trustbase-seller-backend 0.2.8 → 0.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/payments/wechat/profitsharing.js

@@ -107,16 +107,15 @@ async function addReceivers(receivers) {
     return results.length === 1 ? results[0] : results;
 }
 
-/** 接收方名称加密: 微信支付公钥 RSA-OAEP → base64。
- *  ⚠️ 2026-09-26 实测坑: 微信"OAEPWithSHA-256AndMGF1Padding"是 Java 语义 — MGF1 实际用 SHA-1。
- *  Node crypto.publicEncrypt 的 oaepHash 会把 OAEP+MGF1 都设成同一 hash → 微信"平台私钥解密失败"。
- *  必须用 openssl 子进程分开指定 (rsa_oaep_md:sha256 + rsa_mgf1_md:sha1)。 */
+/** 接收方名称加密: 微信支付公钥 RSAES-OAEP → base64。
+ *  ⚠️ 2026-09-26 实测枚举锁定: 微信的 RSAES-OAEP = OAEP-SHA1 + MGF1-SHA1 (全线 SHA-1)。
+ *  sha256/sha256、sha256/sha1 都被微信拒 ("平台私钥解密失败"), sha1/sha1 通过。openssl 子进程实现。 */
 function encryptReceiverName(name) {
     const p = process.env.WXPAY_SP_PUBLIC_KEY_PATH || process.env.WXPAY_PUBLIC_KEY_PATH;
     if (!p) throw new Error("WXPAY_(SP_)PUBLIC_KEY_PATH 未配置, 接收方名称无法加密");
     const { execSync } = require("child_process");
     const b64 = execSync(
-        `openssl pkeyutl -encrypt -pubin -inkey ${JSON.stringify(p)} -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha1 | base64 -w0`,
+        `openssl pkeyutl -encrypt -pubin -inkey ${JSON.stringify(p)} -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha1 -pkeyopt rsa_mgf1_md:sha1 | base64 -w0`,
         { input: Buffer.from(name, "utf8"), maxBuffer: 1024 * 1024 }
     ).toString("utf8").trim();
     return b64;

package/routes/sp-applyment.js

@@ -110,12 +110,30 @@ function wxPubKeyPem() {
     throw new HttpError(500, "wx_pubkey_missing", "WXPAY_SP_PUBLIC_KEY_PATH 未配置, 敏感字段无法加密");
 }
 
-/** 敏感字段加密: RSA-OAEP-SHA256 → base64 (微信敏感信息加密口径) */
+/** 敏感字段加密: 微信支付公钥 RSAES-OAEP → base64。
+ *  ⚠️ 2026-09-26 实测枚举锁定: 微信 RSAES-OAEP = OAEP-SHA1 + MGF1-SHA1 (全线 SHA-1),
+ *  sha256 系全部"平台私钥解密失败"。openssl 子进程, pem 参数保留兼容旧调用签名。 */
 function encryptSensitive(plain, pem) {
-    return crypto.publicEncrypt(
-        { key: pem, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
-        Buffer.from(String(plain), "utf8")
-    ).toString("base64");
+    const { execSync } = require("child_process");
+    const fs = require("fs");
+    const os = require("os");
+    const path = require("path");
+    // openssl 需要文件路径: pem 已是路径直接用; 是内容则写临时文件
+    let keyPath = pem;
+    let tmp = null;
+    if (String(pem).includes("BEGIN")) {
+        tmp = path.join(os.tmpdir(), `wxpk-${process.pid}-${Date.now()}.pem`);
+        fs.writeFileSync(tmp, pem, { mode: 0o600 });
+        keyPath = tmp;
+    }
+    try {
+        return execSync(
+            `openssl pkeyutl -encrypt -pubin -inkey ${JSON.stringify(keyPath)} -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha1 -pkeyopt rsa_mgf1_md:sha1 | base64 -w0`,
+            { input: Buffer.from(String(plain), "utf8"), maxBuffer: 1024 * 1024 }
+        ).toString("utf8").trim();
+    } finally {
+        if (tmp) { try { fs.unlinkSync(tmp); } catch (_) {} }
+    }
 }
 
 /** 业务申请编号: TB{毫秒}{6位随机} (微信要求仅数字/字母/下划线) */

package/test-onboard-applyment.js

@@ -1,451 +1,451 @@
-"use strict";
-/**
- * test-onboard-applyment.js — 卖家本机进件链路 离线单测 (2026-10-03 架构纠偏)
- * node --test test-onboard-applyment.js
- *
- * 数据流: 卖家页面 → 卖家本机 seller-backend (敏感字段本地 RSA-OAEP 加密)
- *   → 假 SP 网关 (本测试起的 mock HTTP 服务, 捕获转发体断言无明文) → (真环境再到微信)
- * SP 不可达: SP_GATEWAY_URL 指到关闭端口, 断言 503 友好提示 + 台账 PENDING_PUSH 可重试。
- */
-const test = require("node:test");
-const assert = require("node:assert");
-const crypto = require("crypto");
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const express = require("express");
-const Database = require("better-sqlite3");
-
-const MERCHANT_TOKEN = "test-sp-merchant-token";
-
-// 测试 SP 微信支付公钥对 (卖家本机加密用; 私钥断言密文可还原)
-const wxPub = crypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
-const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "onboard-apply-test-"));
-const pubKeyPath = path.join(tmpDir, "wx_sp_pub.pem");
-fs.writeFileSync(pubKeyPath, wxPub.publicKey.export({ type: "spki", format: "pem" }));
-
-process.env.WXPAY_SP_PUBLIC_KEY_PATH = pubKeyPath;
-process.env.TB_BASE_DIR = tmpDir; // M2: applyment submit 会读本机 seller 身份 (tb_address 贯通), 隔离到临时目录
-process.env.SP_MERCHANT_TOKEN = MERCHANT_TOKEN;
-
-const onboard = require("./routes/onboard");
-const spApplymentLib = require("./routes/sp-applyment"); // buildApplymentBody 场景结构断言用
-
-// ---------- 假 SP 网关 (捕获请求体) ----------
-const spCapture = { uploads: [], submits: [], statusQueries: [] };
-let spSrv = null;
-let spBase = "";
-let submitCounter = 0;
-
-async function startFakeSp() {
-    const app = express();
-    app.use(express.json());
-    // 凭证校验 (卖家带 x-sp-admin-key = SP_MERCHANT_TOKEN)
-    app.use((req, res, next) => {
-        if (req.path === "/api/sp/info") return next();
-        if (req.headers["x-sp-admin-key"] !== MERCHANT_TOKEN) {
-            return res.status(401).json({ error: "unauthorized", message: "x-sp-admin-key 无效" });
-        }
-        next();
-    });
-    app.get("/api/sp/info", (req, res) => {
-        spCapture.infoQueries = (spCapture.infoQueries || 0) + 1;
-        res.json({ name: "无锡小播鼠网络科技", desc: "TrustBase 官方支付服务商", commission_rate_bp: 100, rate_pct: "1.00%", gateway: "fake-sp" });
-    });
-    app.post("/api/sp/applyment/upload", (req, res) => {
-        spCapture.uploads.push(req.body);
-        res.json({ media_id: "FAKE_MEDIA_" + crypto.randomBytes(6).toString("hex") });
-    });
-    app.post("/api/sp/applyment/submit", (req, res) => {
-        spCapture.submits.push(req.body);
-        submitCounter++;
-        // F3: 卖家侧生成 business_code, SP 回显同号 (不带号才兜底生成)
-        res.json({ applyment_id: "200000212477" + String(5690 + submitCounter), business_code: req.body.business_code || ("TBFAKE" + String(submitCounter).padStart(6, "0")) });
-    });
-    app.get("/api/sp/applyment/status/:bc", (req, res) => {
-        spCapture.statusQueries.push(req.params.bc);
-        const ov = spCapture.statusOverride || {};
-        res.json({
-            business_code: req.params.bc, status: ov.status || "APPLYMENT_STATE_FINISHED", state_msg: ov.state_msg || "已完成",
-            sign_url: "https://pay.weixin.qq.com/public/apply4ec_sign/s?fake=1", sub_mchid: "1600000888",
-        });
-    });
-    spSrv = app.listen(0);
-    await new Promise((r) => spSrv.once("listening", r));
-    spBase = `http://127.0.0.1:${spSrv.address().port}`;
-}
-
-/** 起被测卖家后端 (新内存库) */
-async function startSeller() {
-    const db = new Database(":memory:");
-    const app = express();
-    app.use(express.json());
-    const router = onboard.createOnboardRouter({ db });
-    app.use("/api/onboard", router);
-    app.use("/onboard", router);
-    const srv = app.listen(0);
-    await new Promise((r) => srv.once("listening", r));
-    return { db, srv, base: `http://127.0.0.1:${srv.address().port}` };
-}
-
-const PLAINTEXT = { id: "440300199001011234", card: "6225880212345678", mobile: "13800001111" };
-
-/** 合法表单 (5 张图先走 upload 代理拿 media_id) */
-async function fillForm(base) {
-    const media = {};
-    for (const k of ["license_media_id", "legal_id_front_media_id", "legal_id_back_media_id", "store_entrance_media_id", "store_indoor_media_id"]) {
-        const r = await fetch(base + "/api/onboard/applyment/upload", {
-            method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ filename: k + ".jpg", content_b64: Buffer.from("fake-jpeg-" + k).toString("base64") }),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200, "upload " + k + ": " + JSON.stringify(j));
-        media[k] = j.media_id;
-    }
-    return {
-        subject_type: "SUBJECT_TYPE_INDIVIDUAL",
-        contact_name: "张三", contact_mobile: PLAINTEXT.mobile, contact_email: "zs@example.com",
-        merchant_shortname: "张三餐饮店", merchant_name: "深圳市张三餐饮店", license_number: "92440300MA5F00000X",
-        legal_name: "张三", legal_id_number: PLAINTEXT.id,
-        legal_id_period_begin: "2015-01-01", legal_id_period_end: "2035-01-01",
-        account_type: "BANK_ACCOUNT_TYPE_PERSONAL",
-        account_name: "张三", account_number: PLAINTEXT.card, account_bank: "招商银行",
-        store_name: "张三餐饮店南山店", store_address_code: "440300", store_address: "南山区xx路1号",
-        service_phone: "0755-12345678", settlement_id: "719", qualification_type: "零售",
-        ...media,
-    };
-}
-
-test.before(async () => {
-    await startFakeSp();
-    process.env.SP_GATEWAY_URL = spBase;
-});
-test.after(() => { if (spSrv) spSrv.close(); });
-
-test("upload 代理: 转发假 SP 拿 media_id, 凭证头正确", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        const before = spCapture.uploads.length;
-        const r = await fetch(base + "/api/onboard/applyment/upload", {
-            method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ filename: "id_front.jpg", content_b64: Buffer.from("fake-jpeg").toString("base64") }),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200);
-        assert.match(j.media_id, /^FAKE_MEDIA_/);
-        assert.strictEqual(spCapture.uploads.length, before + 1);
-        assert.strictEqual(spCapture.uploads[before].filename, "id_front.jpg");
-    } finally { srv.close(); }
-});
-
-test("submit: 本地加密转发 (转发体无明文, 密文可还原) + 台账落行 + 幂等", async () => {
-    const { db, srv, base } = await startSeller();
-    try {
-        const form = await fillForm(base);
-        const submitsBefore = spCapture.submits.length;
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200, JSON.stringify(j));
-        assert.match(j.business_code, /^TB\d{19}$/, "business_code 卖家侧本地生成 (F3)");
-        assert.ok(j.applyment_id);
-
-        // 转发体: already_encrypted + 无明文敏感
-        assert.strictEqual(spCapture.submits.length, submitsBefore + 1);
-        const fwd = spCapture.submits[submitsBefore];
-        assert.strictEqual(fwd.already_encrypted, true);
-        assert.match(fwd.tb_address || "", /^tct1[a-z0-9]{20,60}$/, "M2: payload 带商户链上地址 (引导金 recipient)");
-        const fwdStr = JSON.stringify(fwd);
-        assert.ok(!fwdStr.includes(PLAINTEXT.id), "转发体不含明文身份证");
-        assert.ok(!fwdStr.includes(PLAINTEXT.card), "转发体不含明文卡号");
-        assert.ok(!fwdStr.includes(PLAINTEXT.mobile), "转发体不含明文手机");
-        // 密文可用测试私钥还原 (证明用的是 SP 公钥 RSA-OAEP-SHA256)
-        const dec = crypto.privateDecrypt(
-            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
-            Buffer.from(fwd.legal_id_number, "base64")
-        ).toString("utf8");
-        assert.strictEqual(dec, PLAINTEXT.id);
-        // media_id 透传
-        assert.strictEqual(fwd.license_media_id, form.license_media_id);
-
-        // 台账: business_code 落行, 快照无明文, 暂存 payload 是密文
-        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
-        assert.strictEqual(row.business_code, j.business_code);
-        assert.strictEqual(row.status, "SUBMITTED");
-        assert.ok(!row.form_snapshot.includes(PLAINTEXT.id), "快照无明文身份证");
-        assert.ok(!row.encrypted_payload.includes(PLAINTEXT.id), "暂存 payload 无 plaintext");
-
-        // 幂等: 同表单再提交 → 同 business_code, 不重复调 SP
-        const r2 = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j2 = await r2.json();
-        assert.strictEqual(j2.idempotent, true);
-        assert.strictEqual(j2.business_code, j.business_code);
-        assert.strictEqual(spCapture.submits.length, submitsBefore + 1, "SP 未被重复调用");
-    } finally { srv.close(); }
-});
-
-test("status 代理: FINISHED + sign_url + sub_mchid 回页面, 台账同步", async () => {
-    const { db, srv, base } = await startSeller();
-    try {
-        const form = await fillForm(base);
-        const sr = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const { business_code } = await sr.json();
-        const r = await fetch(base + "/api/onboard/applyment/status");
-        const j = await r.json();
-        assert.strictEqual(r.status, 200);
-        assert.strictEqual(j.status, "APPLYMENT_STATE_FINISHED");
-        assert.ok(j.sign_url.includes("pay.weixin.qq.com"));
-        assert.strictEqual(j.sub_mchid, "1600000888");
-        assert.ok(spCapture.statusQueries.includes(business_code), "按 business_code 查 SP");
-        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
-        assert.strictEqual(row.sub_mchid, "1600000888");
-        assert.ok(row.sign_url.includes("pay.weixin.qq.com"));
-    } finally { srv.close(); }
-});
-
-test("SP 不可达: 503 友好提示 + 台账 PENDING_PUSH, 恢复后空 body 重试成功", async () => {
-    const { db, srv, base } = await startSeller();
-    try {
-        // 先上传 (SP 还在线)
-        const form = await fillForm(base);
-        // 掐断 SP
-        process.env.SP_GATEWAY_URL = "http://127.0.0.1:1";
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 503);
-        assert.strictEqual(j.error, "sp_unavailable");
-        assert.ok(j.message.includes("服务商暂时不可用"), j.message);
-        assert.strictEqual(j.pending, true);
-        // 台账 PENDING_PUSH + 密文暂存
-        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
-        assert.strictEqual(row.status, "PENDING_PUSH");
-        assert.ok(!row.encrypted_payload.includes(PLAINTEXT.id), "暂存的是密文");
-        // 状态查询如实回 PENDING_PUSH
-        const st = await (await fetch(base + "/api/onboard/applyment/status")).json();
-        assert.strictEqual(st.status, "PENDING_PUSH");
-        // 恢复 SP → 空 body 重试
-        process.env.SP_GATEWAY_URL = spBase;
-        const submitsBefore = spCapture.submits.length;
-        const r2 = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
-        });
-        const j2 = await r2.json();
-        assert.strictEqual(r2.status, 200, JSON.stringify(j2));
-        assert.match(j2.business_code, /^TB\d{19}$/);
-        assert.strictEqual(spCapture.submits.length, submitsBefore + 1, "用暂存密文重试转发了一次");
-        const row2 = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
-        assert.strictEqual(row2.status, "SUBMITTED");
-    } finally { srv.close(); }
-});
-
-test("缺必填字段 → 400; 缺 media_id → 400 指明哪张图", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        // 空表单
-        let r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
-        });
-        assert.strictEqual(r.status, 400);
-        // 缺一张图
-        const form = await fillForm(base);
-        delete form.store_indoor_media_id;
-        r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 400);
-        assert.strictEqual(j.error, "media_missing");
-        assert.ok(j.message.includes("门店内部照片"), j.message);
-    } finally { srv.close(); }
-});
-
-test("onboard 页面含进件表单 (btn-apply-submit) 且第③步状态机元素齐", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        const r = await fetch(base + "/onboard/");
-        const html = await r.text();
-        assert.strictEqual(r.status, 200);
-        assert.ok(html.includes("btn-apply-submit"), "进件提交按钮");
-        assert.ok(html.includes("apply-status"), "状态框");
-        assert.ok(html.includes("/api/onboard/applyment"), "页面打新端点");
-        // 2026-10-03: 三场景选择器 + 错误红卡
-        assert.ok(html.includes('name="sales_scene"'), "场景单选");
-        assert.ok(html.includes("SALES_SCENES_WEB") && html.includes("SALES_SCENES_MP"), "WEB/MP 场景");
-        assert.ok(html.includes("apply-err"), "错误红卡容器");
-        // 2026-10-03 二重框修复: 上传槽双态 (替换/删除按钮 + _aSlots 注册 + 删除清 media_id)
-        assert.ok(html.includes("upops") && html.includes("updel"), "替换/删除按钮结构");
-        assert.ok(html.includes("替换") && html.includes("删除"), "替换/删除文案");
-        assert.ok(html.includes("_aSlots"), "槽位双态注册表");
-        assert.ok(html.includes("delete _aMedia[field]"), "删除清 media_id");
-        assert.ok(!html.includes("slot.insertBefore(img"), "旧增强脚本预览补丁已删 (二重框根因)");
-        assert.ok(html.includes("prefill:function(mediaId)"), "预填走双态 (无第二个空框)");
-        assert.ok(html.includes("maybeAutoKyc"), "M2: 进件受理后自动 KYC 提交");
-        assert.ok(!html.includes("btn-verify"), "手动实名按钮已删 (自动触发)");
-    } finally { srv.close(); }
-});
-
-/** 场景表单变体: 去掉门店字段, 换场景专属字段+照片 */
-async function fillSceneForm(base, scene) {
-    const form = await fillForm(base);
-    delete form.store_name; delete form.store_address_code; delete form.store_address;
-    delete form.store_entrance_media_id; delete form.store_indoor_media_id;
-    form.sales_scene = scene;
-    if (scene === "SALES_SCENES_WEB") {
-        form.website_url = "https://shop.example.com";
-        for (const k of ["web_home_media_id", "web_product_media_id"]) {
-            const r = await fetch(base + "/api/onboard/applyment/upload", {
-                method: "POST", headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ filename: k + ".jpg", content_b64: Buffer.from("fake-" + k).toString("base64") }),
-            });
-            form[k] = (await r.json()).media_id;
-        }
-    } else if (scene === "SALES_SCENES_MP") {
-        form.appid = "wx1234567890abcdef";
-        form.appid_type = "mp";
-        const r = await fetch(base + "/api/onboard/applyment/upload", {
-            method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ filename: "mp.jpg", content_b64: Buffer.from("fake-mp").toString("base64") }),
-        });
-        form.mp_media_id = (await r.json()).media_id;
-    }
-    return form;
-}
-
-test("错误提示: 缺 store_address → 中文 message + field 定位 (2026-10-03 实测 fix)", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        const form = await fillForm(base);
-        delete form.store_address;
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 400);
-        assert.strictEqual(j.error, "invalid_param");
-        assert.strictEqual(j.field, "store_address", "field 回传供前端高亮");
-        assert.ok(j.message.includes("门店详细地址"), "中文文案: " + j.message);
-        assert.ok(j.message.includes("(store_address)"), "带字段名: " + j.message);
-    } finally { srv.close(); }
-});
-
-test("qualification_type 留空可提交 (后端默认 '无', 2026-10-03 实测秒拒 fix)", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        const form = await fillForm(base);
-        delete form.qualification_type;
-        const before = spCapture.submits.length;
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200, JSON.stringify(j));
-        assert.strictEqual(spCapture.submits[before].qualification_type, "无", "留空默认 '无'");
-    } finally { srv.close(); }
-});
-
-test("WEB 场景: 不带门店字段可提交, SP 侧组装 web_info", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        const form = await fillSceneForm(base, "SALES_SCENES_WEB");
-        const before = spCapture.submits.length;
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200, JSON.stringify(j));
-        const fwd = spCapture.submits[before];
-        assert.strictEqual(fwd.sales_scene, "SALES_SCENES_WEB");
-        assert.strictEqual(fwd.website_url, "https://shop.example.com");
-        assert.ok(!fwd.store_name, "不带门店字段");
-        // SP 侧结构: sales_info.web_info.domain (F2: 微信官方字段是 domain, 无 web_pics)
-        const wxBody = spApplymentLib.buildApplymentBody({ ...fwd, business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
-        assert.deepStrictEqual(wxBody.business_info.sales_info.sales_scenes_type, ["SALES_SCENES_WEB"]);
-        assert.strictEqual(wxBody.business_info.sales_info.web_info.domain, "https://shop.example.com");
-        assert.ok(!("web_pics" in wxBody.business_info.sales_info.web_info), "微信 web_info 无 pics 字段");
-        assert.ok(!wxBody.business_info.sales_info.biz_store_info, "无门店结构");
-        // 网址不带协议 → SP 拒
-        assert.throws(() => spApplymentLib.buildApplymentBody({ ...fwd, website_url: "shop.example.com" }, (s) => s, { alreadyEncrypted: true }), /http/);
-    } finally { srv.close(); }
-});
-
-test("MP 场景: mp_media_id 必传 + appid_type=mini 走 mini_program_info", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        // 缺公众号截图 → 400 中文提示
-        const form = await fillSceneForm(base, "SALES_SCENES_MP");
-        delete form.mp_media_id;
-        let r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        let j = await r.json();
-        assert.strictEqual(r.status, 400);
-        assert.strictEqual(j.error, "media_missing");
-        assert.strictEqual(j.field, "mp_media_id");
-        assert.ok(j.message.includes("公众号/小程序页面截图"), j.message);
-        // 补齐 → 200; mini 类型 → mini_program_info
-        const form2 = await fillSceneForm(base, "SALES_SCENES_MP");
-        form2.appid_type = "mini";
-        r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form2),
-        });
-        j = await r.json();
-        assert.strictEqual(r.status, 200, JSON.stringify(j));
-        const fwd = spCapture.submits[spCapture.submits.length - 1];
-        const wxBody = spApplymentLib.buildApplymentBody({ ...fwd, business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
-        assert.deepStrictEqual(wxBody.business_info.sales_info.sales_scenes_type, ["SALES_SCENES_MINI_PROGRAM"]);
-        assert.strictEqual(wxBody.business_info.sales_info.mini_program_info.mini_program_sub_appid, "wx1234567890abcdef");
-        // 公众号类型 → mp_info.mp_sub_appid
-        const wxBody2 = spApplymentLib.buildApplymentBody({ ...fwd, appid_type: "mp", business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
-        assert.strictEqual(wxBody2.business_info.sales_info.mp_info.mp_sub_appid, "wx1234567890abcdef");
-    } finally { srv.close(); }
-});
-
-test("端到端兼容: 卖家本机 → 真 sp-applyment 路由 (mock 微信), already_encrypted 直通成功", async () => {
-    // 起真 SP 网关代码 (微信调用 mock), admin key = 商户 token
-    process.env.SP_APPLYMENT_MOCK = "1";
-    process.env.SP_ADMIN_API_KEY = MERCHANT_TOKEN;
-    const spApplyment = require("./routes/sp-applyment");
-    const spDb = new Database(":memory:");
-    const spApp = express();
-    spApp.use(express.json());
-    spApp.use("/api/sp", spApplyment.createSpApplymentRouter({ db: spDb }));
-    const realSp = spApp.listen(0);
-    await new Promise((r) => realSp.once("listening", r));
-    const { db, srv, base } = await startSeller();
-    try {
-        process.env.SP_GATEWAY_URL = `http://127.0.0.1:${realSp.address().port}`;
-        const form = await fillForm(base);
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200, "真 SP 路由应接受密文直通: " + JSON.stringify(j));
-        assert.match(j.business_code, /^TB\d{19}$/, "business_code 由真 SP 生成");
-        assert.strictEqual(j.applyment_id, "2000002124775691", "mock applyment_id");
-        // SP 侧台账落行
-        const spRow = spDb.prepare("SELECT * FROM sp_applyments WHERE business_code = ?").get(j.business_code);
-        assert.ok(spRow, "SP 台账落行");
-        // 状态端到端: 卖家 → 真 SP (mock FINISHED)
-        const st = await (await fetch(base + "/api/onboard/applyment/status")).json();
-        assert.strictEqual(st.status, "APPLYMENT_STATE_FINISHED");
-        assert.ok(st.sign_url);
-        // 本地台账同步 sub_mchid
-        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
-        assert.strictEqual(row.sub_mchid, "1600000999");
-    } finally {
-        srv.close(); realSp.close();
-        delete process.env.SP_APPLYMENT_MOCK;
-        delete process.env.SP_ADMIN_API_KEY;
-        process.env.SP_GATEWAY_URL = spBase;
-    }
-});
+"use strict";
+/**
+ * test-onboard-applyment.js — 卖家本机进件链路 离线单测 (2026-10-03 架构纠偏)
+ * node --test test-onboard-applyment.js
+ *
+ * 数据流: 卖家页面 → 卖家本机 seller-backend (敏感字段本地 RSA-OAEP 加密)
+ *   → 假 SP 网关 (本测试起的 mock HTTP 服务, 捕获转发体断言无明文) → (真环境再到微信)
+ * SP 不可达: SP_GATEWAY_URL 指到关闭端口, 断言 503 友好提示 + 台账 PENDING_PUSH 可重试。
+ */
+const test = require("node:test");
+const assert = require("node:assert");
+const crypto = require("crypto");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const express = require("express");
+const Database = require("better-sqlite3");
+
+const MERCHANT_TOKEN = "test-sp-merchant-token";
+
+// 测试 SP 微信支付公钥对 (卖家本机加密用; 私钥断言密文可还原)
+const wxPub = crypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "onboard-apply-test-"));
+const pubKeyPath = path.join(tmpDir, "wx_sp_pub.pem");
+fs.writeFileSync(pubKeyPath, wxPub.publicKey.export({ type: "spki", format: "pem" }));
+
+process.env.WXPAY_SP_PUBLIC_KEY_PATH = pubKeyPath;
+process.env.TB_BASE_DIR = tmpDir; // M2: applyment submit 会读本机 seller 身份 (tb_address 贯通), 隔离到临时目录
+process.env.SP_MERCHANT_TOKEN = MERCHANT_TOKEN;
+
+const onboard = require("./routes/onboard");
+const spApplymentLib = require("./routes/sp-applyment"); // buildApplymentBody 场景结构断言用
+
+// ---------- 假 SP 网关 (捕获请求体) ----------
+const spCapture = { uploads: [], submits: [], statusQueries: [] };
+let spSrv = null;
+let spBase = "";
+let submitCounter = 0;
+
+async function startFakeSp() {
+    const app = express();
+    app.use(express.json());
+    // 凭证校验 (卖家带 x-sp-admin-key = SP_MERCHANT_TOKEN)
+    app.use((req, res, next) => {
+        if (req.path === "/api/sp/info") return next();
+        if (req.headers["x-sp-admin-key"] !== MERCHANT_TOKEN) {
+            return res.status(401).json({ error: "unauthorized", message: "x-sp-admin-key 无效" });
+        }
+        next();
+    });
+    app.get("/api/sp/info", (req, res) => {
+        spCapture.infoQueries = (spCapture.infoQueries || 0) + 1;
+        res.json({ name: "无锡小播鼠网络科技", desc: "TrustBase 官方支付服务商", commission_rate_bp: 100, rate_pct: "1.00%", gateway: "fake-sp" });
+    });
+    app.post("/api/sp/applyment/upload", (req, res) => {
+        spCapture.uploads.push(req.body);
+        res.json({ media_id: "FAKE_MEDIA_" + crypto.randomBytes(6).toString("hex") });
+    });
+    app.post("/api/sp/applyment/submit", (req, res) => {
+        spCapture.submits.push(req.body);
+        submitCounter++;
+        // F3: 卖家侧生成 business_code, SP 回显同号 (不带号才兜底生成)
+        res.json({ applyment_id: "200000212477" + String(5690 + submitCounter), business_code: req.body.business_code || ("TBFAKE" + String(submitCounter).padStart(6, "0")) });
+    });
+    app.get("/api/sp/applyment/status/:bc", (req, res) => {
+        spCapture.statusQueries.push(req.params.bc);
+        const ov = spCapture.statusOverride || {};
+        res.json({
+            business_code: req.params.bc, status: ov.status || "APPLYMENT_STATE_FINISHED", state_msg: ov.state_msg || "已完成",
+            sign_url: "https://pay.weixin.qq.com/public/apply4ec_sign/s?fake=1", sub_mchid: "1600000888",
+        });
+    });
+    spSrv = app.listen(0);
+    await new Promise((r) => spSrv.once("listening", r));
+    spBase = `http://127.0.0.1:${spSrv.address().port}`;
+}
+
+/** 起被测卖家后端 (新内存库) */
+async function startSeller() {
+    const db = new Database(":memory:");
+    const app = express();
+    app.use(express.json());
+    const router = onboard.createOnboardRouter({ db });
+    app.use("/api/onboard", router);
+    app.use("/onboard", router);
+    const srv = app.listen(0);
+    await new Promise((r) => srv.once("listening", r));
+    return { db, srv, base: `http://127.0.0.1:${srv.address().port}` };
+}
+
+const PLAINTEXT = { id: "440300199001011234", card: "6225880212345678", mobile: "13800001111" };
+
+/** 合法表单 (5 张图先走 upload 代理拿 media_id) */
+async function fillForm(base) {
+    const media = {};
+    for (const k of ["license_media_id", "legal_id_front_media_id", "legal_id_back_media_id", "store_entrance_media_id", "store_indoor_media_id"]) {
+        const r = await fetch(base + "/api/onboard/applyment/upload", {
+            method: "POST", headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ filename: k + ".jpg", content_b64: Buffer.from("fake-jpeg-" + k).toString("base64") }),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, "upload " + k + ": " + JSON.stringify(j));
+        media[k] = j.media_id;
+    }
+    return {
+        subject_type: "SUBJECT_TYPE_INDIVIDUAL",
+        contact_name: "张三", contact_mobile: PLAINTEXT.mobile, contact_email: "zs@example.com",
+        merchant_shortname: "张三餐饮店", merchant_name: "深圳市张三餐饮店", license_number: "92440300MA5F00000X",
+        legal_name: "张三", legal_id_number: PLAINTEXT.id,
+        legal_id_period_begin: "2015-01-01", legal_id_period_end: "2035-01-01",
+        account_type: "BANK_ACCOUNT_TYPE_PERSONAL",
+        account_name: "张三", account_number: PLAINTEXT.card, account_bank: "招商银行",
+        store_name: "张三餐饮店南山店", store_address_code: "440300", store_address: "南山区xx路1号",
+        service_phone: "0755-12345678", settlement_id: "719", qualification_type: "零售",
+        ...media,
+    };
+}
+
+test.before(async () => {
+    await startFakeSp();
+    process.env.SP_GATEWAY_URL = spBase;
+});
+test.after(() => { if (spSrv) spSrv.close(); });
+
+test("upload 代理: 转发假 SP 拿 media_id, 凭证头正确", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const before = spCapture.uploads.length;
+        const r = await fetch(base + "/api/onboard/applyment/upload", {
+            method: "POST", headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ filename: "id_front.jpg", content_b64: Buffer.from("fake-jpeg").toString("base64") }),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200);
+        assert.match(j.media_id, /^FAKE_MEDIA_/);
+        assert.strictEqual(spCapture.uploads.length, before + 1);
+        assert.strictEqual(spCapture.uploads[before].filename, "id_front.jpg");
+    } finally { srv.close(); }
+});
+
+test("submit: 本地加密转发 (转发体无明文, 密文可还原) + 台账落行 + 幂等", async () => {
+    const { db, srv, base } = await startSeller();
+    try {
+        const form = await fillForm(base);
+        const submitsBefore = spCapture.submits.length;
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.match(j.business_code, /^TB\d{19}$/, "business_code 卖家侧本地生成 (F3)");
+        assert.ok(j.applyment_id);
+
+        // 转发体: already_encrypted + 无明文敏感
+        assert.strictEqual(spCapture.submits.length, submitsBefore + 1);
+        const fwd = spCapture.submits[submitsBefore];
+        assert.strictEqual(fwd.already_encrypted, true);
+        assert.match(fwd.tb_address || "", /^tct1[a-z0-9]{20,60}$/, "M2: payload 带商户链上地址 (引导金 recipient)");
+        const fwdStr = JSON.stringify(fwd);
+        assert.ok(!fwdStr.includes(PLAINTEXT.id), "转发体不含明文身份证");
+        assert.ok(!fwdStr.includes(PLAINTEXT.card), "转发体不含明文卡号");
+        assert.ok(!fwdStr.includes(PLAINTEXT.mobile), "转发体不含明文手机");
+        // 密文可用测试私钥还原 (证明用的是 SP 公钥 RSA-OAEP-SHA256)
+        const dec = crypto.privateDecrypt(
+            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha1" },
+            Buffer.from(fwd.legal_id_number, "base64")
+        ).toString("utf8");
+        assert.strictEqual(dec, PLAINTEXT.id);
+        // media_id 透传
+        assert.strictEqual(fwd.license_media_id, form.license_media_id);
+
+        // 台账: business_code 落行, 快照无明文, 暂存 payload 是密文
+        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
+        assert.strictEqual(row.business_code, j.business_code);
+        assert.strictEqual(row.status, "SUBMITTED");
+        assert.ok(!row.form_snapshot.includes(PLAINTEXT.id), "快照无明文身份证");
+        assert.ok(!row.encrypted_payload.includes(PLAINTEXT.id), "暂存 payload 无 plaintext");
+
+        // 幂等: 同表单再提交 → 同 business_code, 不重复调 SP
+        const r2 = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j2 = await r2.json();
+        assert.strictEqual(j2.idempotent, true);
+        assert.strictEqual(j2.business_code, j.business_code);
+        assert.strictEqual(spCapture.submits.length, submitsBefore + 1, "SP 未被重复调用");
+    } finally { srv.close(); }
+});
+
+test("status 代理: FINISHED + sign_url + sub_mchid 回页面, 台账同步", async () => {
+    const { db, srv, base } = await startSeller();
+    try {
+        const form = await fillForm(base);
+        const sr = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const { business_code } = await sr.json();
+        const r = await fetch(base + "/api/onboard/applyment/status");
+        const j = await r.json();
+        assert.strictEqual(r.status, 200);
+        assert.strictEqual(j.status, "APPLYMENT_STATE_FINISHED");
+        assert.ok(j.sign_url.includes("pay.weixin.qq.com"));
+        assert.strictEqual(j.sub_mchid, "1600000888");
+        assert.ok(spCapture.statusQueries.includes(business_code), "按 business_code 查 SP");
+        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
+        assert.strictEqual(row.sub_mchid, "1600000888");
+        assert.ok(row.sign_url.includes("pay.weixin.qq.com"));
+    } finally { srv.close(); }
+});
+
+test("SP 不可达: 503 友好提示 + 台账 PENDING_PUSH, 恢复后空 body 重试成功", async () => {
+    const { db, srv, base } = await startSeller();
+    try {
+        // 先上传 (SP 还在线)
+        const form = await fillForm(base);
+        // 掐断 SP
+        process.env.SP_GATEWAY_URL = "http://127.0.0.1:1";
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 503);
+        assert.strictEqual(j.error, "sp_unavailable");
+        assert.ok(j.message.includes("服务商暂时不可用"), j.message);
+        assert.strictEqual(j.pending, true);
+        // 台账 PENDING_PUSH + 密文暂存
+        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
+        assert.strictEqual(row.status, "PENDING_PUSH");
+        assert.ok(!row.encrypted_payload.includes(PLAINTEXT.id), "暂存的是密文");
+        // 状态查询如实回 PENDING_PUSH
+        const st = await (await fetch(base + "/api/onboard/applyment/status")).json();
+        assert.strictEqual(st.status, "PENDING_PUSH");
+        // 恢复 SP → 空 body 重试
+        process.env.SP_GATEWAY_URL = spBase;
+        const submitsBefore = spCapture.submits.length;
+        const r2 = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
+        });
+        const j2 = await r2.json();
+        assert.strictEqual(r2.status, 200, JSON.stringify(j2));
+        assert.match(j2.business_code, /^TB\d{19}$/);
+        assert.strictEqual(spCapture.submits.length, submitsBefore + 1, "用暂存密文重试转发了一次");
+        const row2 = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
+        assert.strictEqual(row2.status, "SUBMITTED");
+    } finally { srv.close(); }
+});
+
+test("缺必填字段 → 400; 缺 media_id → 400 指明哪张图", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        // 空表单
+        let r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
+        });
+        assert.strictEqual(r.status, 400);
+        // 缺一张图
+        const form = await fillForm(base);
+        delete form.store_indoor_media_id;
+        r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 400);
+        assert.strictEqual(j.error, "media_missing");
+        assert.ok(j.message.includes("门店内部照片"), j.message);
+    } finally { srv.close(); }
+});
+
+test("onboard 页面含进件表单 (btn-apply-submit) 且第③步状态机元素齐", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const r = await fetch(base + "/onboard/");
+        const html = await r.text();
+        assert.strictEqual(r.status, 200);
+        assert.ok(html.includes("btn-apply-submit"), "进件提交按钮");
+        assert.ok(html.includes("apply-status"), "状态框");
+        assert.ok(html.includes("/api/onboard/applyment"), "页面打新端点");
+        // 2026-10-03: 三场景选择器 + 错误红卡
+        assert.ok(html.includes('name="sales_scene"'), "场景单选");
+        assert.ok(html.includes("SALES_SCENES_WEB") && html.includes("SALES_SCENES_MP"), "WEB/MP 场景");
+        assert.ok(html.includes("apply-err"), "错误红卡容器");
+        // 2026-10-03 二重框修复: 上传槽双态 (替换/删除按钮 + _aSlots 注册 + 删除清 media_id)
+        assert.ok(html.includes("upops") && html.includes("updel"), "替换/删除按钮结构");
+        assert.ok(html.includes("替换") && html.includes("删除"), "替换/删除文案");
+        assert.ok(html.includes("_aSlots"), "槽位双态注册表");
+        assert.ok(html.includes("delete _aMedia[field]"), "删除清 media_id");
+        assert.ok(!html.includes("slot.insertBefore(img"), "旧增强脚本预览补丁已删 (二重框根因)");
+        assert.ok(html.includes("prefill:function(mediaId)"), "预填走双态 (无第二个空框)");
+        assert.ok(html.includes("maybeAutoKyc"), "M2: 进件受理后自动 KYC 提交");
+        assert.ok(!html.includes("btn-verify"), "手动实名按钮已删 (自动触发)");
+    } finally { srv.close(); }
+});
+
+/** 场景表单变体: 去掉门店字段, 换场景专属字段+照片 */
+async function fillSceneForm(base, scene) {
+    const form = await fillForm(base);
+    delete form.store_name; delete form.store_address_code; delete form.store_address;
+    delete form.store_entrance_media_id; delete form.store_indoor_media_id;
+    form.sales_scene = scene;
+    if (scene === "SALES_SCENES_WEB") {
+        form.website_url = "https://shop.example.com";
+        for (const k of ["web_home_media_id", "web_product_media_id"]) {
+            const r = await fetch(base + "/api/onboard/applyment/upload", {
+                method: "POST", headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ filename: k + ".jpg", content_b64: Buffer.from("fake-" + k).toString("base64") }),
+            });
+            form[k] = (await r.json()).media_id;
+        }
+    } else if (scene === "SALES_SCENES_MP") {
+        form.appid = "wx1234567890abcdef";
+        form.appid_type = "mp";
+        const r = await fetch(base + "/api/onboard/applyment/upload", {
+            method: "POST", headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ filename: "mp.jpg", content_b64: Buffer.from("fake-mp").toString("base64") }),
+        });
+        form.mp_media_id = (await r.json()).media_id;
+    }
+    return form;
+}
+
+test("错误提示: 缺 store_address → 中文 message + field 定位 (2026-10-03 实测 fix)", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const form = await fillForm(base);
+        delete form.store_address;
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 400);
+        assert.strictEqual(j.error, "invalid_param");
+        assert.strictEqual(j.field, "store_address", "field 回传供前端高亮");
+        assert.ok(j.message.includes("门店详细地址"), "中文文案: " + j.message);
+        assert.ok(j.message.includes("(store_address)"), "带字段名: " + j.message);
+    } finally { srv.close(); }
+});
+
+test("qualification_type 留空可提交 (后端默认 '无', 2026-10-03 实测秒拒 fix)", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const form = await fillForm(base);
+        delete form.qualification_type;
+        const before = spCapture.submits.length;
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.strictEqual(spCapture.submits[before].qualification_type, "无", "留空默认 '无'");
+    } finally { srv.close(); }
+});
+
+test("WEB 场景: 不带门店字段可提交, SP 侧组装 web_info", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const form = await fillSceneForm(base, "SALES_SCENES_WEB");
+        const before = spCapture.submits.length;
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        const fwd = spCapture.submits[before];
+        assert.strictEqual(fwd.sales_scene, "SALES_SCENES_WEB");
+        assert.strictEqual(fwd.website_url, "https://shop.example.com");
+        assert.ok(!fwd.store_name, "不带门店字段");
+        // SP 侧结构: sales_info.web_info.domain (F2: 微信官方字段是 domain, 无 web_pics)
+        const wxBody = spApplymentLib.buildApplymentBody({ ...fwd, business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
+        assert.deepStrictEqual(wxBody.business_info.sales_info.sales_scenes_type, ["SALES_SCENES_WEB"]);
+        assert.strictEqual(wxBody.business_info.sales_info.web_info.domain, "https://shop.example.com");
+        assert.ok(!("web_pics" in wxBody.business_info.sales_info.web_info), "微信 web_info 无 pics 字段");
+        assert.ok(!wxBody.business_info.sales_info.biz_store_info, "无门店结构");
+        // 网址不带协议 → SP 拒
+        assert.throws(() => spApplymentLib.buildApplymentBody({ ...fwd, website_url: "shop.example.com" }, (s) => s, { alreadyEncrypted: true }), /http/);
+    } finally { srv.close(); }
+});
+
+test("MP 场景: mp_media_id 必传 + appid_type=mini 走 mini_program_info", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        // 缺公众号截图 → 400 中文提示
+        const form = await fillSceneForm(base, "SALES_SCENES_MP");
+        delete form.mp_media_id;
+        let r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        let j = await r.json();
+        assert.strictEqual(r.status, 400);
+        assert.strictEqual(j.error, "media_missing");
+        assert.strictEqual(j.field, "mp_media_id");
+        assert.ok(j.message.includes("公众号/小程序页面截图"), j.message);
+        // 补齐 → 200; mini 类型 → mini_program_info
+        const form2 = await fillSceneForm(base, "SALES_SCENES_MP");
+        form2.appid_type = "mini";
+        r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form2),
+        });
+        j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        const fwd = spCapture.submits[spCapture.submits.length - 1];
+        const wxBody = spApplymentLib.buildApplymentBody({ ...fwd, business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
+        assert.deepStrictEqual(wxBody.business_info.sales_info.sales_scenes_type, ["SALES_SCENES_MINI_PROGRAM"]);
+        assert.strictEqual(wxBody.business_info.sales_info.mini_program_info.mini_program_sub_appid, "wx1234567890abcdef");
+        // 公众号类型 → mp_info.mp_sub_appid
+        const wxBody2 = spApplymentLib.buildApplymentBody({ ...fwd, appid_type: "mp", business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
+        assert.strictEqual(wxBody2.business_info.sales_info.mp_info.mp_sub_appid, "wx1234567890abcdef");
+    } finally { srv.close(); }
+});
+
+test("端到端兼容: 卖家本机 → 真 sp-applyment 路由 (mock 微信), already_encrypted 直通成功", async () => {
+    // 起真 SP 网关代码 (微信调用 mock), admin key = 商户 token
+    process.env.SP_APPLYMENT_MOCK = "1";
+    process.env.SP_ADMIN_API_KEY = MERCHANT_TOKEN;
+    const spApplyment = require("./routes/sp-applyment");
+    const spDb = new Database(":memory:");
+    const spApp = express();
+    spApp.use(express.json());
+    spApp.use("/api/sp", spApplyment.createSpApplymentRouter({ db: spDb }));
+    const realSp = spApp.listen(0);
+    await new Promise((r) => realSp.once("listening", r));
+    const { db, srv, base } = await startSeller();
+    try {
+        process.env.SP_GATEWAY_URL = `http://127.0.0.1:${realSp.address().port}`;
+        const form = await fillForm(base);
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, "真 SP 路由应接受密文直通: " + JSON.stringify(j));
+        assert.match(j.business_code, /^TB\d{19}$/, "business_code 由真 SP 生成");
+        assert.strictEqual(j.applyment_id, "2000002124775691", "mock applyment_id");
+        // SP 侧台账落行
+        const spRow = spDb.prepare("SELECT * FROM sp_applyments WHERE business_code = ?").get(j.business_code);
+        assert.ok(spRow, "SP 台账落行");
+        // 状态端到端: 卖家 → 真 SP (mock FINISHED)
+        const st = await (await fetch(base + "/api/onboard/applyment/status")).json();
+        assert.strictEqual(st.status, "APPLYMENT_STATE_FINISHED");
+        assert.ok(st.sign_url);
+        // 本地台账同步 sub_mchid
+        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
+        assert.strictEqual(row.sub_mchid, "1600000999");
+    } finally {
+        srv.close(); realSp.close();
+        delete process.env.SP_APPLYMENT_MOCK;
+        delete process.env.SP_ADMIN_API_KEY;
+        process.env.SP_GATEWAY_URL = spBase;
+    }
+});
 
 test("F1: REJECTED 后可同 business_code 覆盖重提 (卖家侧不幂等拦截)", async () => {
     const { db, srv, base } = await startSeller();
@@ -523,7 +523,7 @@ test("F4: 企业主体 id_card_address 必填 + 本机加密 + SP 组装进 id_c
         assert.notStrictEqual(fwd.legal_id_address, form.legal_id_address, "居住地址不是明文");
         assert.ok(!JSON.stringify(fwd).includes("xx路1号101室"), "转发体无明文居住地址");
         const dec = crypto.privateDecrypt(
-            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
+            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha1" },
             Buffer.from(fwd.legal_id_address, "base64")
         ).toString("utf8");
         assert.strictEqual(dec, form.legal_id_address);

package/test-sp-applyment.js

@@ -163,7 +163,7 @@ test("submit mock: 落台账 + 敏感字段加密 (非明文且可还原) + 重
         const encId = wxBody.subject_info.identity_info.id_card_info.id_card_number;
         assert.notStrictEqual(encId, form.legal_id_number, "身份证号不是明文");
         const dec = crypto.privateDecrypt(
-            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
+            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha1" },
             Buffer.from(encId, "base64")
         ).toString("utf8");
         assert.strictEqual(dec, form.legal_id_number, "密文可还原");