trustbase-seller-backend 0.6.0 → 0.7.0

package/db/store-migrate.js

@@ -88,6 +88,8 @@ function runStoreMigrations(db) {
         `ALTER TABLE store_products ADD COLUMN chain_listed_at INTEGER`,
         `ALTER TABLE store_products ADD COLUMN chain_tx_hash TEXT`,
         `ALTER TABLE store_products ADD COLUMN chain_stake_per_unit INTEGER`,
+        // A1 (2026-10-05): 商品类型驱动收货地址 — physical(默认) 实物 / virtual 虚拟
+        `ALTER TABLE store_products ADD COLUMN product_type TEXT NOT NULL DEFAULT 'physical'`,
     ];
     for (const stmt of alterStatements) {
         try {

package/middleware/api-key-auth.js

@@ -165,7 +165,10 @@ function isTunnelBuyerRequest(req, clientIP) {
     const fromLoopback = clientIP === '127.0.0.1' || clientIP === '::1' || /^127\./.test(clientIP);
     if (!fromLoopback) return false;
     if (String(req.headers['x-tb-tunnel'] || '') !== '1') return false;
-    return TUNNEL_BUYER_PATHS.some(p => req.path.startsWith(p));
+    // 注意: 本中间件挂在 '/api' 上, req.path 是挂载后路径 ('/products'), req.originalUrl 才带 '/api'
+    // → 两种前缀都要判, 否则放行条件恒为假 (2026-10-03 .211 实测 401 才发现)
+    const paths = [String(req.path || ''), String(req.originalUrl || '').split('?')[0]];
+    return TUNNEL_BUYER_PATHS.some(p => paths.some(x => x === p || x.startsWith(p + '/') || x.startsWith(p)));
 }
 
 function requireAPIKey(skipLAN = true, exemptPaths = []) {    return (req, res, next) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/agent-pay.js

@@ -44,6 +44,7 @@ CREATE TABLE IF NOT EXISTS agent_pay_sessions (
   pay_token_hash TEXT NOT NULL,
   status_token_hash TEXT NOT NULL,
   state TEXT NOT NULL DEFAULT 'CREATED',  -- CREATED/PAID/ON_CHAIN/SHIPPED/DELIVERED/CONFIRMED/CLOSED/EXPIRED/REFUNDED/DISPUTED
+  sub_mchid TEXT DEFAULT '',              -- Lane C: 本单所属特约商户 (多商户; 查单/对账按它选 partner 端点)
   psp_code_url TEXT DEFAULT '',
   psp_txn_id TEXT DEFAULT '',
   shopxo_order_no TEXT DEFAULT '',
@@ -62,9 +63,16 @@ CREATE TABLE IF NOT EXISTS psp_txns (
   created_at INTEGER NOT NULL
 );
 CREATE INDEX IF NOT EXISTS idx_aps_state ON agent_pay_sessions(state);
-`);
-    // 2026-09-20 E4': 物流列 (老库兼容)
-    for (const col of ["carrier TEXT DEFAULT ''", "tracking_no TEXT DEFAULT ''", "logistics_state TEXT DEFAULT ''", "timeline TEXT DEFAULT '[]'", "shopxo_order_no_ref TEXT DEFAULT ''"]) {
+`);
+    // Lane C (2026-10-03): 旧库补列 — CREATE TABLE IF NOT EXISTS 不会给已有表加列
+    try {
+        const _c = db.prepare("PRAGMA table_info(agent_pay_sessions)").all().map((x) => x.name);
+        if (!_c.includes("sub_mchid")) db.exec("ALTER TABLE agent_pay_sessions ADD COLUMN sub_mchid TEXT DEFAULT ''");
+    } catch (_) {}
+
+    // 2026-09-20 E4': 物流列 (老库兼容) + A1 收货地址/交付凭据列
+    for (const col of ["carrier TEXT DEFAULT ''", "tracking_no TEXT DEFAULT ''", "logistics_state TEXT DEFAULT ''", "timeline TEXT DEFAULT '[]'", "shopxo_order_no_ref TEXT DEFAULT ''",
+        "shipping_address TEXT DEFAULT ''", "delivery_credential TEXT DEFAULT ''"]) {
         try { db.exec("ALTER TABLE agent_pay_sessions ADD COLUMN " + col); } catch (e) { /* 已存在 */ }
     }
 }
@@ -138,13 +146,21 @@ async function wxApiCall(method, urlPath, bodyObj, override) {
 // opts.settleInfo (2026-10-06 U7): 可选, 如 { profit_sharing: true } — 微信规则: 订单下单时
 // 不带 settle_info.profit_sharing 的分账请求会被拒; 默认不带 (向后兼容, 直连模式不用传)
 async function wxNativeOrder(outTradeNo, description, totalCents, expireSec, opts) {
+    // Lane C (2026-10-03): sub_mchid 按本单商家传入 (多商户), 未传才回落全局 env (单商户旧部署)
+    const subMchid = String((opts && opts.subMchid) || process.env.WXPAY_SUB_MCHID || "");
+    if (opts && opts.subMchidSource && opts.subMchidSource !== "registry") {
+        console.warn(
+            `[agent-pay] 本单 sub_mchid 来源=${opts.subMchidSource} (非登记表), 使用 ${subMchid || "直连模式"}` +
+            (subMchid ? " — 多商户场景请核对该商户是否已进件登记" : "")
+        );
+    }
     // SP 模式: 用服务商身份签名 + 请求体带 sp_mchid + sub_mchid
-    const isSp = !!(WX.spMchid && process.env.WXPAY_SUB_MCHID);
+    const isSp = !!(WX.spMchid && subMchid);
     const override = isSp ? { mchid: WX.spMchid, serial: WX.spSerial, keyPath: WX.spKeyPath } : undefined;
     const body = {
         // 直连模式: appid = 商户公众号; SP 模式: 微信不认 appid, 要 sp_appid(服务商) + sub_appid(特约商户)
         ...(isSp
-            ? { sp_mchid: WX.spMchid, sp_appid: WX.spAppid, sub_mchid: process.env.WXPAY_SUB_MCHID, sub_appid: WX.subAppid || WX.appid }
+            ? { sp_mchid: WX.spMchid, sp_appid: WX.spAppid, sub_mchid: subMchid, sub_appid: WX.subAppid || WX.appid }
             : { appid: WX.appid, mchid: WX.mchid }),
         description: String(description).slice(0, 127),
         out_trade_no: outTradeNo, time_expire: new Date(expireSec * 1000).toISOString(),
@@ -161,11 +177,13 @@ async function wxNativeOrder(outTradeNo, description, totalCents, expireSec, opt
     return r.json.code_url;
 }
 // 查单: trade_state ∈ {SUCCESS, NOTPAY, CLOSED, ...} (SP 模式走 partner endpoint + 双 mchid 查询串)
-async function wxQueryOrder(outTradeNo) {
-    const isSp = !!(WX.spMchid && process.env.WXPAY_SUB_MCHID);
+async function wxQueryOrder(outTradeNo, opts) {
+    // Lane C: 本单商户号优先, 回落全局 env (多商户)
+    const qSubMchid = String((opts && opts.subMchid) || process.env.WXPAY_SUB_MCHID || "");
+    const isSp = !!(WX.spMchid && qSubMchid);
     const override = isSp ? { mchid: WX.spMchid, serial: WX.spSerial, keyPath: WX.spKeyPath } : undefined;
     const endpoint = isSp
-        ? `/v3/pay/partner/transactions/out-trade-no/${outTradeNo}?sp_mchid=${WX.spMchid}&sub_mchid=${process.env.WXPAY_SUB_MCHID}`
+        ? `/v3/pay/partner/transactions/out-trade-no/${outTradeNo}?sp_mchid=${WX.spMchid}&sub_mchid=${qSubMchid}`
         : `/v3/pay/transactions/out-trade-no/${outTradeNo}?mchid=${WX.mchid}`;
     const r = await wxApiCall("GET", endpoint, null, override);
     if (r.status !== 200) return { state: "UNKNOWN", raw: r.json };
@@ -210,7 +228,8 @@ function loadPlatformCertsFromDisk() {
 
 /** 拉取微信平台证书 (GET /v3/certificates, 密文用调用方 APIv3 key 解密) → 内存+磁盘缓存 */
 async function refreshPlatformCerts() {
-    const isSp = !!(WX.spMchid && process.env.WXPAY_SUB_MCHID);
+    // Lane C: SP 身份只判 sp_mchid 是否配置 — 不能依赖全局 sub_mchid (多商户部署常不设默认值)
+    const isSp = !!WX.spMchid;
     const override = isSp ? { mchid: WX.spMchid, serial: WX.spSerial, keyPath: WX.spKeyPath } : undefined;
     const r = await wxApiCall("GET", "/v3/certificates", null, override);
     if (r.status !== 200 || !Array.isArray(r.json && r.json.data)) {
@@ -260,7 +279,8 @@ function wxVerifyNotifySignature(serial, timestamp, nonce, rawBody, signature) {
 
 /** 回调资源解密 (SP 模式优先 sp APIv3 key) */
 function wxDecryptNotifyResource(resource) {
-    const isSp = !!(WX.spMchid && process.env.WXPAY_SUB_MCHID);
+    // Lane C: 回调是发给服务商的, 必须用服务商 apiv3 key — 不能依赖全局 sub_mchid
+    const isSp = !!WX.spMchid;
     const apiv3 = isSp && WX.spApiv3Key ? WX.spApiv3Key : WX.apiv3Key;
     const plain = wxAesGcmDecrypt(apiv3, resource.nonce, resource.associated_data, resource.ciphertext);
     return JSON.parse(plain.toString("utf8"));
@@ -624,7 +644,7 @@ async function runReconcileOnce(db) {
             scanned = pend.length;
             for (const row of pend) {
                 try {
-                    const q = await wxQueryOrder(row.order_ref);
+                    const q = await wxQueryOrder(row.order_ref, { subMchid: row.sub_mchid });
                     if (q.state === "SUCCESS") {
                         settlePayment(row, q.txnId || ("wxq-" + row.order_ref), "wechat_native", q.amount || row.amount_total, JSON.stringify(q.raw).slice(0, 2000));
                         settled++;

package/routes/buyer-shop.js

@@ -31,6 +31,9 @@
  *
  * 下单要点:
  *   - 价格权威 = 本地 DB (单价 × qty 算总分), 客户端传的任何金额字段一律忽略
+ *   - A1 (2026-10-05 设计方案): product_type 驱动收货地址 — physical 强制 shipping_address
+ *     (缺失 400 SHIPPING_ADDRESS_REQUIRED), virtual 免地址并生成 delivery_credential
+ *     (license 格式 tb-license-{order_ref}-{random4}); 无 product_type 列/字段默认 physical
  *   - qty 整数 >=1 且不超库存; 单价折算后 <= 0 分 → 409 (微信不支持 0 元单)
  *   - 幂等两级: ① body.client_order_no → client_session_id='buyer:{card}:{no}' 同号返原单
  *     ② 无 client_order_no → 同 buyer_card+product_id 5 分钟窗口内未支付未过期单直接复用
@@ -93,11 +96,19 @@ CREATE TABLE IF NOT EXISTS agent_pay_sessions (
   updated_at INTEGER NOT NULL
 );
 `);
-    // 老库兼容: agent-pay 的物流列 + U7 分账标记列 (已存在则跳过)
+    // 老库兼容: agent-pay 的物流列 + Lane C 商户号列 + U7 分账标记列 + A1 收货地址/交付凭据列 (已存在则跳过)
     for (const col of ["carrier TEXT DEFAULT ''", "tracking_no TEXT DEFAULT ''", "logistics_state TEXT DEFAULT ''", "timeline TEXT DEFAULT '[]'", "shopxo_order_no_ref TEXT DEFAULT ''",
-        "ps_flag INTEGER NOT NULL DEFAULT 0"]) { // U7: 1=下单带 settle_info.profit_sharing (rate>0 且 SP 模式)
+        "sub_mchid TEXT DEFAULT ''",          // Lane C: 本单所属特约商户 (INSERT 引用; 0.4.3 教训: 写路径自建, 不依赖 agent-pay 先跑)
+        "ps_flag INTEGER NOT NULL DEFAULT 0", // U7: 1=下单带 settle_info.profit_sharing (rate>0 且 SP 模式)
+        "shipping_address TEXT DEFAULT ''",   // A1: 实物订单收货地址 (虚拟单允许空)
+        "delivery_credential TEXT DEFAULT ''" // A1: 虚拟商品交付凭据 (license/兑换码; 实物单为空)
+    ]) {
         try { db.exec("ALTER TABLE agent_pay_sessions ADD COLUMN " + col); } catch (e) { /* 已存在 */ }
     }
+    // A1 商品类型: store_products 补 product_type (写路径自建, 不依赖 store-migrate 先跑; 表不存在则跳过)
+    if (hasTable(db, "store_products")) {
+        try { db.exec("ALTER TABLE store_products ADD COLUMN product_type TEXT NOT NULL DEFAULT 'physical'"); } catch (e) { /* 已存在 */ }
+    }
 }
 
 function hasTable(db, name) {
@@ -139,13 +150,14 @@ const RATE_CACHE_MS = 60 * 1000;        // U7: 费率网关查询 60s 内存缓
 function makeCommissionRateResolver(db, fetcher) {
     const cache = new Map(); // sub_mchid → {bp, expiresAt}
     const fetchFn = fetcher || globalThis.fetch;
-    return async function resolveRateBp() {
+    return async function resolveRateBp(subMchidArg) {
         // ① env 显式覆盖 (最高优先, 不调网关不读表)
         if (process.env.SP_COMMISSION_BP !== undefined && process.env.SP_COMMISSION_BP !== "") {
             const v = Number(process.env.SP_COMMISSION_BP);
             return Number.isInteger(v) && v >= 0 ? v : 0;
         }
-        const subMchid = String(process.env.WXPAY_SUB_MCHID || "");
+        // Lane C (2026-10-03): 按传入的商户号解析; 未传才回落全局 env (多商户)
+        const subMchid = String(subMchidArg || process.env.WXPAY_SUB_MCHID || "");
         if (!subMchid) return 0; // 直连模式不标记
         const hit = cache.get(subMchid);
         if (hit && Date.now() < hit.expiresAt) return hit.bp;
@@ -176,12 +188,48 @@ function makeCommissionRateResolver(db, fetcher) {
     };
 }
 
+/** Lane C (2026-10-03): 按「商品卖家地址」解析特约商户号 —— 多商户的核心
+ *  数据源: sp_sub_merchants.seller_address → sub_mchid (进件时写入, 网关与商家机各一份)
+ *  兜底: 全局 env WXPAY_SUB_MCHID (单商户旧部署) —— **必须显式告警**, 不静默错分
+ *  返回 { subMchid, source: registry | env-fallback | none } */
+function makeSubMchidResolver(db) {
+    const cache = new Map(); // seller_address → {subMchid, source}
+    return function resolveSubMchid(sellerAddress) {
+        const env = String(process.env.WXPAY_SUB_MCHID || "");
+        const key = String(sellerAddress || "");
+        if (!key) return { subMchid: env, source: env ? "env-fallback-no-seller" : "none" };
+        const hit = cache.get(key);
+        if (hit) return hit;
+        let out = { subMchid: env, source: env ? "env-fallback" : "none" };
+        try {
+            if (hasTable(db, "sp_sub_merchants")) {
+                const row = db.prepare(
+                    "SELECT sub_mchid FROM sp_sub_merchants WHERE seller_address = ? AND status = 'active'"
+                ).get(key);
+                if (row && row.sub_mchid) out = { subMchid: String(row.sub_mchid), source: "registry" };
+            }
+        } catch (_) { /* 表缺失/异常 → 走兜底 */ }
+        if (out.source !== "registry") {
+            console.warn(
+                `[buyer-shop] 卖家 ${key.slice(0, 14)}… 未在 sp_sub_merchants 登记 → ` +
+                (out.subMchid
+                    ? `回退全局 WXPAY_SUB_MCHID=${out.subMchid}（多商户场景可能分错商户！）`
+                    : "无 sub_mchid（按直连模式，本单不分账）")
+            );
+        }
+        cache.set(key, out);
+        return out;
+    };
+}
+
 function createBuyerShopRouter(deps) {
     const router = express.Router();
     const { db } = deps;
     ensureBuyerTables(db);
     const rateLimit = makeRateLimiter();
     const resolveRateBp = makeCommissionRateResolver(db, deps.fetcher);
+    // Lane C: 按商品卖家解析 sub_mchid (多商户); 表缺失时回落 env 并告警
+    const resolveSubMchid = makeSubMchidResolver(db);
 
     const MODE = process.env.AGENT_PAY_MODE || "mock"; // mock | wechat (同 agent-pay 口径)
     // 测试可注入假 wxNativeOrder; 生产默认 agent-pay 真实现 (SP 模式其内部自动切换)
@@ -210,6 +258,8 @@ function createBuyerShopRouter(deps) {
             price: fenToYuan(unitFenOf(row)),
             image_url: productCols.includes("image_url") ? String(row.image_url || "") : "",
             stock: Number(row.stock) || 0,
+            // A1: 商品类型 (physical=实物要收货地址 / virtual=虚拟免地址发凭据); 无该列的老库默认 physical
+            product_type: productCols.includes("product_type") ? String(row.product_type || "physical") : "physical",
         };
     }
 
@@ -241,6 +291,9 @@ function createBuyerShopRouter(deps) {
             quantity: row.qty,
             tx_hash: txHash,
             code_url: row.psp_code_url || "",
+            // A1: 收货地址 / 交付凭据 (老订单两列为空 → 空串)
+            shipping_address: String(row.shipping_address || ""),
+            delivery_credential: String(row.delivery_credential || ""),
         };
     }
 
@@ -328,6 +381,13 @@ function createBuyerShopRouter(deps) {
             if (!(unitFen >= 1)) return err("PRICE_UNAVAILABLE", 409, "该商品暂未定价，暂不可购买");
             const totalFen = unitFen * qty;
 
+            // A1 商品类型驱动收货地址 (2026-10-05 设计方案): physical 强制收货地址, virtual 免地址生成交付凭据
+            const productType = String(product.product_type || "physical").toLowerCase() === "virtual" ? "virtual" : "physical";
+            const shippingAddress = String(b.shipping_address || "").trim().slice(0, 500);
+            if (productType === "physical" && !shippingAddress) {
+                return err("SHIPPING_ADDRESS_REQUIRED", 400, "该商品需要填写收货地址");
+            }
+
             // 幂等②: 无 client_order_no 时, 同买家同商品 5 分钟内未支付未过期单直接复用
             const now = nowSec();
             if (!clientOrderNo) {
@@ -338,23 +398,35 @@ function createBuyerShopRouter(deps) {
                 if (exist) return res.json(orderToJson(exist));
             }
 
+            // Lane C: 本单属于哪个特约商户 = 商品卖家的登记商户号 (不再是全局 env)
+            const sellerResolved = resolveSubMchid(product.seller_address);
+            const subMchid = sellerResolved.subMchid;
+
             // U7: rate>0 且 SP 模式 → 微信下单带 settle_info.profit_sharing (不带标记的订单分账被拒)
-            const rateBp = await resolveRateBp();
-            const psFlag = process.env.WXPAY_SUB_MCHID && rateBp > 0 ? 1 : 0;
+            const rateBp = await resolveRateBp(subMchid);
+            const psFlag = subMchid && rateBp > 0 ? 1 : 0;
 
             // 创建订单 (订单号 = order_ref, 对外 id)
             const orderRef = "tb-" + crypto.randomBytes(8).toString("hex");
             const clientSessionId = `buyer:${buyerCard}:${clientOrderNo || orderRef}`;
             const exp = now + SESSION_TTL_SEC;
 
+            // A1: 虚拟商品交付凭据 (license/兑换码, 与订单绑定, 格式 tb-license-{order_ref}-{random4}; 实物单为空)
+            const deliveryCredential = productType === "virtual"
+                ? `tb-license-${orderRef}-${crypto.randomBytes(2).toString("hex")}`
+                : "";
+
             // 微信 Native 下单拿 code_url (mock 模式生成伪码, 不碰真微信)
             let codeUrl = "";
             if (MODE === "mock") {
                 codeUrl = `weixin://mock-pay/${orderRef}`;
             } else {
                 try {
-                    codeUrl = await wxNativeOrder(orderRef, String(product.title || productId), totalFen, exp,
-                        psFlag ? { settleInfo: { profit_sharing: true } } : undefined);
+                    codeUrl = await wxNativeOrder(orderRef, String(product.title || productId), totalFen, exp, {
+                        subMchid,
+                        subMchidSource: sellerResolved.source,
+                        ...(psFlag ? { settleInfo: { profit_sharing: true } } : {}),
+                    });
                 } catch (e) {
                     console.error("[buyer-shop] wx order fail:", e && e.message);
                     return err("PAYMENT_UPSTREAM", 502, "支付通道暂时不可用，请稍后再试");
@@ -365,11 +437,11 @@ function createBuyerShopRouter(deps) {
             // 买家面无账号体系, 订单 id 即凭据 — 与 pwa-shop-demo 轮询模型一致)
             // U7: ps_flag 台账标注该单是否带分账标记 (运营台区分用)
             db.prepare(`INSERT INTO agent_pay_sessions
- (client_session_id, sku_id, qty, amount_total, currency, agent_addr, order_ref, pay_token_hash, status_token_hash, state, psp_code_url, callback_url, expires_at, created_at, updated_at, ps_flag)
- VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
+ (client_session_id, sku_id, qty, amount_total, currency, agent_addr, order_ref, pay_token_hash, status_token_hash, state, psp_code_url, callback_url, expires_at, created_at, updated_at, ps_flag, sub_mchid, shipping_address, delivery_credential)
+ VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
                 .run(clientSessionId, productId, qty, totalFen, "CNY", "buyer:" + buyerCard, orderRef,
                     crypto.randomBytes(32).toString("hex"), crypto.randomBytes(32).toString("hex"),
-                    "CREATED", codeUrl, "", exp, now, now, psFlag);
+                    "CREATED", codeUrl, "", exp, now, now, psFlag, subMchid, shippingAddress, deliveryCredential);
             console.log(`[buyer-shop] 下单 ${orderRef} product=${productId} qty=${qty} total=${totalFen}分 ps_flag=${psFlag}`);
             const row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(orderRef);
             res.json(orderToJson(row));

package/test-buyer-shop-ps.js

@@ -71,10 +71,10 @@ function withWechatMode(fn) {
     };
 }
 
-async function placeOrder(base, card) {
+async function placeOrder(base, card, productId = "p1") {
     const r = await fetch(base + "/api/orders", {
         method: "POST", headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ product_id: "p1", quantity: 1, buyer_card: card }),
+        body: JSON.stringify({ product_id: productId, quantity: 1, buyer_card: card, shipping_address: "addr-ps" }),
     });
     return { status: r.status, json: await r.json() };
 }
@@ -90,7 +90,7 @@ test("rate=0 (网关 404 未登记) + SP 模式 → 不带 settle_info, ps_flag=
         const { status, json } = await placeOrder(base, "card_ps1");
         assert.strictEqual(status, 200, JSON.stringify(json));
         assert.strictEqual(wxCalls.length, 1);
-        assert.strictEqual(wxCalls[0].opts, undefined, "rate=0 不传 settleInfo");
+        assert.deepStrictEqual(wxCalls[0].opts, { subMchid: "1118152327", subMchidSource: "env-fallback" }, "rate=0 不传 settleInfo");
         const row = db.prepare("SELECT ps_flag FROM agent_pay_sessions WHERE order_ref = ?").get(json.id);
         assert.strictEqual(row.ps_flag, 0, "台账 ps_flag=0");
     } finally { srv.close(); restoreEnv(env); }
@@ -110,7 +110,7 @@ test("rate=100 (env SP_COMMISSION_BP 覆盖) + SP 模式 → settle_info.profit_
         assert.strictEqual(status, 200, JSON.stringify(json));
         assert.strictEqual(gwCalls, 0, "env 覆盖时不调网关");
         assert.strictEqual(wxCalls.length, 1);
-        assert.deepStrictEqual(wxCalls[0].opts, { settleInfo: { profit_sharing: true } }, "带分账标记");
+        assert.deepStrictEqual(wxCalls[0].opts, { subMchid: "1118152327", subMchidSource: "env-fallback", settleInfo: { profit_sharing: true } }, "带分账标记");
         assert.strictEqual(db.prepare("SELECT ps_flag FROM agent_pay_sessions WHERE order_ref = ?").get(json.id).ps_flag, 1);
     } finally { srv.close(); restoreEnv(env); }
 }));
@@ -126,13 +126,13 @@ test("网关接口返回 rate_bp=100 → 带 settle_info; 60s 缓存 (第二次
         process.env.SP_GATEWAY_URL = "https://gw.example.com";
         const a = await placeOrder(base, "card_ps3a");
         assert.strictEqual(a.status, 200);
-        assert.deepStrictEqual(wxCalls[0].opts, { settleInfo: { profit_sharing: true } });
+        assert.deepStrictEqual(wxCalls[0].opts, { subMchid: "1118152327", subMchidSource: "env-fallback", settleInfo: { profit_sharing: true } });
         assert.strictEqual(gwCalls, 1);
         // 第二次下单 (不同买家卡避免幂等复用) → 命中缓存, 不再调网关
         const b = await placeOrder(base, "card_ps3b");
         assert.strictEqual(b.status, 200);
         assert.strictEqual(gwCalls, 1, "60s 缓存生效");
-        assert.deepStrictEqual(wxCalls[1].opts, { settleInfo: { profit_sharing: true } });
+        assert.deepStrictEqual(wxCalls[1].opts, { subMchid: "1118152327", subMchidSource: "env-fallback", settleInfo: { profit_sharing: true } });
         assert.strictEqual(db.prepare("SELECT COUNT(*) n FROM agent_pay_sessions WHERE ps_flag = 1").get().n, 2);
     } finally { srv.close(); restoreEnv(env); }
 }));
@@ -148,7 +148,7 @@ test("费率网关失败 → 缓存 0 防抖动, 不阻塞下单, 不带 settle_
         process.env.SP_GATEWAY_URL = "https://unreachable.example.com";
         const a = await placeOrder(base, "card_ps4a");
         assert.strictEqual(a.status, 200, "网关失败不阻塞下单");
-        assert.strictEqual(wxCalls[0].opts, undefined, "失败按 rate=0 不带标记");
+        assert.deepStrictEqual(wxCalls[0].opts, { subMchid: "1118152327", subMchidSource: "env-fallback" }, "失败按 rate=0 不带标记");
         const b = await placeOrder(base, "card_ps4b");
         assert.strictEqual(b.status, 200);
         assert.strictEqual(gwCalls, 1, "失败也缓存 60s (防抖动)");
@@ -167,12 +167,15 @@ test("本地 sp_commission_rates 兜底 (网关未配置, 同库直读) + 直连
         process.env.WXPAY_SUB_MCHID = "1118152327";
         const a = await placeOrder(base, "card_ps5a");
         assert.strictEqual(a.status, 200);
-        assert.deepStrictEqual(wxCalls[0].opts, { settleInfo: { profit_sharing: true } }, "本地表 rate=150 → 带标记");
+        assert.deepStrictEqual(wxCalls[0].opts, { subMchid: "1118152327", subMchidSource: "env-fallback", settleInfo: { profit_sharing: true } }, "本地表 rate=150 → 带标记");
         // 直连模式: 即便有费率也不标记 (settle_info 是 SP 分账语义)
+        // Lane C: sub_mchid 解析按卖家地址缓存 — 换另一个卖家的商品, 避免命中上一单的 env-fallback 缓存
         delete process.env.WXPAY_SUB_MCHID;
-        const b = await placeOrder(base, "card_ps5b");
+        db.prepare(`INSERT INTO store_products (id, seller_address, title, description, price_utct, stock, status, image_url, created_at, updated_at)
+ VALUES ('p2','tct1sellerDirect','U7直连商品','',2500000,10,'active',NULL,?,?)`).run(NOW_MS, NOW_MS);
+        const b = await placeOrder(base, "card_ps5b", "p2");
         assert.strictEqual(b.status, 200);
-        assert.strictEqual(wxCalls[1].opts, undefined, "直连模式不带 settle_info");
+        assert.deepStrictEqual(wxCalls[1].opts, { subMchid: "", subMchidSource: "none" }, "直连模式不带 settle_info");
         assert.strictEqual(db.prepare("SELECT ps_flag FROM agent_pay_sessions WHERE order_ref = ?").get(b.json.id).ps_flag, 0);
     } finally { srv.close(); restoreEnv(env); }
 }));

package/test-buyer-shop.js

@@ -87,12 +87,13 @@ test("GET /api/products: 只在架商品 + 契约字段 + utct 折元 (整数分
         assert.ok(Array.isArray(list), "契约: 裸数组");
         assert.strictEqual(list.length, 3, "draft 被过滤 (active 3 个)");
         const p = list.find((x) => x.id === "p-active-1");
-        assert.deepStrictEqual(Object.keys(p).sort(), ["description", "id", "image_url", "name", "price", "stock"], "契约字段一字不差");
+        assert.deepStrictEqual(Object.keys(p).sort(), ["description", "id", "image_url", "name", "price", "product_type", "stock"], "契约字段一字不差");
         assert.strictEqual(p.name, "测试商品A");
         assert.strictEqual(p.description, "好用");
         assert.strictEqual(p.price, 2.5, "2_500_000 utct / 1e6 = 2.5 元");
         assert.strictEqual(p.image_url, "https://img.example.com/a.jpg");
         assert.strictEqual(p.stock, 10);
+        assert.strictEqual(p.product_type, "physical", "A1: 无 product_type 列的老库默认 physical");
         const noImg = list.find((x) => x.id === "p-nostock");
         assert.strictEqual(noImg.image_url, "", "无图给空字符串");
         assert.strictEqual(noImg.price, 1);
@@ -125,7 +126,7 @@ test("POST /api/orders: 正常下单 (mock code_url) + 价格以 DB 为权威 (
     try {
         const r = await fetch(base + "/api/orders", {
             method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ product_id: "p-active-1", quantity: 2, buyer_card: "card_test001", amount: 0.01, price: 0 }), // 乱传金额无效
+            body: JSON.stringify({ product_id: "p-active-1", quantity: 2, buyer_card: "card_test001", shipping_address: "上海市浦东新区测试路1号", amount: 0.01, price: 0 }), // 乱传金额无效
         });
         const j = await r.json();
         assert.strictEqual(r.status, 200, JSON.stringify(j));
@@ -182,20 +183,20 @@ test("POST /api/orders 幂等: client_order_no 同号返原单; 无号 5 分钟
             method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body),
         }).then((r) => r.json());
         // ① client_order_no 幂等
-        const a = await post({ product_id: "p-active-1", quantity: 1, buyer_card: "card_idem1", client_order_no: "ORDER-X-1" });
-        const b = await post({ product_id: "p-active-1", quantity: 1, buyer_card: "card_idem1", client_order_no: "ORDER-X-1" });
+        const a = await post({ product_id: "p-active-1", quantity: 1, buyer_card: "card_idem1", client_order_no: "ORDER-X-1", shipping_address: "addr-1" });
+        const b = await post({ product_id: "p-active-1", quantity: 1, buyer_card: "card_idem1", client_order_no: "ORDER-X-1", shipping_address: "addr-1" });
         assert.strictEqual(b.id, a.id, "同 client_order_no 返原单");
         assert.strictEqual(db.prepare("SELECT COUNT(*) n FROM agent_pay_sessions").get().n, 1);
         // 不同 client_order_no → 新单
-        const c = await post({ product_id: "p-active-1", quantity: 1, buyer_card: "card_idem1", client_order_no: "ORDER-X-2" });
+        const c = await post({ product_id: "p-active-1", quantity: 1, buyer_card: "card_idem1", client_order_no: "ORDER-X-2", shipping_address: "addr-1" });
         assert.notStrictEqual(c.id, a.id);
         // ② 无号窗口复用 (同买家同商品)
-        const d = await post({ product_id: "p-active-1", quantity: 3, buyer_card: "card_idem2" });
-        const e = await post({ product_id: "p-active-1", quantity: 1, buyer_card: "card_idem2" });
+        const d = await post({ product_id: "p-active-1", quantity: 3, buyer_card: "card_idem2", shipping_address: "addr-2" });
+        const e = await post({ product_id: "p-active-1", quantity: 1, buyer_card: "card_idem2", shipping_address: "addr-2" });
         assert.strictEqual(e.id, d.id, "5 分钟窗口内复用未支付单");
         assert.strictEqual(e.amount, 7.5, "复用的是原单金额 (qty=3)");
         // 不同买家不复用
-        const f = await post({ product_id: "p-active-1", quantity: 1, buyer_card: "card_idem3" });
+        const f = await post({ product_id: "p-active-1", quantity: 1, buyer_card: "card_idem3", shipping_address: "addr-3" });
         assert.notStrictEqual(f.id, d.id);
     } finally { srv.close(); }
 });
@@ -205,7 +206,7 @@ test("POST /api/orders 限流: IP 维度 10 单/分钟, 第 11 单 429", async (
     try {
         const post = (card) => fetch(base + "/api/orders", {
             method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ product_id: "p-active-1", quantity: 1, buyer_card: card }),
+            body: JSON.stringify({ product_id: "p-active-1", quantity: 1, buyer_card: card, shipping_address: "addr-rl" }),
         });
         for (let i = 0; i < 10; i++) {
             const r = await post("card_rl_" + i); // 不同买家卡 → 每单独立 (不触发幂等)
@@ -226,12 +227,12 @@ test("GET /api/orders/:id: 状态映射 pending/paid/completed/failed + 404", as
     try {
         const cr = await fetch(base + "/api/orders", {
             method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ product_id: "p-active-1", quantity: 2, buyer_card: "card_st1" }),
+            body: JSON.stringify({ product_id: "p-active-1", quantity: 2, buyer_card: "card_st1", shipping_address: "addr-st1" }),
         });
         const { id } = await cr.json();
         const get = () => fetch(base + "/api/orders/" + id).then((r) => r.json());
         let o = await get();
-        assert.deepStrictEqual(Object.keys(o).sort(), ["amount", "code_url", "id", "product_id", "product_name", "quantity", "status", "tx_hash"] /* 0.5.2 补 product_id (Pi 复核 P2) */, "契约字段一字不差");
+        assert.deepStrictEqual(Object.keys(o).sort(), ["amount", "code_url", "delivery_credential", "id", "product_id", "product_name", "quantity", "shipping_address", "status", "tx_hash"] /* 0.5.2 补 product_id (Pi 复核 P2); A1 补 shipping_address/delivery_credential */, "契约字段一字不差");
         assert.strictEqual(o.status, "pending", "CREATED → pending");
         assert.strictEqual(o.amount, 5);
         assert.strictEqual(o.product_name, "测试商品A", "product_name 联 store_products.title");
@@ -295,7 +296,7 @@ test("wechat 模式: wxNativeOrder 注入捕获参数 (out_trade_no/金额分/
     try {
         const r = await fetch(base + "/api/orders", {
             method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ product_id: "p-active-1", quantity: 2, buyer_card: "card_wx1" }),
+            body: JSON.stringify({ product_id: "p-active-1", quantity: 2, buyer_card: "card_wx1", shipping_address: "addr-wx1" }),
         });
         const j = await r.json();
         assert.strictEqual(r.status, 200, JSON.stringify(j));
@@ -319,7 +320,7 @@ test("wechat 模式: 微信下单失败 → 502, 不落单", async () => {
     try {
         const r = await fetch(base + "/api/orders", {
             method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ product_id: "p-active-1", quantity: 1, buyer_card: "card_wx2" }),
+            body: JSON.stringify({ product_id: "p-active-1", quantity: 1, buyer_card: "card_wx2", shipping_address: "addr-wx2" }),
         });
         assert.strictEqual(r.status, 502);
         const j = await r.json();

package/test-laneC.js

@@ -0,0 +1,85 @@
+/**
+ * Lane C 多商户路由 单测 (2026-10-03 kimi)
+ * 验证: ① 按商品卖家解析 sub_mchid  ② 兜底回退 env 且有告警语义  ③ 费率按商户号解析
+ * 跑法: node test-laneC.js
+ */
+const sqlite3 = require("better-sqlite3");
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = path.join(os.tmpdir(), "lanec-test-" + Date.now() + ".db");
+const db = new sqlite3(tmp);
+
+// 造最小 schema (与线上同结构)
+db.exec(`
+CREATE TABLE IF NOT EXISTS sp_sub_merchants (sub_mchid TEXT, seller_address TEXT, shop_name TEXT, webhook_url TEXT, status TEXT, created_at INTEGER);
+CREATE TABLE IF NOT EXISTS sp_commission_rates (sub_mchid TEXT, rate_bp INTEGER);
+CREATE TABLE IF NOT EXISTS store_products (id TEXT, seller_address TEXT, title TEXT, price_utct INTEGER, stock INTEGER, status TEXT);
+`);
+db.prepare("INSERT INTO sp_sub_merchants VALUES (?,?,?,?,?,?)").run("1118152327", "tct1v75dSellerA", "港思恒", "", "active", 1);
+db.prepare("INSERT INTO sp_sub_merchants VALUES (?,?,?,?,?,?)").run("1900000109", "tct1v75dSellerB", "第二商户", "", "active", 1);
+db.prepare("INSERT INTO sp_commission_rates VALUES (?,?)").run("1900000109", 100); // 第二商户 1%
+
+process.env.WXPAY_SUB_MCHID = "1118152327"; // 全局默认(单商户旧部署)
+delete process.env.SP_COMMISSION_BP;        // 走解析路径
+
+// 载入被测函数 (从 buyer-shop.js 里抠出来, 避免 require 整个应用)
+const src = fs.readFileSync(path.join(__dirname, "routes", "buyer-shop.js"), "utf8");
+function extract(name) {
+    const i = src.indexOf("function " + name);
+    if (i < 0) throw new Error("找不到函数 " + name);
+    // 找到函数体结束
+    let depth = 0, started = false, j = i;
+    for (; j < src.length; j++) {
+        if (src[j] === "{") { depth++; started = true; }
+        else if (src[j] === "}") { depth--; if (started && depth === 0) { j++; break; } }
+    }
+    return src.slice(i, j);
+}
+global.hasTable = eval("(" + extract("hasTable") + ")");
+const makeSubMchidResolver = eval("(" + extract("makeSubMchidResolver") + ")");
+const RATE_CACHE_MS = 60 * 1000; // 与 buyer-shop.js 同值
+const makeCommissionRateResolver = eval("(" + extract("makeCommissionRateResolver") + ")");
+
+const resolveSubMchid = makeSubMchidResolver(db);
+const resolveRateBp = makeCommissionRateResolver(db, null);
+
+let pass = 0, fail = 0;
+function check(name, got, want) {
+    const okv = JSON.stringify(got) === JSON.stringify(want);
+    console.log((okv ? "  ✔ " : "  ✘ ") + name + (okv ? "" : `  got=${JSON.stringify(got)} want=${JSON.stringify(want)}`));
+    okv ? pass++ : fail++;
+}
+
+console.log("Lane C 多商户路由单测:");
+
+// ① 已登记商户 → 走登记表
+check("港思恒(1118152327) 解析", resolveSubMchid("tct1v75dSellerA").subMchid, "1118152327");
+check("第二商户(1900000109) 解析", resolveSubMchid("tct1v75dSellerB").subMchid, "1900000109");
+check("第二商户 source=registry", resolveSubMchid("tct1v75dSellerB").source, "registry");
+
+// ② 未登记卖家 → 回落 env + source 标记(不静默)
+const r3 = resolveSubMchid("tct1unknown");
+check("未登记卖家回落 env", r3.subMchid, "1118152327");
+check("未登记卖家 source=env-fallback", r3.source, "env-fallback");
+
+// ③ 无卖家地址 → 也不静默
+check("无 seller 回落 env", resolveSubMchid("").source, "env-fallback-no-seller");
+
+// ④ 费率按传入商户号解析 (第二商户 1% = 100bp; 全局默认未登记 → 0)
+resolveRateBp.cache = null;
+(async () => {
+    const bp2 = await resolveRateBp("1900000109");
+    check("费率按第二商户解析 (1%=100bp)", bp2, 100);
+    const bp1 = await resolveRateBp("1118152327");
+    check("费率按港思恒解析 (未登记→0)", bp1, 0);
+    // 不传参 → 回落 env 商户号
+    const bp0 = await resolveRateBp();
+    check("费率不传参回落 env", bp0, 0);
+
+    console.log(`\n结果: ${pass} 通过, ${fail} 失败`);
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    process.exit(fail ? 1 : 0);
+})();

package/test-product-type.js

@@ -0,0 +1,173 @@
+"use strict";
+/**
+ * test-product-type.js — A1 商品类型驱动收货地址 离线单测 (2026-10-05 设计方案)
+ * node --test test-product-type.js
+ *
+ * 照 test-buyer-shop.js 模式: :memory: 库起 mock server, AGENT_PAY_MODE=mock 不碰真微信/真链。
+ * 覆盖设计方案 4 条验收:
+ *   1. physical 商品下单必须提供 shipping_address, 缺失 400 (SHIPPING_ADDRESS_REQUIRED)
+ *   2. virtual 商品下单不要地址, 返回 delivery_credential (tb-license-{order_ref}-{random4})
+ *   3. 向后兼容: 无 product_type 列的商品默认 physical, 要求地址
+ *   4. 老订单 (新列为空) 查询正常, 返回空串
+ */
+const test = require("node:test");
+const assert = require("node:assert");
+const express = require("express");
+const Database = require("better-sqlite3");
+
+process.env.AGENT_PAY_MODE = "mock";
+
+const buyerShop = require("./routes/buyer-shop");
+
+const NOW_MS = Date.now();
+const ADDR = "上海市浦东新区测试路1号 张三收 13800000000";
+
+/** 新 schema: store_products 含 product_type 列 (A1 迁移后) */
+function seedProductsWithType(db) {
+    db.exec(`
+CREATE TABLE store_products (
+  id TEXT PRIMARY KEY, seller_address TEXT NOT NULL, title TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '', price_utct INTEGER NOT NULL,
+  stock INTEGER NOT NULL DEFAULT 0, status TEXT NOT NULL DEFAULT 'draft',
+  product_type TEXT NOT NULL DEFAULT 'physical',
+  created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL
+);
+`);
+    const ins = db.prepare(`INSERT INTO store_products (id, seller_address, title, price_utct, stock, status, product_type, created_at, updated_at)
+ VALUES (?,?,?,?,?,?,?,?,?)`);
+    ins.run("p-phys-1", "tct1seller", "实物商品", 2500000, 10, "active", "physical", NOW_MS, NOW_MS);
+    ins.run("p-virt-1", "tct1seller", "虚拟商品", 1000000, 99, "active", "virtual", NOW_MS, NOW_MS);
+}
+
+/** 老 schema: store_products 无 product_type 列 (A1 迁移前的生产库形状, 同 test-buyer-shop.js) */
+function seedProductsLegacy(db) {
+    db.exec(`
+CREATE TABLE store_products (
+  id TEXT PRIMARY KEY, seller_address TEXT NOT NULL, title TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '', price_utct INTEGER NOT NULL,
+  stock INTEGER NOT NULL DEFAULT 0, status TEXT NOT NULL DEFAULT 'draft',
+  created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL
+);
+`);
+    db.prepare(`INSERT INTO store_products (id, seller_address, title, price_utct, stock, status, created_at, updated_at)
+ VALUES (?,?,?,?,?,?,?,?)`)
+        .run("p-legacy-1", "tct1seller", "老商品", 2500000, 10, "active", NOW_MS, NOW_MS);
+}
+
+async function startServer(seed) {
+    const db = new Database(":memory:");
+    seed(db);
+    const app = express();
+    app.use(express.json());
+    app.use("/api", buyerShop.createBuyerShopRouter({ db }));
+    const srv = app.listen(0);
+    await new Promise((r) => srv.once("listening", r));
+    return { db, srv, base: `http://127.0.0.1:${srv.address().port}` };
+}
+
+function post(base, body) {
+    return fetch(base + "/api/orders", {
+        method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body),
+    });
+}
+
+test("① physical 商品: 缺 shipping_address → 400 SHIPPING_ADDRESS_REQUIRED; 提供后下单成功且落库/返回地址", async () => {
+    const { db, srv, base } = await startServer(seedProductsWithType);
+    try {
+        // 缺地址 → 400
+        let r = await post(base, { product_id: "p-phys-1", quantity: 1, buyer_card: "card_pt1" });
+        assert.strictEqual(r.status, 400);
+        let j = await r.json();
+        assert.strictEqual(j.error, "SHIPPING_ADDRESS_REQUIRED");
+        assert.ok(j.message, "{error, message} 结构");
+        // 空白地址也视为缺失
+        r = await post(base, { product_id: "p-phys-1", quantity: 1, buyer_card: "card_pt1", shipping_address: "   " });
+        assert.strictEqual(r.status, 400);
+        assert.strictEqual(db.prepare("SELECT COUNT(*) n FROM agent_pay_sessions").get().n, 0, "校验失败不落单");
+        // 提供地址 → 200, 地址落库且随单返回
+        r = await post(base, { product_id: "p-phys-1", quantity: 1, buyer_card: "card_pt1", shipping_address: ADDR });
+        j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.match(j.id, /^tb-[0-9a-f]{16}$/);
+        assert.strictEqual(j.shipping_address, ADDR);
+        assert.strictEqual(j.delivery_credential, "", "实物单无交付凭据");
+        const row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(j.id);
+        assert.strictEqual(row.shipping_address, ADDR, "地址落 agent_pay_sessions");
+        assert.strictEqual(row.delivery_credential, "");
+        // 查单也带地址
+        const o = await (await fetch(base + "/api/orders/" + j.id)).json();
+        assert.strictEqual(o.shipping_address, ADDR);
+    } finally { srv.close(); }
+});
+
+test("② virtual 商品: 不要地址, 返回 delivery_credential (license 格式), 幂等重放凭据不变", async () => {
+    const { db, srv, base } = await startServer(seedProductsWithType);
+    try {
+        let r = await post(base, { product_id: "p-virt-1", quantity: 1, buyer_card: "card_pt2", client_order_no: "V-ORDER-1" });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.match(j.delivery_credential, /^tb-license-tb-[0-9a-f]{16}-[0-9a-f]{4}$/, "license 格式 tb-license-{order_ref}-{random4}");
+        assert.ok(j.delivery_credential.includes(j.id), "凭据与订单绑定");
+        assert.strictEqual(j.shipping_address, "", "虚拟单地址为空");
+        const row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(j.id);
+        assert.strictEqual(row.delivery_credential, j.delivery_credential, "凭据落库");
+        // 幂等重放 → 同一凭据 (不重新生成)
+        r = await post(base, { product_id: "p-virt-1", quantity: 1, buyer_card: "card_pt2", client_order_no: "V-ORDER-1" });
+        const j2 = await r.json();
+        assert.strictEqual(j2.id, j.id);
+        assert.strictEqual(j2.delivery_credential, j.delivery_credential);
+        // 查单带凭据
+        const o = await (await fetch(base + "/api/orders/" + j.id)).json();
+        assert.strictEqual(o.delivery_credential, j.delivery_credential);
+        // 两个虚拟单凭据不同
+        const j3 = await (await post(base, { product_id: "p-virt-1", quantity: 1, buyer_card: "card_pt2", client_order_no: "V-ORDER-2" })).json();
+        assert.notStrictEqual(j3.delivery_credential, j.delivery_credential);
+    } finally { srv.close(); }
+});
+
+test("②b 商品面: GET /products 返回 product_type (virtual/physical 如实; 列表含类型)", async () => {
+    const { srv, base } = await startServer(seedProductsWithType);
+    try {
+        const list = await (await fetch(base + "/api/products")).json();
+        assert.strictEqual(list.find((x) => x.id === "p-phys-1").product_type, "physical");
+        assert.strictEqual(list.find((x) => x.id === "p-virt-1").product_type, "virtual");
+        const one = await (await fetch(base + "/api/products/p-virt-1")).json();
+        assert.strictEqual(one.product_type, "virtual");
+    } finally { srv.close(); }
+});
+
+test("③ 向后兼容: 无 product_type 列的老商品默认 physical, 下单要求地址", async () => {
+    const { srv, base } = await startServer(seedProductsLegacy);
+    try {
+        // 商品面默认 physical
+        const p = await (await fetch(base + "/api/products/p-legacy-1")).json();
+        assert.strictEqual(p.product_type, "physical", "无该列 → 默认 physical");
+        // 缺地址 → 400
+        let r = await post(base, { product_id: "p-legacy-1", quantity: 1, buyer_card: "card_pt3" });
+        assert.strictEqual(r.status, 400);
+        assert.strictEqual((await r.json()).error, "SHIPPING_ADDRESS_REQUIRED");
+        // 带地址 → 200
+        r = await post(base, { product_id: "p-legacy-1", quantity: 1, buyer_card: "card_pt3", shipping_address: ADDR });
+        assert.strictEqual(r.status, 200, JSON.stringify(await r.json()));
+    } finally { srv.close(); }
+});
+
+test("④ 老订单 (新列为空) 查询正常, shipping_address / delivery_credential 返回空串", async () => {
+    const { db, srv, base } = await startServer(seedProductsWithType);
+    try {
+        // 直插一行"迁移前形状"的老订单 (不指定新列 → DEFAULT '')
+        const now = Math.floor(Date.now() / 1000);
+        db.prepare(`INSERT INTO agent_pay_sessions
+ (client_session_id, sku_id, qty, amount_total, currency, agent_addr, order_ref, pay_token_hash, status_token_hash, state, psp_code_url, callback_url, expires_at, created_at, updated_at, ps_flag, sub_mchid)
+ VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
+            .run("buyer:card_old:tb-00000000000000ff", "p-phys-1", 1, 250, "CNY", "buyer:card_old", "tb-00000000000000ff",
+                "x".repeat(64), "y".repeat(64), "PAID", "", "", now + 900, now, now, 0, "");
+        const r = await fetch(base + "/api/orders/tb-00000000000000ff");
+        assert.strictEqual(r.status, 200);
+        const o = await r.json();
+        assert.strictEqual(o.shipping_address, "", "老订单地址空串");
+        assert.strictEqual(o.delivery_credential, "", "老订单凭据空串");
+        assert.strictEqual(o.status, "paid", "状态机不受影响");
+        assert.strictEqual(o.amount, 2.5);
+    } finally { srv.close(); }
+});