg });
+    });
+    // 公开：卖家评价聚合（卖家主页）
+    app.get('/api/sellers/:seller_id/ratings', (req, res) => {
+        const limit = Math.min(50, Math.max(1, Number(req.query.limit) || 20));
+        const rows = db.prepare(`
+      SELECT r.stars, r.comment, r.reply, r.replied_at, r.buyer_followup, r.buyer_followup_at, r.created_at, r.product_id,
+             p.title as product_title,
+             u.name as buyer_name, u.handle as buyer_handle
+      FROM order_ratings r
+      JOIN products p ON p.id = r.product_id
+      JOIN users u ON u.id = r.buyer_id
+      WHERE r.seller_id = ?
+      ORDER BY r.created_at DESC LIMIT ?
+    `).all(req.params.seller_id, limit);
+        const agg = db.prepare(`SELECT COUNT(*) as cnt, COALESCE(AVG(stars), 0) as avg_stars FROM order_ratings WHERE seller_id = ?`).get(req.params.seller_id);
+        res.json({ items: rows, agg });
+    });
+}