trustbase-seller-backend 0.1.6 → 0.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/agent-pay.js

@@ -114,6 +114,8 @@ async function wxApiCall(method, urlPath, bodyObj, override) {
             "Authorization": wxSignAuth(method, urlPath, bodyStr, override),
             "Content-Type": "application/json",
             "Accept": "application/json",
+            // 微信 APIv3 拒默认 Accept-Language: * (undici 自动带) — 2026-09-25 /v3/certificates 实测 PARAM_ERROR
+            "Accept-Language": "zh-CN",
             "User-Agent": "trustbase-seller-backend/1.0",
         },
         body: method === "GET" ? undefined : bodyStr,
@@ -213,10 +215,28 @@ async function refreshPlatformCerts() {
     console.log(`[agent-pay] 微信平台证书已刷新 (${Object.keys(certs).length} 张)`);
 }
 
-/** 验签: timestamp\nnonce\nbody 用平台证书公钥 RSA-SHA256 校验 */
+/** 验签: timestamp\nnonce\nbody RSA-SHA256 校验。
+ *  双轨 (2026-09-25 真机): serial 以 "PUB_KEY_ID_" 开头 = 微信支付公钥模式 (新政策,
+ *  /v3/certificates 返回空, 商户平台下载固定公钥); 否则走平台证书缓存 (老模式)。
+ *  公钥池 (2026-09-25): merchant + SP 多把公钥并存, 按回调 serial 精确匹配 ID —
+ *  直连回调用商户号公钥, SP 特约商户回调用服务商号公钥。 */
 function wxVerifyNotifySignature(serial, timestamp, nonce, rawBody, signature) {
-    loadPlatformCertsFromDisk();
-    const pem = wxPlatformCerts && wxPlatformCerts[serial];
+    let pem = null;
+    if (String(serial).startsWith("PUB_KEY_ID_")) {
+        const pool = [
+            [process.env.WXPAY_PUBLIC_KEY_ID, process.env.WXPAY_PUBLIC_KEY_PATH],
+            [process.env.WXPAY_SP_PUBLIC_KEY_ID, process.env.WXPAY_SP_PUBLIC_KEY_PATH],
+        ];
+        for (const [id, p] of pool) {
+            if (id && id === serial && p) {
+                try { pem = require("fs").readFileSync(p, "utf8"); } catch (_) { pem = null; }
+                break;
+            }
+        }
+    } else {
+        loadPlatformCertsFromDisk();
+        pem = wxPlatformCerts && wxPlatformCerts[serial];
+    }
     if (!pem) return false;
     const msg = [timestamp, nonce, rawBody].join("\n") + "\n";
     return crypto.createVerify("RSA-SHA256").update(msg).verify(pem, signature, "base64");

package/routes/onboard.html

@@ -49,6 +49,45 @@ h1{font-size:22px;margin-bottom:4px}
 .sbtn.primary:hover{background:#A95230}
 .hintbox{display:none;font-size:12px;color:#6B655B;background:#F7F3EB;border-radius:8px;padding:10px 12px;margin-top:8px;line-height:1.9}
 .hintbox code{background:#fff;padding:1px 6px;border-radius:4px;font-family:Consolas,monospace}
+/* ===== ③ 进件表单美化 (2026-10-03): 分组卡片 / 统一控件 / 虚线上传卡 / 状态卡片 ===== */
+#apply-form .acard{background:#FCFAF4;border:1px solid #EAE3D6;border-radius:14px;padding:18px 16px;margin-bottom:14px}
+#apply-form .acard-h{font-size:15px;font-weight:600;color:#33302B;margin-bottom:12px;display:flex;align-items:center;gap:8px}
+#apply-form .anum{display:inline-flex;align-items:center;justify-content:center;width:22px;height:22px;border-radius:50%;background:#C4633C;color:#fff;font-size:12px;font-weight:600;flex:none}
+#apply-form .agrid{display:grid;grid-template-columns:1fr 1fr;gap:12px 14px}
+#apply-form .afield-full{grid-column:1/-1}
+#apply-form .afield label{display:block;font-size:13px;color:#6B655B;margin:0 0 5px}
+#apply-form .aopt{font-size:11px;color:#BDB5A6;font-weight:400;margin-left:4px}
+#apply-form .afield input,#apply-form .afield select{width:100%;padding:10px 12px;border:1px solid #D4CDBF;border-radius:8px;font-size:15px;background:#fff;transition:border-color .15s,box-shadow .15s}
+#apply-form .afield input::placeholder{color:#BDB5A6}
+#apply-form .afield input:focus,#apply-form .afield select:focus{outline:none;border-color:#C4633C;box-shadow:0 0 0 3px rgba(196,99,60,.15)}
+/* 上传卡片 (结构由 mountApplyUpload 生成: 标题label + label.sbtn>input + span#st_*) */
+#apply-form .auploads{display:grid;grid-template-columns:1fr 1fr;gap:12px 14px}
+#apply-form div[id^="a_up_"]>label:first-child{display:block;font-size:13px;font-weight:600;color:#33302B;margin-bottom:6px}
+#apply-form div[id^="a_up_"]>label:first-child::after{content:' *';color:#DC2626}
+#apply-form div[id^="a_up_"] label.sbtn{display:flex;flex-direction:column;align-items:center;justify-content:center;gap:4px;border:2px dashed #D4CDBF;border-radius:10px;background:#FFFDF9;padding:18px 10px;margin:0;text-align:center;cursor:pointer;color:#6B655B;transition:border-color .15s,background .15s}
+#apply-form div[id^="a_up_"] label.sbtn::before{content:'📷';font-size:22px;line-height:1}
+#apply-form div[id^="a_up_"] label.sbtn::after{content:'支持 jpg/png, 本机压缩后上传';font-size:11px;color:#BDB5A6;font-weight:400;border:none;background:none;padding:0}
+#apply-form div[id^="a_up_"] label.sbtn:hover{border-color:#C4633C;background:#FBF1EA}
+#apply-form div[id^="a_up_"] span[id^="st_"]{display:block;font-size:12px;margin-top:6px}
+img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radius:8px;margin-bottom:8px;border:1px solid #EAE3D6}
+.auname{font-size:11px;color:#8A857B;margin:-2px 0 6px;word-break:break-all}
+/* 提交按钮 + 隐私行 */
+#btn-apply-submit{display:block;width:100%;background:#C4633C;color:#fff;border:none;border-radius:10px;padding:15px;font-size:17px;font-weight:600;cursor:pointer;margin-top:4px;transition:background .15s}
+#btn-apply-submit:hover{background:#A95230}
+#btn-apply-submit:disabled{background:#D8D2C8;cursor:not-allowed}
+.aprivacy{font-size:12px;color:#8A857B;text-align:center;margin-top:10px;line-height:1.8}
+/* 状态卡片 (按 data-state 着色, 由追加脚本按内容标) */
+#apply-status{border-radius:12px;padding:14px 16px;font-size:14px;line-height:2;border:1px solid #EAE3D6;background:#FCFAF4;word-break:break-all}
+#apply-status[data-state="done"]{background:#F0FDF4;border-color:#BBF7D0}
+#apply-status[data-state="checking"]{background:#FFFBEB;border-color:#FDE68A}
+#apply-status[data-state="sign"]{background:#EFF6FF;border-color:#BFDBFE}
+#apply-status[data-state="pending"]{background:#FFF7ED;border-color:#FED7AA}
+#apply-status a{display:inline-block;background:#C4633C;color:#fff !important;border-radius:8px;padding:10px 18px;font-size:15px;font-weight:600;text-decoration:none;margin-top:8px}
+#apply-status .aqr{display:flex;align-items:center;justify-content:center;width:120px;height:120px;border:2px dashed #93C5FD;border-radius:10px;background:#fff;color:#8A857B;font-size:12px;text-align:center;margin:10px 0 2px;line-height:1.6}
+@media (max-width:640px){
+  #apply-form .agrid{grid-template-columns:1fr}
+  #apply-form .auploads{grid-template-columns:1fr}
+}
 @media print{
   body *{visibility:hidden}
   #print-area,#print-area *{visibility:visible}
@@ -82,29 +121,74 @@ h1{font-size:22px;margin-bottom:4px}
     <div class="ops"><button class="sbtn" id="btn-verify" onclick="submitVerification()">提交实名认证</button></div>
     <div class="desc" id="verify-desc">提交后由服务商审核微信特约商户收款账户; 审核通过后自动发放 100 TCT 引导金 (无需重复提交)</div>
     <div class="hintbox" id="verify-msg"></div>
-    <div class="ops noprint"><button class="sbtn" id="btn-materials" onclick="toggleMaterials()">填写进件资料并上传证件</button></div>
-    <div class="hintbox" id="materials-msg"></div>
-    <div id="materials-form" style="display:none;margin-top:10px">
-      <div class="desc" style="margin-bottom:6px">以下资料用于服务商代你向微信申请特约商户收款账户。<b>资料只保存在你的电脑上</b>，并交给服务商用于进件。</div>
-      <label>主体类型</label>
-      <select id="m_subject_type"><option>个体户</option><option>企业</option><option>小微</option></select>
-      <label>商户全称 (与执照一致)</label><input id="m_merchant_name" placeholder="如: 无锡嘟嘟百货商行">
-      <label>统一社会信用代码 / 执照编号</label><input id="m_license_no" placeholder="18 位">
-      <label>法人/经营者姓名</label><input id="m_legal_name">
-      <label>法人身份证号</label><input id="m_legal_id_no" placeholder="18 位">
-      <label>超级管理员姓名</label><input id="m_admin_name">
-      <label>超级管理员手机号</label><input id="m_admin_mobile" placeholder="需与微信实名一致">
-      <label>门店名称 (选填)</label><input id="m_store_name">
-      <label>门店地址 (选填)</label><input id="m_store_address">
-      <label>结算账户类型 (选填)</label><select id="m_settle_type"><option></option><option>对公</option><option>对私</option></select>
-      <label>开户行 (选填)</label><input id="m_bank_name">
-      <label>结算账号 (选填)</label><input id="m_bank_account">
-      <label>营业执照照片 (必传)</label><input type="file" id="m_file_license" accept="image/*">
-      <label>法人身份证·正面 (必传)</label><input type="file" id="m_file_legal_id_front" accept="image/*">
-      <label>法人身份证·反面 (必传)</label><input type="file" id="m_file_legal_id_back" accept="image/*">
-      <label>门店照片 (选填)</label><input type="file" id="m_file_store_photo" accept="image/*">
-      <div class="ops"><button class="sbtn" id="btn-materials-submit" onclick="submitMaterials()">提交资料</button></div>
-      <div class="desc">单个文件不超过 4MB；资料含证件照片，请勿转发到聊天工具或网盘。</div>
+    <div class="ops noprint"><button class="sbtn" id="btn-apply-toggle" onclick="toggleApplyForm()">填写进件资料并上传证件</button></div>
+    <div class="hintbox" id="apply-msg"></div>
+    <div id="apply-status" style="display:none;margin-top:12px"></div>
+    <div id="apply-form" style="display:none;margin-top:12px">
+      <div class="desc" style="margin-bottom:12px">以下资料由你的电脑<b>本地加密</b>后交给服务商，向微信申请特约商户收款账户。身份证号/银行卡号在你电脑上就已加密，任何人 (含服务商) 都看不到明文。</div>
+
+      <div class="acard">
+        <div class="acard-h"><span class="anum">1</span>主体资料</div>
+        <div class="agrid">
+          <div class="afield"><label for="a_subject_type">主体类型</label>
+            <select id="a_subject_type"><option value="SUBJECT_TYPE_INDIVIDUAL">个体工商户</option><option value="SUBJECT_TYPE_ENTERPRISE">企业</option></select></div>
+          <div class="afield"><label for="a_shortname">商户简称</label><input id="a_shortname" placeholder="支付完成页展示, 如: 张三餐饮店"></div>
+          <div class="afield"><label for="a_merchant_name">营业执照名称</label><input id="a_merchant_name" placeholder="全称, 与执照一致"></div>
+          <div class="afield"><label for="a_license_number">统一社会信用代码</label><input id="a_license_number" placeholder="18 位, 9 开头"></div>
+          <div class="afield"><label for="a_service_phone">客服电话</label><input id="a_service_phone" placeholder="交易记录向买家展示"></div>
+          <div class="afield"><label for="a_settlement_id">经营类目编码</label><input id="a_settlement_id" placeholder="如: 719 (服务商提供对照表)"></div>
+          <div class="afield afield-full"><label for="a_qualification_type">类目资质描述</label><input id="a_qualification_type" placeholder="如: 零售"></div>
+        </div>
+      </div>
+
+      <div class="acard">
+        <div class="acard-h"><span class="anum">2</span>法人身份 / 超级管理员</div>
+        <div class="agrid">
+          <div class="afield"><label for="a_legal_name">法人/经营者姓名</label><input id="a_legal_name" placeholder="与身份证一致"></div>
+          <div class="afield"><label for="a_legal_id_number">法人身份证号</label><input id="a_legal_id_number" placeholder="17 位数字 + 数字或 X"></div>
+          <div class="afield"><label for="a_period_begin">身份证有效期开始</label><input id="a_period_begin" placeholder="YYYY-MM-DD"></div>
+          <div class="afield"><label for="a_period_end">有效期结束</label><input id="a_period_end" placeholder="YYYY-MM-DD 或 长期"></div>
+          <div class="afield"><label for="a_contact_name">超级管理员姓名</label><input id="a_contact_name" placeholder="与微信实名一致"></div>
+          <div class="afield"><label for="a_contact_mobile">超管手机号</label><input id="a_contact_mobile" placeholder="11 位, 接收微信验证码"></div>
+          <div class="afield afield-full"><label for="a_contact_email">联系邮箱</label><input id="a_contact_email" placeholder="接收微信开户邮件"></div>
+        </div>
+      </div>
+
+      <div class="acard">
+        <div class="acard-h"><span class="anum">3</span>结算账户</div>
+        <div class="agrid">
+          <div class="afield"><label for="a_account_type">账户类型</label>
+            <select id="a_account_type"><option value="BANK_ACCOUNT_TYPE_PERSONAL">经营者个人银行卡 (个体户)</option><option value="BANK_ACCOUNT_TYPE_CORPORATE">对公银行账户</option></select></div>
+          <div class="afield"><label for="a_account_bank">开户银行</label><input id="a_account_bank" placeholder="如: 招商银行"></div>
+          <div class="afield"><label for="a_account_name">开户名称</label><input id="a_account_name" placeholder="个人卡=经营者姓名 / 对公=执照名称"></div>
+          <div class="afield"><label for="a_account_number">银行账号</label><input id="a_account_number" placeholder="卡号"></div>
+          <div class="afield"><label for="a_bank_name">开户支行 <span class="aopt">选填</span></label><input id="a_bank_name" placeholder="如: 招商银行深圳分行营业部"></div>
+          <div class="afield"><label for="a_bank_address_code">开户行省市编码 <span class="aopt">选填</span></label><input id="a_bank_address_code" placeholder="如: 440300"></div>
+        </div>
+      </div>
+
+      <div class="acard">
+        <div class="acard-h"><span class="anum">4</span>门店信息</div>
+        <div class="agrid">
+          <div class="afield"><label for="a_store_name">门店名称</label><input id="a_store_name" placeholder="线下场所名称"></div>
+          <div class="afield"><label for="a_store_address_code">门店省市编码</label><input id="a_store_address_code" placeholder="如: 440300"></div>
+          <div class="afield afield-full"><label for="a_store_address">门店详细地址</label><input id="a_store_address" placeholder="xx 路 xx 号"></div>
+        </div>
+      </div>
+
+      <div class="acard">
+        <div class="acard-h"><span class="anum">5</span>证件上传</div>
+        <div class="auploads">
+          <div id="a_up_license"></div>
+          <div id="a_up_idfront"></div>
+          <div id="a_up_idback"></div>
+          <div id="a_up_entrance"></div>
+          <div id="a_up_indoor"></div>
+        </div>
+      </div>
+
+      <button class="abtn" id="btn-apply-submit" onclick="submitApplyment()">加密并提交进件</button>
+      <div class="aprivacy">🔒 资料只保存在这台电脑; 敏感字段本机加密后交服务商; 服务商暂时不可达时加密暂存本机, 可重试。</div>
     </div>
   </div>
 </div>
@@ -235,67 +319,130 @@ function reprintKey(){
     h.style.display=h.style.display==='block'?'none':'block';
   }
 }
-function toggleMaterials(){
-  var el=document.getElementById('materials-form');
+// ---- 进件 (2026-10-03 架构纠偏: 卖家本机提交 → 本机加密 → SP 网关 → 微信) ----
+var _aMedia={}; // 字段名 → 微信 media_id (上传成功后才提交得动)
+function toggleApplyForm(){
+  var el=document.getElementById('apply-form');
   el.style.display = el.style.display==='none' ? 'block' : 'none';
 }
-function readFileBase64(input){
-  return new Promise(function(resolve,reject){
-    var f=input.files && input.files[0];
-    if(!f) return resolve(null);
-    if(f.size > 4*1024*1024) return reject(new Error('文件超过 4MB: '+f.name));
-    var r=new FileReader();
-    r.onload=function(){resolve({name:f.name,data:String(r.result).replace(/^data:[^;]+;base64,/,'')})};
-    r.onerror=function(){reject(new Error('读取失败: '+f.name))};
-    r.readAsDataURL(f);
+// 照片本机压缩 (≤1600px JPEG; 全局 JSON 上限 1MB, 超了降质再压)
+function shrinkImage(file,cb){
+  var rd=new FileReader();
+  rd.onload=function(){
+    var img=new Image();
+    img.onload=function(){
+      var max=1600,w=img.width,h=img.height;
+      if(Math.max(w,h)>max){var k=max/Math.max(w,h);w=Math.round(w*k);h=Math.round(h*k);}
+      var cv=document.createElement('canvas');cv.width=w;cv.height=h;
+      cv.getContext('2d').drawImage(img,0,0,w,h);
+      var b64=cv.toDataURL('image/jpeg',0.85).split(',')[1];
+      if(b64.length*0.75>950*1024) b64=cv.toDataURL('image/jpeg',0.6).split(',')[1];
+      if(b64.length*0.75>950*1024) return cb(new Error('图片压缩后仍超服务器上限, 请换更小的图'));
+      cb(null,{filename:(file.name||'photo').replace(/\.[^.]*$/,'')+'.jpg',content_b64:b64});
+    };
+    img.onerror=function(){cb(new Error('图片读取失败'))};
+    img.src=rd.result;
+  };
+  rd.onerror=function(){cb(new Error('文件读取失败'))};
+  rd.readAsDataURL(file);
+}
+// 照片上传位: 选图 → 本机压缩 → 卖家后端转发 SP 网关 → media_id
+function mountApplyUpload(slotId,field,label){
+  var slot=document.getElementById(slotId);
+  slot.innerHTML='<label>'+label+'</label>'
+    +'<label class="sbtn" style="cursor:pointer">拍照/选图<input type="file" accept="image/*" style="display:none"></label>'
+    +' <span id="st_'+field+'" style="font-size:12px"></span>';
+  var input=slot.querySelector('input[type=file]');
+  var stat=document.getElementById('st_'+field);
+  input.addEventListener('change',function(){
+    if(!input.files||!input.files[0]) return;
+    stat.style.color='';stat.textContent='压缩中...';
+    shrinkImage(input.files[0],function(err,payload){
+      if(err){stat.style.color='#DC2626';stat.textContent=err.message;return;}
+      stat.textContent='上传中...';
+      fetch('/api/onboard/applyment/upload',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(payload)})
+        .then(readJson).then(function(j){
+          if(j.ok&&j.media_id){_aMedia[field]=j.media_id;stat.style.color='#16A34A';stat.textContent='✓ 已上传';}
+          else{stat.style.color='#DC2626';stat.textContent='上传失败: '+(j.message||j.error||'未知错误');}
+        }).catch(function(e){stat.style.color='#DC2626';stat.textContent='网络错误: '+e.message;});
+    });
   });
 }
-function mval(id){var e=document.getElementById(id);return e?e.value.trim():''}
-async function submitMaterials(){
-  var btn=document.getElementById('btn-materials-submit');
-  var msg=document.getElementById('materials-msg');
-  btn.disabled=true;btn.textContent='提交中...';
+mountApplyUpload('a_up_license','license_media_id','营业执照照片 (必传)');
+mountApplyUpload('a_up_idfront','legal_id_front_media_id','身份证人像面 (必传)');
+mountApplyUpload('a_up_idback','legal_id_back_media_id','身份证国徽面 (必传)');
+mountApplyUpload('a_up_entrance','store_entrance_media_id','门店门头照片 (必传)');
+mountApplyUpload('a_up_indoor','store_indoor_media_id','门店内部照片 (必传)');
+function aval(id){var e=document.getElementById(id);return e?e.value.trim():''}
+function applyFormBody(){
+  return {
+    subject_type:aval('a_subject_type'),merchant_shortname:aval('a_shortname'),merchant_name:aval('a_merchant_name'),
+    license_number:aval('a_license_number'),service_phone:aval('a_service_phone'),
+    settlement_id:aval('a_settlement_id'),qualification_type:aval('a_qualification_type'),
+    contact_name:aval('a_contact_name'),contact_mobile:aval('a_contact_mobile'),contact_email:aval('a_contact_email'),
+    legal_name:aval('a_legal_name'),legal_id_number:aval('a_legal_id_number'),
+    legal_id_period_begin:aval('a_period_begin'),legal_id_period_end:aval('a_period_end'),
+    account_type:aval('a_account_type'),account_name:aval('a_account_name'),account_number:aval('a_account_number'),
+    account_bank:aval('a_account_bank'),bank_name:aval('a_bank_name'),bank_address_code:aval('a_bank_address_code'),
+    store_name:aval('a_store_name'),store_address_code:aval('a_store_address_code'),store_address:aval('a_store_address'),
+    license_media_id:_aMedia.license_media_id||'',legal_id_front_media_id:_aMedia.legal_id_front_media_id||'',
+    legal_id_back_media_id:_aMedia.legal_id_back_media_id||'',store_entrance_media_id:_aMedia.store_entrance_media_id||'',
+    store_indoor_media_id:_aMedia.store_indoor_media_id||''
+  };
+}
+// 状态机渲染: 未提交(表单) → 已提交(business_code+轮询) → TO_BE_SIGNED(签约链接) → FINISHED(sub_mchid+引导金)
+function renderApplyment(j){
+  var box=document.getElementById('apply-status');
+  if(!j||!j.status||j.status==='NOT_SUBMITTED'){box.style.display='none';return;}
+  box.style.display='block';
+  var html='';
+  if(j.status==='PENDING_PUSH'){
+    html='📦 进件资料已加密暂存本机'+(j.push_error?' (上次提交: '+j.push_error+')':'')
+      +' <button class="sbtn" onclick="retryApplyment()">重新提交</button>';
+  } else {
+    html='业务申请编号: <b>'+(j.business_code||'')+'</b>'
+      +'<br>申请状态: <b>'+j.status+'</b>'+(j.state_msg?' ('+j.state_msg+')':'')+(j.cached?' (本机缓存)':'');
+    if(j.reject_reason) html+='<br><span style="color:#DC2626">驳回原因: '+j.reject_reason+'</span> — 点"填写进件资料"修改后重新提交';
+    if(j.sub_mchid) html+='<br>特约商户号 sub_mchid: <b>'+j.sub_mchid+'</b>';
+    if(j.sign_url) html+='<br><a href="'+String(j.sign_url).replace(/"/g,'')+'" target="_blank" style="color:#C4633C;font-weight:600">👉 法人/超管用微信打开签约链接完成签约</a>';
+    if(j.status==='APPLYMENT_STATE_FINISHED') html+='<br>✅ 微信收款账户已开通, 引导金将自动发放, 可进入下一步上架商品';
+    html+=' <button class="sbtn" onclick="queryApplyment()">刷新状态</button>';
+  }
+  box.innerHTML=html;
+  if(j.status==='APPLYMENT_STATE_FINISHED') markStepDone('st-verification');
+}
+async function submitApplyment(){
+  var btn=document.getElementById('btn-apply-submit');
+  var msg=document.getElementById('apply-msg');
+  btn.disabled=true;btn.textContent='加密并提交中...';
   try{
-    var files={};
-    var names={license:'m_file_license',legal_id_front:'m_file_legal_id_front',legal_id_back:'m_file_legal_id_back',store_photo:'m_file_store_photo'};
-    for(var k in names){
-      var f=await readFileBase64(document.getElementById(names[k]));
-      if(f) files[k]=f;
+    var j=await readJson(await fetch('/api/onboard/applyment',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(applyFormBody())}));
+    if(j.ok){
+      msg.style.display='block';
+      msg.textContent='✅ 已提交微信审核 (敏感字段已在本机加密)'+(j.idempotent?' — 此前已提交过, 幂等忽略':'');
+      document.getElementById('apply-form').style.display='none';
+      queryApplyment();
+    } else {
+      msg.style.display='block';
+      msg.textContent='提交失败: '+(j.message||j.error||'未知错误');
+      loadApplymentStatus(); // PENDING_PUSH 时状态框给出重试按钮
     }
-    var body={subject_type:mval('m_subject_type'),merchant_name:mval('m_merchant_name'),license_no:mval('m_license_no'),
-      legal_name:mval('m_legal_name'),legal_id_no:mval('m_legal_id_no'),admin_name:mval('m_admin_name'),admin_mobile:mval('m_admin_mobile'),
-      store_name:mval('m_store_name'),store_address:mval('m_store_address'),settle_type:mval('m_settle_type'),bank_name:mval('m_bank_name'),bank_account:mval('m_bank_account'),
-      files:files};
-    var r=await fetch('/onboard/materials',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});
-    var j=await readJson(r);
-    if(!j.ok){msg.style.display='block';msg.textContent='提交失败: '+(j.message||j.error||'未知错误');btn.disabled=false;btn.textContent='提交资料';return}
-    msg.style.display='block';
-    msg.textContent='✅ '+(j.message||'资料已提交')+' — 服务商审核通过后自动发放引导金 (凭据 '+String(j.bundle_hash||'').slice(0,16)+'…)';
-    document.getElementById('materials-form').style.display='none';
-    markStepDone('st-verification');
-    loadStatus(); // 资料提交后立刻拉一次链上状态
-    btn.disabled=false;btn.textContent='提交资料';
-  }catch(e){
-    msg.style.display='block';msg.textContent='提交失败: '+e.message;
-    btn.disabled=false;btn.textContent='提交资料';
-  }
+  }catch(e){msg.style.display='block';msg.textContent='提交失败: 服务暂时不可用，请刷新重试 ('+e.message+')';}
+  btn.disabled=false;btn.textContent='加密并提交进件';
 }
+async function retryApplyment(){
+  var j=await readJson(await fetch('/api/onboard/applyment',{method:'POST',headers:{'Content-Type':'application/json'},body:'{}'}));
+  if(j.ok){queryApplyment();}
+  else{var msg=document.getElementById('apply-msg');msg.style.display='block';msg.textContent=j.message||'重试失败, 请稍后再试';}
+}
+async function queryApplyment(){
+  try{renderApplyment(await readJson(await fetch('/api/onboard/applyment/status')));}catch(e){}
+}
+async function loadApplymentStatus(){queryApplyment();}
 function markStepDone(id){
   var el=document.getElementById(id);
   if(el){el.className='step done';var m=el.querySelector('.mark');if(m)m.textContent='✅'}
 }
-async function loadMaterialsStatus(){
-  try{
-    var j=await readJson(await fetch('/onboard/materials'));
-    if(!j.ok) return;
-    if(j.submitted){
-      markStepDone('st-verification');
-      var msg=document.getElementById('materials-msg');
-      msg.style.display='block';
-      msg.textContent='资料已提交 (待审核)'+(j.pushed?' — 已送达服务商':' — '+ (j.push_error||'未能送达服务商'));
-    }
-  }catch(e){}
-}
 async function submitVerification(){
   var btn=document.getElementById('btn-verify');btn.disabled=true;btn.textContent='提交中...';
   var msg=document.getElementById('verify-msg');
@@ -324,7 +471,7 @@ async function loadStatus(){
 }
 window.addEventListener('load',loadStatus);
 setInterval(loadStatus,15000); // 链上实名审批/引导金发放会变, 页面自动刷新 (不必手点)
-window.addEventListener('load',loadMaterialsStatus);
+window.addEventListener('load',loadApplymentStatus);
 async function submit(){
   var btn=document.getElementById('btn');btn.disabled=true;btn.textContent='生成中...';
   var d={merchant_shortname:document.getElementById('m_name').value,mobile_phone:document.getElementById('m_phone').value,category:document.getElementById('m_category').value};
@@ -348,5 +495,57 @@ async function submit(){
   }catch(e){alert('网络错误: '+e.message);btn.disabled=false}
 }
 </script>
+<script>
+/* ===== ③ 进件表单 美化增强 (2026-10-03) —— 纯追加脚本: 不修改/不覆盖任何现有函数,
+   只做两件视觉事: ① 证件选中后显示缩略图+文件名 ② 状态卡片按内容着色 + 签约二维码占位。
+   所有字段 id / 上传提交函数 / 状态机 DOM 目标均沿用现有逻辑。 ===== */
+(function(){
+  // ① 证件缩略图预览 (事件委托, 与现有上传 handler 并存, 只读文件不干预流程)
+  var form=document.getElementById('apply-form');
+  if(form){
+    form.addEventListener('change',function(ev){
+      var input=ev.target;
+      if(!input||input.type!=='file'||!input.files||!input.files[0]) return;
+      var slot=input.closest('div[id^="a_up_"]');
+      if(!slot) return;
+      var rd=new FileReader();
+      rd.onload=function(){
+        var img=slot.querySelector('img.auprev');
+        if(!img){
+          img=document.createElement('img');
+          img.className='auprev';img.alt='预览';
+          slot.insertBefore(img,slot.children[1]||null); // 标题label之后
+        }
+        img.src=rd.result;img.style.display='block';
+        var nm=slot.querySelector('.auname');
+        if(!nm){nm=document.createElement('div');nm.className='auname';img.insertAdjacentElement('afterend',nm);}
+        nm.textContent=input.files[0].name+' · 点卡片可重新选择';
+      };
+      rd.readAsDataURL(input.files[0]);
+    },true);
+  }
+  // ② 状态卡片着色 + 签约二维码占位 (监听现有状态机的 DOM 更新, 不改其内容逻辑)
+  var box=document.getElementById('apply-status');
+  if(box){
+    var paint=function(){
+      var t=box.textContent||'';
+      box.setAttribute('data-state',
+        t.indexOf('FINISHED')>=0?'done':
+        (t.indexOf('TO_BE_SIGNED')>=0||t.indexOf('签约')>=0)?'sign':
+        t.indexOf('PENDING_PUSH')>=0?'pending':'checking');
+      // 有签约链接 → 补一个二维码占位块 (真二维码后续可接 qrcode 库, 链接本身可点)
+      var link=box.querySelector('a');
+      if(link&&!box.querySelector('.aqr')){
+        var qr=document.createElement('div');
+        qr.className='aqr';
+        qr.textContent='签约二维码 (用法人微信扫)';
+        link.insertAdjacentElement('beforebegin',qr);
+      }
+    };
+    new MutationObserver(paint).observe(box,{childList:true,subtree:true,characterData:true});
+    paint();
+  }
+})();
+</script>
 </body>
 </html>