trustbase-seller-backend 0.1.5

package/mcp/web-panel.js

@@ -0,0 +1,1657 @@
+"use strict";
+/**
+ * TrustCoin MCP Web Panel
+ *
+ * 内嵌在 MCP Server 中的轻量 Web 管理面板
+ * - 钱包创建/导入
+ * - 密码加密存储
+ * - 2FA/TOTP 绑定
+ * - 链状态仪表板
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWebPanel = createWebPanel;
+const express_1 = __importDefault(require("express"));
+const path_1 = require("path");
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_2 = __importDefault(require("path"));
+const amino_1 = require("@cosmjs/amino");
+const stargate_1 = require("@cosmjs/stargate");
+const base32_1 = require("../utils/base32");
+const totp_1 = require("../utils/totp");
+const runtime_data_1 = require("../core/runtime-data");
+// ===================== Storage =====================
+const PROFILES_FILE = runtime_data_1.runtimeDataFile('profiles.json');
+const SESSIONS = new Map();
+function loadProfiles() {
+    try {
+        return JSON.parse(fs_1.default.readFileSync(PROFILES_FILE, 'utf8'));
+    }
+    catch {
+        return [];
+    }
+}
+function saveProfiles(profiles) {
+    const dir = path_2.default.dirname(PROFILES_FILE);
+    if (!fs_1.default.existsSync(dir))
+        fs_1.default.mkdirSync(dir, { recursive: true });
+    fs_1.default.writeFileSync(PROFILES_FILE, JSON.stringify(profiles, null, 2));
+}
+// ===================== Crypto Helpers =====================
+function deriveKey(password, salt) {
+    return crypto_1.default.pbkdf2Sync(password, salt, 100000, 32, 'sha256');
+}
+function encrypt(text, password) {
+    const salt = crypto_1.default.randomBytes(16).toString('hex');
+    const key = deriveKey(password, salt);
+    const iv = crypto_1.default.randomBytes(12);
+    const cipher = crypto_1.default.createCipheriv('aes-256-gcm', key, iv);
+    let encrypted = cipher.update(text, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const tag = cipher.getAuthTag();
+    return {
+        encrypted: encrypted + ':' + tag.toString('hex'),
+        iv: iv.toString('hex'),
+        salt,
+    };
+}
+function decrypt(encryptedText, iv, salt, password) {
+    const key = deriveKey(password, salt);
+    const parts = encryptedText.split(':');
+    const tag = parts.pop();
+    const data = parts.join(':');
+    const decipher = crypto_1.default.createDecipheriv('aes-256-gcm', key, Buffer.from(iv, 'hex'));
+    decipher.setAuthTag(Buffer.from(tag, 'hex'));
+    let decrypted = decipher.update(data, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
+// ===================== Mnemonic Generation (BIP39-like) =====================
+const WORDLIST = [
+    'abandon', 'ability', 'able', 'about', 'above', 'absent', 'absorb', 'abstract',
+    'absurd', 'abuse', 'access', 'accident', 'account', 'accuse', 'achieve', 'acid',
+    'acoustic', 'acquire', 'across', 'act', 'action', 'actor', 'actress', 'actual',
+    'adapt', 'add', 'addict', 'address', 'adjust', 'admit', 'adult', 'advance',
+    'advice', 'aerobic', 'affair', 'afford', 'afraid', 'again', 'age', 'agent',
+    'agree', 'ahead', 'aim', 'air', 'airport', 'aisle', 'alarm', 'album',
+    'alcohol', 'alert', 'alien', 'all', 'alley', 'allow', 'almost', 'alone',
+    'alpha', 'already', 'also', 'alter', 'always', 'amateur', 'amazing', 'among',
+    'amount', 'amused', 'analyst', 'anchor', 'ancient', 'anger', 'angle', 'angry',
+    'animal', 'ankle', 'announce', 'annual', 'another', 'answer', 'antenna', 'antique',
+    'anxiety', 'any', 'apart', 'apology', 'appear', 'apple', 'approve', 'april',
+    'arch', 'arctic', 'area', 'arena', 'argue', 'arm', 'armed', 'armor',
+    'army', 'around', 'arrange', 'arrest', 'arrive', 'arrow', 'art', 'artefact',
+    'artist', 'artwork', 'ask', 'aspect', 'assault', 'asset', 'assist', 'assume',
+    'asthma', 'athlete', 'atom', 'attack', 'attend', 'attitude', 'attract', 'auction',
+    'audit', 'august', 'aunt', 'author', 'auto', 'autumn', 'average', 'avocado',
+    'avoid', 'awake', 'aware', 'awesome', 'awful', 'awkward', 'axis', 'baby',
+    'bachelor', 'bacon', 'badge', 'bag', 'balance', 'balcony', 'ball', 'bamboo',
+    'banana', 'banner', 'bar', 'barely', 'bargain', 'barrel', 'base', 'basic',
+    'basket', 'battle', 'beach', 'bean', 'beauty', 'because', 'become', 'beef',
+    'before', 'begin', 'behave', 'behind', 'believe', 'below', 'belt', 'bench',
+    'benefit', 'best', 'betray', 'better', 'between', 'beyond', 'bicycle', 'bid',
+    // ... truncated for size, will use crypto random selection
+];
+function generateMnemonic(wordCount = 24) {
+    // Use bip39 for proper BIP39 checksum
+    const bip39 = require('bip39');
+    return bip39.generateMnemonic(wordCount === 24 ? 256 : 128);
+}
+// ===================== TOTP Helpers =====================
+function generateTotpSecret() {
+    return (0, base32_1.encodeBase32)(crypto_1.default.randomBytes(20));
+}
+function generateTotpUri(secret, address) {
+    return `otpauth://totp/TrustCoin:${address}?secret=${secret}&issuer=TrustCoin&algorithm=SHA1&digits=6&period=30`;
+}
+// ===================== Auth Middleware =====================
+function authMiddleware(req, res, next) {
+    const token = req.headers.authorization?.replace('Bearer ', '');
+    if (!token) {
+        res.status(401).json({ error: '未登录' });
+        return;
+    }
+    const session = SESSIONS.get(token);
+    if (!session || session.expiresAt < Date.now()) {
+        SESSIONS.delete(token);
+        res.status(401).json({ error: '会话过期' });
+        return;
+    }
+    const profiles = loadProfiles();
+    const profile = profiles.find(p => p.id === session.walletId);
+    if (!profile) {
+        res.status(401).json({ error: '钱包不存在' });
+        return;
+    }
+    req.profile = profile;
+    req.session = session;
+    next();
+}
+// ===================== Web Panel HTML =====================
+function getPanelHtml() {
+    return `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>TrustCoin</title>
+<style>
+  :root {
+    --bg-primary: #09090b;
+    --bg-secondary: #18181b;
+    --bg-tertiary: #27272a;
+    --border: #3f3f46;
+    --border-hover: #52525b;
+    --text-primary: #fafafa;
+    --text-secondary: #a1a1aa;
+    --text-muted: #71717a;
+    --accent: #8b5cf6;
+    --accent-hover: #7c3aed;
+    --accent-soft: rgba(139,92,246,0.15);
+    --success: #22c55e;
+    --success-bg: rgba(34,197,94,0.1);
+    --error: #ef4444;
+    --error-bg: rgba(239,68,68,0.1);
+    --warning: #f59e0b;
+    --warning-bg: rgba(245,158,11,0.1);
+    --radius: 8px;
+    --radius-lg: 12px;
+  }
+  * { margin:0; padding:0; box-sizing:border-box; }
+  body {
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Inter', 'Noto Sans SC', 'Noto Sans JP', sans-serif;
+    background: var(--bg-primary); color: var(--text-primary);
+    min-height: 100vh; line-height: 1.5; -webkit-font-smoothing: antialiased;
+  }
+  .shell { max-width:480px; margin:0 auto; padding:24px 16px; min-height:100vh; }
+  .header {
+    display:flex; align-items:center; gap:12px; padding:16px 0 24px;
+    border-bottom:1px solid var(--border); margin-bottom:24px;
+  }
+  .header-icon {
+    width:40px; height:40px; background:var(--accent); border-radius:var(--radius);
+    display:flex; align-items:center; justify-content:center; flex-shrink:0;
+  }
+  .header-icon svg { width:22px; height:22px; color:white; }
+  .header-text { flex:1; }
+  .header-text h1 { font-size:18px; font-weight:600; letter-spacing:-0.01em; }
+  .header-text p { font-size:13px; color:var(--text-muted); margin-top:2px; }
+  /* Language Switcher */
+  .lang-switch {
+    display:flex; gap:2px; background:var(--bg-secondary); border:1px solid var(--border);
+    border-radius:6px; padding:2px;
+  }
+  .lang-btn {
+    padding:4px 10px; border:none; background:none; color:var(--text-muted);
+    font-size:11px; font-weight:500; cursor:pointer; border-radius:4px; transition:all .15s;
+  }
+  .lang-btn:hover { color:var(--text-secondary); }
+  .lang-btn.active { background:var(--bg-tertiary); color:var(--text-primary); }
+
+  .status-bar { display:grid; grid-template-columns:repeat(3,1fr); gap:8px; margin-bottom:24px; }
+  .stat-card { background:var(--bg-secondary); border:1px solid var(--border); border-radius:var(--radius); padding:12px; }
+  .stat-card .value { font-size:16px; font-weight:600; color:var(--text-primary); }
+  .stat-card .label { font-size:11px; color:var(--text-muted); margin-top:2px; text-transform:uppercase; letter-spacing:.05em; }
+
+  .card { background:var(--bg-secondary); border:1px solid var(--border); border-radius:var(--radius-lg); padding:20px; margin-bottom:16px; }
+  .card-title { font-size:14px; font-weight:600; color:var(--text-primary); margin-bottom:16px; display:flex; align-items:center; gap:8px; }
+  .card-title svg { width:16px; height:16px; color:var(--text-muted); }
+
+  .tabs {
+    display:flex; gap:2px; background:var(--bg-secondary); border:1px solid var(--border);
+    border-radius:var(--radius); padding:3px; margin-bottom:24px;
+  }
+  .tab-btn {
+    flex:1; padding:8px 12px; border:none; background:none; color:var(--text-muted);
+    font-size:13px; font-weight:500; cursor:pointer; border-radius:6px; transition:all .15s;
+  }
+  .tab-btn:hover { color:var(--text-secondary); }
+  .tab-btn.active { background:var(--bg-tertiary); color:var(--text-primary); }
+  .tab-content { display:none; }
+  .tab-content.active { display:block; }
+
+  .field { margin-bottom:16px; }
+  .field-label { display:block; font-size:13px; font-weight:500; color:var(--text-secondary); margin-bottom:6px; }
+  .input {
+    width:100%; padding:9px 12px; background:var(--bg-primary); border:1px solid var(--border);
+    border-radius:var(--radius); color:var(--text-primary); font-size:14px; transition:border-color .15s; outline:none;
+  }
+  .input:focus { border-color:var(--accent); }
+  .input::placeholder { color:var(--text-muted); }
+  .input-totp { font-size:20px; letter-spacing:8px; text-align:center; font-family:'SF Mono','Cascadia Code',monospace; }
+
+  .btn {
+    display:inline-flex; align-items:center; justify-content:center; gap:6px;
+    padding:9px 16px; border:1px solid var(--border); border-radius:var(--radius);
+    background:var(--bg-secondary); color:var(--text-primary); font-size:13px; font-weight:500;
+    cursor:pointer; transition:all .15s; white-space:nowrap;
+  }
+  .btn:hover { background:var(--bg-tertiary); border-color:var(--border-hover); }
+  .btn svg { width:14px; height:14px; }
+  .btn-primary { background:var(--accent); border-color:var(--accent); color:white; }
+  .btn-primary:hover { background:var(--accent-hover); border-color:var(--accent-hover); }
+  .btn-danger { border-color:var(--error); color:var(--error); }
+  .btn-danger:hover { background:var(--error-bg); }
+  .btn-full { width:100%; }
+  .btn-sm { padding:6px 12px; font-size:12px; }
+  .btn-ghost { border:none; background:none; color:var(--text-muted); }
+  .btn-ghost:hover { color:var(--text-primary); background:var(--bg-tertiary); }
+
+  .mnemonic-grid { display:grid; grid-template-columns:repeat(4,1fr); gap:4px; margin:12px 0; }
+  .mnemonic-word {
+    background:var(--bg-primary); border:1px solid var(--border); border-radius:6px;
+    padding:6px 4px; font-size:12px; font-family:'SF Mono','Cascadia Code',monospace;
+    color:var(--accent); text-align:center; user-select:all;
+  }
+  .mnemonic-word .num { color:var(--text-muted); font-size:9px; margin-right:2px; }
+
+  .alert {
+    padding:12px; border-radius:var(--radius); font-size:13px; margin:12px 0;
+    display:flex; align-items:flex-start; gap:8px;
+  }
+  .alert svg { width:16px; height:16px; flex-shrink:0; margin-top:1px; }
+  .alert-warning { background:var(--warning-bg); border:1px solid rgba(245,158,11,.2); color:var(--warning); }
+  .alert-success { background:var(--success-bg); border:1px solid rgba(34,197,94,.2); color:var(--success); }
+  .alert-error { background:var(--error-bg); border:1px solid rgba(239,68,68,.2); color:var(--error); }
+
+  .info-row {
+    display:flex; justify-content:space-between; align-items:center;
+    padding:10px 0; border-bottom:1px solid var(--border); font-size:13px;
+  }
+  .info-row:last-child { border-bottom:none; }
+  .info-row .key { color:var(--text-muted); }
+  .info-row .value { color:var(--text-primary); font-family:'SF Mono','Cascadia Code',monospace; font-size:12px; }
+
+  .badge { display:inline-flex; align-items:center; padding:2px 8px; border-radius:99px; font-size:11px; font-weight:500; }
+  .badge-success { background:var(--success-bg); color:var(--success); }
+  .badge-warning { background:var(--warning-bg); color:var(--warning); }
+
+  .balance { font-size:32px; font-weight:700; color:var(--text-primary); letter-spacing:-0.02em; margin:4px 0 16px; }
+  .balance .unit { font-size:16px; font-weight:400; color:var(--text-muted); margin-left:4px; }
+
+  .qr-container { text-align:center; margin:16px 0; }
+  .qr-container img { border-radius:var(--radius); border:1px solid var(--border); }
+  .qr-hint { font-size:12px; color:var(--text-muted); margin-top:8px; }
+  .qr-key {
+    font-family:'SF Mono','Cascadia Code',monospace; font-size:12px; color:var(--accent);
+    word-break:break-all; background:var(--bg-primary); padding:8px 12px;
+    border-radius:6px; border:1px solid var(--border); margin-top:8px; text-align:center;
+  }
+
+  .divider { height:1px; background:var(--border); margin:20px 0; }
+  .dash-nav {
+    display:flex; align-items:center; gap:2px; background:var(--bg-secondary);
+    border:1px solid var(--border); border-radius:var(--radius); padding:3px; margin-bottom:24px;
+  }
+  .dash-nav .tab-btn { flex:none; padding:8px 14px; }
+  .dash-nav .spacer { flex:1; }
+  .btn-group { display:flex; gap:8px; margin-top:16px; }
+  pre {
+    background:var(--bg-primary); border:1px solid var(--border); border-radius:var(--radius);
+    padding:12px; font-size:12px; overflow-x:auto; color:var(--text-secondary);
+    font-family:'SF Mono','Cascadia Code',monospace;
+  }
+</style>
+</head>
+<body>
+<div class="shell">
+  <div class="header">
+    <div class="header-icon">
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><path d="M12 6v12M6 12h12"/></svg>
+    </div>
+    <div class="header-text">
+      <h1>TrustCoin</h1>
+      <p data-i18n="subtitle">Decentralized E-Commerce Protocol</p>
+    </div>
+    <div class="lang-switch">
+      <button class="lang-btn active" onclick="setLang('zh')">中文</button>
+      <button class="lang-btn" onclick="setLang('en')">EN</button>
+      <button class="lang-btn" onclick="setLang('ja')">日本語</button>
+    </div>
+  </div>
+
+  <div class="status-bar" id="chainStatus">
+    <div class="stat-card"><div class="value" id="blockHeight">--</div><div class="label" data-i18n="height">Height</div></div>
+    <div class="stat-card"><div class="value" id="chainId">--</div><div class="label" data-i18n="chain">Chain</div></div>
+    <div class="stat-card"><div class="value" id="syncStatus">--</div><div class="label" data-i18n="status">Status</div></div>
+  </div>
+
+  <div id="authSection">
+    <div class="tabs">
+      <button class="tab-btn active" onclick="showTab('login',this)" data-i18n="signIn">Sign In</button>
+      <button class="tab-btn" onclick="showTab('create',this)" data-i18n="create">Create</button>
+      <button class="tab-btn" onclick="showTab('import',this)" data-i18n="import">Import</button>
+    </div>
+
+    <div id="tab-login" class="tab-content active">
+      <div class="card">
+        <div class="card-title">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="11" width="18" height="11" rx="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/></svg>
+          <span data-i18n="signIn">Sign In</span>
+        </div>
+        <div class="field">
+          <label class="field-label" data-i18n="password">Password</label>
+          <input type="password" class="input" id="loginPassword" data-i18n-placeholder="enterPassword">
+        </div>
+        <div class="field" id="totpGroup" style="display:none">
+          <label class="field-label" data-i18n="twoFACode">2FA Code</label>
+          <input type="text" class="input input-totp" id="loginTotp" placeholder="000000" maxlength="6">
+        </div>
+        <button class="btn btn-primary btn-full" onclick="login()" data-i18n="signIn">Sign In</button>
+        <div id="loginMsg"></div>
+      </div>
+    </div>
+
+    <div id="tab-create" class="tab-content">
+      <div class="card">
+        <div class="card-title">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg>
+          <span data-i18n="createWallet">Create Wallet</span>
+        </div>
+        <div class="alert alert-warning">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z"/><line x1="12" y1="9" x2="12" y2="13"/><line x1="12" y1="17" x2="12.01" y2="17"/></svg>
+          <span data-i18n="warningPhrase">Write down your recovery phrase on paper. It cannot be recovered if lost.</span>
+        </div>
+        <div class="mnemonic-grid" id="mnemonicDisplay"></div>
+        <div class="btn-group">
+          <button class="btn btn-sm" onclick="regenerateMnemonic()">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="width:12px;height:12px"><polyline points="23 4 23 10 17 10"/><path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/></svg>
+            <span data-i18n="regenerate">Regenerate</span>
+          </button>
+        </div>
+        <div class="divider"></div>
+        <div class="field">
+          <label class="field-label" data-i18n="passwordMin">Password (min 8 chars)</label>
+          <input type="password" class="input" id="createPassword" data-i18n-placeholder="setPassword">
+        </div>
+        <div class="field">
+          <label class="field-label" data-i18n="confirmPassword">Confirm Password</label>
+          <input type="password" class="input" id="createPassword2" data-i18n-placeholder="confirmPwd">
+        </div>
+        <div class="field">
+          <label class="field-label" data-i18n="displayName">Display Name (optional)</label>
+          <input type="text" class="input" id="createMoniker" data-i18n-placeholder="yourName">
+        </div>
+        <button class="btn btn-primary btn-full" onclick="createWallet()" data-i18n="createWallet">Create Wallet</button>
+        <div id="createMsg"></div>
+      </div>
+    </div>
+
+    <div id="tab-import" class="tab-content">
+      <div class="card">
+        <div class="card-title">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
+          <span data-i18n="importWallet">Import Wallet</span>
+        </div>
+        <div class="field">
+          <label class="field-label" data-i18n="recoveryPhrase">Recovery Phrase</label>
+          <input type="text" class="input" id="importMnemonic" data-i18n-placeholder="phrasePlaceholder">
+        </div>
+        <div class="field">
+          <label class="field-label" data-i18n="password">Password</label>
+          <input type="password" class="input" id="importPassword" data-i18n-placeholder="setPassword">
+        </div>
+        <button class="btn btn-primary btn-full" onclick="importWallet()" data-i18n="import">Import</button>
+        <div id="importMsg"></div>
+      </div>
+    </div>
+  </div>
+
+  <div id="dashboardSection" style="display:none">
+    <div class="dash-nav">
+      <button class="tab-btn active" onclick="showDashTab('overview',this)" data-i18n="overview">Overview</button>
+      <button class="tab-btn" onclick="showDashTab('security',this)" data-i18n="security">Security</button>
+      <button class="tab-btn" onclick="showDashTab('2fa',this)" data-i18n="tab2FA">2FA</button>
+      <span class="spacer"></span>
+      <button class="tab-btn" onclick="logout()" style="color:var(--error)" data-i18n="signOut">Sign Out</button>
+    </div>
+
+    <div id="dash-overview" class="tab-content active">
+      <div class="card">
+        <div class="balance" id="balanceDisplay">--<span class="unit">TCT</span></div>
+        <div class="info-row"><span class="key" data-i18n="address">Address</span><span class="value" id="walletAddr"></span></div>
+        <div class="info-row"><span class="key" data-i18n="name">Name</span><span class="value" id="walletMoniker">--</span></div>
+        <div class="info-row"><span class="key">2FA</span><span class="value" id="wallet2fa"></span></div>
+        <div class="info-row"><span class="key" data-i18n="created">Created</span><span class="value" id="walletCreated">--</span></div>
+      </div>
+      <div class="card">
+        <div class="card-title">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="22 12 18 12 15 21 9 3 6 12 2 12"/></svg>
+          <span data-i18n="chainStatus">Chain Status</span>
+        </div>
+        <div id="onchainData"><pre>Loading...</pre></div>
+      </div>
+    </div>
+
+    <div id="dash-security" class="tab-content">
+      <div class="card">
+        <div class="card-title">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="11" width="18" height="11" rx="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/></svg>
+          <span data-i18n="changePassword">Change Password</span>
+        </div>
+        <div class="field">
+          <label class="field-label" data-i18n="currentPassword">Current Password</label>
+          <input type="password" class="input" id="oldPassword">
+        </div>
+        <div class="field">
+          <label class="field-label" data-i18n="newPassword">New Password</label>
+          <input type="password" class="input" id="newPassword">
+        </div>
+        <button class="btn btn-primary btn-full" onclick="changePassword()" data-i18n="updatePassword">Update Password</button>
+        <div id="pwdMsg"></div>
+      </div>
+      <div class="card">
+        <div class="card-title">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/></svg>
+          <span data-i18n="exportPhrase">Export Recovery Phrase</span>
+        </div>
+        <div class="alert alert-warning">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z"/><line x1="12" y1="9" x2="12" y2="13"/><line x1="12" y1="17" x2="12.01" y2="17"/></svg>
+          <span data-i18n="warningExport">Never save on a connected device. Write on paper only.</span>
+        </div>
+        <div class="field">
+          <label class="field-label" data-i18n="verifyPassword">Verify Password</label>
+          <input type="password" class="input" id="exportPassword">
+        </div>
+        <button class="btn btn-danger btn-full" onclick="exportMnemonic()" data-i18n="showPhrase">Show Recovery Phrase</button>
+        <div id="exportMsg"></div>
+      </div>
+    </div>
+
+    <div id="dash-2fa" class="tab-content">
+      <div class="card">
+        <div class="card-title">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
+          <span data-i18n="twoFactorAuth">Two-Factor Authentication</span>
+        </div>
+        <div id="totpStep1">
+          <p style="margin:12px 0;font-size:13px;color:var(--text-muted)" data-i18n="twoFADesc">Require a verification code from your authenticator app each time you sign in.</p>
+          <div class="field">
+            <label class="field-label" data-i18n="verifyWalletPwd">Verify wallet password first</label>
+            <input type="password" class="input" id="totpPassword" data-i18n-placeholder="walletPassword">
+          </div>
+          <button class="btn btn-primary btn-full" onclick="start2faSetup()" data-i18n="getQRCode">Get QR Code</button>
+          <div id="totpStep1Msg"></div>
+        </div>
+        <div id="totpStep2" style="display:none">
+          <p style="margin:12px 0;font-size:13px;color:var(--text-muted)" data-i18n="scanQRDesc">Scan with Google Authenticator or similar app:</p>
+          <div class="qr-container"><img id="totpQrImg" style="max-width:220px" /></div>
+          <div class="qr-hint" data-i18n="cantScan">Can't scan? Enter this key manually:</div>
+          <div class="qr-key" id="totpManualKey"></div>
+          <div class="alert alert-warning" style="margin-top:16px">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z"/><line x1="12" y1="9" x2="12" y2="13"/><line x1="12" y1="17" x2="12.01" y2="17"/></svg>
+            <span data-i18n="enterCodeDesc">Enter the 6-digit code currently showing in your app</span>
+          </div>
+          <div class="field">
+            <label class="field-label" data-i18n="verificationCode">Verification Code</label>
+            <input type="text" class="input input-totp" id="totpVerifyCode" placeholder="000000" maxlength="6">
+          </div>
+          <div class="btn-group">
+            <button class="btn btn-primary" onclick="confirm2fa()" data-i18n="confirm">Confirm</button>
+            <button class="btn" onclick="cancel2fa()" data-i18n="cancel">Cancel</button>
+          </div>
+          <div id="totpStep2Msg"></div>
+        </div>
+        <div id="totpEnabled" style="display:none">
+          <div class="alert alert-success">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><polyline points="22 4 12 14.01 9 11.01"/></svg>
+            <span data-i18n="twoFAEnabled">2FA is enabled. Sign-in requires password + verification code.</span>
+          </div>
+          <div class="divider"></div>
+          <div class="field">
+            <label class="field-label" data-i18n="enterCodeDisable">Enter current 2FA code to disable</label>
+            <input type="text" class="input input-totp" id="disableTotp" placeholder="000000" maxlength="6">
+          </div>
+          <button class="btn btn-danger btn-sm" onclick="disable2fa()" data-i18n="disable2FA">Disable 2FA</button>
+          <div id="totpDisableMsg"></div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+
+<script>
+// ===================== i18n =====================
+const I18N = {
+  zh: {
+    subtitle: '去中心化电商协议',
+    height: '高度', chain: '链', status: '状态',
+    signIn: '登录', create: '创建', import: '导入',
+    password: '密码', enterPassword: '输入钱包密码',
+    twoFACode: '2FA验证码',
+    createWallet: '创建钱包',
+    warningPhrase: '请将助记词抄写在纸上并妥善保管，丢失将无法恢复。',
+    regenerate: '重新生成',
+    passwordMin: '密码（至少8位）', setPassword: '设置密码',
+    confirmPwd: '再次输入密码', confirmPassword: '确认密码',
+    displayName: '显示名称（可选）', yourName: '你的名称',
+    importWallet: '导入钱包',
+    recoveryPhrase: '助记词', phrasePlaceholder: 'word1 word2 word3 ... word24',
+    overview: '总览', security: '安全', tab2FA: '2FA', signOut: '退出',
+    address: '地址', name: '名称', created: '创建时间',
+    chainStatus: '链状态',
+    changePassword: '修改密码', currentPassword: '当前密码', newPassword: '新密码', updatePassword: '更新密码',
+    exportPhrase: '导出助记词', warningExport: '切勿在联网设备上保存，只写在纸上。', verifyPassword: '验证密码', showPhrase: '显示助记词',
+    twoFactorAuth: '两步验证',
+    twoFADesc: '启用后每次登录需要密码 + 手机验证码，大幅提升安全性。',
+    verifyWalletPwd: '请先输入钱包密码验证身份', walletPassword: '钱包密码',
+    getQRCode: '获取二维码',
+    scanQRDesc: '使用 Google Authenticator 或类似App扫描下方二维码：',
+    cantScan: '无法扫码？手动输入密钥：',
+    enterCodeDesc: '输入App上当前显示的6位验证码',
+    verificationCode: '验证码', confirm: '确认', cancel: '取消',
+    twoFAEnabled: '2FA已启用。登录需要密码 + 验证码。',
+    enterCodeDisable: '输入当前2FA验证码以禁用', disable2FA: '禁用2FA',
+    enabled: '已启用', disabled: '未启用',
+    errPasswordMin: '密码至少8位', errPasswordMatch: '两次密码不一致', errEnterPhrase: '请输入助记词',
+    errEnterPassword: '请输入密码', errEnterCode: '请输入6位验证码',
+    okWalletCreated: '钱包创建成功', okImported: '导入成功', okPasswordUpdated: '密码修改成功',
+    ok2FAEnabled: '2FA绑定成功', ok2FADisabled: '2FA已禁用',
+  },
+  en: {
+    subtitle: 'Decentralized E-Commerce Protocol',
+    height: 'Height', chain: 'Chain', status: 'Status',
+    signIn: 'Sign In', create: 'Create', import: 'Import',
+    password: 'Password', enterPassword: 'Enter wallet password',
+    twoFACode: '2FA Code',
+    createWallet: 'Create Wallet',
+    warningPhrase: 'Write down your recovery phrase on paper. It cannot be recovered if lost.',
+    regenerate: 'Regenerate',
+    passwordMin: 'Password (min 8 chars)', setPassword: 'Set password',
+    confirmPwd: 'Confirm password', confirmPassword: 'Confirm Password',
+    displayName: 'Display Name (optional)', yourName: 'Your name',
+    importWallet: 'Import Wallet',
+    recoveryPhrase: 'Recovery Phrase', phrasePlaceholder: 'word1 word2 word3 ... word24',
+    overview: 'Overview', security: 'Security', tab2FA: '2FA', signOut: 'Sign Out',
+    address: 'Address', name: 'Name', created: 'Created',
+    chainStatus: 'Chain Status',
+    changePassword: 'Change Password', currentPassword: 'Current Password', newPassword: 'New Password', updatePassword: 'Update Password',
+    exportPhrase: 'Export Recovery Phrase', warningExport: 'Never save on a connected device. Write on paper only.', verifyPassword: 'Verify Password', showPhrase: 'Show Recovery Phrase',
+    twoFactorAuth: 'Two-Factor Authentication',
+    twoFADesc: 'Require a verification code from your authenticator app each time you sign in.',
+    verifyWalletPwd: 'Verify wallet password first', walletPassword: 'Wallet password',
+    getQRCode: 'Get QR Code',
+    scanQRDesc: 'Scan with Google Authenticator or similar app:',
+    cantScan: "Can't scan? Enter this key manually:",
+    enterCodeDesc: 'Enter the 6-digit code currently showing in your app',
+    verificationCode: 'Verification Code', confirm: 'Confirm', cancel: 'Cancel',
+    twoFAEnabled: '2FA is enabled. Sign-in requires password + verification code.',
+    enterCodeDisable: 'Enter current 2FA code to disable', disable2FA: 'Disable 2FA',
+    enabled: 'Enabled', disabled: 'Disabled',
+    errPasswordMin: 'Password must be at least 8 characters', errPasswordMatch: 'Passwords do not match', errEnterPhrase: 'Enter recovery phrase',
+    errEnterPassword: 'Enter password', errEnterCode: 'Enter 6-digit code',
+    okWalletCreated: 'Wallet created', okImported: 'Imported', okPasswordUpdated: 'Password updated',
+    ok2FAEnabled: '2FA enabled', ok2FADisabled: '2FA disabled',
+  },
+  ja: {
+    subtitle: '分散型ECプロトコル',
+    height: '高さ', chain: 'チェーン', status: '状態',
+    signIn: 'ログイン', create: '作成', import: 'インポート',
+    password: 'パスワード', enterPassword: 'ウォレットパスワードを入力',
+    twoFACode: '2FAコード',
+    createWallet: 'ウォレット作成',
+    warningPhrase: 'リカバリーフレーズは紙に書き留めてください。紛失すると復元できません。',
+    regenerate: '再生成',
+    passwordMin: 'パスワード（8文字以上）', setPassword: 'パスワードを設定',
+    confirmPwd: 'パスワード確認', confirmPassword: 'パスワード確認',
+    displayName: '表示名（任意）', yourName: '名前',
+    importWallet: 'ウォレットインポート',
+    recoveryPhrase: 'リカバリーフレーズ', phrasePlaceholder: 'word1 word2 word3 ... word24',
+    overview: '概要', security: 'セキュリティ', tab2FA: '2FA', signOut: 'ログアウト',
+    address: 'アドレス', name: '名前', created: '作成日時',
+    chainStatus: 'チェーン状態',
+    changePassword: 'パスワード変更', currentPassword: '現在のパスワード', newPassword: '新しいパスワード', updatePassword: 'パスワード更新',
+    exportPhrase: 'リカバリーフレーズ書き出し', warningExport: '接続されたデバイスに保存しないでください。紙にのみ書き留めてください。', verifyPassword: 'パスワード確認', showPhrase: 'リカバリーフレーズを表示',
+    twoFactorAuth: '二要素認証',
+    twoFADesc: 'ログイン時にパスワード＋認証アプリのコードが必要になり、安全性が大幅に向上します。',
+    verifyWalletPwd: 'ウォレットパスワードで本人確認', walletPassword: 'ウォレットパスワード',
+    getQRCode: 'QRコードを取得',
+    scanQRDesc: 'Google Authenticator または類似アプリでスキャン：',
+    cantScan: 'スキャンできない場合、このキーを手動入力：',
+    enterCodeDesc: 'アプリに表示されている6桁のコードを入力',
+    verificationCode: '確認コード', confirm: '確認', cancel: 'キャンセル',
+    twoFAEnabled: '2FA有効。ログインにパスワード＋確認コードが必要です。',
+    enterCodeDisable: '現在の2FAコードを入力して無効化', disable2FA: '2FA無効化',
+    enabled: '有効', disabled: '無効',
+    errPasswordMin: 'パスワードは8文字以上必要です', errPasswordMatch: 'パスワードが一致しません', errEnterPhrase: 'リカバリーフレーズを入力',
+    errEnterPassword: 'パスワードを入力', errEnterCode: '6桁のコードを入力',
+    okWalletCreated: 'ウォレット作成完了', okImported: 'インポート完了', okPasswordUpdated: 'パスワード更新完了',
+    ok2FAEnabled: '2FA有効化完了', ok2FADisabled: '2FA無効化完了',
+  }
+};
+
+let lang = localStorage.getItem('tc-lang') || 'zh';
+function t(key) { return I18N[lang]?.[key] || I18N.en[key] || key; }
+function setLang(l) {
+  lang = l;
+  localStorage.setItem('tc-lang', l);
+  document.querySelectorAll('.lang-btn').forEach(b => b.classList.toggle('active', b.textContent.trim() === {zh:'中文',en:'EN',ja:'日本語'}[l]));
+  document.querySelectorAll('[data-i18n]').forEach(el => { el.textContent = t(el.dataset.i18n); });
+  document.querySelectorAll('[data-i18n-placeholder]').forEach(el => { el.placeholder = t(el.dataset.i18nPlaceholder); });
+}
+
+let currentMnemonic = '';
+let authToken = '';
+const API = window.location.origin + '/api';
+
+function showTab(name, el) {
+  document.querySelectorAll('#authSection .tab-content').forEach(t => t.classList.remove('active'));
+  document.querySelectorAll('#authSection .tab-btn').forEach(b => b.classList.remove('active'));
+  document.getElementById('tab-' + name).classList.add('active');
+  el.classList.add('active');
+}
+function showDashTab(name, el) {
+  document.querySelectorAll('#dashboardSection .tab-content').forEach(t => t.classList.remove('active'));
+  document.querySelectorAll('#dashboardSection .tab-btn').forEach(b => b.classList.remove('active'));
+  document.getElementById('dash-' + name).classList.add('active');
+  el.classList.add('active');
+}
+
+async function init() {
+  setLang(lang);
+  await refreshChainStatus();
+  regenerateMnemonic();
+  const resp = await fetch(API + '/has-wallet');
+  const data = await resp.json();
+  if (data.hasWallet && data.totpEnabled) document.getElementById('totpGroup').style.display = '';
+}
+
+async function refreshChainStatus() {
+  try {
+    const resp = await fetch(API + '/chain-status');
+    const data = await resp.json();
+    document.getElementById('blockHeight').textContent = data.block_height?.toLocaleString() || '--';
+    document.getElementById('chainId').textContent = data.chain_id || '--';
+    document.getElementById('syncStatus').textContent = data.catching_up ? 'Syncing' : 'Active';
+  } catch {}
+}
+
+async function regenerateMnemonic() {
+  const resp = await fetch(API + '/generate-mnemonic');
+  const data = await resp.json();
+  currentMnemonic = data.mnemonic;
+  const words = currentMnemonic.split(' ');
+  document.getElementById('mnemonicDisplay').innerHTML = words.map((w,i) =>
+    '<div class="mnemonic-word"><span class="num">' + (i+1) + '</span>' + w + '</div>'
+  ).join('');
+}
+
+async function createWallet() {
+  const pwd = document.getElementById('createPassword').value;
+  const pwd2 = document.getElementById('createPassword2').value;
+  const moniker = document.getElementById('createMoniker').value;
+  if (pwd.length < 8) return showMsg('createMsg','error', t('errPasswordMin'));
+  if (pwd !== pwd2) return showMsg('createMsg','error', t('errPasswordMatch'));
+  if (!currentMnemonic) return;
+  const resp = await fetch(API+'/create-wallet',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:pwd,mnemonic:currentMnemonic,moniker})});
+  const data = await resp.json();
+  if (data.error) return showMsg('createMsg','error',data.error);
+  showMsg('createMsg','success',t('okWalletCreated')+': '+data.address);
+  currentMnemonic = '';
+  setTimeout(()=>loginWithPassword(pwd),500);
+}
+
+async function importWallet() {
+  const mnemonic = document.getElementById('importMnemonic').value.trim();
+  const pwd = document.getElementById('importPassword').value;
+  if (!mnemonic) return showMsg('importMsg','error',t('errEnterPhrase'));
+  if (pwd.length < 8) return showMsg('importMsg','error',t('errPasswordMin'));
+  const resp = await fetch(API+'/create-wallet',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:pwd,mnemonic,moniker:''})});
+  const data = await resp.json();
+  if (data.error) return showMsg('importMsg','error',data.error);
+  showMsg('importMsg','success',t('okImported')+': '+data.address);
+  setTimeout(()=>loginWithPassword(pwd),500);
+}
+
+async function login() {
+  const pwd = document.getElementById('loginPassword').value;
+  const totp = document.getElementById('loginTotp').value;
+  if (!pwd) return showMsg('loginMsg','error',t('errEnterPassword'));
+  const resp = await fetch(API+'/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:pwd,totp:totp||undefined})});
+  const data = await resp.json();
+  if (data.error) return showMsg('loginMsg','error',data.error);
+  authToken = data.token;
+  showDashboard();
+}
+
+async function loginWithPassword(pwd) {
+  const resp = await fetch(API+'/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:pwd})});
+  const data = await resp.json();
+  if (data.token) { authToken = data.token; showDashboard(); }
+}
+
+function logout() {
+  authToken = '';
+  document.getElementById('authSection').style.display = '';
+  document.getElementById('dashboardSection').style.display = 'none';
+}
+
+async function showDashboard() {
+  document.getElementById('authSection').style.display = 'none';
+  document.getElementById('dashboardSection').style.display = '';
+  const resp = await fetch(API+'/profile',{headers:{'Authorization':'Bearer '+authToken}});
+  const data = await resp.json();
+  if (data.error) return logout();
+  document.getElementById('walletAddr').textContent = data.address;
+  document.getElementById('walletMoniker').textContent = data.moniker || '--';
+  document.getElementById('wallet2fa').innerHTML = data.totp_enabled
+    ? '<span class="badge badge-success">'+t('enabled')+'</span>'
+    : '<span class="badge badge-warning">'+t('disabled')+'</span>';
+  document.getElementById('walletCreated').textContent = new Date(data.created_at).toLocaleString();
+  if (data.totp_enabled) { document.getElementById('totpStep1').style.display='none'; document.getElementById('totpEnabled').style.display=''; }
+  try {
+    const balResp = await fetch(API+'/balance',{headers:{'Authorization':'Bearer '+authToken}});
+    const balData = await balResp.json();
+    document.getElementById('balanceDisplay').innerHTML = (balData.tct_balance||0).toLocaleString()+'<span class="unit">TCT</span>';
+  } catch { document.getElementById('balanceDisplay').innerHTML = '--<span class="unit">TCT</span>'; }
+  try {
+    const chainResp = await fetch(API+'/chain-status');
+    const chainData = await chainResp.json();
+    document.getElementById('onchainData').innerHTML = '<pre>'+JSON.stringify(chainData,null,2)+'</pre>';
+  } catch {}
+}
+
+async function changePassword() {
+  const oldPwd = document.getElementById('oldPassword').value;
+  const newPwd = document.getElementById('newPassword').value;
+  if (newPwd.length < 8) return showMsg('pwdMsg','error',t('errPasswordMin'));
+  const resp = await fetch(API+'/change-password',{method:'POST',headers:{'Authorization':'Bearer '+authToken,'Content-Type':'application/json'},body:JSON.stringify({old_password:oldPwd,new_password:newPwd})});
+  const data = await resp.json();
+  if (data.error) return showMsg('pwdMsg','error',data.error);
+  showMsg('pwdMsg','success',t('okPasswordUpdated'));
+}
+
+async function exportMnemonic() {
+  const pwd = document.getElementById('exportPassword').value;
+  const resp = await fetch(API+'/export-mnemonic',{method:'POST',headers:{'Authorization':'Bearer '+authToken,'Content-Type':'application/json'},body:JSON.stringify({password:pwd})});
+  const data = await resp.json();
+  if (data.error) return showMsg('exportMsg','error',data.error);
+  const words = data.mnemonic.split(' ');
+  showMsg('exportMsg','success',words.map((w,i)=>(i+1)+'. '+w).join('   '));
+}
+
+async function start2faSetup() {
+  const pwd = document.getElementById('totpPassword').value;
+  if (!pwd) return showMsg('totpStep1Msg','error',t('errEnterPassword'));
+  const verifyResp = await fetch(API+'/verify-password',{method:'POST',headers:{'Authorization':'Bearer '+authToken,'Content-Type':'application/json'},body:JSON.stringify({password:pwd})});
+  const verifyData = await verifyResp.json();
+  if (verifyData.error) return showMsg('totpStep1Msg','error',verifyData.error);
+  const resp = await fetch(API+'/setup-2fa',{method:'POST',headers:{'Authorization':'Bearer '+authToken,'Content-Type':'application/json'}});
+  const data = await resp.json();
+  if (data.error) return showMsg('totpStep1Msg','error',data.error);
+  document.getElementById('totpQrImg').src = 'https://api.qrserver.com/v1/create-qr-code/?size=256x256&data='+encodeURIComponent(data.uri);
+  document.getElementById('totpManualKey').textContent = data.secret;
+  document.getElementById('totpStep1').style.display = 'none';
+  document.getElementById('totpStep2').style.display = '';
+}
+
+async function confirm2fa() {
+  const code = document.getElementById('totpVerifyCode').value;
+  if (!code||code.length!==6) return showMsg('totpStep2Msg','error',t('errEnterCode'));
+  const resp = await fetch(API+'/enable-2fa',{method:'POST',headers:{'Authorization':'Bearer '+authToken,'Content-Type':'application/json'},body:JSON.stringify({code})});
+  const data = await resp.json();
+  if (data.error) return showMsg('totpStep2Msg','error',data.error);
+  showMsg('totpStep2Msg','success',t('ok2FAEnabled'));
+  setTimeout(()=>location.reload(),1500);
+}
+
+function cancel2fa() {
+  document.getElementById('totpStep1').style.display = '';
+  document.getElementById('totpStep2').style.display = 'none';
+  document.getElementById('totpVerifyCode').value = '';
+}
+
+async function disable2fa() {
+  const code = document.getElementById('disableTotp').value;
+  const resp = await fetch(API+'/disable-2fa',{method:'POST',headers:{'Authorization':'Bearer '+authToken,'Content-Type':'application/json'},body:JSON.stringify({code})});
+  const data = await resp.json();
+  if (data.error) return showMsg('totpDisableMsg','error',data.error);
+  showMsg('totpDisableMsg','success',t('ok2FADisabled'));
+  setTimeout(()=>location.reload(),1000);
+}
+
+function showMsg(id, type, msg) {
+  const icon = type === 'success'
+    ? '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="width:16px;height:16px;flex-shrink:0;margin-top:1px"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><polyline points="22 4 12 14.01 9 11.01"/></svg>'
+    : '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="width:16px;height:16px;flex-shrink:0;margin-top:1px"><circle cx="12" cy="12" r="10"/><line x1="15" y1="9" x2="9" y2="15"/><line x1="9" y1="9" x2="15" y2="15"/></svg>';
+  document.getElementById(id).innerHTML = '<div class="alert alert-'+type+'" style="margin-top:12px">'+icon+msg+'</div>';
+}
+
+init();
+</script>
+</body>
+</html>`;
+}
+// ===================== Express App =====================
+function createWebPanel(config) {
+    const app = (0, express_1.default)();
+    app.use(express_1.default.json());
+    // CORS middleware
+    app.use((req, res, next) => {
+        res.header('Access-Control-Allow-Origin', '*');
+        res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+        res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+        if (req.method === 'OPTIONS') {
+            return res.sendStatus(200);
+        }
+        next();
+    });
+    // Serve panel
+    // Serve Vue build if available, fallback to inline HTML
+    const vueDist = (0, path_1.resolve)(__dirname, '..', '..', 'web-dist');
+    if (fs_1.default.existsSync((0, path_1.resolve)(vueDist, 'index.html'))) {
+        app.use(express_1.default.static(vueDist));
+        app.get('/', (_req, res) => res.sendFile((0, path_1.resolve)(vueDist, 'index.html')));
+    }
+    else {
+        app.get('/', (_req, res) => res.type('html').send(getPanelHtml()));
+    }
+    // ---- Public APIs ----
+    app.get('/api/chain-status', async (_req, res) => {
+        try {
+            const resp = await fetch(`${config.rpcUrl}/status`);
+            const data = await resp.json();
+            const info = data.result;
+            res.json({
+                chain_id: info.node_info.network,
+                moniker: info.node_info.moniker,
+                block_height: Number(info.sync_info.latest_block_height),
+                catching_up: info.sync_info.catching_up,
+                voting_power: info.validator_info.voting_power,
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    app.get('/api/has-wallet', (_req, res) => {
+        const profiles = loadProfiles();
+        res.json({ hasWallet: profiles.length > 0, totpEnabled: profiles.some(p => p.totpEnabled) });
+    });
+    app.get('/api/generate-mnemonic', (_req, res) => {
+        res.json({ mnemonic: generateMnemonic(24) });
+    });
+    app.post('/api/create-wallet', async (req, res) => {
+        try {
+            const { password, mnemonic, moniker } = req.body;
+            if (!password || password.length < 8)
+                return res.status(400).json({ error: '密码至少8位' });
+            if (!mnemonic)
+                return res.status(400).json({ error: '助记词不能为空' });
+            const wordCount = mnemonic.trim().split(/\s+/).length;
+            if (![12, 15, 18, 21, 24].includes(wordCount))
+                return res.status(400).json({ error: '助记词长度无效（支持12/15/18/21/24词）' });
+            const profiles = loadProfiles();
+            if (profiles.length >= 10)
+                return res.status(400).json({ error: '最多10个钱包' });
+            // Derive address from mnemonic using Cosmos SDK HD wallet derivation
+            const wallet = await amino_1.Secp256k1HdWallet.fromMnemonic(mnemonic, { prefix: 'tct' });
+            const [{ address }] = await wallet.getAccounts();
+            const encrypted = encrypt(mnemonic, password);
+            const profile = {
+                id: crypto_1.default.randomUUID(),
+                address,
+                moniker: moniker || '',
+                encryptedMnemonic: encrypted.encrypted,
+                iv: encrypted.iv,
+                salt: encrypted.salt,
+                totpEnabled: false,
+                createdAt: Date.now(),
+            };
+            profiles.push(profile);
+            saveProfiles(profiles);
+            // Auto-create session token so 2FA setup doesn't need login
+            const token = crypto_1.default.randomUUID();
+            SESSIONS.set(token, {
+                id: token,
+                walletId: profile.id,
+                createdAt: Date.now(),
+                expiresAt: Date.now() + 24 * 60 * 60 * 1000,
+            });
+            res.json({ address: profile.address, moniker: profile.moniker, token });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    app.post('/api/login', (req, res) => {
+        const { password, totp } = req.body;
+        const profiles = loadProfiles();
+        if (profiles.length === 0)
+            return res.status(400).json({ error: '没有钱包，请先创建' });
+        // Try to decrypt each profile
+        for (const profile of profiles) {
+            try {
+                decrypt(profile.encryptedMnemonic, profile.iv, profile.salt, password);
+                // Check TOTP if enabled
+                if (profile.totpEnabled && profile.totpSecret) {
+                    if (!totp || !(0, totp_1.verifyTOTP)(profile.totpSecret, totp)) {
+                        return res.status(401).json({ error: '2FA验证码错误', requires2fa: true });
+                    }
+                }
+                const token = crypto_1.default.randomUUID();
+                SESSIONS.set(token, {
+                    id: token,
+                    walletId: profile.id,
+                    createdAt: Date.now(),
+                    expiresAt: Date.now() + 24 * 60 * 60 * 1000, // 24h
+                });
+                return res.json({ token, address: profile.address });
+            }
+            catch {
+                continue; // Wrong password for this profile
+            }
+        }
+        res.status(401).json({ error: '密码错误' });
+    });
+    // ---- Authenticated APIs ----
+    app.get('/api/profile', authMiddleware, (req, res) => {
+        const profile = req.profile;
+        res.json({
+            address: profile.address,
+            moniker: profile.moniker,
+            totp_enabled: profile.totpEnabled,
+            created_at: profile.createdAt,
+        });
+    });
+    app.get('/api/balance', authMiddleware, async (req, res) => {
+        const profile = req.profile;
+        try {
+            const resp = await fetch(`${config.lcdUrl}/cosmos/bank/v1beta1/balances/${profile.address}`);
+            const data = await resp.json();
+            const tct = data.balances?.find((b) => b.denom === 'utct');
+            res.json({ tct_balance: tct ? Number(tct.amount) / 1_000_000 : 0 });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    app.post('/api/change-password', authMiddleware, (req, res) => {
+        const { old_password, new_password, totp } = req.body;
+        const profile = req.profile;
+        // 2FA required when enabled
+        if (profile.totpEnabled && profile.totpSecret) {
+            if (!totp || !(0, totp_1.verifyTOTP)(profile.totpSecret, totp)) {
+                return res.status(401).json({ error: '2FA验证码错误' });
+            }
+        }
+        try {
+            // Verify old password
+            const mnemonic = decrypt(profile.encryptedMnemonic, profile.iv, profile.salt, old_password);
+            // Re-encrypt with new password
+            const encrypted = encrypt(mnemonic, new_password);
+            const profiles = loadProfiles();
+            const idx = profiles.findIndex(p => p.id === profile.id);
+            if (idx >= 0) {
+                profiles[idx].encryptedMnemonic = encrypted.encrypted;
+                profiles[idx].iv = encrypted.iv;
+                profiles[idx].salt = encrypted.salt;
+                saveProfiles(profiles);
+            }
+            res.json({ success: true });
+        }
+        catch {
+            res.status(401).json({ error: '当前密码错误' });
+        }
+    });
+    app.post('/api/export-mnemonic', authMiddleware, (req, res) => {
+        const { password, totp } = req.body;
+        const profile = req.profile;
+        // 2FA required when enabled
+        if (profile.totpEnabled && profile.totpSecret) {
+            if (!totp || !(0, totp_1.verifyTOTP)(profile.totpSecret, totp)) {
+                return res.status(401).json({ error: '2FA验证码错误' });
+            }
+        }
+        try {
+            const mnemonic = decrypt(profile.encryptedMnemonic, profile.iv, profile.salt, password);
+            res.json({ mnemonic });
+        }
+        catch {
+            res.status(401).json({ error: '密码错误' });
+        }
+    });
+    app.post('/api/verify-password', authMiddleware, (req, res) => {
+        const { password } = req.body;
+        const profile = req.profile;
+        try {
+            decrypt(profile.encryptedMnemonic, profile.iv, profile.salt, password);
+            res.json({ valid: true });
+        }
+        catch {
+            res.status(401).json({ error: '密码错误' });
+        }
+    });
+    app.post('/api/setup-2fa', authMiddleware, (req, res) => {
+        const profile = req.profile;
+        if (profile.totpEnabled)
+            return res.status(400).json({ error: '2FA已启用' });
+        const secret = generateTotpSecret();
+        const uri = generateTotpUri(secret, profile.address);
+        console.error('[DEBUG setup-2fa] generated secret:', secret, 'uri:', uri);
+        // Save secret temporarily (not enabled yet)
+        const profiles = loadProfiles();
+        const idx = profiles.findIndex(p => p.id === profile.id);
+        if (idx >= 0) {
+            profiles[idx].totpSecret = secret;
+            saveProfiles(profiles);
+        }
+        res.json({ secret, uri });
+    });
+    app.post('/api/enable-2fa', authMiddleware, (req, res) => {
+        const { code } = req.body;
+        const profile = req.profile;
+        console.error('[DEBUG enable-2fa] code:', code, 'secret:', profile.totpSecret, 'time:', Date.now());
+        if (!profile.totpSecret)
+            return res.status(400).json({ error: '请先设置2FA' });
+        if (!(0, totp_1.verifyTOTP)(profile.totpSecret, code))
+            return res.status(400).json({ error: '验证码错误' });
+        const profiles = loadProfiles();
+        const idx = profiles.findIndex(p => p.id === profile.id);
+        if (idx >= 0) {
+            profiles[idx].totpEnabled = true;
+            saveProfiles(profiles);
+        }
+        res.json({ success: true });
+    });
+    app.post('/api/disable-2fa', authMiddleware, (req, res) => {
+        const { code } = req.body;
+        const profile = req.profile;
+        if (!profile.totpSecret || !(0, totp_1.verifyTOTP)(profile.totpSecret, code)) {
+            return res.status(400).json({ error: '验证码错误' });
+        }
+        const profiles = loadProfiles();
+        const idx = profiles.findIndex(p => p.id === profile.id);
+        if (idx >= 0) {
+            profiles[idx].totpEnabled = false;
+            profiles[idx].totpSecret = undefined;
+            saveProfiles(profiles);
+        }
+        res.json({ success: true });
+    });
+    // ---- Seller Registration (auto-configures verifier) ----
+    app.post('/api/register-seller', authMiddleware, async (req, res) => {
+        const { shop_name, verify_server } = req.body;
+        const profile = req.profile;
+        if (!shop_name)
+            return res.status(400).json({ error: '店铺名称不能为空' });
+        try {
+            // 1. Generate seller API key
+            const apiKey = crypto_1.default.randomBytes(32).toString('hex');
+            // 2. Write verifier config (silent - seller never sees this)
+            const validatorDir = runtime_data_1.runtimeDataFile('.validator');
+            if (!fs_1.default.existsSync(validatorDir)) {
+                fs_1.default.mkdirSync(validatorDir, { recursive: true });
+            }
+            const verifierConfig = {
+                sellerId: profile.address,
+                apiKey,
+                verifyServer: verify_server || 'https://verify.trustchain.io',
+                rpcUrl: config.rpcUrl,
+                chainId: 'trustchain-local',
+                registeredAt: Date.now(),
+            };
+            fs_1.default.writeFileSync((0, path_1.resolve)(validatorDir, 'config.json'), JSON.stringify(verifierConfig, null, 2), { mode: 0o600 });
+            // 3. Update profile with seller info
+            const profiles = loadProfiles();
+            const idx = profiles.findIndex(p => p.id === profile.id);
+            if (idx >= 0) {
+                profiles[idx].isSeller = true;
+                profiles[idx].shopName = shop_name;
+                saveProfiles(profiles);
+            }
+            res.json({ success: true, shop_name });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    // Check seller status
+    app.get('/api/seller-status', authMiddleware, (req, res) => {
+        const profile = req.profile;
+        const validatorConfig = runtime_data_1.runtimeDataFile('.validator', 'config.json');
+        const isSeller = fs_1.default.existsSync(validatorConfig);
+        let shopName = '';
+        if (isSeller) {
+            try {
+                const cfg = JSON.parse(fs_1.default.readFileSync(validatorConfig, 'utf8'));
+                shopName = profile.shopName || '';
+            }
+            catch { }
+        }
+        res.json({ isSeller, shopName });
+    });
+    // ---- Register Account on Chain ----
+    // Check if account is registered on chain
+    app.get('/api/account-status', authMiddleware, async (req, res) => {
+        const profile = req.profile;
+        try {
+            const { execSync } = require('child_process');
+            const cmd = `wsl -u root -e bash -c "sshpass -p ${process.env.SSH_PASSWORD || 'CHANGE_ME'} ssh -o StrictHostKeyChecking=no root@${process.env.SSH_HOST || 'localhost'} 'trustchaind query trustcoin account --address ${profile.address} -o json 2>&1'"`;
+            const output = execSync(cmd, { timeout: 10000 }).toString();
+            // Check if account exists
+            if (output.includes('not found') || output.includes('InvalidArgument')) {
+                return res.json({ registered: false, account: null });
+            }
+            const accountData = JSON.parse(output);
+            res.json({ registered: true, account: accountData.account });
+        }
+        catch (e) {
+            // If error, assume not registered
+            res.json({ registered: false, account: null, error: e?.message });
+        }
+    });
+    // Register account on chain
+    app.post('/api/register-account', authMiddleware, async (req, res) => {
+        const { role, region, password, totp } = req.body;
+        const profile = req.profile;
+        // Validate inputs
+        if (!role || !['buyer', 'seller', 'both'].includes(role)) {
+            return res.status(400).json({ error: '角色必须是 buyer、seller 或 both' });
+        }
+        if (!region || !['CN', 'US', 'JP', 'domestic', 'international'].includes(region)) {
+            return res.status(400).json({ error: '地区必须是 CN、US、JP、domestic 或 international' });
+        }
+        if (!password)
+            return res.status(400).json({ error: '请输入钱包密码' });
+        // 2FA required when enabled
+        if (profile.totpEnabled && profile.totpSecret) {
+            if (!totp || !(0, totp_1.verifyTOTP)(profile.totpSecret, totp)) {
+                return res.status(401).json({ error: '2FA验证码错误' });
+            }
+        }
+        try {
+            // First check if already registered
+            const { execSync } = require('child_process');
+            const checkCmd = `wsl -u root -e bash -c "sshpass -p ${process.env.SSH_PASSWORD || 'CHANGE_ME'} ssh -o StrictHostKeyChecking=no root@${process.env.SSH_HOST || 'localhost'} 'trustchaind query trustcoin account --address ${profile.address} -o json 2>&1'"`;
+            const checkOutput = execSync(checkCmd, { timeout: 10000 }).toString();
+            if (!checkOutput.includes('not found') && !checkOutput.includes('InvalidArgument')) {
+                return res.status(400).json({ error: '账户已注册', alreadyRegistered: true });
+            }
+            // Decrypt mnemonic to get the key
+            const mnemonic = decrypt(profile.encryptedMnemonic, profile.iv, profile.salt, password);
+            // Import key to node's keyring temporarily
+            const importCmd = `wsl -u root -e bash -c "sshpass -p ${process.env.SSH_PASSWORD || 'CHANGE_ME'} ssh -o StrictHostKeyChecking=no root@${process.env.SSH_HOST || 'localhost'} 'echo \"${mnemonic}\" | trustchaind keys import mnemonic temp-register --keyring-backend test --recover 2>&1'"`;
+            execSync(importCmd, { timeout: 15000 });
+            // Register account on chain
+            const registerCmd = `wsl -u root -e bash -c "sshpass -p ${process.env.SSH_PASSWORD || 'CHANGE_ME'} ssh -o StrictHostKeyChecking=no root@${process.env.SSH_HOST || 'localhost'} 'trustchaind tx trustcoin register-account --role ${role} --region ${region} --from temp-register --keyring-backend test --chain-id trustchain-local --fees 5000utct --yes --output json 2>&1'"`;
+            const registerOutput = execSync(registerCmd, { timeout: 30000 }).toString();
+            // Parse result
+            const txResult = JSON.parse(registerOutput);
+            if (txResult.code !== undefined && txResult.code !== 0) {
+                // Delete temp key
+                try {
+                    execSync(`wsl -u root -e bash -c "sshpass -p ${process.env.SSH_PASSWORD || 'CHANGE_ME'} ssh -o StrictHostKeyChecking=no root@${process.env.SSH_HOST || 'localhost'} 'trustchaind keys delete temp-register --keyring-backend test --yes 2>&1'"`, { timeout: 10000 });
+                }
+                catch { }
+                return res.status(500).json({ error: txResult.raw_log || '注册失败' });
+            }
+            // Delete temp key after successful registration
+            try {
+                execSync(`wsl -u root -e bash -c "sshpass -p ${process.env.SSH_PASSWORD || 'CHANGE_ME'} ssh -o StrictHostKeyChecking=no root@${process.env.SSH_HOST || 'localhost'} 'trustchaind keys delete temp-register --keyring-backend test --yes 2>&1'"`, { timeout: 10000 });
+            }
+            catch { }
+            res.json({
+                success: true,
+                txHash: txResult.txhash,
+                address: profile.address,
+                role,
+                region,
+            });
+        }
+        catch (e) {
+            console.error('[register-account error]', e);
+            res.status(500).json({ error: e?.message || '注册失败' });
+        }
+    });
+    // ---- Products & Orders APIs ----
+    app.get('/api/products', (req, res) => {
+        if (!config.dbPath || !fs_1.default.existsSync(config.dbPath)) {
+            return res.json({ products: [], total: 0 });
+        }
+        try {
+            const Database = require('better-sqlite3');
+            const db = new Database(config.dbPath, { readonly: true });
+            const page = Math.max(1, parseInt(req.query.page) || 1);
+            const limit = Math.min(100, Math.max(1, parseInt(req.query.limit) || 20));
+            const offset = (page - 1) * limit;
+            const status = req.query.status || 'active';
+            const keyword = (req.query.keyword || '').trim();
+            let where = 'WHERE status = ?';
+            const params = [status];
+            // 质押可见性硬规则 (xiaomu 2026-09-18 拍板, 与 search core 同款):
+            // active 列表只显示链上有 slot 且有质押的商品 (status=active 视图才套用,
+            // 避免影响 delisted 等管理视图)。
+            if (status === 'active') {
+                where += " AND CAST(IFNULL(NULLIF(slot_index, ''), '-1') AS INTEGER) >= 0" +
+                    " AND CAST(IFNULL(NULLIF(stake_per_unit, ''), '0') AS INTEGER) > 0";
+            }
+            if (keyword) {
+                where += ' AND (title LIKE ? OR description LIKE ?)';
+                params.push(`%${keyword}%`, `%${keyword}%`);
+            }
+            const total = db.prepare(`SELECT COUNT(*) as c FROM products ${where}`).get(...params).c;
+            const rows = db.prepare(`SELECT * FROM products ${where} ORDER BY created_at DESC LIMIT ? OFFSET ?`).all(...params, limit, offset);
+            db.close();
+            res.json({ products: rows, total, page, limit });
+        }
+        catch (e) {
+            res.status(500).json({ error: e?.message || 'DB error' });
+        }
+    });
+    app.get('/api/orders', authMiddleware, (req, res) => {
+        if (!config.dbPath || !fs_1.default.existsSync(config.dbPath)) {
+            return res.json({ orders: [], total: 0 });
+        }
+        try {
+            const Database = require('better-sqlite3');
+            const db = new Database(config.dbPath, { readonly: true });
+            const profile = req.profile;
+            const page = Math.max(1, parseInt(req.query.page) || 1);
+            const limit = Math.min(100, Math.max(1, parseInt(req.query.limit) || 20));
+            const offset = (page - 1) * limit;
+            // Show orders where user is buyer or seller
+            const rows = db.prepare(`SELECT o.*, p.title as product_title FROM orders o LEFT JOIN products p ON o.sku_id = p.sku_id WHERE o.buyer = ? OR o.seller = ? ORDER BY o.created_at DESC LIMIT ? OFFSET ?`).all(profile.address, profile.address, limit, offset);
+            const total = db.prepare(`SELECT COUNT(*) as c FROM orders WHERE buyer = ? OR seller = ?`).get(profile.address, profile.address).c;
+            db.close();
+            res.json({ orders: rows, total, page, limit });
+        }
+        catch (e) {
+            res.status(500).json({ error: e?.message || 'DB error' });
+        }
+    });
+    app.get('/api/indexer-stats', (_req, res) => {
+        if (!config.dbPath || !fs_1.default.existsSync(config.dbPath)) {
+            return res.json({ totalProducts: 0, totalSellers: 0, totalOrders: 0, totalReviews: 0 });
+        }
+        try {
+            const Database = require('better-sqlite3');
+            const db = new Database(config.dbPath, { readonly: true });
+            const stats = {
+                totalProducts: db.prepare('SELECT COUNT(*) as c FROM products').get().c,
+                totalSellers: db.prepare('SELECT COUNT(*) as c FROM sellers').get().c,
+                totalOrders: db.prepare('SELECT COUNT(*) as c FROM orders').get().c,
+                totalReviews: db.prepare('SELECT COUNT(*) as c FROM reviews').get().c,
+            };
+            db.close();
+            res.json(stats);
+        }
+        catch (e) {
+            res.status(500).json({ error: e?.message || 'DB error' });
+        }
+    });
+    // ---- Transfer API (2FA required) ----
+    app.post('/api/transfer', authMiddleware, async (req, res) => {
+        const { to_address, amount, password, totp } = req.body;
+        const profile = req.profile;
+        // Validate inputs
+        if (!to_address)
+            return res.status(400).json({ error: '请输入收款地址' });
+        if (!amount || parseFloat(amount) <= 0)
+            return res.status(400).json({ error: '金额必须大于0' });
+        if (!password)
+            return res.status(400).json({ error: '请输入钱包密码' });
+        // 2FA is mandatory for transfers
+        if (profile.totpEnabled && profile.totpSecret) {
+            if (!totp || !(0, totp_1.verifyTOTP)(profile.totpSecret, totp)) {
+                return res.status(401).json({ error: '2FA验证码错误' });
+            }
+        }
+        try {
+            // Decrypt mnemonic
+            const mnemonic = decrypt(profile.encryptedMnemonic, profile.iv, profile.salt, password);
+            // Create wallet and client
+            const wallet = await amino_1.Secp256k1HdWallet.fromMnemonic(mnemonic, { prefix: 'tct' });
+            const { GasPrice } = await Promise.resolve().then(() => __importStar(require('@cosmjs/stargate')));
+            const gasPrice = GasPrice.fromString('0.001utct');
+            const client = await stargate_1.SigningStargateClient.connectWithSigner(config.lcdUrl.replace(':1317', ':26657'), // RPC endpoint
+            wallet, { gasPrice });
+            // Convert TCT to utct (6 decimals)
+            const amountUtct = Math.floor(parseFloat(amount) * 1_000_000).toString();
+            const result = await client.sendTokens(profile.address, to_address, [{ denom: 'utct', amount: amountUtct }], 'auto', `Transfer ${amount} TCT`);
+            res.json({
+                success: true,
+                txHash: result.transactionHash,
+                height: result.height,
+            });
+        }
+        catch (e) {
+            console.error('[transfer error]', e);
+            res.status(500).json({ error: e?.message || '转账失败' });
+        }
+    });
+    // ---- List SKU API (2FA required, via CLI) ----
+    app.post('/api/list-sku', authMiddleware, async (req, res) => {
+        const { sku_id, title, description, variants, category, images, videos, shipping, payment_methods, return_policy, stock, password, totp, stake_per_unit } = req.body;
+        const profile = req.profile;
+        if (!sku_id)
+            return res.status(400).json({ error: '请输入SKU ID' });
+        if (!title)
+            return res.status(400).json({ error: '请输入商品标题' });
+        if (!variants || !Array.isArray(variants) || variants.length === 0)
+            return res.status(400).json({ error: '至少需要一个规格' });
+        if (!password)
+            return res.status(400).json({ error: '请输入钱包密码' });
+        // Validate variants
+        for (const v of variants) {
+            if (!v.name)
+                return res.status(400).json({ error: '规格名称不能为空' });
+            if (!v.price_cny || v.price_cny <= 0)
+                return res.status(400).json({ error: '法币价格必须大于0' });
+            if (!v.stock || v.stock <= 0)
+                return res.status(400).json({ error: '库存必须大于0' });
+        }
+        // Validate images
+        if (images && images.length > 50)
+            return res.status(400).json({ error: '图片最多50张' });
+        // 2FA required
+        if (profile.totpEnabled && profile.totpSecret) {
+            if (!totp || !(0, totp_1.verifyTOTP)(profile.totpSecret, totp)) {
+                return res.status(401).json({ error: '2FA验证码错误' });
+            }
+        }
+        try {
+            // Verify password by decrypting mnemonic
+            decrypt(profile.encryptedMnemonic, profile.iv, profile.salt, password);
+            // Build full product MD document
+            const totalStock = variants.reduce((sum, v) => sum + (v.stock || 0), 0);
+            const minPrice = Math.min(...variants.map((v) => v.price_cny || 0));
+            const stakePerUnit = stake_per_unit ? Math.floor(parseFloat(stake_per_unit) * 1_000_000).toString() : '1000000'; // default 1 TCT
+            // Build product metadata JSON (future: full MD document)
+            const productDoc = JSON.stringify({
+                sku_id,
+                seller: profile.address,
+                title,
+                description: description || '',
+                variants: variants.map((v) => ({
+                    id: v.id || v.name.replace(/\s+/g, '-').toUpperCase(),
+                    name: v.name,
+                    price_cny: v.price_cny,
+                    price_tct: v.price_tct || null,
+                    stock: v.stock,
+                })),
+                category: category || {},
+                images: (images || []).map((img) => ({
+                    url: img.url,
+                    sha256: img.sha256 || '',
+                })),
+                videos: (videos || []).map((vid) => ({
+                    url: vid.url,
+                    sha256: vid.sha256 || '',
+                })),
+                shipping: shipping || { method: 'standard', fee: 0, delivery_days: 3 },
+                payment_methods: payment_methods || ['wechat', 'alipay'],
+                return_policy: return_policy || '',
+                created_at: new Date().toISOString(),
+            });
+            // SHA256 hash of product document → content_hash
+            const contentHash = crypto_1.default.createHash('sha256').update(productDoc).digest('hex');
+            // Execute via CLI on the node
+            const { execSync } = require('child_process');
+            const cmd = `wsl -u root -e bash -c "sshpass -p ${process.env.SSH_PASSWORD || 'CHANGE_ME'} ssh -o StrictHostKeyChecking=no root@${process.env.SSH_HOST || 'localhost'} 'trustchaind tx marketplace list-sku --sku-id ${sku_id} --content-hash 0x${contentHash} --stock ${totalStock} --stake-per-unit ${stakePerUnit} --from ${profile.address} --keyring-backend test --chain-id trustchain-local --fees 5000utct --yes --output json 2>&1'"`;
+            const output = execSync(cmd, { timeout: 30000 }).toString();
+            const txResult = JSON.parse(output);
+            if (txResult.code !== undefined && txResult.code !== 0) {
+                return res.status(500).json({ error: txResult.raw_log || '上架失败' });
+            }
+            // Save product document to P2P data directory
+            try {
+                const fs = require('fs');
+                const path = require('path');
+                const p2pDir = path.resolve(config.dataDir, 'seller', 'products', sku_id);
+                fs.mkdirSync(p2pDir, { recursive: true });
+                fs.writeFileSync(path.resolve(p2pDir, '..', `${sku_id}.md`), productDoc);
+                console.error(`[P2P] Product saved: ${sku_id}`);
+            }
+            catch (saveErr) {
+                console.error('[P2P] Save product failed:', saveErr.message);
+            }
+            res.json({
+                success: true,
+                txHash: txResult.txhash,
+                height: txResult.height,
+                content_hash: contentHash,
+            });
+        }
+        catch (e) {
+            console.error('[list-sku error]', e);
+            res.status(500).json({ error: e?.message || '上架失败' });
+        }
+    });
+    // ===================== P2P Port Registry =====================
+    // Register P2P ports (called by seller's P2P node on startup)
+    app.post('/api/register-p2p', (req, res) => {
+        const { seller_address, http_port, tcp_port, quic_port, peer_id, ip } = req.body;
+        if (!seller_address) {
+            return res.status(400).json({ error: 'seller_address required' });
+        }
+        try {
+            config.indexer.updateP2PPorts(seller_address, Number(http_port) || 0, Number(tcp_port) || 0, Number(quic_port) || 0, String(peer_id || ''), String(ip || ''));
+            console.error(`[P2P Registry] ${seller_address}: http=${http_port} tcp=${tcp_port} quic=${quic_port} peer=${(peer_id || '').substring(0, 16)} ip=${ip || ''}`);
+            res.json({ success: true, message: 'P2P ports registered' });
+        }
+        catch (err) {
+            res.status(500).json({ error: err.message });
+        }
+    });
+    // Query seller's P2P endpoint info
+    app.get('/api/seller-p2p/:address', (req, res) => {
+        const info = config.indexer.getSellerP2P(req.params.address);
+        if (!info) {
+            return res.status(404).json({ error: 'Seller not found' });
+        }
+        res.json(info);
+    });
+    // ===================== Verification APIs =====================
+    // Check if entity is verified
+    app.get('/api/verification/check', async (req, res) => {
+        const { type, id } = req.query;
+        if (!type || !id) {
+            return res.status(400).json({ error: 'type and id required' });
+        }
+        try {
+            const lcdUrl = process.env.TRUSTCOIN_LCD_URL || 'http://localhost:1317';
+            const resp = await fetch(`${lcdUrl}/oxiaom/trustchain/verification/v1/is-verified/${type}/${id}`);
+            if (!resp.ok) {
+                return res.json({ verified: false, entity_type: type, entity_id: id });
+            }
+            const data = await resp.json();
+            res.json({
+                verified: data.verified || false,
+                entity_type: type,
+                entity_id: id,
+                method: data.method || null,
+                verified_at: data.verified_at || null,
+            });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    // Get verification details
+    app.get('/api/verification/:id', async (req, res) => {
+        try {
+            const lcdUrl = process.env.TRUSTCOIN_LCD_URL || 'http://localhost:1317';
+            const resp = await fetch(`${lcdUrl}/oxiaom/trustchain/verification/v1/verifications/${req.params.id}`);
+            if (!resp.ok) {
+                return res.status(404).json({ error: 'Verification not found' });
+            }
+            const data = await resp.json();
+            res.json(data.verification || data);
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    // List pending verifications
+    app.get('/api/verification/pending', async (req, res) => {
+        const { submitter, entity_type, limit = 20 } = req.query;
+        try {
+            const lcdUrl = process.env.TRUSTCOIN_LCD_URL || 'http://localhost:1317';
+            let url = `${lcdUrl}/oxiaom/trustchain/verification/v1/pending-verifications?limit=${limit}`;
+            if (entity_type)
+                url += `&entity_type=${entity_type}`;
+            const resp = await fetch(url);
+            if (!resp.ok) {
+                return res.json({ verifications: [], total: 0 });
+            }
+            const data = await resp.json();
+            let verifications = data.verifications || [];
+            // Filter by submitter if provided
+            if (submitter) {
+                verifications = verifications.filter((v) => v.submitter === submitter);
+            }
+            res.json({ verifications, total: verifications.length });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    // Submit verification request
+    app.post('/api/verification/submit', authMiddleware, async (req, res) => {
+        const { entity_type, entity_id, method, credential_hash, metadata } = req.body;
+        const profile = req.profile;
+        if (!entity_type || !method || !credential_hash) {
+            return res.status(400).json({ error: 'entity_type, method, and credential_hash required' });
+        }
+        try {
+            const { execSync } = require('child_process');
+            const entityId = entity_id || profile.address;
+            const metaFlag = metadata ? `--metadata='${metadata}'` : '';
+            const cmd = `wsl -u root -e bash -c "sshpass -p ${process.env.SSH_PASSWORD || 'CHANGE_ME'} ssh -o StrictHostKeyChecking=no root@${process.env.SSH_HOST || 'localhost'} 'trustchaind tx verification submit-verification --entity-type=${entity_type} --entity-id=${entityId} --method=${method} --credential-hash=${credential_hash} ${metaFlag} --from=${profile.address} --keyring-backend=test --chain-id=trustchain-local --fees=5000utct --yes --output=json 2>&1'"`;
+            const output = execSync(cmd, { timeout: 30000 }).toString().trim();
+            const result = JSON.parse(output);
+            if (result.code !== undefined && result.code !== 0) {
+                return res.status(400).json({ error: result.raw_log || 'Submit failed' });
+            }
+            res.json({
+                success: true,
+                tx_hash: result.txhash,
+                entity_type,
+                entity_id: entityId,
+                method,
+            });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    // Approve verification (authority only)
+    app.post('/api/verification/approve', authMiddleware, async (req, res) => {
+        const { verification_id } = req.body;
+        const profile = req.profile;
+        if (!verification_id) {
+            return res.status(400).json({ error: 'verification_id required' });
+        }
+        try {
+            const { execSync } = require('child_process');
+            const cmd = `wsl -u root -e bash -c "sshpass -p ${process.env.SSH_PASSWORD || 'CHANGE_ME'} ssh -o StrictHostKeyChecking=no root@${process.env.SSH_HOST || 'localhost'} 'trustchaind tx verification approve-verification --verification-id=${verification_id} --from=${profile.address} --keyring-backend=test --chain-id=trustchain-local --fees=5000utct --yes --output=json 2>&1'"`;
+            const output = execSync(cmd, { timeout: 30000 }).toString().trim();
+            const result = JSON.parse(output);
+            if (result.code !== undefined && result.code !== 0) {
+                return res.status(400).json({ error: result.raw_log || 'Approve failed' });
+            }
+            res.json({ success: true, tx_hash: result.txhash, verification_id });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    // Reject verification (authority only)
+    app.post('/api/verification/reject', authMiddleware, async (req, res) => {
+        const { verification_id, reason } = req.body;
+        const profile = req.profile;
+        if (!verification_id || !reason) {
+            return res.status(400).json({ error: 'verification_id and reason required' });
+        }
+        try {
+            const { execSync } = require('child_process');
+            const cmd = `wsl -u root -e bash -c "sshpass -p ${process.env.SSH_PASSWORD || 'CHANGE_ME'} ssh -o StrictHostKeyChecking=no root@${process.env.SSH_HOST || 'localhost'} 'trustchaind tx verification reject-verification --verification-id=${verification_id} --reason=\"${reason}\" --from=${profile.address} --keyring-backend=test --chain-id=trustchain-local --fees=5000utct --yes --output=json 2>&1'"`;
+            const output = execSync(cmd, { timeout: 30000 }).toString().trim();
+            const result = JSON.parse(output);
+            if (result.code !== undefined && result.code !== 0) {
+                return res.status(400).json({ error: result.raw_log || 'Reject failed' });
+            }
+            res.json({ success: true, tx_hash: result.txhash, verification_id, reason });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    // Get verification statistics
+    app.get('/api/verification/stats', async (req, res) => {
+        try {
+            const lcdUrl = process.env.TRUSTCOIN_LCD_URL || 'http://localhost:1317';
+            const resp = await fetch(`${lcdUrl}/oxiaom/trustchain/verification/v1/stats`);
+            if (!resp.ok) {
+                return res.json({ total: 0, pending: 0, approved: 0, rejected: 0 });
+            }
+            const data = await resp.json();
+            res.json({
+                total: data.total_verifications || 0,
+                pending: data.pending_count || 0,
+                approved: data.approved_count || 0,
+                rejected: data.rejected_count || 0,
+                revoked: data.revoked_count || 0,
+                by_entity_type: data.by_entity_type || {},
+                by_method: data.by_method || {},
+            });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    // SPA fallback - return index.html for all non-API routes
+    app.get('*', (req, res, next) => {
+        // Skip API routes and static files
+        if (req.path.startsWith('/api/') || req.path.includes('.')) {
+            return next();
+        }
+        // Return index.html for SPA routes
+        const vueDist = (0, path_1.resolve)(__dirname, '..', '..', 'web-dist');
+        if (fs_1.default.existsSync((0, path_1.resolve)(vueDist, 'index.html'))) {
+            res.sendFile((0, path_1.resolve)(vueDist, 'index.html'));
+        }
+        else {
+            res.type('html').send(getPanelHtml());
+        }
+    });
+    return app;
+}
+//# sourceMappingURL=web-panel.js.map