trustbase-seller-backend 0.3.8 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.3.8",
+  "version": "0.4.0",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/onboard.html

@@ -293,6 +293,8 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
               <div class="hint" id="a_appid_note" style="display:none;font-size:12px;color:#16A34A;margin-top:3px">✓ 由服务商提供</div></div>
             <div class="afield"><label for="a_app_provider">应用归属</label>
               <select id="a_app_provider"><option value="sp">服务商应用 (默认, 零自备)</option><option value="own">商户自有应用</option></select></div>
+            <div class="afield afield-full" id="a_app_select_row" style="display:none"><label for="a_app_select">选择服务商应用</label>
+              <select id="a_app_select"></select></div>
           </div>
           <div class="ahint" id="a_app_provided" style="display:none;margin-top:8px;background:#F0FDF4;border-color:#BBF7D0;color:#166534"></div>
           <div class="ahint" id="a_app_missing" style="display:none;margin-top:8px">⚠️ 服务商尚未配置应用，请联系服务商配置，或改用下方"商户自有应用"填写</div>
@@ -310,13 +312,18 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
         </div>
         <div id="scene_fields_web" style="display:none">
           <div class="agrid">
-            <div class="afield afield-full"><label for="a_website_url">网站网址</label><input id="a_website_url" placeholder="https:// 开头, 需已上线可访问"></div>
+            <div class="afield afield-full" id="a_web_sp_row" style="display:none"><label for="a_web_spapp">使用服务商提供的网站</label>
+              <select id="a_web_spapp"></select></div>
+            <div class="afield afield-full" id="a_website_field"><label for="a_website_url">网站网址</label><input id="a_website_url" placeholder="https:// 开头, 需已上线可访问"></div>
           </div>
           <div class="ahint">⚠️ 网站需已上线且有 ICP 备案, 微信审核会实际访问验证</div>
         </div>
         <div id="scene_fields_mp" style="display:none">
           <div class="agrid">
-            <div class="afield"><label for="a_appid">公众号/小程序 AppID</label><input id="a_appid" placeholder="wx 开头"></div>
+            <div class="afield" id="a_mpid_field"><label for="a_appid">公众号/小程序 AppID</label><input id="a_appid" placeholder="wx 开头"></div>
+            <div class="afield afield-full" id="a_mp_sp_row" style="display:none"><label for="a_mp_spapp">使用服务商提供的小程序应用</label>
+              <select id="a_mp_spapp"></select>
+              <div id="a_mp_sp_note" style="font-size:12px;color:#16A34A;margin-top:4px"></div></div>
             <div class="afield"><label for="a_appid_type">类型</label>
               <select id="a_appid_type"><option value="mp">公众号</option><option value="mini">小程序</option></select></div>
           </div>
@@ -700,7 +707,27 @@ function setScene(scene){
 // APP 场景 (2026-10-03 UX 修正): 服务商配置完整 (AppID+4素材) → AppID 框和截图槽全隐藏,
 // 只留绿标"应用和截图由服务商提供, 无需操作"; 未配齐 → 提示联系服务商 + 展开自有字段组;
 // 选自有应用 → AppID 输入框 + 4 张截图槽。
+// 服务商应用列表 (多形态多应用): 按场景 type 过滤选择
+function spAppsOf(type){ return ((window._spInfo||{}).apps||[]).filter(function(a){return a.type===type;}); }
+function defaultAppOf(type){
+  var l=spAppsOf(type);
+  return l.filter(function(a){return a.is_default;})[0]||l[0]||null;
+}
+function selectedSpApp(type, selectId){
+  var list=spAppsOf(type);
+  if(!list.length) return null;
+  var sel=selectId?document.getElementById(selectId):null;
+  if(sel&&sel.value){
+    var hit=list.filter(function(a){return String(a.id)===sel.value;})[0];
+    if(hit) return hit;
+  }
+  return defaultAppOf(type);
+}
+function appAssetCount(app){ return ['home','tail','inner','pay'].filter(function(k){return app&&app.assets&&app.assets[k];}).length; }
 function appSpComplete(){
+  // 零操作 = 选中的服务商应用 AppID+4 素材全在 (旧单配置兼容: /info 的 app_appid/app_screenshots)
+  var app=selectedSpApp('app','a_app_select');
+  if(app) return !!(app.appid&&appAssetCount(app)===4);
   var sp=window._spInfo||{}, a=sp.app_screenshots||{};
   return !!(sp.app_appid&&a.home&&a.tail&&a.inner&&a.pay);
 }
@@ -713,10 +740,11 @@ function paintAppScene(){
   var missing=provider==='sp'&&!complete; // 服务商未配齐 → 提示+自有组
   var fAppid=document.getElementById('a_appid_field');
   if(fAppid) fAppid.style.display=zeroMode?'none':'';
+  var selApp=selectedSpApp('app','a_app_select');
   var provided=document.getElementById('a_app_provided');
   if(provided){
     provided.style.display=zeroMode?'':'none';
-    if(zeroMode) provided.textContent='✓ 应用和截图由服务商提供 (AppID: '+maskAppid((window._spInfo||{}).app_appid)+'), 无需操作';
+    if(zeroMode) provided.textContent='✓ 应用和截图由服务商提供 ('+(selApp?selApp.name+' · ':'')+'AppID: '+maskAppid(selApp?selApp.appid:(window._spInfo||{}).app_appid)+'), 无需操作';
   }
   var missEl=document.getElementById('a_app_missing');
   if(missEl) missEl.style.display=missing?'':'none';
@@ -732,6 +760,72 @@ function paintAppScene(){
     appidEl.placeholder='wx 开头';
   }
 }
+// ---- 多应用选择联动 (2026-10-03 服务商应用列表): APP/小程序/网站 按场景 type 选服务商应用 ----
+function paintSceneSpRows(){
+  // APP: 应用下拉 (>1 且归属=服务商 才显示; 单个自动默认)
+  var appList=spAppsOf('app');
+  var appRow=document.getElementById('a_app_select_row');
+  var appSel=document.getElementById('a_app_select');
+  if(appRow&&appSel){
+    var provider=(document.getElementById('a_app_provider')||{}).value||'sp';
+    appRow.style.display=(appList.length>1&&provider==='sp')?'':'none';
+    if(appSel.options.length!==appList.length){
+      appSel.innerHTML=appList.map(function(a){return '<option value="'+a.id+'">'+escHtml(a.name)+(a.is_default?' ⭐默认':'' )+'</option>';}).join('');
+      var def=defaultAppOf('app'); if(def) appSel.value=String(def.id);
+    }
+  }
+  // MP: 服务商小程序行 (有 mini_program 应用才显示; 空值=自己填写)
+  var mpList=spAppsOf('mini_program');
+  var mpRow=document.getElementById('a_mp_sp_row');
+  var mpSel=document.getElementById('a_mp_spapp');
+  if(mpRow&&mpSel){
+    mpRow.style.display=mpList.length?'':'none';
+    if(mpSel.options.length!==mpList.length+1){
+      mpSel.innerHTML='<option value="">(自己填写)</option>'+mpList.map(function(a){return '<option value="'+a.id+'">'+escHtml(a.name)+(a.is_default?' ⭐':'')+'</option>';}).join('');
+    }
+  }
+  // WEB: 服务商网站行
+  var webList=spAppsOf('web');
+  var webRow=document.getElementById('a_web_sp_row');
+  var webSel=document.getElementById('a_web_spapp');
+  if(webRow&&webSel){
+    webRow.style.display=webList.length?'':'none';
+    if(webSel.options.length!==webList.length+1){
+      webSel.innerHTML='<option value="">(自己填写)</option>'+webList.map(function(a){return '<option value="'+a.id+'">'+escHtml(a.name)+(a.is_default?' ⭐':'')+'</option>';}).join('');
+    }
+  }
+  paintMpSp(); paintWebSp();
+}
+function paintMpSp(){
+  var selEl=document.getElementById('a_mp_spapp');
+  var chosen=!!(selEl&&selEl.value);
+  var f=document.getElementById('a_mpid_field');
+  if(f) f.style.display=chosen?'none':'';
+  var slot=document.getElementById('a_up_s1');
+  if(slot&&currentScene()==='SALES_SCENES_MP') slot.style.display=chosen?'none':'';
+  var note=document.getElementById('a_mp_sp_note');
+  if(note) note.textContent=chosen?'✓ 使用服务商应用, 截图素材复用, 无需操作':'';
+}
+function paintWebSp(){
+  var selEl=document.getElementById('a_web_spapp');
+  var chosen=!!(selEl&&selEl.value);
+  var inp=document.getElementById('a_website_url');
+  if(inp){
+    if(chosen){
+      var app=spAppsOf('web').filter(function(a){return String(a.id)===selEl.value;})[0];
+      if(app){ inp.value=app.appid; inp.readOnly=true; } // web 应用的 appid 字段存的是域名
+    }else inp.readOnly=false;
+  }
+}
+(function(){
+  var s1=document.getElementById('a_app_select');
+  if(s1) s1.addEventListener('change',function(){ paintAppScene(); saveApplyDraft(); });
+  var s2=document.getElementById('a_mp_spapp');
+  if(s2) s2.addEventListener('change',function(){ paintMpSp(); saveApplyDraft(); });
+  var s3=document.getElementById('a_web_spapp');
+  if(s3) s3.addEventListener('change',function(){ paintWebSp(); saveApplyDraft(); });
+})();
+
 setScene('SALES_SCENES_APP'); // 默认 APP (普通商户零自备)
 function aval(id){var e=document.getElementById(id);return e?e.value.trim():''}
 function applyFormBody(){
@@ -760,8 +854,13 @@ function applyFormBody(){
   }else if(scene==='SALES_SCENES_APP'){
     var provider=aval('a_app_provider')||'sp';
     body.appid_provider=provider; // sp=服务商应用(默认零自备) / own=商户自有应用
-    if(provider==='sp'&&appSpComplete()){
-      // 零操作: AppID 和截图全部用服务商配置 (商户页面全隐藏)
+    var selApp=selectedSpApp('app','a_app_select');
+    if(provider==='sp'&&selApp&&appSpComplete()){
+      // 零操作: AppID 和截图全部用所选服务商应用 (商户页面全隐藏)
+      body.appid=selApp.appid;
+      body.app_screenshots=['home','tail','inner','pay'].map(function(k){return selApp.assets[k];}).filter(Boolean);
+    }else if(provider==='sp'&&appSpComplete()){
+      // 旧单配置兜底 (无 sp_apps 行时)
       body.appid=(window._spInfo||{}).app_appid;
       var sa=(window._spInfo||{}).app_screenshots||{};
       body.app_screenshots=['home','tail','inner','pay'].map(function(k){return sa[k];}).filter(Boolean);
@@ -770,8 +869,17 @@ function applyFormBody(){
       body.app_screenshots=[_aMedia.app_home_media_id,_aMedia.app_tail_media_id,_aMedia.app_inner_media_id,_aMedia.app_pay_media_id].filter(Boolean);
     }
   }else{
-    body.appid=aval('a_appid');body.appid_type=aval('a_appid_type');
-    body.mp_media_id=_aMedia.mp_media_id||'';
+    var mpSelEl=document.getElementById('a_mp_spapp');
+    var mpChosen=!!(mpSelEl&&mpSelEl.value);
+    var mpApp=mpChosen?spAppsOf('mini_program').filter(function(a){return String(a.id)===mpSelEl.value;})[0]:null;
+    if(mpChosen&&mpApp){
+      // 服务商小程序应用: appid+截图素材复用 (页面隐藏自有字段)
+      body.appid=mpApp.appid; body.appid_type='mp'; body.appid_provider='sp';
+      body.mp_screenshots=['home','tail','inner','pay'].map(function(k){return mpApp.assets[k];}).filter(Boolean);
+    }else{
+      body.appid=aval('a_appid');body.appid_type=aval('a_appid_type');
+      body.mp_media_id=_aMedia.mp_media_id||'';
+    }
   }
   return body;
 }
@@ -1023,6 +1131,7 @@ async function loadSpInfo(){
     window._spInfo=j; // APP 场景零自备: app_appid/app_screenshots 预填复用
     var appidEl=document.getElementById('a_app_appid');
     if(appidEl&&j.app_appid&&!appidEl.value) appidEl.value=j.app_appid;
+    paintSceneSpRows(); // 多应用下拉 (app/mini_program/web 按场景)
     paintAppScene(); // 三态显隐按服务商配置完整度刷新
     card.style.display='block';
     card.classList.toggle('offline', !!j.offline);
@@ -1171,7 +1280,8 @@ function wzValidate(n){
     }else if(scene==='SALES_SCENES_WEB'){
       r=need('a_website_url','网站网址','website_url');
     }else if(scene==='SALES_SCENES_MP'){
-      r=need('a_appid','公众号/小程序 AppID','appid');
+      var mpSelV=document.getElementById('a_mp_spapp');
+      if(!(mpSelV&&mpSelV.value)) r=need('a_appid','公众号/小程序 AppID','appid');
     }else{
       // APP 场景: 服务商配置完整(零操作)时 AppID 框隐藏且用服务商值, 不校验输入框
       if(!((document.getElementById('a_app_provider')||{}).value!=='own'&&appSpComplete())){
@@ -1205,7 +1315,8 @@ function wzValidate(n){
       if(!_aMedia.web_home_media_id) return {ok:false,field:'web_home_media_id',msg:'请上传: 网站首页截图'};
       if(!_aMedia.web_product_media_id) return {ok:false,field:'web_product_media_id',msg:'请上传: 商品/服务页截图'};
     }else if(scene==='SALES_SCENES_MP'){
-      if(!_aMedia.mp_media_id) return {ok:false,field:'mp_media_id',msg:'请上传: 公众号/小程序页面截图'};
+      var mpSelV2=document.getElementById('a_mp_spapp');
+      if(!(mpSelV2&&mpSelV2.value)&&!_aMedia.mp_media_id) return {ok:false,field:'mp_media_id',msg:'请上传: 公众号/小程序页面截图 (或选用服务商提供的应用)'};
     }
     return {ok:true};
   }
@@ -1399,7 +1510,7 @@ async function restoreIdentity(){
   if(stl){ stl.addEventListener('change',paintQualSlot); }
   // APP 场景联动: 应用归属切换 → 字段组/截图槽显隐
   var appProv=document.getElementById('a_app_provider');
-  if(appProv) appProv.addEventListener('change',function(){ paintAppScene(); saveApplyDraft(); });
+  if(appProv) appProv.addEventListener('change',function(){ paintSceneSpRows(); paintAppScene(); saveApplyDraft(); });
   if(catEl){ catEl.addEventListener('change',function(){ renderIndustrySubs(false); }); }
   // 结算规则只读展示 (settlement_id 按主体推导: 企业 716 / 个体户 719 / 其他组织 727; 商户不用选)
   var SETTLE_RULES={SUBJECT_TYPE_INDIVIDUAL:'719 · 个体户通用（0.6% T+1）',

package/routes/onboard.js

@@ -623,7 +623,7 @@ function createOnboardRouter(deps) {
         SALES_SCENES_APP: { fields: ["appid"], media: [] }, // 普通商户默认: 服务商应用零自备 (截图复用服务商素材)
         SALES_SCENES_STORE: { fields: ["store_name", "store_address_code", "store_address"], media: ["store_entrance_media_id", "store_indoor_media_id"] },
         SALES_SCENES_WEB: { fields: ["website_url"], media: [] },
-        SALES_SCENES_MP: { fields: ["appid"], media: ["mp_media_id"] },
+        SALES_SCENES_MP: { fields: ["appid"], media: [] }, // mp 截图: 服务商素材数组 或 商户单张 (下方手动校验)
     };
     const APPLY_MEDIA_COMMON = ["license_media_id", "legal_id_front_media_id", "legal_id_back_media_id"];
     // 行业 → 特殊资质映射 (微信 qualifications: 需资质行业缺证必被拒; 与页面 QUAL_REQUIRED 同口径)
@@ -808,6 +808,14 @@ CREATE TABLE IF NOT EXISTS onboard_draft (
                         return res.status(400).json({ ok: false, error: "invalid_param", field: k, message: `缺少必填字段: ${label} (${k})` });
                     }
                 }
+                // MP 场景: 截图 = 服务商素材数组 (mp_screenshots) 或商户单张 (mp_media_id), 二选一必传
+                if (scene === "SALES_SCENES_MP") {
+                    const hasArr = Array.isArray(b.mp_screenshots) && b.mp_screenshots.filter(Boolean).length > 0;
+                    if (!hasArr && !b.mp_media_id) {
+                        return res.status(400).json({ ok: false, error: "media_missing", field: "mp_media_id",
+                            message: "请上传公众号/小程序页面截图 (或选用服务商提供的应用)" });
+                    }
+                }
                 // APP 场景: 应用截图必传 (app_pics; 商户复用服务商素材或自己传, 页面已二选一)
                 if (scene === "SALES_SCENES_APP") {
                     const pics = Array.isArray(b.app_screenshots) ? b.app_screenshots.filter(Boolean) : [];
@@ -840,10 +848,13 @@ CREATE TABLE IF NOT EXISTS onboard_draft (
                 for (const k of Object.keys(b)) {
                     if (typeof b[k] === "string" && b[k].trim()) payload[k] = b[k].trim();
                 }
-                // 数组字段透传 (通用 copy 只收字符串): APP 场景截图 media_id 数组
+                // 数组字段透传 (通用 copy 只收字符串): APP/MP 场景截图 media_id 数组
                 if (Array.isArray(b.app_screenshots) && b.app_screenshots.length) {
                     payload.app_screenshots = b.app_screenshots.map((x) => String(x)).filter(Boolean).slice(0, 5);
                 }
+                if (Array.isArray(b.mp_screenshots) && b.mp_screenshots.length) {
+                    payload.mp_screenshots = b.mp_screenshots.map((x) => String(x)).filter(Boolean).slice(0, 5);
+                }
                 payload.sales_scene = scene; // 场景必带 (SP 侧按它组装 biz_store_info/web_info/mp_info)
                 // 特殊资质: qual_media_id → qualifications 数组 (没有则不传该字段)
                 if (payload.qual_media_id) {

package/routes/sp-applyment.js

@@ -203,9 +203,13 @@ function buildApplymentBody(form, enc, opts) {
                 mini_program_pics: [String(f.mp_media_id)],
             };
         } else {
+            // 截图: 服务商小程序应用素材数组 (mp_screenshots) 优先, 否则商户自传单张
+            const mpPics = (Array.isArray(f.mp_screenshots) && f.mp_screenshots.length)
+                ? f.mp_screenshots.map((x) => String(x)).filter(Boolean).slice(0, 5)
+                : [String(f.mp_media_id)];
             salesInfo.mp_info = {
                 mp_sub_appid: reqStr(f.appid, "公众号 AppID", 64), // 商家自己的已认证公众号
-                mp_pics: [String(f.mp_media_id)],
+                mp_pics: mpPics,
             };
         }
     }
@@ -292,6 +296,92 @@ function buildMultipart(filename, fileBuf, metaStr) {
     return { boundary, body: Buffer.concat([Buffer.from(head, "utf8"), fileBuf, Buffer.from(tail, "utf8")]) };
 }
 
+/** 服务商配置档案 (sp_profile 键值表, /sp/config 配置页的数据源; 读表优先 env 兜底) */
+function ensureSpProfile(db) {
+    db.exec(`CREATE TABLE IF NOT EXISTS sp_profile (
+  key TEXT PRIMARY KEY, value TEXT NOT NULL DEFAULT '', updated_at INTEGER NOT NULL)`);
+}
+/** 读配置: 表里有值用表, 否则 undefined (调用方回落 env) */
+function spProfileGet(db, key) {
+    ensureSpProfile(db);
+    const row = db.prepare("SELECT value FROM sp_profile WHERE key = ?").get(key);
+    return row && row.value !== "" ? row.value : undefined;
+}
+function spProfileSet(db, key, value) {
+    ensureSpProfile(db);
+    db.prepare("INSERT INTO sp_profile (key, value, updated_at) VALUES (?,?,?) ON CONFLICT(key) DO UPDATE SET value=excluded.value, updated_at=excluded.updated_at")
+        .run(key, String(value), nowSec());
+}
+
+/** 服务商应用列表 (sp_apps, 2026-10-03 多形态多应用): 一个服务商可有多个 APP/小程序/网站,
+ *  商户进件按场景 (app/mini_program/web) 从对应 type 的应用里选, is_default 唯一主推。 */
+const SP_APP_TYPES = ["app", "mini_program", "web"];
+function ensureSpApps(db) {
+    db.exec(`CREATE TABLE IF NOT EXISTS sp_apps (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL DEFAULT '',
+  appid TEXT NOT NULL DEFAULT '',
+  type TEXT NOT NULL DEFAULT 'app',
+  assets_home TEXT NOT NULL DEFAULT '',
+  assets_tail TEXT NOT NULL DEFAULT '',
+  assets_inner TEXT NOT NULL DEFAULT '',
+  assets_pay TEXT NOT NULL DEFAULT '',
+  is_default INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+)`);
+    // 旧单配置自动迁移: 列表为空且旧配置在 (sp_profile.app_appid 或 sp_app_assets 有素材) → 迁入为默认应用
+    const n = db.prepare("SELECT COUNT(*) n FROM sp_apps").get().n;
+    if (n === 0) {
+        const legacyAppid = spProfileGet(db, "app_appid") || process.env.SP_APP_APPID || "";
+        const legacyAssets = readAppAssets(db);
+        if (legacyAppid || Object.keys(legacyAssets).length) {
+            const now = nowSec();
+            db.prepare(`INSERT INTO sp_apps (name, appid, type, assets_home, assets_tail, assets_inner, assets_pay, is_default, created_at, updated_at)
+ VALUES (?,?,?,?,?,?,?,?,?,?)`)
+                .run("默认应用", legacyAppid, "app",
+                    legacyAssets.home || "", legacyAssets.tail || "", legacyAssets.inner || "", legacyAssets.pay || "",
+                    1, now, now);
+            console.log(`[sp-applyment] 旧应用配置已迁入 sp_apps (appid=${legacyAppid || "(空)"}, 素材 ${Object.keys(legacyAssets).length}/4)`);
+        }
+    }
+}
+function appRowToJson(r) {
+    return {
+        id: r.id, name: r.name, appid: r.appid, type: r.type,
+        assets: { home: r.assets_home, tail: r.assets_tail, inner: r.assets_inner, pay: r.assets_pay },
+        is_default: !!r.is_default,
+    };
+}
+function listSpApps(db) {
+    ensureSpApps(db);
+    return db.prepare("SELECT * FROM sp_apps ORDER BY is_default DESC, id ASC").all().map(appRowToJson);
+}
+/** 按类型选应用: 该 type 的默认行 → 该 type 第一行 → null (调用方回落旧单配置) */
+function pickSpApp(db, type) {
+    ensureSpApps(db);
+    let r = db.prepare("SELECT * FROM sp_apps WHERE type = ? AND is_default = 1 ORDER BY id ASC LIMIT 1").get(type);
+    if (!r) r = db.prepare("SELECT * FROM sp_apps WHERE type = ? ORDER BY is_default DESC, id ASC LIMIT 1").get(type);
+    return r ? appRowToJson(r) : null;
+}
+
+/** 旧单素材端点 (app-assets) 写入时同步默认应用行 — 保证 /info 兼容字段永远是最新
+ *  (迁移行不能变成旧素材的只读快照) */
+function upsertDefaultAppAsset(db, kind, mediaId) {
+    ensureSpApps(db);
+    let row = db.prepare("SELECT * FROM sp_apps WHERE type='app' AND is_default=1 ORDER BY id ASC LIMIT 1").get()
+        || db.prepare("SELECT * FROM sp_apps WHERE is_default=1 ORDER BY id ASC LIMIT 1").get()
+        || db.prepare("SELECT * FROM sp_apps ORDER BY id ASC LIMIT 1").get();
+    const now = nowSec();
+    if (row) {
+        db.prepare(`UPDATE sp_apps SET assets_${kind} = ?, updated_at = ? WHERE id = ?`).run(mediaId, now, row.id);
+    } else if (mediaId) {
+        const appid = spProfileGet(db, "app_appid") || process.env.SP_APP_APPID || "";
+        db.prepare(`INSERT INTO sp_apps (name, appid, type, assets_${kind}, is_default, created_at, updated_at) VALUES (?,?,?,?,1,?,?)`)
+            .run("默认应用", appid, "app", mediaId, now, now);
+    }
+}
+
 /** 服务商应用素材: 表优先, env SP_APP_ASSETS_JSON ({home,tail,inner,pay} 各 media_id) 兜底 */
 function readAppAssets(db) {
     try {
@@ -312,6 +402,281 @@ function readAppAssets(db) {
     } catch (_) { return {}; }
 }
 
+/** sp-config 段 (2026-10-03): /sp/config 服务商配置页 + GET/PUT /api/sp/config + 素材删除。
+ *  页面极简卡片风 (设计规范), 一屏三件事: 应用配置 / 服务商名片 / 状态总览。 */
+
+/** 配齐度计算 (AppID / 4 素材 / 名片 / 费率 四块) */
+function configCompleteness(db) {
+    const appid = spProfileGet(db, "app_appid") || process.env.SP_APP_APPID || "";
+    const assets = readAppAssets(db);
+    const name = spProfileGet(db, "sp_name") || process.env.SP_NAME || "";
+    const contact = spProfileGet(db, "sp_contact") || process.env.SP_CONTACT || "";
+    const KIND_LABEL = { home: "首页截图", tail: "尾页截图", inner: "应用内截图", pay: "支付页截图" };
+    const missing = [];
+    if (!appid) missing.push("AppID");
+    for (const k of ["home", "tail", "inner", "pay"]) if (!assets[k]) missing.push(KIND_LABEL[k]);
+    if (!name) missing.push("服务商名称");
+    if (!contact) missing.push("客服联系方式");
+    const assetCount = ["home", "tail", "inner", "pay"].filter((k) => assets[k]).length;
+    return {
+        appid: !!appid,
+        assets: assetCount, // 0-4
+        profile: !!(name && contact),
+        rate: true, // getDefaultRateBp 总有兜底
+        complete: missing.length === 0,
+        missing,
+    };
+}
+
+/** 当前全量配置 (表优先 env 兜底) */
+function currentConfig(db) {
+    const bp = spCommission.getDefaultRateBp(db);
+    return {
+        app_appid: spProfileGet(db, "app_appid") || process.env.SP_APP_APPID || "",
+        sp_name: spProfileGet(db, "sp_name") || process.env.SP_NAME || "",
+        sp_desc: spProfileGet(db, "sp_desc") || process.env.SP_DESC || "",
+        sp_official_url: spProfileGet(db, "sp_official_url") || process.env.SP_OFFICIAL_URL || "",
+        sp_contact: spProfileGet(db, "sp_contact") || process.env.SP_CONTACT || "",
+        commission_bp: bp,
+        rate_pct: (bp / 100).toFixed(2) + "%",
+        assets: readAppAssets(db),
+    };
+}
+
+const CONFIG_PAGE_HTML = `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>服务商配置 · TrustBase SP</title>
+<style>
+*{margin:0;padding:0;box-sizing:border-box}
+body{background:#F7F3EB;color:#33302B;font-family:-apple-system,'PingFang SC','Microsoft YaHei',sans-serif;line-height:1.7}
+.wrap{max-width:680px;margin:0 auto;padding:20px 16px 60px}
+h1{font-size:20px;margin-bottom:4px}
+.sub{font-size:13px;color:#8A857B;margin-bottom:16px}
+.chips{display:flex;gap:8px;flex-wrap:wrap;margin-bottom:16px}
+.chip{font-size:12px;border-radius:999px;padding:5px 12px;border:1px solid #EAE3D6;background:#FCFAF4;color:#8A857B}
+.chip.ok{background:#F0FDF4;border-color:#BBF7D0;color:#166534}
+.box{background:#FCFAF4;border:1px solid #EAE3D6;border-radius:14px;padding:18px;margin-bottom:14px}
+.box h3{font-size:15px;color:#C4633C;margin-bottom:10px}
+label{display:block;font-size:13px;color:#6B655B;margin:10px 0 4px}
+input,select{width:100%;padding:10px 12px;border:1px solid #D4CDBF;border-radius:8px;font-size:15px;background:#fff}
+input:focus,select:focus{outline:none;border-color:#C4633C;box-shadow:0 0 0 3px rgba(196,99,60,.15)}
+.cur{font-size:12px;color:#8A857B;word-break:break-all}
+.btn{display:inline-block;background:#C4633C;color:#fff;border:none;border-radius:8px;padding:10px 24px;font-size:15px;cursor:pointer;margin-top:12px}
+.btn.ghost{background:#8A857B;margin-left:8px}
+.slots{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-top:8px}
+.slot{border:2px dashed #D4CDBF;border-radius:10px;background:#FFFDF9;padding:10px;text-align:center;font-size:12px;color:#6B655B}
+.slot .t{font-weight:600;color:#33302B;margin-bottom:6px}
+.slot img{max-width:100%;max-height:100px;border-radius:6px;margin-bottom:6px}
+.slot .mid{font-size:11px;color:#16A34A;word-break:break-all;margin-bottom:6px}
+.upbtn{display:inline-block;background:#fff;border:1px solid #C4633C;color:#C4633C;border-radius:6px;padding:4px 12px;font-size:12px;cursor:pointer;margin:2px}
+.upbtn.del{color:#DC2626;border-color:#FCA5A5}
+.app-row{display:flex;justify-content:space-between;align-items:center;gap:10px;border:1px solid #EAE3D6;border-radius:10px;background:#FFFDF9;padding:10px 12px;margin-bottom:8px}
+.app-info{font-size:13px;min-width:0}
+.app-ops{flex:none;white-space:nowrap}
+.star{color:#C4633C;font-size:12px;font-weight:600}
+.tag{font-size:11px;border:1px solid #D4CDBF;border-radius:999px;padding:1px 8px;color:#6B655B;margin-left:4px}
+.msg{font-size:13px;margin-top:8px}
+.msg.err{color:#DC2626}.msg.ok{color:#16A34A}
+@media (max-width:640px){.slots{grid-template-columns:1fr}.app-row{flex-direction:column;align-items:flex-start}}
+</style>
+</head>
+<body>
+<div class="wrap">
+<h1>服务商配置</h1>
+<div class="sub">TrustBase 服务商运营台 · 应用/名片/状态 一屏三件事</div>
+
+<div class="chips" id="chips"></div>
+
+<div class="box">
+<h3>① 应用配置 (APP/小程序/网站 · 商户进件按场景选用)</h3>
+<div id="apps-list"></div>
+<h3 id="app-form-title" style="margin-top:14px">新增应用</h3>
+<label>应用名称</label><input id="f_name" placeholder="如: TrustBase 店铺标准版">
+<label>AppID <span style="color:#BDB5A6;font-weight:400">(web 类型填域名 https://)</span></label><input id="f_appid" placeholder="wx 开头 / https://">
+<label>类型</label>
+<select id="f_type"><option value="app">APP 应用</option><option value="mini_program">小程序</option><option value="web">网站</option></select>
+<label>素材截图 <span id="f_assets_hint" style="color:#BDB5A6;font-weight:400">(APP 需 4 张; 小程序/网站 2 张即可)</span></label>
+<div class="slots" id="f_slots"></div>
+<label style="cursor:pointer;font-size:13px;margin-top:10px"><input type="checkbox" id="f_default" style="width:auto;margin-right:6px">设为默认主推 ⭐</label>
+<br>
+<button class="btn" onclick="saveApp()">保存应用</button>
+<button class="btn ghost" id="f_cancel" style="display:none" onclick="resetForm()">取消编辑</button>
+<div class="msg" id="app-msg"></div>
+</div>
+
+<div class="box">
+<h3>② 服务商名片 (商户入驻页展示)</h3>
+<label>名称</label><input id="p_name" placeholder="如: 无锡小播鼠网络科技">
+<label>简介</label><input id="p_desc" placeholder="一句话介绍">
+<label>官网</label><input id="p_url" placeholder="https://">
+<label>客服联系方式</label><input id="p_contact" placeholder="微信/电话/邮箱">
+<label>默认抽佣费率 (bp, 100 = 1.00%)</label><input id="p_bp" type="number" min="0" max="3000">
+<div class="cur" id="bp-cur"></div>
+<button class="btn" onclick="saveProfile()">保存名片</button>
+<div class="msg" id="p-msg"></div>
+</div>
+</div>
+
+<script>
+var KINDS=[['home','首页'],['tail','尾页'],['inner','应用内'],['pay','支付页']];
+var CFG=null, APPS=[], editingId=null, formAssets={home:'',tail:'',inner:'',pay:''};
+function adminKey(){
+  var k=localStorage.getItem('spAdminKey')||'';
+  if(!k){k=prompt('请输入管理密钥 (x-sp-admin-key)')||''; if(k)localStorage.setItem('spAdminKey',k);}
+  return k;
+}
+function api(path,opts){
+  opts=opts||{};
+  opts.headers=Object.assign({'Content-Type':'application/json','Accept':'application/json','x-sp-admin-key':adminKey()},opts.headers||{});
+  return fetch(path,opts).then(function(r){
+    if(r.status===401){localStorage.removeItem('spAdminKey');}
+    return r.json().then(function(j){return{status:r.status,json:j};});
+  });
+}
+function esc(s){return String(s==null?'':s).replace(/&/g,'&amp;').replace(/</g,'&lt;');}
+function maskMid(m){m=String(m||'');return m.length>16?m.slice(0,12)+'…'+m.slice(-4):m;}
+function maskApp(a){a=String(a||'');return a.length>10?a.slice(0,6)+'****'+a.slice(-4):a;}
+var TYPE_LABEL={app:'APP',mini_program:'小程序',web:'网站'};
+
+function render(){
+  var c=CFG, comp=c.completeness;
+  document.getElementById('chips').innerHTML=
+    '<span class="chip '+(APPS.length?'ok':'')+'">'+(APPS.length?'✓':'○')+' 应用 '+APPS.length+'</span>'
+    +'<span class="chip '+(comp.assets===4||APPS.length?'ok':'')+'">'+(comp.assets===4||APPS.length?'✓':'○')+' 素材</span>'
+    +'<span class="chip '+(comp.profile?'ok':'')+'">'+(comp.profile?'✓':'○')+' 名片</span>'
+    +'<span class="chip '+(comp.rate?'ok':'')+'">'+(comp.rate?'✓':'○')+' 费率</span>';
+  document.getElementById('apps-list').innerHTML=APPS.length?APPS.map(function(a){
+    var cnt=['home','tail','inner','pay'].filter(function(k){return a.assets[k];}).length;
+    return '<div class="app-row"><div class="app-info"><b>'+esc(a.name)+'</b>'
+      +(a.is_default?'<span class="star"> ⭐默认</span>':'')
+      +'<span class="tag">'+(TYPE_LABEL[a.type]||a.type)+'</span><br>'
+      +'<span class="cur">'+esc(maskApp(a.appid))+' · 素材 '+cnt+'/4</span></div>'
+      +'<div class="app-ops">'
+      +'<button class="upbtn" onclick="editApp('+a.id+')">编辑</button>'
+      +(a.is_default?'':'<button class="upbtn" onclick="setDefault('+a.id+')">设默认</button>')
+      +'<button class="upbtn del" onclick="delApp('+a.id+')">删除</button>'
+      +'</div></div>';
+  }).join(''):'<div class="cur">还没有应用, 在下方新增第一个</div>';
+  renderSlots();
+  document.getElementById('p_name').value=c.sp_name||'';
+  document.getElementById('p_desc').value=c.sp_desc||'';
+  document.getElementById('p_url').value=c.sp_official_url||'';
+  document.getElementById('p_contact').value=c.sp_contact||'';
+  document.getElementById('p_bp').value=c.commission_bp;
+  document.getElementById('bp-cur').textContent='当前: '+c.commission_bp+' bp ('+c.rate_pct+')';
+}
+function renderSlots(){
+  document.getElementById('f_slots').innerHTML=KINDS.map(function(kk){
+    var mid=formAssets[kk[0]];
+    return '<div class="slot"><div class="t">'+kk[1]+'</div>'
+      +(mid?'<div class="mid">✓ '+esc(maskMid(mid))+'</div>':'')
+      +'<img id="img-'+kk[0]+'" style="display:none">'
+      +'<label class="upbtn">'+(mid?'替换':'点击上传')+'<input type="file" accept="image/*" style="display:none" onchange="upFormAsset(event,\x27'+kk[0]+'\x27)"></label>'
+      +(mid?'<button class="upbtn del" onclick="formAssets[\x27'+kk[0]+'\x27]=\x27\x27;renderSlots()">删除</button>':'')
+      +'</div>';
+  }).join('');
+}
+async function load(){
+  var r=await api('/api/sp/config');
+  if(r.status!==200){alert(r.json.message||'加载失败');return;}
+  CFG=r.json;
+  var ra=await api('/api/sp/apps');
+  APPS=(ra.json&&ra.json.apps)||[];
+  render();
+}
+function editApp(id){
+  var a=APPS.filter(function(x){return x.id===id;})[0];
+  if(!a) return;
+  editingId=id;
+  document.getElementById('app-form-title').textContent='编辑应用 #'+id;
+  document.getElementById('f_name').value=a.name;
+  document.getElementById('f_appid').value=a.appid;
+  document.getElementById('f_type').value=a.type;
+  document.getElementById('f_default').checked=!!a.is_default;
+  formAssets={home:a.assets.home,tail:a.assets.tail,inner:a.assets.inner,pay:a.assets.pay};
+  document.getElementById('f_cancel').style.display='';
+  renderSlots();
+}
+function resetForm(){
+  editingId=null;
+  document.getElementById('app-form-title').textContent='新增应用';
+  ['f_name','f_appid'].forEach(function(id){document.getElementById(id).value='';});
+  document.getElementById('f_type').value='app';
+  document.getElementById('f_default').checked=false;
+  formAssets={home:'',tail:'',inner:'',pay:''};
+  document.getElementById('f_cancel').style.display='none';
+  renderSlots();
+}
+async function saveApp(){
+  var m=document.getElementById('app-msg');
+  var body={name:document.getElementById('f_name').value.trim(),
+    appid:document.getElementById('f_appid').value.trim(),
+    type:document.getElementById('f_type').value,
+    assets:formAssets, is_default:document.getElementById('f_default').checked};
+  if(!body.name||!body.appid){m.className='msg err';m.textContent='应用名称和 AppID 必填';return;}
+  var r=editingId?await api('/api/sp/apps/'+editingId,{method:'PUT',body:JSON.stringify(body)})
+    :await api('/api/sp/apps',{method:'POST',body:JSON.stringify(body)});
+  m.className='msg '+(r.json.ok?'ok':'err');
+  m.textContent=r.json.ok?'✓ 已保存':(r.json.message||'保存失败');
+  if(r.json.ok){resetForm();load();}
+}
+async function setDefault(id){
+  var r=await api('/api/sp/apps/'+id,{method:'PUT',body:JSON.stringify({is_default:true})});
+  if(r.json.ok) load();
+}
+async function delApp(id){
+  if(!confirm('删除这个应用? (不影响已提交的进件)')) return;
+  var r=await api('/api/sp/apps/'+id,{method:'DELETE'});
+  if(r.json.ok) load();
+}
+function shrink(file,cb){
+  var rd=new FileReader();
+  rd.onload=function(){
+    var img=new Image();
+    img.onload=function(){
+      var max=1600,w=img.width,h=img.height;
+      if(Math.max(w,h)>max){var k=max/Math.max(w,h);w=Math.round(w*k);h=Math.round(h*k);}
+      var cv=document.createElement('canvas');cv.width=w;cv.height=h;
+      cv.getContext('2d').drawImage(img,0,0,w,h);
+      cb(null,cv.toDataURL('image/jpeg',0.85).split(',')[1]);
+    };
+    img.src=rd.result;
+  };
+  rd.readAsDataURL(file);
+}
+async function upFormAsset(ev,kind){
+  var file=ev.target.files&&ev.target.files[0];
+  if(!file) return;
+  var m=document.getElementById('app-msg');
+  m.className='msg';m.textContent='上传中...';
+  shrink(file,async function(err,b64){
+    if(err){m.className='msg err';m.textContent=err.message;return;}
+    var r=await api('/api/sp/applyment/upload',{method:'POST',body:JSON.stringify({filename:kind+'.jpg',content_b64:b64})});
+    if(r.json.media_id){formAssets[kind]=r.json.media_id;m.textContent='';renderSlots();}
+    else{m.className='msg err';m.textContent=r.json.message||'上传失败';}
+  });
+}
+async function saveProfile(){
+  var bp=Number(document.getElementById('p_bp').value);
+  var r=await api('/api/sp/config',{method:'PUT',body:JSON.stringify({
+    sp_name:document.getElementById('p_name').value.trim(),
+    sp_desc:document.getElementById('p_desc').value.trim(),
+    sp_official_url:document.getElementById('p_url').value.trim(),
+    sp_contact:document.getElementById('p_contact').value.trim(),
+    commission_bp:bp})});
+  var m=document.getElementById('p-msg');
+  m.className='msg '+(r.json.ok?'ok':'err'); m.textContent=r.json.ok?'✓ 已保存 (商户端 /api/sp/info 立即生效)':(r.json.message||'保存失败');
+  if(r.json.ok) load();
+}
+adminKey(); load();
+</script>
+</body>
+</html>`;
+
+
 /** mock 微信应答 (SP_APPLYMENT_MOCK=1; 不碰真 API) */
 function mockWx(method, urlPath) {
     if (method === "POST" && urlPath === "/v3/merchant/media/upload") {
@@ -690,18 +1055,25 @@ function createSpApplymentRouter(deps) {
      *  M3 🟡-1: 公示比例读 sp_commission_rates 默认行 (__default__) 优先, env 只作首次种子 */
     router.get("/info", (req, res) => {
         const bp = spCommission.getDefaultRateBp(db);
+        // 2026-10-03 配置页落地: 名片/AppID 读 sp_profile 表优先 (env 兜底) — 配置页保存即生效
         res.json({
-            name: process.env.SP_NAME || "TrustBase 官方服务商",
-            desc: process.env.SP_DESC || "",
-            official_url: process.env.SP_OFFICIAL_URL || "",
-            contact: process.env.SP_CONTACT || "",
+            name: spProfileGet(db, "sp_name") || process.env.SP_NAME || "TrustBase 官方服务商",
+            desc: spProfileGet(db, "sp_desc") || process.env.SP_DESC || "",
+            official_url: spProfileGet(db, "sp_official_url") || process.env.SP_OFFICIAL_URL || "",
+            contact: spProfileGet(db, "sp_contact") || process.env.SP_CONTACT || "",
             commission_rate_bp: bp,
             rate_pct: (bp / 100).toFixed(2) + "%",
             chain_address: process.env.SP_CHAIN_ADDR || "",
             gateway: String(req.headers.host || ""), // 本网关域名 (从请求 host 推断)
-            // 普通商户 APP 场景零自备: 服务商应用 AppID + 应用截图素材 (sp_app_assets 表优先, env 兜底)
-            app_appid: process.env.SP_APP_APPID || "",
-            app_screenshots: readAppAssets(db),
+            // 普通商户零自备: 多应用列表 (sp_apps) + 兼容单配置字段 (= 默认应用那套, 旧商户端不受影响)
+            ...(() => {
+                const defApp = pickSpApp(db, "app");
+                return {
+                    app_appid: defApp ? defApp.appid : (spProfileGet(db, "app_appid") || process.env.SP_APP_APPID || ""),
+                    app_screenshots: defApp ? defApp.assets : readAppAssets(db),
+                    apps: listSpApps(db),
+                };
+            })(),
         });
     });
 
@@ -761,6 +1133,7 @@ function createSpApplymentRouter(deps) {
                 const mediaId = await wxUploadMedia(filename, Buffer.from(String(a.content_b64), "base64"));
                 db.prepare("INSERT INTO sp_app_assets (kind, media_id, updated_at) VALUES (?,?,?) ON CONFLICT(kind) DO UPDATE SET media_id=excluded.media_id, updated_at=excluded.updated_at")
                     .run(kind, mediaId, nowSec());
+                upsertDefaultAppAsset(db, kind, mediaId); // 同步默认应用行 (/info 兼容字段始终最新)
                 saved[kind] = mediaId;
             }
             if (!Object.keys(saved).length) throw new HttpError(400, "invalid_param", "assets 至少给一张 (home/tail/inner/pay)");
@@ -771,6 +1144,129 @@ function createSpApplymentRouter(deps) {
         }
     });
 
+    /** GET/PUT /config — 服务商配置 (admin)。浏览器 (Accept: text/html) → /sp/config 配置页;
+     *  API (Accept: application/json) → 全量配置 JSON (表优先 env 兜底 + 配齐度) */
+    router.get("/config", (req, res) => {
+        const wantsHtml = String(req.headers.accept || "").includes("text/html");
+        if (wantsHtml) { // 页面本身不鉴权 (admin key 在页面内输入, 所有 API 都要 key — 同 /sp/apply 口径)
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            return res.send(CONFIG_PAGE_HTML);
+        }
+        if (!checkAdmin(req, res)) return;
+        res.json({ ok: true, ...currentConfig(db), completeness: configCompleteness(db) });
+    });
+    router.put("/config", (req, res) => {
+        if (!checkAdmin(req, res)) return;
+        try {
+            const b = req.body || {};
+            const KEYMAP = { app_appid: "app_appid", sp_name: "sp_name", sp_desc: "sp_desc", sp_official_url: "sp_official_url", sp_contact: "sp_contact" };
+            const saved = {};
+            for (const k of Object.keys(KEYMAP)) {
+                if (b[k] !== undefined) {
+                    const v = String(b[k]).trim().slice(0, 200);
+                    spProfileSet(db, KEYMAP[k], v);
+                    saved[k] = v;
+                }
+            }
+            if (b.commission_bp !== undefined) {
+                const bp = Number(b.commission_bp);
+                if (!Number.isInteger(bp) || bp < 0 || bp > spCommission.MAX_RATE_BP) {
+                    throw new HttpError(422, "rate_out_of_range", `commission_bp 必须是 0..${spCommission.MAX_RATE_BP} 的整数 (万分比)`);
+                }
+                // 费率写 sp_commission_rates 默认行 (__default__) — /api/sp/info 的 getDefaultRateBp 单源
+                spCommission.ensureCommissionTables(db);
+                const now = nowSec();
+                db.prepare(`INSERT INTO sp_commission_rates (sub_mchid, provider, rate_bp, updated_by, created_at, updated_at)
+ VALUES ('__default__','',?,'config-page',?,?)
+ ON CONFLICT(sub_mchid) DO UPDATE SET rate_bp=excluded.rate_bp, updated_by=excluded.updated_by, updated_at=excluded.updated_at`)
+                    .run(bp, now, now);
+                saved.commission_bp = bp;
+            }
+            if (!Object.keys(saved).length) throw new HttpError(400, "invalid_param", "没有可保存的字段");
+            console.log(`[sp-applyment] 配置已保存 keys=${Object.keys(saved).join(",")}`);
+            res.json({ ok: true, saved, ...currentConfig(db), completeness: configCompleteness(db) });
+        } catch (e) {
+            return chainWrites.handleError(res, e, "/api/sp/config");
+        }
+    });
+    /** DELETE /app-assets/:kind — 删除一张应用素材 (admin; 配置页"删除"按钮) */
+    router.delete("/app-assets/:kind", (req, res) => {
+        if (!checkAdmin(req, res)) return;
+        const kind = String(req.params.kind || "");
+        if (!["home", "tail", "inner", "pay"].includes(kind)) {
+            return res.status(400).json({ ok: false, error: "invalid_param", message: "kind 必须是 home/tail/inner/pay" });
+        }
+        db.prepare("DELETE FROM sp_app_assets WHERE kind = ?").run(kind);
+        upsertDefaultAppAsset(db, kind, ""); // 同步清空默认应用行
+        res.json({ ok: true, assets: readAppAssets(db) });
+    });
+
+    /** 服务商应用列表 CRUD (admin; 配置页"① 应用配置"的数据源) */
+    router.get("/apps", (req, res) => {
+        if (!checkAdmin(req, res)) return;
+        res.json({ ok: true, apps: listSpApps(db) });
+    });
+    router.post("/apps", (req, res) => {
+        if (!checkAdmin(req, res)) return;
+        try {
+            const b = req.body || {};
+            const name = String(b.name || "").trim();
+            const appid = String(b.appid || "").trim();
+            const type = String(b.type || "app");
+            if (!name || !appid) throw new HttpError(400, "invalid_param", "name/appid 必填");
+            if (!SP_APP_TYPES.includes(type)) throw new HttpError(400, "invalid_param", "type 必须是 app/mini_program/web");
+            const a = b.assets || {};
+            const now = nowSec();
+            // 第一个应用自动设默认; 显式 is_default 则清其它
+            const count = db.prepare("SELECT COUNT(*) n FROM sp_apps").get().n;
+            const isDef = b.is_default || count === 0 ? 1 : 0;
+            if (isDef) db.prepare("UPDATE sp_apps SET is_default = 0").run();
+            const r = db.prepare(`INSERT INTO sp_apps (name, appid, type, assets_home, assets_tail, assets_inner, assets_pay, is_default, created_at, updated_at)
+ VALUES (?,?,?,?,?,?,?,?,?,?)`)
+                .run(name, appid, type,
+                    String(a.home || ""), String(a.tail || ""), String(a.inner || ""), String(a.pay || ""),
+                    isDef, now, now);
+            console.log(`[sp-applyment] 新增应用 #${r.lastInsertRowid} ${name} (${type})${isDef ? " 默认⭐" : ""}`);
+            res.json({ ok: true, id: r.lastInsertRowid, apps: listSpApps(db) });
+        } catch (e) {
+            return chainWrites.handleError(res, e, "/api/sp/apps");
+        }
+    });
+    router.put("/apps/:id", (req, res) => {
+        if (!checkAdmin(req, res)) return;
+        try {
+            const id = Number(req.params.id);
+            const row = db.prepare("SELECT * FROM sp_apps WHERE id = ?").get(id);
+            if (!row) throw new HttpError(404, "not_found", "应用不存在");
+            const b = req.body || {};
+            const now = nowSec();
+            if (b.is_default) db.prepare("UPDATE sp_apps SET is_default = 0 WHERE id <> ?").run(id); // 默认唯一
+            const type = b.type !== undefined ? String(b.type) : row.type;
+            if (!SP_APP_TYPES.includes(type)) throw new HttpError(400, "invalid_param", "type 必须是 app/mini_program/web");
+            const a = b.assets || {};
+            db.prepare(`UPDATE sp_apps SET name=?, appid=?, type=?,
+  assets_home=?, assets_tail=?, assets_inner=?, assets_pay=?, is_default=?, updated_at=? WHERE id=?`)
+                .run(
+                    b.name !== undefined ? String(b.name).trim() : row.name,
+                    b.appid !== undefined ? String(b.appid).trim() : row.appid,
+                    type,
+                    a.home !== undefined ? String(a.home) : row.assets_home,
+                    a.tail !== undefined ? String(a.tail) : row.assets_tail,
+                    a.inner !== undefined ? String(a.inner) : row.assets_inner,
+                    a.pay !== undefined ? String(a.pay) : row.assets_pay,
+                    b.is_default ? 1 : row.is_default,
+                    now, id);
+            res.json({ ok: true, apps: listSpApps(db) });
+        } catch (e) {
+            return chainWrites.handleError(res, e, "/api/sp/apps");
+        }
+    });
+    router.delete("/apps/:id", (req, res) => {
+        if (!checkAdmin(req, res)) return;
+        db.prepare("DELETE FROM sp_apps WHERE id = ?").run(Number(req.params.id));
+        res.json({ ok: true, apps: listSpApps(db) });
+    });
+
     /** POST /applyment/submit — 组装进件 JSON (敏感字段 RSA-OAEP 加密) → 微信提交 → 台账落行
      *  幂等/重提 (2026-10-03 F1/F3 fix):
      *   - business_code 由调用方 (卖家本机) 首次提交时生成并随单带上; 未带则 SP 兜底生成

package/test-onboard-applyment.js

@@ -822,3 +822,28 @@ test("分步向导: stepper/导航/校验/预览 元素与逻辑齐备", async (
         assert.ok(html.includes("a_shortname") && html.includes("a_up_license") && html.includes("btn-apply-submit"), "既有字段/提交钮保留");
     } finally { srv.close(); }
 });
+
+test("MP 场景: 服务商小程序素材数组 (mp_screenshots) 免单张上传 + 组装 mp_pics", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const form = await fillSceneForm(base, "SALES_SCENES_MP");
+        delete form.mp_media_id; // 不传单张, 改用服务商素材数组
+        // 缺两者 → 400
+        let r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        assert.strictEqual(r.status, 400);
+        // 数组路径 → 200, SP 组装 mp_pics=数组
+        form.mp_screenshots = ["MP_M1", "MP_M2"];
+        const before = spCapture.submits.length;
+        r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        const fwd = spCapture.submits[before];
+        assert.deepStrictEqual(fwd.mp_screenshots, ["MP_M1", "MP_M2"]);
+        const wxBody = spApplymentLib.buildApplymentBody({ ...fwd, business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
+        assert.deepStrictEqual(wxBody.business_info.sales_info.mp_info.mp_pics, ["MP_M1", "MP_M2"], "mp_pics=服务商素材数组");
+    } finally { srv.close(); }
+});

package/test-sp-applyment.js

@@ -425,3 +425,118 @@ test("M4-APP: /info 带 app 配置 (env + 素材表) + POST /app-assets 上传
         delete process.env.SP_APP_APPID; delete process.env.SP_APP_ASSETS_JSON;
     }
 });
+
+test("SP 配置页后端: config 读写 (表优先 env) + 配齐度 + info 立即生效 + 素材删除", async () => {
+    const { srv, base } = await startServer();
+    try {
+        // 无 key → 401
+        let r = await fetch(base + "/api/sp/config", { headers: { Accept: "application/json" } });
+        assert.strictEqual(r.status, 401);
+        // 页面: Accept text/html 无 key 也 200 (admin key 页面内输入)
+        r = await fetch(base + "/sp/config", { headers: { Accept: "text/html" } });
+        assert.strictEqual(r.status, 200);
+        assert.ok((await r.text()).includes("服务商配置"));
+        // 读默认 (env 兜底)
+        let j = await (await fetch(base + "/api/sp/config", { headers: { ...H, Accept: "application/json" } })).json();
+        assert.strictEqual(j.ok, true);
+        assert.strictEqual(j.app_appid, "");
+        assert.strictEqual(j.completeness.appid, false);
+        assert.ok(j.completeness.missing.includes("AppID"));
+        // PUT 应用 AppID + 名片 + 费率 → 表优先, /info 立即生效
+        r = await fetch(base + "/api/sp/config", {
+            method: "PUT", headers: { ...H, Accept: "application/json" },
+            body: JSON.stringify({ app_appid: "wx_cfg_app_001", sp_name: "配置页服务商", sp_contact: "微信: cfg", commission_bp: 200 }),
+        });
+        j = await r.json();
+        assert.strictEqual(j.ok, true);
+        assert.strictEqual(j.saved.app_appid, "wx_cfg_app_001");
+        assert.strictEqual(j.saved.commission_bp, 200);
+        assert.strictEqual(j.completeness.appid, true);
+        j = await (await fetch(base + "/api/sp/info")).json();
+        assert.strictEqual(j.app_appid, "wx_cfg_app_001", "/info 读表立即生效");
+        assert.strictEqual(j.name, "配置页服务商");
+        assert.strictEqual(j.contact, "微信: cfg");
+        assert.strictEqual(j.commission_rate_bp, 200);
+        assert.strictEqual(j.rate_pct, "2.00%");
+        // env 设置后表仍优先 (表 > env)
+        process.env.SP_NAME = "env-不应生效";
+        j = await (await fetch(base + "/api/sp/info")).json();
+        assert.strictEqual(j.name, "配置页服务商", "表优先于 env");
+        delete process.env.SP_NAME;
+        // 素材上传 → 配齐度 4/4 + /info app_screenshots
+        for (const kind of ["home", "tail", "inner", "pay"]) {
+            const ur = await fetch(base + "/api/sp/app-assets", {
+                method: "POST", headers: H,
+                body: JSON.stringify({ assets: { [kind]: { filename: kind + ".jpg", content_b64: Buffer.from("fake-" + kind).toString("base64") } } }),
+            });
+            assert.strictEqual(ur.status, 200);
+        }
+        j = await (await fetch(base + "/api/sp/config", { headers: { ...H, Accept: "application/json" } })).json();
+        assert.strictEqual(j.completeness.assets, 4);
+        assert.ok(j.completeness.complete, "AppID+4素材+名片全齐 → complete");
+        j = await (await fetch(base + "/api/sp/info")).json();
+        assert.ok(j.app_screenshots.home && j.app_screenshots.pay, "素材返回");
+        // 删除一张 → 不再 complete
+        r = await fetch(base + "/api/sp/app-assets/pay", { method: "DELETE", headers: H });
+        assert.strictEqual((await r.json()).ok, true);
+        j = await (await fetch(base + "/api/sp/config", { headers: { ...H, Accept: "application/json" } })).json();
+        assert.strictEqual(j.completeness.assets, 3);
+        assert.ok(!j.completeness.complete);
+        assert.ok(j.completeness.missing.includes("支付页截图"));
+        // 费率越界 422
+        r = await fetch(base + "/api/sp/config", {
+            method: "PUT", headers: { ...H, Accept: "application/json" },
+            body: JSON.stringify({ commission_bp: 3001 }),
+        });
+        assert.strictEqual(r.status, 422);
+    } finally { srv.close(); }
+});
+
+test("多应用: CRUD + 默认唯一 + 旧配置自动迁移 + /info apps 列表", async () => {
+    const { srv, base } = await startServer();
+    try {
+        // 先写旧单配置 (profile.app_appid) → 首次访问 apps 应自动迁移为默认应用
+        await fetch(base + "/api/sp/config", {
+            method: "PUT", headers: { ...H, Accept: "application/json" },
+            body: JSON.stringify({ app_appid: "wx_legacy_001" }),
+        });
+        let j = await (await fetch(base + "/api/sp/apps", { headers: H })).json();
+        assert.strictEqual(j.apps.length, 1, "旧配置自动迁移");
+        assert.strictEqual(j.apps[0].appid, "wx_legacy_001");
+        assert.strictEqual(j.apps[0].is_default, true, "迁入行为默认应用");
+        assert.strictEqual(j.apps[0].type, "app");
+        const legacyId = j.apps[0].id;
+        // 新增第二个 (不默认)
+        let r = await fetch(base + "/api/sp/apps", {
+            method: "POST", headers: H,
+            body: JSON.stringify({ name: "店铺小程序", appid: "wx_mini_002", type: "mini_program", assets: { home: "M1", tail: "M2" } }),
+        });
+        j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.strictEqual(j.apps.length, 2);
+        const miniId = j.id;
+        assert.strictEqual(j.apps.filter((a) => a.is_default).length, 1, "默认仍唯一");
+        // 设默认到第二个 → 唯一切换
+        r = await fetch(base + "/api/sp/apps/" + miniId, { method: "PUT", headers: H, body: JSON.stringify({ is_default: true }) });
+        j = await r.json();
+        assert.strictEqual(j.apps.filter((a) => a.is_default).length, 1);
+        assert.strictEqual(j.apps.find((a) => a.is_default).id, miniId);
+        // /info: apps 列表 + 兼容字段 = 默认应用 (mini 类型不应影响 app 兼容字段)
+        j = await (await fetch(base + "/api/sp/info")).json();
+        assert.strictEqual(j.apps.length, 2);
+        assert.strictEqual(j.app_appid, "wx_legacy_001", "兼容字段=app 类型默认/首行, 不被 mini 默认抢走");
+        // 编辑
+        r = await fetch(base + "/api/sp/apps/" + miniId, { method: "PUT", headers: H, body: JSON.stringify({ name: "店铺小程序Pro" }) });
+        assert.strictEqual((await r.json()).apps.find((a) => a.id === miniId).name, "店铺小程序Pro");
+        // 删除
+        r = await fetch(base + "/api/sp/apps/" + miniId, { method: "DELETE", headers: H });
+        j = await r.json();
+        assert.strictEqual(j.apps.length, 1);
+        // 无 key 401
+        r = await fetch(base + "/api/sp/apps");
+        assert.strictEqual(r.status, 401);
+        // 校验: type 非法 400
+        r = await fetch(base + "/api/sp/apps", { method: "POST", headers: H, body: JSON.stringify({ name: "x", appid: "y", type: "bad" }) });
+        assert.strictEqual(r.status, 400);
+    } finally { srv.close(); }
+});