trustbase-seller-backend 0.1.5

package/routes/order.js

@@ -0,0 +1,607 @@
+"use strict";
+/**
+ * Order API Routes — 订单生命周期 (发货 / 确认收货 / 取消 / 发起争议) + 订单查询
+ *
+ * ★ v3.9.4 / D2 链侧口径 (与 trustchain-relmerge proto 逐条对齐; 必须与链升级**同批**上线):
+ *
+ *   | 消息              | signer (proto 注解) | 字段                                                                 |
+ *   |-------------------|---------------------|----------------------------------------------------------------------|
+ *   | MsgShipOrder      | seller              | seller / order_id / tracking_info                                     |
+ *   | MsgConfirmOrder   | **submitter**       | buyer(=订单买家) / order_id / rating / review / **submitter**          |
+ *   | MsgCancelOrder    | **seller**          | canceller(实际发起方) / order_id / **seller**(=签名者=订单卖家)         |
+ *   | MsgDisputeOrder   | **submitter**       | disputer(实际发起方) / order_id / reason / evidence_hash / **submitter**|
+ *
+ *   本服务签名者恒为**本机卖家 key** (`chainWrites.keyAddress`), 代买家提交。
+ *   `submitter`/`seller` 字段 = 该签名地址; `buyer`/`canceller`/`disputer` 是**实际发起方记录**
+ *   (**不是签名者**, 字段语义别搞反 —— keeper 会校验它们与订单的关系)。
+ *   submitter 白名单由 keeper `authorizeOrderSubmit` 判定 (三条路径: 订单卖家 / params.dispute_authority /
+ *   超时兜底), 事件带 `submitter` + `submit_path`; 本服务不复制这套规则, 只在本地挡住"明显错的"。
+ *
+ * ⚠️ **上线顺序 (硬约束, 剧本 §7): 先发本后端, 再换链。**
+ *   - 链升级后, 旧后端发出的 tx 会全部被链拒 (缺 submitter / seller 字段, 或 buyer==seller);
+ *   - 本后端不发新语义的 Confirm/Cancel/Dispute, 则"确认收货/取消/争议"在链上不可用 (死锁);
+ *   - 下单不在这里: 走 `POST /api/orders` (routes/chain-writes.js, 带 tb-auth:<sha256(整批意愿)> memo)。
+ *
+ * 前置校验口径: 订单存在 / 属于本店 / 状态允许 —— **本地先挡明显错的**;
+ * LCD 查不到订单时 fail-open (链上仍是权威), 但"确定不对"(订单属于别人 / 状态不符)时本地就拒。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOrderRoutes = createOrderRoutes;
+const express_1 = require("express");
+const chainWrites = require("./chain-writes");
+const { isTctAddress } = require("../core/address");
+const orderIntent = require("../core/order-intent");
+const intentStore = require("../core/order-intent-store");
+const { classifyChainReject } = require("../core/chain-reject");
+const { HttpError } = chainWrites;
+
+/** 订单状态 (链侧 enum, 出处 x/order/types/params.pb.go:31-39) —— LCD 返回的是枚举名 */
+const ORDER_STATUS = {
+    PENDING: 'ORDER_STATUS_PENDING',
+    SHIPPED: 'ORDER_STATUS_SHIPPED',
+    CONFIRMED: 'ORDER_STATUS_CONFIRMED',
+    DISPUTED: 'ORDER_STATUS_DISPUTED',
+    RESOLVED: 'ORDER_STATUS_RESOLVED',
+    CANCELLED: 'ORDER_STATUS_CANCELLED',
+    REFUNDED: 'ORDER_STATUS_REFUNDED',
+    PAID: 'ORDER_STATUS_PAID',
+};
+const ORDER_STATUS_BY_NUM = ['ORDER_STATUS_PENDING', 'ORDER_STATUS_SHIPPED', 'ORDER_STATUS_CONFIRMED', 'ORDER_STATUS_DISPUTED', 'ORDER_STATUS_RESOLVED', 'ORDER_STATUS_CANCELLED', 'ORDER_STATUS_REFUNDED', 'ORDER_STATUS_PAID'];
+
+/** LCD 可能回枚举名或枚举数字 → 统一成枚举名 */
+function normalizeStatus(v) {
+    if (typeof v === 'number')
+        return ORDER_STATUS_BY_NUM[v] || String(v);
+    const s = String(v === undefined || v === null ? '' : v).trim();
+    if (/^\d+$/.test(s))
+        return ORDER_STATUS_BY_NUM[Number(s)] || s;
+    return s.toUpperCase();
+}
+
+function createOrderRoutes(authPlugin, deps) {
+    const router = (0, express_1.Router)();
+    const db = deps && deps.db ? deps.db : null;
+    const lcdUrl = process.env.LCD_URL || 'http://localhost:1317';
+    const rpcUrl = process.env.RPC_URL || 'http://localhost:26657';
+    let intentTableReady = false;
+
+    // ---------------------------------------------------------------- 共用工具
+
+    /** 操作员鉴权 (沿用本文件既有的 Bearer JWT 口径): 通过返回 tokenData, 否则已写响应并返回 null */
+    async function operator(req, res) {
+        const authHeader = req.headers.authorization;
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            res.status(401).json({ error: 'Missing authorization header' });
+            return null;
+        }
+        const tokenData = await authPlugin.verifyToken(authHeader.substring(7));
+        if (!tokenData) {
+            res.status(401).json({ error: 'Invalid token' });
+            return null;
+        }
+        return tokenData;
+    }
+
+    /** order_id: uint64 数字串 (兼容 orderId / order_id 两种字段名) */
+    function requireOrderId(body) {
+        const raw = body.orderId !== undefined ? body.orderId : body.order_id;
+        const s = String(raw === undefined || raw === null ? '' : raw).trim();
+        if (!s)
+            throw new HttpError(400, 'order_id_required', 'orderId 必填 (链上订单号, uint64 数字串)');
+        if (!/^\d+$/.test(s))
+            throw new HttpError(400, 'order_id_invalid', `orderId 必须是数字串 (链上自增单号), 收到: ${s.slice(0, 32)}`);
+        return s;
+    }
+
+    /** 链上订单查询: 返回 order 对象; 订单不存在返回 null; 其它失败抛 HttpError */
+    async function fetchChainOrder(orderId) {
+        const c = chainWrites.cfg();
+        const url = `${c.lcdUrl}/oxiaom/trustchain/order/v1/orders/${encodeURIComponent(orderId)}`;
+        let resp;
+        try {
+            resp = await fetch(url, { signal: AbortSignal.timeout(5000) });
+        }
+        catch (e) {
+            // LCD 不可达: fail-open (本地拿不到 ≠ 订单不对; 链上仍会校验)
+            console.warn(`[OrderAPI] 查订单失败 (LCD 不可达, 跳过前置校验): ${(e && e.message) || e}`);
+            return { unknown: true };
+        }
+        if (resp.status === 404)
+            return null;
+        if (!resp.ok) {
+            console.warn(`[OrderAPI] 查订单 HTTP ${resp.status} (跳过前置校验)`);
+            return { unknown: true };
+        }
+        const j = await resp.json().catch(() => null);
+        const order = j && j.order ? j.order : null;
+        if (!order) {
+            console.warn('[OrderAPI] 查订单响应缺 order 字段 (跳过前置校验)');
+            return { unknown: true };
+        }
+        return order;
+    }
+
+    /**
+     * 前置校验: 订单存在 / 属于本店 / 状态允许。
+     * 只挡"确定错"的情况; 查不到 (unknown) 就放行, 交给链上判。
+     */
+    async function precheckOrder(orderId, signerAddr, opts) {
+        const order = await fetchChainOrder(orderId);
+        if (order && order.unknown)
+            return { checked: false };
+        if (!order)
+            throw new HttpError(404, 'order_not_found', `链上找不到订单 ${orderId} (可能单号不对, 或还没入块)`);
+        const orderSeller = String(order.seller || '');
+        if (orderSeller && orderSeller !== signerAddr) {
+            throw new HttpError(403, 'order_not_ours',
+                `订单 ${orderId} 不属于本店 (订单卖家 ${orderSeller}, 本机签名地址 ${signerAddr})`);
+        }
+        const status = normalizeStatus(order.status);
+        if (opts && Array.isArray(opts.allowStatus) && status && !opts.allowStatus.includes(status)) {
+            throw new HttpError(409, opts.statusCode || 'order_status_invalid',
+                `订单 ${orderId} 当前状态 ${status}, 该操作要求: ${opts.allowStatus.join(' / ')}`);
+        }
+        return { checked: true, order, status };
+    }
+
+    /** 实际发起方记录 (canceller / disputer): 缺省由调用方给默认值; 必须是订单买卖双方之一 */
+    function resolveParty(raw, order, fallback) {
+        const s = raw === undefined || raw === null || raw === '' ? fallback : String(raw).trim();
+        if (!isTctAddress(s))
+            throw new HttpError(400, 'party_invalid', `发起方标识必须是合法 tct1 地址, 收到: ${String(s).slice(0, 64)}`);
+        const buyer = String((order && order.buyer) || '');
+        const seller = String((order && order.seller) || '');
+        if (buyer && seller && s !== buyer && s !== seller) {
+            throw new HttpError(400, 'party_not_in_order',
+                `发起方必须是订单买家 (${buyer}) 或卖家 (${seller}); 收到: ${s}`);
+        }
+        return s;
+    }
+
+    /** 从 tx 事件里取 order 生命周期事件属性 (submit_path / submitter 等; 拿不到不影响成功) */
+    async function readOrderEvent(txhash, evType) {
+        try {
+            const c = chainWrites.cfg();
+            const resp = await fetch(`${c.lcdUrl}/cosmos/tx/v1beta1/txs/${txhash}`, { signal: AbortSignal.timeout(5000) });
+            const j = await resp.json();
+            for (const ev of (j && j.tx_response && j.tx_response.events) || []) {
+                if (ev.type !== evType)
+                    continue;
+                const get = (k) => {
+                    const a = (ev.attributes || []).find((x) => x.key === k);
+                    return a ? a.value : undefined;
+                };
+                return { submitter: get('submitter'), submit_path: get('submit_path') };
+            }
+        }
+        catch (e) {
+            console.warn(`[OrderAPI] 解析 ${evType} 事件失败 (不影响上链结果): ${(e && e.message) || e}`);
+        }
+        return null;
+    }
+
+    /** 发起一笔生命周期 tx: 卖家 key 签名 → 广播 → 结果分类。返回 {result, signer} */
+    async function sendLifecycle(messages, memo, tag) {
+        const c = chainWrites.cfg();
+        const signer = await chainWrites.keyAddress(c);
+        const result = await chainWrites.sendTxAs(c, messages, signer, memo ? { memo } : undefined);
+        if (result.code !== 0) {
+            const hint = classifyChainReject(result.raw_log);
+            console.error(`[OrderAPI] ${tag} 链上拒绝 code=${result.code} hint=${hint} raw_log=${result.raw_log}`);
+            const err = new HttpError(502, 'chain_tx_failed', `链上拒绝 (code=${result.code})`);
+            err.hint = hint;              // raw_log 原样回传, 不吞
+            err.rawLog = result.raw_log;
+            err.txhash = result.txhash;
+            err.chainCode = result.code;
+            throw err;
+        }
+        return { result, signer };
+    }
+
+    /** 统一的错误出口: HttpError → {error, message}; 链上拒绝带上 hint + raw_log */
+    function fail(res, e, tag) {
+        if (e instanceof HttpError) {
+            const body = { error: e.code, message: e.message };
+            if (e.hint !== undefined)
+                body.hint = e.hint;
+            if (e.rawLog !== undefined)
+                body.raw_log = e.rawLog;
+            if (e.txhash !== undefined)
+                body.txhash = e.txhash;
+            if (e.chainCode !== undefined)
+                body.code = e.chainCode;
+            return res.status(e.status).json(body);
+        }
+        console.error(`[OrderAPI] ${tag} 失败:`, (e && e.message) || e);
+        return res.status(502).json({ error: 'chain_write_error', message: String((e && e.message) || e).slice(0, 200) });
+    }
+
+    /**
+     * 获取订单详情
+     * GET /api/order/:orderId
+     */
+    router.get('/:orderId', async (req, res) => {
+        try {
+            const authHeader = req.headers.authorization;
+            if (!authHeader || !authHeader.startsWith('Bearer ')) {
+                return res.status(401).json({ error: 'Missing authorization header' });
+            }
+            const token = authHeader.substring(7);
+            const tokenData = await authPlugin.verifyToken(token);
+            if (!tokenData) {
+                return res.status(401).json({ error: 'Invalid token' });
+            }
+            const { orderId } = req.params;
+            const response = await fetch(`${lcdUrl}/oxiaom/trustchain/order/v1/orders/${orderId}`);
+            if (!response.ok) {
+                return res.status(404).json({ error: 'Order not found' });
+            }
+            const data = await response.json();
+            res.json({ success: true, order: data.order });
+        }
+        catch (error) {
+            console.error('[OrderAPI] Get order error:', error);
+            res.status(400).json({ error: error.message });
+        }
+    });
+    /**
+     * 获取买家订单列表
+     * GET /api/order/buyer/:address
+     */
+    router.get('/buyer/:address', async (req, res) => {
+        try {
+            const authHeader = req.headers.authorization;
+            if (!authHeader || !authHeader.startsWith('Bearer ')) {
+                return res.status(401).json({ error: 'Missing authorization header' });
+            }
+            const token = authHeader.substring(7);
+            const tokenData = await authPlugin.verifyToken(token);
+            if (!tokenData) {
+                return res.status(401).json({ error: 'Invalid token' });
+            }
+            const { address } = req.params;
+            const response = await fetch(`${lcdUrl}/oxiaom/trustchain/order/v1/buyers/${address}/orders`);
+            if (!response.ok) {
+                return res.status(404).json({ error: 'Buyer orders not found' });
+            }
+            const data = await response.json();
+            res.json({ success: true, orders: data.orders || [], address });
+        }
+        catch (error) {
+            console.error('[OrderAPI] Get buyer orders error:', error);
+            res.status(400).json({ error: error.message });
+        }
+    });
+    /**
+     * 获取卖家订单列表
+     * GET /api/order/seller/:address
+     */
+    router.get('/seller/:address', async (req, res) => {
+        try {
+            const authHeader = req.headers.authorization;
+            if (!authHeader || !authHeader.startsWith('Bearer ')) {
+                return res.status(401).json({ error: 'Missing authorization header' });
+            }
+            const token = authHeader.substring(7);
+            const tokenData = await authPlugin.verifyToken(token);
+            if (!tokenData) {
+                return res.status(401).json({ error: 'Invalid token' });
+            }
+            const { address } = req.params;
+            const response = await fetch(`${lcdUrl}/oxiaom/trustchain/order/v1/sellers/${address}/orders`);
+            if (!response.ok) {
+                return res.status(404).json({ error: 'Seller orders not found' });
+            }
+            const data = await response.json();
+            res.json({ success: true, orders: data.orders || [], address });
+        }
+        catch (error) {
+            console.error('[OrderAPI] Get seller orders error:', error);
+            res.status(400).json({ error: error.message });
+        }
+    });
+    /**
+     * 获取订单参数
+     * GET /api/order/params
+     */
+    router.get('/params/info', async (req, res) => {
+        try {
+            const response = await fetch(`${lcdUrl}/oxiaom/trustchain/order/v1/params`);
+            if (!response.ok) {
+                return res.status(404).json({ error: 'Params not found' });
+            }
+            const data = await response.json();
+            res.json({ success: true, params: data.params });
+        }
+        catch (error) {
+            console.error('[OrderAPI] Get params error:', error);
+            res.status(400).json({ error: error.message });
+        }
+    });
+    /**
+     * POST /api/order/create — ⛔ 已停用 (v3.9.4)
+     *
+     * 结论: **不在这里做第二套下单**。真正的下单主路径是 `POST /api/orders`
+     * (routes/chain-writes.js), 它已具备 v3.9.4 全套语义: buyer 必填校验、卖家签名代建单、
+     * tb-auth 整批意愿 memo + order_intent_log 存证、chain_write_log 幂等、回传 chain_order_ids。
+     *
+     * 本端点此前是 stub: 回一个 `{success:true, msg:{...}}`"构造体" + cli_command, 从不发链,
+     * 且字段是错的 (`product_id/amount/price/memo` 在 proto 里不存在; buyer 取的是平台用户 id
+     * 而不是 tct1 地址)。它比 404 更危险 —— 调用方会以为订单建了。
+     *
+     * 三选一里挑"软删"(410 Gone + 指路):
+     *   - 硬删 = 给未知调用方一个沉默的 404, 排查成本高;
+     *   - 薄封装 = 必须把 stub 的近义字段硬翻译成 `quantity/price_per_unit`
+     *     (`amount` 是数量还是金额? `price` 是单价还是总价?) —— 只能靠猜, 猜错就是把错金额写进链上订单;
+     *   - 410 = 调用方立刻知道该改哪儿, 且这套写路径全仓只有一份实现。
+     */
+    router.post('/create', async (req, res) => {
+        const tokenData = await operator(req, res);
+        if (!tokenData)
+            return;
+        return res.status(410).json({
+            error: 'endpoint_gone',
+            message: '下单请改用 POST /api/orders (buyer_address 必填, 卖家签名代建单, 带 tb-auth 意愿 memo)',
+            use: 'POST /api/orders',
+            removed_in: 'v3.9.4',
+            docs: 'routes/chain-writes.js 的 /api/orders 注释 + README「与插件/安装器的契约」',
+        });
+    });
+    /**
+     * 发货
+     * POST /api/order/ship
+     */
+    router.post('/ship', async (req, res) => {
+        const TAG = '/api/order/ship';
+        try {
+            const tokenData = await operator(req, res);
+            if (!tokenData)
+                return;
+            const body = req.body || {};
+            const orderId = requireOrderId(body);
+            const trackingInfo = String(body.trackingInfo !== undefined ? body.trackingInfo
+                : body.tracking_info !== undefined ? body.tracking_info
+                    : body.trackingNumber !== undefined ? body.trackingNumber : '').slice(0, 200);
+            const c = chainWrites.cfg();
+            const signer = await chainWrites.keyAddress(c);
+            await precheckOrder(orderId, signer, { allowStatus: [ORDER_STATUS.PAID], statusCode: 'order_not_paid' });
+            const msg = {
+                '@type': '/trustchain.order.v1.MsgShipOrder',
+                seller: signer,
+                order_id: orderId,
+                tracking_info: trackingInfo,
+            };
+            const { result } = await sendLifecycle([msg], '', TAG);
+            console.log(`[OrderAPI] ship 成功 order=${orderId} txhash=${result.txhash} seller=${signer}`);
+            return res.json({
+                ok: true,
+                order_id: orderId,
+                txhash: result.txhash,
+                code: result.code,
+                seller: signer,
+                tracking_info: trackingInfo,
+            });
+        }
+        catch (e) {
+            return fail(res, e, TAG);
+        }
+    });
+    /**
+     * POST /api/order/confirm — 确认收货 (代买家; 评分/评价走同一笔 tx)
+     *
+     * v3.9.4/D2: signer = **submitter** (=本机卖家 key); `buyer` 是实际发起方记录,
+     * keeper 校验它必须 = 订单买家 → 本端点**从链上订单取 buyer**, 不信 payload
+     * (避免调用方填错被链拒); payload 里的 buyer_address 只做事后核对。
+     * 白名单三条路径由 keeper 判定 (订单卖家 / dispute_authority / 超时兜底), 事件回 submit_path。
+     */
+    router.post('/confirm', async (req, res) => {
+        const TAG = '/api/order/confirm';
+        try {
+            const tokenData = await operator(req, res);
+            if (!tokenData)
+                return;
+            const body = req.body || {};
+            const orderId = requireOrderId(body);
+            const ratingRaw = body.rating === undefined || body.rating === null || body.rating === '' ? '0' : String(body.rating).trim();
+            if (!/^\d+$/.test(ratingRaw) || Number(ratingRaw) > 5)
+                throw new HttpError(400, 'rating_invalid', 'rating 必须是 0-5 的整数 (0 = 未评分)');
+            const review = String(body.review === undefined ? '' : body.review).slice(0, 500);
+            const c = chainWrites.cfg();
+            const signer = await chainWrites.keyAddress(c);
+            const pre = await precheckOrder(orderId, signer, { allowStatus: [ORDER_STATUS.SHIPPED], statusCode: 'order_not_shipped' });
+            // buyer 以链上订单为准 (payload 里的 buyer_address 只做事后核对, 不作输入)
+            let orderBuyer = pre.order ? String(pre.order.buyer || '') : '';
+            if (!orderBuyer) {
+                // 链上读不到 (LCD 不可达/响应异常): 允许调用方显式带 buyer_address, 否则宁可 503 也不发必被拒的 tx
+                const fromPayload = body.buyer_address === undefined ? '' : String(body.buyer_address).trim();
+                if (!isTctAddress(fromPayload)) {
+                    throw new HttpError(503, 'order_lookup_unavailable',
+                        'LCD 暂时读不到订单买家 (链不可达); 请稍后重试, 或在 payload 里带 buyer_address (必须 = 订单买家)');
+                }
+                orderBuyer = fromPayload;
+            }
+            if (body.buyer_address !== undefined && orderBuyer && String(body.buyer_address).trim() !== orderBuyer) {
+                throw new HttpError(400, 'buyer_mismatch',
+                    `buyer_address (${String(body.buyer_address).slice(0, 64)}) 与链上订单买家 (${orderBuyer}) 不一致`);
+            }
+            const msg = {
+                '@type': '/trustchain.order.v1.MsgConfirmOrder',
+                buyer: orderBuyer,
+                order_id: orderId,
+                rating: ratingRaw,
+                review,
+                submitter: signer,
+            };
+            const { result } = await sendLifecycle([msg], '', TAG);
+            const ev = await readOrderEvent(result.txhash, 'confirm_order');
+            console.log(`[OrderAPI] confirm 成功 order=${orderId} txhash=${result.txhash} submitter=${signer} path=${(ev && ev.submit_path) || '?'}`);
+            return res.json({
+                ok: true,
+                order_id: orderId,
+                txhash: result.txhash,
+                code: result.code,
+                buyer: orderBuyer,
+                submitter: signer,
+                submit_path: (ev && ev.submit_path) || null,
+                rating: Number(ratingRaw),
+            });
+        }
+        catch (e) {
+            return fail(res, e, TAG);
+        }
+    });
+    /**
+     * POST /api/order/cancel — 取消订单 (仅 PENDING)
+     *
+     * v3.9.4: signer = **seller** (=本机卖家 key; keeper 校验 `seller` 必须 = 订单卖家);
+     * `canceller` 是实际发起方记录 (buyer 或 seller, keeper 校验)。
+     * 缺省记 seller (本店自己取消); "买家要求取消、卖家代提交" 时传 `initiator: "buyer"`
+     * 或 `canceller: <买家地址>`。
+     * 注意: proto 里 MsgCancelOrder **没有 reason 字段** —— 传了只进本地日志, 不上链。
+     */
+    router.post('/cancel', async (req, res) => {
+        const TAG = '/api/order/cancel';
+        try {
+            const tokenData = await operator(req, res);
+            if (!tokenData)
+                return;
+            const body = req.body || {};
+            const orderId = requireOrderId(body);
+            const reason = String(body.reason === undefined ? '' : body.reason).slice(0, 200);
+            const c = chainWrites.cfg();
+            const signer = await chainWrites.keyAddress(c);
+            const pre = await precheckOrder(orderId, signer, { allowStatus: [ORDER_STATUS.PENDING], statusCode: 'order_not_pending' });
+            const initiator = String(body.initiator === undefined ? '' : body.initiator).trim().toLowerCase();
+            const fallback = initiator === 'buyer' && pre.order ? String(pre.order.buyer || signer) : signer;
+            const canceller = resolveParty(body.canceller, pre.order || {}, fallback);
+            const msg = {
+                '@type': '/trustchain.order.v1.MsgCancelOrder',
+                canceller,
+                order_id: orderId,
+                seller: signer,
+            };
+            const { result } = await sendLifecycle([msg], '', TAG);
+            console.log(`[OrderAPI] cancel 成功 order=${orderId} txhash=${result.txhash} canceller=${canceller}${reason ? ` reason=${reason}` : ''}`);
+            const out = {
+                ok: true,
+                order_id: orderId,
+                txhash: result.txhash,
+                code: result.code,
+                canceller,
+                seller: signer,
+            };
+            if (reason)
+                out.note = 'reason 只记本地日志 (链上 MsgCancelOrder 无 reason 字段)';
+            return res.json(out);
+        }
+        catch (e) {
+            return fail(res, e, TAG);
+        }
+    });
+    /**
+     * POST /api/order/dispute — 发起争议 (代买家立案; 卖家与平台是"买家不持私钥"时的两条入口)
+     *
+     * v3.9.4/D2: signer = **submitter** (=本机卖家 key); `disputer` 是实际发起方记录
+     * (buyer 或 seller, keeper 校验)。缺省记**订单买家** (卖家代买家立案);
+     * 卖家自己发起则传 `initiator: "seller"` 或 `disputer: <本机地址>`。
+     * memo: tb-auth:<sha256(申诉意愿)> —— 原文本地存 order_intent_log (kind=tb.dispute.intent),
+     * 争议时出示原文并复算 hash 与链上 tx memo 比对。
+     */
+    router.post('/dispute', async (req, res) => {
+        const TAG = '/api/order/dispute';
+        try {
+            const tokenData = await operator(req, res);
+            if (!tokenData)
+                return;
+            const body = req.body || {};
+            const orderId = requireOrderId(body);
+            const reason = String(body.reason === undefined || body.reason === null ? '' : body.reason).trim();
+            if (!reason)
+                throw new HttpError(400, 'reason_required', 'reason 必填 (争议原因, 链上会记进订单)');
+            if (reason.length > 200)
+                throw new HttpError(400, 'reason_too_long', 'reason 最长 200 字符');
+            const evidenceHashRaw = body.evidence_hash !== undefined ? body.evidence_hash
+                : body.evidenceHash !== undefined ? body.evidenceHash : '';
+            const evidenceHash = String(evidenceHashRaw === null ? '' : evidenceHashRaw).trim();
+            if (evidenceHash !== '' && !orderIntent.isHex64(evidenceHash))
+                throw new HttpError(400, 'evidence_hash_invalid', 'evidence_hash 必须是空串或 64 位小写 hex (sha256)');
+            const c = chainWrites.cfg();
+            const signer = await chainWrites.keyAddress(c);
+            const pre = await precheckOrder(orderId, signer, {
+                allowStatus: [ORDER_STATUS.SHIPPED, ORDER_STATUS.CONFIRMED],
+                statusCode: 'order_not_disputable',
+            });
+            if (pre.order && normalizeStatus(pre.order.status) === ORDER_STATUS.CONFIRMED && pre.order.settled === true) {
+                throw new HttpError(409, 'order_settled', `订单 ${orderId} 已结算, 不能再发起争议`);
+            }
+            const initiator = String(body.initiator === undefined ? '' : body.initiator).trim().toLowerCase();
+            const fallback = initiator === 'seller' ? signer : (pre.order ? String(pre.order.buyer || signer) : signer);
+            const disputer = resolveParty(body.disputer, pre.order || {}, fallback);
+            const intent = orderIntent.buildDisputeIntentHash({
+                disputer,
+                seller: signer,
+                submitter: signer,
+                order_id: orderId,
+                reason,
+                evidence_hash: evidenceHash,
+                timestamp_ms: orderIntent.normalizeTimestampMs(body.timestamp),
+            });
+            if (db) {
+                try {
+                    if (!intentTableReady) {
+                        intentStore.ensureIntentTable(db);
+                        intentTableReady = true;
+                    }
+                    intentStore.recordIntent(db, {
+                        intent_hash: intent.hash,
+                        kind: 'tb.dispute.intent',
+                        order_id: orderId,
+                        buyer: disputer,
+                        seller: signer,
+                        session_ref: '',
+                        memo: intent.memo,
+                        intent_json: intent.canonical,
+                        status: 'pending',
+                    });
+                }
+                catch (e) {
+                    // 意愿记不下就不发交易 (留证是这条链路的意义之一); 抛出去走 502, 可重试
+                    throw new HttpError(500, 'intent_store_failed', `申诉意愿存证失败, 未发交易: ${(e && e.message) || e}`);
+                }
+            }
+            else {
+                console.warn('[OrderAPI] 未注入 db: 申诉意愿只回 hash, 不做本地存证');
+            }
+            const msg = {
+                '@type': '/trustchain.order.v1.MsgDisputeOrder',
+                disputer,
+                order_id: orderId,
+                reason,
+                evidence_hash: evidenceHash,
+                submitter: signer,
+            };
+            const { result } = await sendLifecycle([msg], intent.memo, TAG);
+            if (db && !intentStore.markIntentTx(db, intent.hash, result.txhash, 'success'))
+                console.warn('[OrderAPI] 申诉意愿表回填 txhash 失败 (不影响上链结果)');
+            const ev = await readOrderEvent(result.txhash, 'dispute_order');
+            console.log(`[OrderAPI] dispute 成功 order=${orderId} txhash=${result.txhash} disputer=${disputer} submitter=${signer} path=${(ev && ev.submit_path) || '?'}`);
+            return res.json({
+                ok: true,
+                order_id: orderId,
+                txhash: result.txhash,
+                code: result.code,
+                disputer,
+                submitter: signer,
+                submit_path: (ev && ev.submit_path) || null,
+                evidence_hash: evidenceHash,
+                dispute_intent_hash: intent.hash,
+                dispute_intent_memo: intent.memo,
+            });
+        }
+        catch (e) {
+            return fail(res, e, TAG);
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=order.js.map

package/routes/order.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"order.js","sourceRoot":"","sources":["../../src/routes/order.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAKH,8CAiUC;AApUD,qCAAoD;AAGpD,SAAgB,iBAAiB,CAAC,UAAsB;IACtD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAE/D;;;OAGG;IACH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,sCAAsC,OAAO,EAAE,CAAC,CAAC;YAEvF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAS,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAClE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,sCAAsC,OAAO,SAAS,CAAC,CAAC;YAE9F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAS,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,uCAAuC,OAAO,SAAS,CAAC,CAAC;YAE/F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAS,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,oCAAoC,CAAC,CAAC;YAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAS,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAE5D,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC,CAAC;YACtG,CAAC;YAED,YAAY;YACZ,MAAM,GAAG,GAAG;gBACV,IAAI,EAAE,qCAAqC;gBAC3C,KAAK,EAAE;oBACL,KAAK,EAAE,SAAS,CAAC,MAAM;oBACvB,MAAM;oBACN,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;oBACtB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;oBACpB,IAAI,EAAE,IAAI,IAAI,EAAE;iBACjB;aACF,CAAC;YAEF,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,oCAAoC;gBAC7C,GAAG;gBACH,IAAI,EAAE,qDAAqD;gBAC3D,WAAW,EAAE,qCAAqC,MAAM,IAAI,SAAS,IAAI,MAAM,IAAI,KAAK,6CAA6C;aACtI,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAE7C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC5E,CAAC;YAED,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,gCAAgC;gBACzC,GAAG,EAAE;oBACH,IAAI,EAAE,mCAAmC;oBACzC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,IAAI,EAAE,EAAE;iBAC9F;gBACD,WAAW,EAAE,mCAAmC,OAAO,IAAI,cAAc,IAAI,EAAE,8CAA8C;aAC9H,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAE7B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC5E,CAAC;YAED,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,mCAAmC;gBAC5C,GAAG,EAAE;oBACH,IAAI,EAAE,sCAAsC;oBAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE;iBACtD;gBACD,WAAW,EAAE,sCAAsC,OAAO,6CAA6C;aACxG,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAErC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC5E,CAAC;YAED,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,kCAAkC;gBAC3C,GAAG,EAAE;oBACH,IAAI,EAAE,qCAAqC;oBAC3C,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE;iBAC5E;gBACD,WAAW,EAAE,qCAAqC,OAAO,6CAA6C;aACvG,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC5E,CAAC;YAED,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,mCAAmC;gBAC5C,GAAG,EAAE;oBACH,IAAI,EAAE,wCAAwC;oBAC9C,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE;iBACzG;gBACD,WAAW,EAAE,wCAAwC,OAAO,gDAAgD;aAC7G,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/routes/p2p-api.d.ts

@@ -0,0 +1,33 @@
+/**
+ * TrustChain P2P M2M API（PRD-F §2.2 Phase 1）
+ *
+ * 节点 ↔ 节点的 M2M HTTP 接口，不依赖会话/JWT。
+ * Phase 1 提供：
+ *   GET  /api/p2p/identity              本节点身份卡（indexer_id + 公钥 + endpoint）
+ *   GET  /api/p2p/products              商品索引（since/limit/cursor 分页）
+ *   GET  /api/p2p/product/:hash         单品详情（chain + extended data）
+ *   GET  /api/p2p/media/:sku/:filename  媒体代理（Phase 1 stub → 404）
+ *   POST /api/p2p/inquiry               买家询价收件箱（Phase 1 入库 fallback）
+ *
+ * 签名模型：
+ *   - 所有 GET 响应都带 `indexer_signature` 或 `signature` 字段
+ *   - 客户端用 /identity 拿到的公钥验签，确认这条响应确实是该 indexer 发的
+ */
+import { Router } from 'express';
+/**
+ * M2M 路由依赖 —— 只接一个 SQLite handle，方便测试注入内存库。
+ * Phase 1 不要求真实签名 key；没传 privKey 时只回明文（部署前会接入 sellerKey）。
+ */
+export interface P2PRouterDeps {
+    db: any;
+    /** 当前节点的 seller 私钥（base64 raw 32 字节）；可选 */
+    getSellerPrivKey?: () => Uint8Array | undefined;
+    /** 当前节点的 seller 地址（bech32）；可选 */
+    getSellerAddress?: () => string | undefined;
+    /** 当前节点的 seller 公钥（raw 33 字节压缩）；可选 */
+    getSellerPubKey?: () => Uint8Array | undefined;
+    port?: number;
+    chainId?: string;
+}
+export declare function createP2PRouter(deps: P2PRouterDeps): Router;
+//# sourceMappingURL=p2p-api.d.ts.map

package/routes/p2p-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"p2p-api.d.ts","sourceRoot":"","sources":["../../src/routes/p2p-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AAIpD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,GAAG,CAAC;IACR,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,MAAM,UAAU,GAAG,SAAS,CAAC;IAChD,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC5C,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,UAAU,GAAG,SAAS,CAAC;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAQD,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAgP3D"}