trustbase-seller-backend 0.3.5 → 0.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/onboard.html

@@ -63,6 +63,30 @@ h1{font-size:22px;margin-bottom:4px}
 /* 结算规则只读展示框 (按主体推导, 商户不用选; settlement_id=结算规则 ID 716/719/727,
    qualification_type=行业类目 MCC — 两次微信实测错误交叉锁定后的正确口径) */
 #apply-form .arule{padding:10px 12px;border:1px dashed #D4CDBF;border-radius:8px;background:#F7F3EB;color:#6B655B;font-size:14px}
+/* ===== 分步向导 stepper (2026-10-03 腾讯式分步填写): 6 步, 当前橙/完成绿/未达灰, 可回跳完成步 ===== */
+#wz-bar{display:flex;gap:6px;overflow-x:auto;margin-bottom:12px;padding-bottom:4px}
+#wz-bar .wz-item{display:flex;align-items:center;gap:6px;flex:none;font-size:12px;padding:6px 10px;border-radius:999px;border:1px solid #EAE3D6;background:#FFFDF9;cursor:pointer;color:#6B655B}
+#wz-bar .wz-dot{display:inline-flex;align-items:center;justify-content:center;width:20px;height:20px;border-radius:50%;background:#D4CDBF;color:#fff;font-size:11px;font-weight:600}
+#wz-bar .wz-item.cur{border-color:#C4633C;background:#FBF1EA;color:#C4633C;font-weight:600}
+#wz-bar .wz-item.cur .wz-dot{background:#C4633C}
+#wz-bar .wz-item.done{border-color:#BBF7D0;background:#F0FDF4;color:#166534}
+#wz-bar .wz-item.done .wz-dot{background:#16A34A}
+#wz-bar .wz-item.todo{color:#BDB5A6;cursor:default}
+#wz-step-head{margin-bottom:10px}
+#wz-step-head .desc{margin-top:2px}
+#wz-nav{display:flex;gap:10px;margin-top:16px}
+#wz-nav .sbtn{flex:1;padding:12px;text-align:center;font-size:15px}
+#wz-preview .wz-grp{border:1px solid #EAE3D6;border-radius:10px;padding:10px 12px;margin-bottom:10px;background:#FFFDF9}
+#wz-preview .wz-grp-t{font-size:13px;font-weight:600;color:#C4633C;margin-bottom:6px}
+#wz-preview .wz-row{display:flex;justify-content:space-between;font-size:13px;padding:3px 0;border-bottom:1px dashed #EFE9DC;gap:12px}
+#wz-preview .wz-row:last-child{border-bottom:none}
+#wz-preview .wz-row span{color:#8A857B;flex:none}
+#wz-preview .wz-row b{text-align:right;word-break:break-all}
+/* 特殊资质槽 (就地位: 行业选择正下方, 紧凑矮版 — 选了餐饮下面立刻要食品经营许可证) */
+#apply-form #a_up_qual_wrap{margin-top:4px}
+#apply-form #a_up_qual_wrap label.sbtn{padding:10px;gap:2px}
+#apply-form #a_up_qual_wrap label.sbtn::before{font-size:16px}
+#apply-form #a_up_qual_wrap .upfilled .auprev{max-height:110px}
 #apply-form .afield input:focus,#apply-form .afield select:focus{outline:none;border-color:#C4633C;box-shadow:0 0 0 3px rgba(196,99,60,.15)}
 /* 上传卡片 (结构由 mountApplyUpload 生成: 标题label + label.sbtn>input + span#st_*) */
 #apply-form .auploads{display:grid;grid-template-columns:1fr 1fr;gap:12px 14px}
@@ -99,7 +123,7 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
 #apply-status a{display:inline-block;background:#C4633C;color:#fff !important;border-radius:8px;padding:10px 18px;font-size:15px;font-weight:600;text-decoration:none;margin-top:8px}
 #apply-status .aqr{display:flex;align-items:center;justify-content:center;width:120px;height:120px;border:2px dashed #93C5FD;border-radius:10px;background:#fff;color:#8A857B;font-size:12px;text-align:center;margin:10px 0 2px;line-height:1.6}
 /* 经营场景选择卡 (2026-10-03 三场景) */
-#apply-form .ascene-row{display:grid;grid-template-columns:repeat(3,1fr);gap:10px}
+#apply-form .ascene-row{display:grid;grid-template-columns:repeat(4,1fr);gap:10px}
 #apply-form .ascene{display:flex;flex-direction:column;align-items:center;gap:2px;border:2px solid #EAE3D6;border-radius:12px;background:#FFFDF9;padding:14px 8px;cursor:pointer;text-align:center;transition:border-color .15s,background .15s}
 #apply-form .ascene input{display:none}
 #apply-form .ascene .ascene-ico{font-size:24px;line-height:1}
@@ -176,12 +200,16 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
     <div class="hintbox" id="apply-msg"></div>
     <div id="apply-status" style="display:none;margin-top:12px"></div>
     <div id="apply-form" style="display:none;margin-top:12px">
-      <div class="desc" style="margin-bottom:12px">以下资料由你的电脑<b>本地加密</b>后交给服务商，向微信申请特约商户收款账户。身份证号/银行卡号在你电脑上就已加密，任何人 (含服务商) 都看不到明文。</div>
+      <div class="desc" style="margin-bottom:12px">以下资料由你的电脑<b>本地加密</b>后交给服务商，向微信申请特约商户收款账户。身份证号/银行卡号在你电脑上就已加密，任何人 (含服务商) 都看不到明文。</div>
+      <div id="wz-bar"></div>
+      <div id="wz-step-head"><b id="wz-title" style="font-size:15px"></b><div class="desc" id="wz-desc"></div></div>
 
       <div class="acard">
         <div class="acard-h">经营场景 <span class="aopt">三选一, 决定第 4/5 张卡片要什么资料</span></div>
         <div class="ascene-row">
-          <label class="ascene selected"><input type="radio" name="sales_scene" value="SALES_SCENES_STORE" checked onchange="setScene(this.value)">
+          <label class="ascene selected"><input type="radio" name="sales_scene" value="SALES_SCENES_APP" checked onchange="setScene(this.value)">
+            <span class="ascene-ico">📲</span><span class="ascene-name">APP 应用</span><span class="ascene-sub">默认: 用服务商应用, 零自备</span></label>
+          <label class="ascene"><input type="radio" name="sales_scene" value="SALES_SCENES_STORE" onchange="setScene(this.value)">
             <span class="ascene-ico">🏬</span><span class="ascene-name">线下门店</span><span class="ascene-sub">门店地址 + 门头/店内照片</span></label>
           <label class="ascene"><input type="radio" name="sales_scene" value="SALES_SCENES_WEB" onchange="setScene(this.value)">
             <span class="ascene-ico">🌐</span><span class="ascene-name">互联网网站</span><span class="ascene-sub">网址 + 截图, 需 ICP 备案</span></label>
@@ -205,6 +233,7 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
             <select id="a_industry_cat"></select></div>
           <div class="afield"><label for="a_settlement_id">所属行业·子类 (微信行业名称)</label>
             <select id="a_settlement_id"></select></div>
+          <div class="afield afield-full" id="a_up_qual_wrap" style="display:none"><div id="a_up_qual"></div></div>
         </div>
       </div>
 
@@ -258,6 +287,18 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
 
       <div class="acard">
         <div class="acard-h"><span class="anum">4</span><span id="acard4-title">门店信息</span></div>
+        <div id="scene_fields_app">
+          <div class="agrid">
+            <div class="afield"><label for="a_app_appid">应用 AppID</label><input id="a_app_appid" placeholder="默认由服务商提供">
+              <div class="hint" id="a_appid_note" style="display:none;font-size:12px;color:#16A34A;margin-top:3px">✓ 由服务商提供, 无需自备</div></div>
+            <div class="afield"><label for="a_app_provider">应用归属</label>
+              <select id="a_app_provider"><option value="sp">服务商应用 (默认, 零自备)</option><option value="own">商户自有应用</option></select></div>
+          </div>
+          <div class="ahint" id="a_app_reuse_row" style="display:none;margin-top:8px">
+            <label style="cursor:pointer"><input type="checkbox" id="a_app_reuse" checked style="width:auto;margin-right:6px">使用服务商提供的应用截图 ✓ (推荐, 不用自己传)</label>
+          </div>
+          <div class="ahint" id="a_app_own_hint" style="display:none;margin-top:8px">使用自有应用: 请填自己的 AppID 并上传 4 张应用截图</div>
+        </div>
         <div class="agrid" id="scene_fields_store">
           <div class="afield"><label for="a_store_name">门店名称</label><input id="a_store_name" placeholder="线下场所名称"></div>
           <div class="afield"><label for="a_store_address_code">门店省市编码</label>
@@ -291,14 +332,24 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
           <div id="a_up_idfront"></div>
           <div id="a_up_idback"></div>
           <div id="a_up_s1"></div>
-          <div id="a_up_s2"></div>
-          <div id="a_up_qual_wrap" style="display:none;grid-column:1/-1"><div id="a_up_qual"></div></div>
+          <div id="a_up_s2"></div>
+          <div id="a_up_s3" style="display:none"></div>
+          <div id="a_up_s4" style="display:none"></div>
         </div>
       </div>
 
+      <div class="acard" id="wz-preview-card" style="display:none">
+        <div class="acard-h"><span class="anum">6</span>确认提交</div>
+        <div class="desc" style="margin-bottom:8px">请核对以下资料，确认无误后提交。身份证号/卡号等敏感信息已打码。</div>
+        <div id="wz-preview"></div>
+      </div>
       <div id="apply-err" style="display:none"></div>
       <button class="abtn" id="btn-apply-submit" onclick="submitApplyment()">加密并提交进件</button>
       <div class="aprivacy">🔒 资料只保存在这台电脑; 敏感字段本机加密后交服务商; 服务商暂时不可达时加密暂存本机, 可重试。</div>
+      <div id="wz-nav">
+        <button type="button" class="sbtn" id="wz-prev" onclick="wzGo(-1)">← 上一步</button>
+        <button type="button" class="sbtn primary" id="wz-next" onclick="wzGo(1)">下一步 →</button>
+      </div>
     </div>
   </div>
 </div>
@@ -617,30 +668,54 @@ mountApplyUpload('a_up_idfront','legal_id_front_media_id','身份证人像面 (
 mountApplyUpload('a_up_idback','legal_id_back_media_id','身份证国徽面 (必传)');
 // 经营场景 (2026-10-03 xiaomu 拍板三选一): 场景决定第 4 卡片字段 + 第 5 卡片场景照片槽
 var SCENE_UPLOADS={
+  SALES_SCENES_APP:[['a_up_s1','app_home_media_id','应用首页截图 (必传)'],['a_up_s2','app_tail_media_id','应用尾页截图 (必传)'],
+    ['a_up_s3','app_inner_media_id','应用内页截图 (必传)'],['a_up_s4','app_pay_media_id','应用支付页截图 (必传)']],
   SALES_SCENES_STORE:[['a_up_s1','store_entrance_media_id','门店门头照片 (必传)'],['a_up_s2','store_indoor_media_id','门店内部照片 (必传)']],
   SALES_SCENES_WEB:[['a_up_s1','web_home_media_id','网站首页截图 (必传)'],['a_up_s2','web_product_media_id','商品/服务页截图 (必传)']],
   SALES_SCENES_MP:[['a_up_s1','mp_media_id','公众号/小程序页面截图 (必传)']]
 };
-var SCENE_TITLES={SALES_SCENES_STORE:'门店信息',SALES_SCENES_WEB:'网站信息',SALES_SCENES_MP:'公众号 / 小程序'};
+var SCENE_TITLES={SALES_SCENES_APP:'应用信息 (APP)',SALES_SCENES_STORE:'门店信息',SALES_SCENES_WEB:'网站信息',SALES_SCENES_MP:'公众号 / 小程序'};
 function currentScene(){
   var r=document.querySelector('input[name="sales_scene"]:checked');
-  return r?r.value:'SALES_SCENES_STORE';
+  return r?r.value:'SALES_SCENES_APP'; // 默认 APP (普通商户零自备)
 }
 function setScene(scene){
+  document.getElementById('scene_fields_app').style.display=scene==='SALES_SCENES_APP'?'':'none';
   document.getElementById('scene_fields_store').style.display=scene==='SALES_SCENES_STORE'?'':'none';
   document.getElementById('scene_fields_web').style.display=scene==='SALES_SCENES_WEB'?'':'none';
   document.getElementById('scene_fields_mp').style.display=scene==='SALES_SCENES_MP'?'':'none';
-  document.getElementById('acard4-title').textContent=SCENE_TITLES[scene]||'门店信息';
+  document.getElementById('acard4-title').textContent=SCENE_TITLES[scene]||'应用信息 (APP)';
   document.querySelectorAll('.ascene').forEach(function(c){
     c.classList.toggle('selected', c.querySelector('input').value===scene);
   });
   // 场景照片槽重挂 + 清掉旧场景 media_id (避免跨场景串数据)
-  ['store_entrance_media_id','store_indoor_media_id','web_home_media_id','web_product_media_id','mp_media_id'].forEach(function(k){delete _aMedia[k];});
-  var slots=SCENE_UPLOADS[scene]||SCENE_UPLOADS.SALES_SCENES_STORE;
+  ['store_entrance_media_id','store_indoor_media_id','web_home_media_id','web_product_media_id','mp_media_id',
+    'app_home_media_id','app_tail_media_id','app_inner_media_id','app_pay_media_id'].forEach(function(k){delete _aMedia[k];});
+  var slots=SCENE_UPLOADS[scene]||SCENE_UPLOADS.SALES_SCENES_APP;
   slots.forEach(function(s){var el=document.getElementById(s[0]);el.style.display='';mountApplyUpload(s[0],s[1],s[2]);});
-  if(!slots.some(function(s){return s[0]==='a_up_s2';})) document.getElementById('a_up_s2').style.display='none';
+  ['a_up_s2','a_up_s3','a_up_s4'].forEach(function(id){
+    if(!slots.some(function(s){return s[0]===id;})) document.getElementById(id).style.display='none';
+  });
+  paintAppScene(); // APP 场景: 服务商素材复用行显隐 + 截图槽联动
+}
+// APP 场景 (普通商户零自备): 服务商已配素材 → 默认勾选"使用服务商提供的应用截图", 截图槽隐藏;
+// 取消勾选或选自有应用 → 显示 4 个截图槽自己传
+function paintAppScene(){
+  if(currentScene()!=='SALES_SCENES_APP') return;
+  var spAssets=(window._spInfo&&window._spInfo.app_screenshots)||{};
+  var hasSp=Object.keys(spAssets).length>0;
+  var reuseRow=document.getElementById('a_app_reuse_row');
+  if(reuseRow) reuseRow.style.display=hasSp?'':'none';
+  var provider=(document.getElementById('a_app_provider')||{}).value||'sp';
+  var reuse=hasSp&&provider==='sp'&&(document.getElementById('a_app_reuse')||{}).checked;
+  ['a_up_s1','a_up_s2','a_up_s3','a_up_s4'].forEach(function(id){
+    var el=document.getElementById(id);
+    if(el) el.style.display=reuse?'none':'';
+  });
+  var ownHint=document.getElementById('a_app_own_hint');
+  if(ownHint) ownHint.style.display=(provider==='own'||!reuse)&&!hasSp?'':'none';
 }
-setScene('SALES_SCENES_STORE'); // 默认线下门店
+setScene('SALES_SCENES_APP'); // 默认 APP (普通商户零自备)
 function aval(id){var e=document.getElementById(id);return e?e.value.trim():''}
 function applyFormBody(){
   var scene=currentScene();
@@ -665,6 +740,17 @@ function applyFormBody(){
   }else if(scene==='SALES_SCENES_WEB'){
     body.website_url=aval('a_website_url');
     body.web_home_media_id=_aMedia.web_home_media_id||'';body.web_product_media_id=_aMedia.web_product_media_id||'';
+  }else if(scene==='SALES_SCENES_APP'){
+    var provider=aval('a_app_provider')||'sp';
+    body.appid=aval('a_app_appid');
+    body.appid_provider=provider; // sp=服务商应用(默认零自备) / own=商户自有应用
+    var spAssets=(window._spInfo&&window._spInfo.app_screenshots)||{};
+    var reuse=provider==='sp'&&Object.keys(spAssets).length>0&&(document.getElementById('a_app_reuse')||{}).checked;
+    if(reuse){
+      body.app_screenshots=['home','tail','inner','pay'].map(function(k){return spAssets[k];}).filter(Boolean); // 复用服务商素材
+    }else{
+      body.app_screenshots=[_aMedia.app_home_media_id,_aMedia.app_tail_media_id,_aMedia.app_inner_media_id,_aMedia.app_pay_media_id].filter(Boolean);
+    }
   }else{
     body.appid=aval('a_appid');body.appid_type=aval('a_appid_type');
     body.mp_media_id=_aMedia.mp_media_id||'';
@@ -916,6 +1002,14 @@ async function loadSpInfo(){
   try{
     var j=await readJson(await fetch('/api/onboard/sp-info'));
     if(!j||!j.name) return;
+    window._spInfo=j; // APP 场景零自备: app_appid/app_screenshots 预填复用
+    var appidEl=document.getElementById('a_app_appid');
+    if(appidEl&&j.app_appid&&!appidEl.value){
+      appidEl.value=j.app_appid;
+      var note=document.getElementById('a_appid_note');
+      if(note) note.style.display='block';
+    }
+    paintAppScene(); // 素材复用行按服务商配置刷新
     card.style.display='block';
     card.classList.toggle('offline', !!j.offline);
     document.getElementById('sp-name').textContent=j.offline&&!j.stale?'服务商暂时不可达':j.name;
@@ -975,6 +1069,170 @@ async function submit(){
     loadStatus(); // 刷新进度面板
   }catch(e){alert('网络错误: '+e.message);btn.disabled=false}
 }
+// ============================== 分步卡片向导 (2026-10-03 腾讯式分步填写) ==============================
+// 6 步: 主体资料 → 法人与超管 → 结算账户 → 经营与行业(场景+行业+许可证) → 证件上传 → 确认提交(预览)。
+// 全部既有逻辑 (字段 id/applyFormBody/上传槽/草稿/联动/错误红卡) 原样复用, 这里只做分步显隐+导航。
+var WZ_STEPS=[
+  {t:'主体资料',d:'营业执照上的主体信息，需与微信实名审核一致'},
+  {t:'法人与超管',d:'法人身份将用于微信实名审核，超管接收开户通知'},
+  {t:'结算账户',d:'微信收的款结算到这张卡（企业主体须对公账户）'},
+  {t:'经营与行业',d:'选经营场景和所属行业，特殊行业就地传许可证'},
+  {t:'证件上传',d:'拍清楚、四角完整、无反光 — 模糊是驳回首因'},
+  {t:'确认提交',d:'核对资料，确认后提交微信审核'}
+];
+var _wzCur=1,_wzMax=1,_wzGroups=[];
+function wzInit(){
+  var cards=document.querySelectorAll('#apply-form > .acard');
+  // 既有卡片 DOM 顺序: [经营场景卡, ①主体, ②法人, ③结算, ④场景信息, ⑤证件上传]
+  _wzGroups=[
+    [cards[1]],[cards[2]],[cards[3]],[cards[0],cards[4]],[cards[5]],
+    [document.getElementById('wz-preview-card'),document.getElementById('btn-apply-submit'),document.querySelector('#apply-form .aprivacy')]
+  ];
+  var bar=document.getElementById('wz-bar');
+  bar.innerHTML='';
+  WZ_STEPS.forEach(function(st,i){
+    var d=document.createElement('div');
+    d.className='wz-item todo'; d.setAttribute('data-step',i+1);
+    d.innerHTML='<span class="wz-dot">'+(i+1)+'</span><span class="wz-lbl">'+st.t+'</span>';
+    d.addEventListener('click',function(){ if(i+1<=_wzMax) wzShow(i+1); }); // 只许回跳已完成步
+    bar.appendChild(d);
+  });
+  wzShow(1);
+}
+function wzShow(n){
+  _wzCur=n; if(n>_wzMax)_wzMax=n;
+  _wzGroups.forEach(function(g,i){
+    g.forEach(function(el){ if(el) el.style.display=(i+1===n)?'':'none'; });
+  });
+  document.querySelectorAll('#wz-bar .wz-item').forEach(function(it){
+    var s=Number(it.getAttribute('data-step'));
+    it.className='wz-item'+(s===n?' cur':(s<_wzMax?' done':' todo'));
+    it.querySelector('.wz-dot').innerHTML=(s<_wzMax&&s!==n)?'✓':String(s);
+  });
+  var st=WZ_STEPS[n-1];
+  document.getElementById('wz-title').textContent='第 '+n+'/6 步 · '+st.t;
+  document.getElementById('wz-desc').textContent=st.d;
+  document.getElementById('wz-prev').style.visibility=n===1?'hidden':'visible';
+  document.getElementById('wz-next').style.display=n===6?'none':'';
+  if(n===6) renderWzPreview();
+  hideApplyErr();
+  document.getElementById('apply-form').scrollIntoView({behavior:'smooth',block:'start'});
+}
+function wzGo(dir){
+  if(dir>0){ var v=wzValidate(_wzCur); if(!v.ok){ showApplyErr(v.msg,v.field); return; } } // 下一步先校验当前步
+  var n=_wzCur+dir;
+  if(n<1||n>6) return;
+  wzShow(n);
+  saveApplyDraft();
+}
+// 当前步必填校验 (不过则红卡指到缺的字段, 不放行; 与后端 APPLY_* 校验同字段名, 错误定位复用)
+function wzValidate(n){
+  function need(id,label,field){
+    var e=document.getElementById(id);
+    if(!e||!String(e.value||'').trim()) return {ok:false,field:field||id.replace(/^a_/,''),msg:'请填写: '+label};
+    return null;
+  }
+  if(n===1){
+    return need('a_shortname','商户简称','merchant_shortname')||need('a_merchant_name','营业执照名称','merchant_name')
+      ||need('a_license_number','统一社会信用代码','license_number')||need('a_service_phone','客服电话','service_phone')||{ok:true};
+  }
+  if(n===2){
+    var r=need('a_legal_name','法人/经营者姓名','legal_name')||need('a_legal_id_number','法人身份证号','legal_id_number');
+    if(r) return r;
+    if(document.getElementById('a_subject_type').value==='SUBJECT_TYPE_ENTERPRISE'){
+      r=need('a_legal_id_address','身份证居住地址','legal_id_address'); if(r) return r;
+    }
+    return need('a_period_begin','身份证有效期开始','legal_id_period_begin')||need('a_period_end','身份证有效期结束','legal_id_period_end')
+      ||need('a_contact_name','超管姓名','contact_name')||need('a_contact_mobile','超管手机号','contact_mobile')
+      ||need('a_contact_email','联系邮箱','contact_email')||{ok:true};
+  }
+  if(n===3){
+    return need('a_account_bank','开户银行','account_bank')||need('a_account_name','开户名称','account_name')
+      ||need('a_account_number','银行账号','account_number')||{ok:true};
+  }
+  if(n===4){
+    var scene=currentScene(), r=null;
+    if(scene==='SALES_SCENES_STORE'){
+      r=need('a_store_name','门店名称','store_name')||need('a_store_address_code','门店省市编码','store_address_code')||need('a_store_address','门店详细地址','store_address');
+    }else if(scene==='SALES_SCENES_WEB'){
+      r=need('a_website_url','网站网址','website_url');
+    }else if(scene==='SALES_SCENES_MP'){
+      r=need('a_appid','公众号/小程序 AppID','appid');
+    }else{
+      r=need('a_app_appid','应用 AppID','app_appid');
+    }
+    if(r) return r;
+    var ind=aval('a_settlement_id');
+    if(!ind) return {ok:false,field:'qualification_type',msg:'请选择: 所属行业'};
+    if(typeof QUAL_REQUIRED!=='undefined'&&QUAL_REQUIRED[ind]&&!_aMedia.qual_media_id){
+      return {ok:false,field:'qual_media_id',msg:'请上传: '+ind+' 所需资质 ('+QUAL_REQUIRED[ind]+')'};
+    }
+    if(scene==='SALES_SCENES_APP'){
+      var spA=(window._spInfo&&window._spInfo.app_screenshots)||{};
+      var provider=(document.getElementById('a_app_provider')||{}).value||'sp';
+      var reuse=provider==='sp'&&Object.keys(spA).length>0&&(document.getElementById('a_app_reuse')||{}).checked;
+      if(!reuse&&!(_aMedia.app_home_media_id&&_aMedia.app_tail_media_id&&_aMedia.app_inner_media_id&&_aMedia.app_pay_media_id)){
+        return {ok:false,field:'app_screenshots',msg:'请上传 4 张应用截图 (或勾选使用服务商提供的应用截图)'};
+      }
+    }
+    return {ok:true};
+  }
+  if(n===5){
+    var scene=currentScene();
+    if(!_aMedia.license_media_id) return {ok:false,field:'license_media_id',msg:'请上传: 营业执照照片'};
+    if(!_aMedia.legal_id_front_media_id) return {ok:false,field:'legal_id_front_media_id',msg:'请上传: 身份证人像面'};
+    if(!_aMedia.legal_id_back_media_id) return {ok:false,field:'legal_id_back_media_id',msg:'请上传: 身份证国徽面'};
+    if(scene==='SALES_SCENES_STORE'){
+      if(!_aMedia.store_entrance_media_id) return {ok:false,field:'store_entrance_media_id',msg:'请上传: 门店门头照片'};
+      if(!_aMedia.store_indoor_media_id) return {ok:false,field:'store_indoor_media_id',msg:'请上传: 门店内部照片'};
+    }else if(scene==='SALES_SCENES_WEB'){
+      if(!_aMedia.web_home_media_id) return {ok:false,field:'web_home_media_id',msg:'请上传: 网站首页截图'};
+      if(!_aMedia.web_product_media_id) return {ok:false,field:'web_product_media_id',msg:'请上传: 商品/服务页截图'};
+    }else if(scene==='SALES_SCENES_MP'){
+      if(!_aMedia.mp_media_id) return {ok:false,field:'mp_media_id',msg:'请上传: 公众号/小程序页面截图'};
+    }
+    return {ok:true};
+  }
+  return {ok:true}; // 第 6 步提交由后端兜底
+}
+// 第 6 步预览: 分组只读摘要 (敏感字段 ***后4位)
+function wzMask(s){ s=String(s||''); return s.length<=4?'***':'***'+s.slice(-4); }
+function renderWzPreview(){
+  var f=applyFormBody();
+  var scene=currentScene();
+  var rows=[];
+  function grp(t,items){
+    rows.push('<div class="wz-grp"><div class="wz-grp-t">'+escHtml(t)+'</div>'
+      +items.map(function(it){return '<div class="wz-row"><span>'+escHtml(it[0])+'</span><b>'+escHtml(it[1]==null||it[1]===''?'—':it[1])+'</b></div>';}).join('')+'</div>');
+  }
+  grp('主体资料',[
+    ['主体类型',(document.querySelector('#a_subject_type option:checked')||{}).textContent||f.subject_type],
+    ['商户简称',f.merchant_shortname],['营业执照名称',f.merchant_name],
+    ['信用代码',f.license_number],['客服电话',f.service_phone]]);
+  grp('法人与超管',[
+    ['法人姓名',f.legal_name],['身份证号',wzMask(f.legal_id_number)],
+    ['有效期',f.legal_id_period_begin+' ~ '+f.legal_id_period_end],
+    ['超管',f.contact_name+' '+wzMask(f.contact_mobile)],['邮箱',f.contact_email]]);
+  grp('结算账户',[
+    ['账户类型',f.account_type==='BANK_ACCOUNT_TYPE_CORPORATE'?'对公账户':'经营者个人卡'],
+    ['开户行',f.account_bank],['户名',wzMask(f.account_name)],['卡号',wzMask(f.account_number)]]);
+  var sceneName={SALES_SCENES_APP:'APP 应用',SALES_SCENES_STORE:'线下门店',SALES_SCENES_WEB:'互联网网站',SALES_SCENES_MP:'公众号/小程序'}[scene]||scene;
+  grp('经营与行业',[
+    ['经营场景',sceneName],
+    ['所属行业',(document.getElementById('a_industry_cat')||{}).value+' > '+f.qualification_type],
+    ['结算规则',(document.getElementById('a_settlement_rule')||{}).textContent||''],
+    ['特殊资质',_aMedia.qual_media_id?'已上传 ✓':'—']]);
+  var docs=[['营业执照',_aMedia.license_media_id],['身份证人像面',_aMedia.legal_id_front_media_id],['身份证国徽面',_aMedia.legal_id_back_media_id]];
+  var sceneDocs={store_entrance_media_id:'门店门头照',store_indoor_media_id:'门店内部照',web_home_media_id:'网站首页截图',web_product_media_id:'商品/服务页截图',mp_media_id:'公众号/小程序截图',app_home_media_id:'应用首页截图',app_tail_media_id:'应用尾页截图',app_inner_media_id:'应用内页截图',app_pay_media_id:'应用支付页截图'};
+  for(var k in sceneDocs){ if(_aMedia[k]) docs.push([sceneDocs[k],_aMedia[k]]); }
+  if(scene==='SALES_SCENES_APP'&&f.app_screenshots&&f.app_screenshots.length&&(document.getElementById('a_app_reuse')||{}).checked){
+    docs.push(['应用截图','服务商素材 ✓']);
+  }
+  grp('证件',docs.map(function(d){return [d[0], d[1]?(d[1]==='服务商素材 ✓'?d[1]:'已上传 ✓'):'未上传 ✗'];}));
+  document.getElementById('wz-preview').innerHTML=rows.join('');
+}
+window.addEventListener('load',wzInit);
+
 // 安全卡二维码: 本机后端读 tb-keyring 出 dataURL (qrcode 包无浏览器 build, 且安全词不进 script 依赖链);
 // 只在创建会话 (_mn 在内存) 拉取 — 刷新后不再展示 (与"安全词只展示一次"同口径)
 async function loadBackupQr(){
@@ -1123,6 +1381,11 @@ async function restoreIdentity(){
     }
   }
   if(stl){ stl.addEventListener('change',paintQualSlot); }
+  // APP 场景联动: 复用勾选/应用归属切换 → 截图槽显隐
+  var appReuse=document.getElementById('a_app_reuse');
+  if(appReuse) appReuse.addEventListener('change',function(){ paintAppScene(); saveApplyDraft(); });
+  var appProv=document.getElementById('a_app_provider');
+  if(appProv) appProv.addEventListener('change',function(){ paintAppScene(); saveApplyDraft(); });
   if(catEl){ catEl.addEventListener('change',function(){ renderIndustrySubs(false); }); }
   // 结算规则只读展示 (settlement_id 按主体推导: 企业 716 / 个体户 719 / 其他组织 727; 商户不用选)
   var SETTLE_RULES={SUBJECT_TYPE_INDIVIDUAL:'719 · 个体户通用（0.6% T+1）',

package/routes/onboard.js

@@ -620,6 +620,7 @@ function createOnboardRouter(deps) {
     // 场景化必填 (2026-10-03 xiaomu 拍板三场景: 线下门店 / 互联网网站 / 公众号·小程序)
     // F2 fix: WEB 场景微信端只有 web_info.domain 无 pics — 截图降为可选 (收集进台账备用, 不进微信 body)
     const APPLY_SCENE_CFG = {
+        SALES_SCENES_APP: { fields: ["appid"], media: [] }, // 普通商户默认: 服务商应用零自备 (截图复用服务商素材)
         SALES_SCENES_STORE: { fields: ["store_name", "store_address_code", "store_address"], media: ["store_entrance_media_id", "store_indoor_media_id"] },
         SALES_SCENES_WEB: { fields: ["website_url"], media: [] },
         SALES_SCENES_MP: { fields: ["appid"], media: ["mp_media_id"] },
@@ -807,6 +808,14 @@ CREATE TABLE IF NOT EXISTS onboard_draft (
                         return res.status(400).json({ ok: false, error: "invalid_param", field: k, message: `缺少必填字段: ${label} (${k})` });
                     }
                 }
+                // APP 场景: 应用截图必传 (app_pics; 商户复用服务商素材或自己传, 页面已二选一)
+                if (scene === "SALES_SCENES_APP") {
+                    const pics = Array.isArray(b.app_screenshots) ? b.app_screenshots.filter(Boolean) : [];
+                    if (!pics.length) {
+                        return res.status(400).json({ ok: false, error: "media_missing", field: "app_screenshots",
+                            message: "请上传应用截图 (或勾选使用服务商提供的应用截图)" });
+                    }
+                }
                 // 需资质行业 → 特殊资质图片必传 (微信 qualifications, 缺证必被拒)
                 const qualNeed = APPLY_QUAL_REQUIRED[String(b.qualification_type || "")];
                 if (qualNeed && !b.qual_media_id) {
@@ -831,6 +840,10 @@ CREATE TABLE IF NOT EXISTS onboard_draft (
                 for (const k of Object.keys(b)) {
                     if (typeof b[k] === "string" && b[k].trim()) payload[k] = b[k].trim();
                 }
+                // 数组字段透传 (通用 copy 只收字符串): APP 场景截图 media_id 数组
+                if (Array.isArray(b.app_screenshots) && b.app_screenshots.length) {
+                    payload.app_screenshots = b.app_screenshots.map((x) => String(x)).filter(Boolean).slice(0, 5);
+                }
                 payload.sales_scene = scene; // 场景必带 (SP 侧按它组装 biz_store_info/web_info/mp_info)
                 // 特殊资质: qual_media_id → qualifications 数组 (没有则不传该字段)
                 if (payload.qual_media_id) {

package/routes/sp-applyment.js

@@ -156,7 +156,7 @@ function buildApplymentBody(form, enc, opts) {
     const f = form || {};
     const sensLen = (opts && opts.alreadyEncrypted) ? 2048 : 0; // 0 = 用明文默认上限
     // 经营场景 (2026-10-03 xiaomu 拍板三选一): 线下门店(默认) / 互联网网站 / 公众号·小程序
-    const scene = (f.sales_scene === "SALES_SCENES_WEB" || f.sales_scene === "SALES_SCENES_MP") ? f.sales_scene : "SALES_SCENES_STORE";
+    const scene = (f.sales_scene === "SALES_SCENES_WEB" || f.sales_scene === "SALES_SCENES_MP" || f.sales_scene === "SALES_SCENES_APP") ? f.sales_scene : "SALES_SCENES_STORE";
     // 必备照片 media_id 校验 (通用 3 张 + 场景照片, 缺哪张报哪张)
     const mediaNeed = [
         ["license_media_id", "营业执照照片"],
@@ -185,6 +185,15 @@ function buildApplymentBody(form, enc, opts) {
         const url = reqStr(f.website_url, "网站网址", 256);
         if (!/^https?:\/\//i.test(url)) throw new HttpError(400, "invalid_param", "网站网址须以 http(s):// 开头 (需已上线且有 ICP 备案)", "website_url");
         salesInfo.web_info = { domain: url }; // 微信官方字段是 domain; web_authorisation/web_appid 选填先不传
+    } else if (scene === "SALES_SCENES_APP") {
+        // 普通商户零自备 (xiaomu 2026-10-03): 默认走服务商应用 — AppID 用服务商的 (app_appid),
+        // 截图复用服务商素材 (sp_app_assets 4 张); 商户自有应用则 app_sub_appid + 自己传截图
+        const pics = Array.isArray(f.app_screenshots) ? f.app_screenshots.map((x) => String(x)).filter(Boolean).slice(0, 5) : [];
+        if (!pics.length) throw new HttpError(400, "media_missing", "应用截图未提供 (应用场景必传 app_pics)", "app_screenshots");
+        const appid = reqStr(f.appid, "应用 AppID", 64);
+        salesInfo.app_info = f.appid_provider === "own"
+            ? { app_sub_appid: appid, app_pics: pics }   // 商户自有应用
+            : { app_appid: appid, app_pics: pics };      // 服务商应用 (默认零自备)
     } else {
         // 公众号/小程序二选一: 用户只有小程序 appid 时用 mini_program_info
         if (f.appid_type === "mini") {
@@ -283,6 +292,26 @@ function buildMultipart(filename, fileBuf, metaStr) {
     return { boundary, body: Buffer.concat([Buffer.from(head, "utf8"), fileBuf, Buffer.from(tail, "utf8")]) };
 }
 
+/** 服务商应用素材: 表优先, env SP_APP_ASSETS_JSON ({home,tail,inner,pay} 各 media_id) 兜底 */
+function readAppAssets(db) {
+    try {
+        db.exec(`CREATE TABLE IF NOT EXISTS sp_app_assets (
+  kind TEXT PRIMARY KEY, media_id TEXT NOT NULL DEFAULT '', updated_at INTEGER NOT NULL)`);
+        const rows = db.prepare("SELECT kind, media_id FROM sp_app_assets WHERE media_id <> ''").all();
+        if (rows.length) {
+            const out = {};
+            for (const r of rows) out[r.kind] = r.media_id;
+            return out;
+        }
+    } catch (_) { /* 表问题走 env */ }
+    try {
+        const j = JSON.parse(process.env.SP_APP_ASSETS_JSON || "{}");
+        const out = {};
+        for (const k of ["home", "tail", "inner", "pay"]) if (j[k]) out[k] = String(j[k]);
+        return out;
+    } catch (_) { return {}; }
+}
+
 /** mock 微信应答 (SP_APPLYMENT_MOCK=1; 不碰真 API) */
 function mockWx(method, urlPath) {
     if (method === "POST" && urlPath === "/v3/merchant/media/upload") {
@@ -670,6 +699,9 @@ function createSpApplymentRouter(deps) {
             rate_pct: (bp / 100).toFixed(2) + "%",
             chain_address: process.env.SP_CHAIN_ADDR || "",
             gateway: String(req.headers.host || ""), // 本网关域名 (从请求 host 推断)
+            // 普通商户 APP 场景零自备: 服务商应用 AppID + 应用截图素材 (sp_app_assets 表优先, env 兜底)
+            app_appid: process.env.SP_APP_APPID || "",
+            app_screenshots: readAppAssets(db),
         });
     });
 
@@ -679,34 +711,66 @@ function createSpApplymentRouter(deps) {
         res.send(PAGE_HTML);
     });
 
+    /** 微信 media/upload 公共通道 (进件照片 / 服务商应用素材共用) */
+    async function wxUploadMedia(filename, buf) {
+        if (!/\.(jpe?g|png|bmp)$/i.test(filename)) throw new HttpError(400, "invalid_param", "filename 仅支持 jpg/jpeg/png/bmp 后缀");
+        if (!buf.length) throw new HttpError(400, "invalid_param", "content_b64 为空");
+        if (buf.length > 5 * 1024 * 1024) throw new HttpError(413, "file_too_large", "图片不能超过 5MB (微信上限)");
+        const sha256 = crypto.createHash("sha256").update(buf).digest("hex");
+        const meta = JSON.stringify({ filename, sha256 }); // 签名串 body 用 meta JSON 串 (非整个 multipart)
+        const mp = buildMultipart(filename, buf, meta);
+        const r = await wxRequest(deps, "POST", "/v3/merchant/media/upload", {
+            signBody: meta, body: mp.body, contentType: "multipart/form-data; boundary=" + mp.boundary,
+        });
+        if (r.status !== 200 || !r.json.media_id) {
+            const e = new HttpError(502, "wx_error", "上传图片到微信失败: " + (r.json.message || ("HTTP " + r.status)));
+            e.wxStatus = r.status; throw e;
+        }
+        return r.json.media_id;
+    }
+
     /** POST /applyment/upload — base64 JSON {filename, content_b64} → 微信 media/upload → {media_id} */
     router.post("/applyment/upload", async (req, res) => {
         if (!checkAdmin(req, res)) return;
         try {
             const b = req.body || {};
             const filename = String(b.filename || "");
-            if (!/\.(jpe?g|png|bmp)$/i.test(filename)) {
-                throw new HttpError(400, "invalid_param", "filename 仅支持 jpg/jpeg/png/bmp 后缀");
-            }
             const buf = Buffer.from(String(b.content_b64 || ""), "base64");
-            if (!buf.length) throw new HttpError(400, "invalid_param", "content_b64 为空");
-            if (buf.length > 5 * 1024 * 1024) throw new HttpError(413, "file_too_large", "图片不能超过 5MB (微信上限)");
-            const sha256 = crypto.createHash("sha256").update(buf).digest("hex");
-            const meta = JSON.stringify({ filename, sha256 }); // 签名串 body 用 meta JSON 串 (非整个 multipart)
-            const mp = buildMultipart(filename, buf, meta);
-            const r = await wxRequest(deps, "POST", "/v3/merchant/media/upload", {
-                signBody: meta,
-                body: mp.body,
-                contentType: "multipart/form-data; boundary=" + mp.boundary,
-            });
-            if (r.status !== 200 || !r.json.media_id) return wxError(res, r, "上传图片到微信失败");
-            console.log(`[sp-applyment] 图片已上传 file=${filename} size=${buf.length} media_id=${String(r.json.media_id).slice(0, 24)}...`);
-            res.json({ media_id: r.json.media_id });
+            const mediaId = await wxUploadMedia(filename, buf);
+            console.log(`[sp-applyment] 图片已上传 file=${filename} size=${buf.length} media_id=${String(mediaId).slice(0, 24)}...`);
+            res.json({ media_id: mediaId });
         } catch (e) {
             return chainWrites.handleError(res, e, "/api/sp/applyment/upload");
         }
     });
 
+    /** POST /app-assets — 服务商应用截图素材配置 (admin; 4 张 base64 → media/upload → sp_app_assets 表,
+     *  普通商户 APP 场景零自备的素材源: 商户进件默认复用这套 media_id, 不用自己传) */
+    const APP_ASSET_KINDS = ["home", "tail", "inner", "pay"]; // 首页/尾页/应用内/支付页
+    router.post("/app-assets", async (req, res) => {
+        if (!checkAdmin(req, res)) return;
+        try {
+            db.exec(`CREATE TABLE IF NOT EXISTS sp_app_assets (
+  kind TEXT PRIMARY KEY, media_id TEXT NOT NULL DEFAULT '', updated_at INTEGER NOT NULL)`);
+            const assets = (req.body || {}).assets || {};
+            const saved = {};
+            for (const kind of APP_ASSET_KINDS) {
+                const a = assets[kind];
+                if (!a || !a.content_b64) continue;
+                const filename = String(a.filename || ("app-" + kind + ".jpg"));
+                const mediaId = await wxUploadMedia(filename, Buffer.from(String(a.content_b64), "base64"));
+                db.prepare("INSERT INTO sp_app_assets (kind, media_id, updated_at) VALUES (?,?,?) ON CONFLICT(kind) DO UPDATE SET media_id=excluded.media_id, updated_at=excluded.updated_at")
+                    .run(kind, mediaId, nowSec());
+                saved[kind] = mediaId;
+            }
+            if (!Object.keys(saved).length) throw new HttpError(400, "invalid_param", "assets 至少给一张 (home/tail/inner/pay)");
+            console.log(`[sp-applyment] 应用素材已更新 kinds=${Object.keys(saved).join(",")}`);
+            res.json({ ok: true, saved, assets: readAppAssets(db) });
+        } catch (e) {
+            return chainWrites.handleError(res, e, "/api/sp/app-assets");
+        }
+    });
+
     /** POST /applyment/submit — 组装进件 JSON (敏感字段 RSA-OAEP 加密) → 微信提交 → 台账落行
      *  幂等/重提 (2026-10-03 F1/F3 fix):
      *   - business_code 由调用方 (卖家本机) 首次提交时生成并随单带上; 未带则 SP 兜底生成

package/test-onboard-applyment.js

@@ -731,6 +731,90 @@ test("特殊资质页面逻辑: QUAL_REQUIRED 映射 + 动态槽位 + 双态复
         assert.ok(html.includes("医疗机构执业许可证"), "医疗资质名");
         assert.ok(html.includes("办学许可证"), "教育资质名");
         assert.ok(html.includes("qual_media_id"), "资质 media_id 字段");
-        assert.ok(html.includes("特殊资质 (必传)"), "槽位必传标注");
+        assert.ok(html.includes("特殊资质 (必传)"), "槽位必传标注");
+        // 位置 (xiaomu 实测): 资质槽在行业二级联动正下方 (第①卡), 不在第⑤卡证件上传区
+        const posQual = html.indexOf("a_up_qual_wrap");
+        const posCard2 = html.indexOf('anum">2');
+        const posCard5 = html.indexOf('anum">5');
+        assert.ok(posQual > 0 && posQual < posCard2, "资质槽在第①卡 (行业区)");
+        assert.ok(posQual < posCard5, "资质槽不在第⑤卡");
+        assert.ok(html.includes("特殊资质槽 (就地位"), "紧凑样式");
+    } finally { srv.close(); }
+});
+
+test("APP 场景零自备: 默认场景=APP + 服务商素材复用提交组装 + 缺截图 400", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        // 后端: APP 场景缺截图 → 400
+        const form = await fillForm(base);
+        form.sales_scene = "SALES_SCENES_APP";
+        delete form.store_name; delete form.store_address_code; delete form.store_address;
+        delete form.store_entrance_media_id; delete form.store_indoor_media_id;
+        form.appid = "wx_sp_appid_001";
+        form.appid_provider = "sp";
+        let r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        let j = await r.json();
+        assert.strictEqual(r.status, 400);
+        assert.strictEqual(j.field, "app_screenshots");
+        assert.ok(j.message.includes("应用截图"), j.message);
+        // 复用服务商素材 (页面从 sp-info 拿到的 4 个 media_id 直接带)
+        form.app_screenshots = ["SP_HOME_MID", "SP_TAIL_MID", "SP_INNER_MID", "SP_PAY_MID"];
+        const before = spCapture.submits.length;
+        r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        const fwd = spCapture.submits[before];
+        assert.strictEqual(fwd.sales_scene, "SALES_SCENES_APP");
+        assert.strictEqual(fwd.appid, "wx_sp_appid_001");
+        assert.deepStrictEqual(fwd.app_screenshots, ["SP_HOME_MID", "SP_TAIL_MID", "SP_INNER_MID", "SP_PAY_MID"], "复用服务商素材 media_id");
+        // SP 侧组装: app_info.app_appid (服务商应用) + app_pics
+        const wxBody = spApplymentLib.buildApplymentBody({ ...fwd, business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
+        assert.deepStrictEqual(wxBody.business_info.sales_info.sales_scenes_type, ["SALES_SCENES_APP"]);
+        assert.strictEqual(wxBody.business_info.sales_info.app_info.app_appid, "wx_sp_appid_001");
+        assert.strictEqual(wxBody.business_info.sales_info.app_info.app_pics.length, 4);
+        // 自有应用 → app_sub_appid
+        const wxBody2 = spApplymentLib.buildApplymentBody({ ...fwd, appid_provider: "own", business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
+        assert.strictEqual(wxBody2.business_info.sales_info.app_info.app_sub_appid, "wx_sp_appid_001");
+    } finally { srv.close(); }
+});
+
+test("APP 场景页面: 默认选中 APP + 字段组 + 复用勾选 + 4 截图槽", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const html = await (await fetch(base + "/onboard/")).text();
+        assert.ok(html.includes('value="SALES_SCENES_APP" checked'), "默认场景=APP");
+        assert.ok(html.includes("scene_fields_app"), "APP 字段组");
+        assert.ok(html.includes("a_app_appid") && html.includes("a_app_provider"), "AppID + 归属");
+        assert.ok(html.includes("a_app_reuse") && html.includes("使用服务商提供的应用截图"), "素材复用勾选");
+        assert.ok(html.includes("a_up_s3") && html.includes("a_up_s4"), "4 截图槽");
+        assert.ok(html.includes("paintAppScene"), "场景联动");
+        assert.ok(html.includes("app_screenshots"), "提交字段");
+    } finally { srv.close(); }
+});
+
+test("分步向导: stepper/导航/校验/预览 元素与逻辑齐备", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const html = await (await fetch(base + "/onboard/")).text();
+        // stepper + 6 步 + 导航
+        assert.ok(html.includes("wz-bar") && html.includes("WZ_STEPS"), "进度条");
+        assert.ok(html.includes("确认提交"), "第 6 步");
+        assert.ok(html.includes("wz-prev") && html.includes("wz-next"), "上一步/下一步");
+        assert.ok(html.includes("wzGo") && html.includes("wzShow"), "导航函数");
+        // 校验: 下一步拦 + 上一步不校验 + 回跳完成步
+        assert.ok(html.includes("wzValidate"), "当前步校验");
+        assert.ok(html.includes("if(dir>0){ var v=wzValidate(_wzCur); if(!v.ok)"), "上一步不校验");
+        assert.ok(html.includes("if(i+1<=_wzMax) wzShow(i+1)"), "只许回跳已完成步");
+        // 第 6 步预览: 分组 + 脱敏
+        assert.ok(html.includes("wz-preview") && html.includes("renderWzPreview"), "预览渲染");
+        assert.ok(html.includes("wzMask") && html.includes("***"), "敏感字段脱敏");
+        assert.ok(html.includes("主体资料") && html.includes("法人与超管") && html.includes("结算账户")
+            && html.includes("经营与行业") && html.includes("证件上传"), "6 步标题");
+        // 旧结构未破坏: 既有卡片/字段 id 都在
+        assert.ok(html.includes("a_shortname") && html.includes("a_up_license") && html.includes("btn-apply-submit"), "既有字段/提交钮保留");
     } finally { srv.close(); }
 });

package/test-sp-applyment.js

@@ -389,3 +389,39 @@ test("M2: FINISHED 钩子在 oracle 不可达时不标 hook_fired_at (下轮重
         assert.ok(db.prepare("SELECT * FROM sp_sub_merchants WHERE sub_mchid='1600000999'").get(), "路由表仍落行");
     } finally { srv.close(); }
 });
+
+test("M4-APP: /info 带 app 配置 (env + 素材表) + POST /app-assets 上传落表", async () => {
+    const { db, srv, base } = await startServer();
+    try {
+        // env 兜底
+        process.env.SP_APP_APPID = "wx_service_app_001";
+        process.env.SP_APP_ASSETS_JSON = JSON.stringify({ home: "ENV_HOME_MID", pay: "ENV_PAY_MID" });
+        let j = await (await fetch(base + "/api/sp/info")).json();
+        assert.strictEqual(j.app_appid, "wx_service_app_001");
+        assert.strictEqual(j.app_screenshots.home, "ENV_HOME_MID");
+        // app-assets 上传 (mock media) → 表优先于 env
+        const r = await fetch(base + "/api/sp/app-assets", {
+            method: "POST", headers: H,
+            body: JSON.stringify({ assets: {
+                home: { filename: "home.jpg", content_b64: Buffer.from("fake-home").toString("base64") },
+                pay: { filename: "pay.jpg", content_b64: Buffer.from("fake-pay").toString("base64") },
+            } }),
+        });
+        j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.ok(j.saved.home.startsWith("MOCK_MEDIA_") && j.saved.pay.startsWith("MOCK_MEDIA_"));
+        const savedIds = j.saved; // 留着对照 (j 下面要复用)
+        j = await (await fetch(base + "/api/sp/info")).json();
+        assert.strictEqual(j.app_screenshots.home, savedIds.home, "表优先于 env");
+        assert.strictEqual(j.app_screenshots.pay, savedIds.pay);
+        // 鉴权: 无 key 401
+        const r2 = await fetch(base + "/api/sp/app-assets", {
+            method: "POST", headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ assets: { home: { filename: "a.jpg", content_b64: "AAAA" } } }),
+        });
+        assert.strictEqual(r2.status, 401);
+    } finally {
+        srv.close();
+        delete process.env.SP_APP_APPID; delete process.env.SP_APP_ASSETS_JSON;
+    }
+});