trustbase-seller-backend 0.7.3 → 0.7.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/run-unified.js

@@ -923,7 +923,13 @@ async function startUnifiedServer() {
     }));
     console.log(`   ✅ Chain RPC/LCD proxy mounted: /rpc -> ${CHAIN_RPC_PROXY_TARGET}, /lcd -> ${CHAIN_LCD_PROXY_TARGET}`);
     // 7.5 静态文件托管（PRD-E §5.1）
-    const webDist = node_path_1.default.resolve(__dirname, '../../web/dist');
+    // 2026-10-17 kimi: 买家 PWA 已内嵌到包内 web/dist；优先包内路径，
+    // 包外 ../../web/dist 仅作老部署兼容，避免“文件装上了却打不开页面”。
+    const webDistCandidates = [
+        node_path_1.default.resolve(__dirname, 'web/dist'),
+        node_path_1.default.resolve(__dirname, '../../web/dist'),
+    ];
+    const webDist = webDistCandidates.find((p) => node_fs_1.default.existsSync(p)) || webDistCandidates[0];
     if (node_fs_1.default.existsSync(webDist)) {
         // index.html 不缓存 (baobei 15442): index.html 引用带 hash 的 assets, 缓存旧版会引旧 hash → 404/旧内容.
         // assets 本身 (带 content hash) 走 maxAge 长缓存.

package/web/dist/app.js

@@ -0,0 +1,398 @@
+/**
+ * pwa-shop-demo — 极简店铺 PWA (pi 2026-09-29)
+ *
+ * 需求: prd-docs/开发文档/示例店铺-pwa-shop-demo-需求骨架-2026-09-29.md
+ * 红线: 买家 UI 零链上术语 (不说链上/助记词/gas/钱包/区块)
+ * 技术: 纯静态 vanilla JS, 无框架无构建, clone 挂静态服务器即跑
+ */
+
+const API = window.location.origin + '/api';
+const app = document.getElementById('app');
+const offlineBar = document.getElementById('offline-bar');
+
+// 2026-10-17 kimi: 不再静默白屏 — 把启动/脚本/异步错误直接显示在页面上。
+function showFatalError(where, err) {
+  const msg = err && err.message ? err.message : String(err || '未知错误');
+  app.innerHTML = `<div class="empty"><div class="empty-icon">⚠️</div><p>${esc(where)}: ${esc(msg)}</p></div>`;
+}
+window.addEventListener('error', (e) => showFatalError('脚本错误', e.error || e.message));
+window.addEventListener('unhandledrejection', (e) => showFatalError('异步错误', e.reason));
+
+// ============================================================
+// 状态管理 (极简)
+// ============================================================
+let state = {
+  view: 'list',        // list | detail | pay | order
+  products: [],
+  currentProduct: null,
+  currentOrder: null,
+  payTimer: null,
+};
+
+// ============================================================
+// 安全卡 (买家身份, 本地生成, 静默)
+// ============================================================
+function getCardId() {
+  let id = localStorage.getItem('tb_card_id');
+  if (!id) {
+    id = 'card_' + crypto.randomUUID().replace(/-/g, '').slice(0, 16);
+    localStorage.setItem('tb_card_id', id);
+  }
+  return id;
+}
+
+// ============================================================
+// API 调用
+// ============================================================
+async function fetchProducts() {
+  const res = await fetch(`${API}/products`);
+  if (!res.ok) throw new Error('获取商品失败');
+  return res.json();
+}
+
+async function fetchProduct(id) {
+  const res = await fetch(`${API}/products/${id}`);
+  if (!res.ok) throw new Error('获取商品详情失败');
+  return res.json();
+}
+
+async function createOrder(productId, quantity, shippingAddress) {
+  const body = {
+    product_id: productId,
+    quantity: quantity,
+    buyer_card: getCardId(),
+  };
+  // A1: physical 商品必传收货地址; virtual 不传 (后端 buyer-shop.js:385-389)
+  if (shippingAddress) body.shipping_address = shippingAddress;
+  const res = await fetch(`${API}/orders`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  if (!res.ok) throw new Error('下单失败');
+  return res.json();
+}
+
+async function fetchOrder(orderId) {
+  const res = await fetch(`${API}/orders/${orderId}`);
+  if (!res.ok) throw new Error('获取订单失败');
+  return res.json();
+}
+
+// ============================================================
+// 视图: 商品列表
+// ============================================================
+function renderList() {
+  state.view = 'list';
+  app.innerHTML = '<div class="loading">加载中…</div>';
+  fetchProducts()
+    .then(products => {
+      state.products = products;
+      if (!products.length) {
+        app.innerHTML = '<div class="empty"><div class="empty-icon">🏪</div><p>暂无商品</p></div>';
+        return;
+      }
+      app.innerHTML = `
+        <div style="padding:16px 0;font-size:20px;font-weight:700">商品</div>
+        <div class="product-grid">
+          ${products.map(p => `
+            <div class="product-card" onclick="location.hash='#product/${p.id}'">
+              <img class="product-img" src="${p.image_url || '/placeholder.svg'}" alt="${esc(p.name)}" loading="lazy">
+              <div class="product-info">
+                <div class="product-name">${esc(p.name)}</div>
+                <div class="product-price">¥${fmt(p.price)}</div>
+                <div class="product-stock">${p.stock > 0 ? '库存 ' + p.stock : '暂时缺货'}</div>
+              </div>
+            </div>
+          `).join('')}
+        </div>
+      `;
+    })
+    .catch(() => {
+      app.innerHTML = '<div class="empty"><div class="empty-icon">📡</div><p>无法连接店铺</p></div>';
+    });
+}
+
+// ============================================================
+// 视图: 商品详情
+// ============================================================
+function renderDetail(productId) {
+  state.view = 'detail';
+  app.innerHTML = '<div class="loading">加载中…</div>';
+  fetchProduct(productId)
+    .then(p => {
+      state.currentProduct = p;
+      app.innerHTML = `
+        <div style="padding:12px 0">
+          <button class="btn btn-secondary" style="width:auto;padding:8px 16px;font-size:14px" onclick="location.hash=''">← 返回</button>
+        </div>
+        <img class="detail-img" src="${p.image_url || '/placeholder.svg'}" alt="${esc(p.name)}">
+        <div class="detail-name">${esc(p.name)}</div>
+        <div class="detail-desc">${esc(p.description || '')}</div>
+        <div class="detail-price">¥${fmt(p.price)}</div>
+        <div style="font-size:13px;color:var(--muted);margin-bottom:16px">
+          ${p.stock > 0 ? '库存 ' + p.stock + ' 件' : '暂时缺货'}
+        </div>
+        ${(p.product_type || 'physical') === 'physical' ? `
+        <div class="field" style="margin-bottom:16px">
+          <label style="font-size:13px;color:var(--muted)">收货地址（实物商品必填）</label>
+          <textarea id="shipping-addr" rows="2" maxlength="500" placeholder="省市区 + 详细地址 + 收件人 + 电话" style="width:100%;padding:10px;border:1px solid var(--line);border-radius:8px;font-size:14px;resize:vertical"></textarea>
+        </div>` : ''}
+        <button class="btn" ${p.stock <= 0 || p.price <= 0 ? 'disabled' : ''} onclick="handleBuy('${p.id}')">
+          ${p.stock > 0 && p.price > 0 ? '立即购买' : (p.price <= 0 ? '暂未定价' : '暂时缺货')}
+        </button>
+      `;
+    })
+    .catch(() => {
+      app.innerHTML = '<div class="empty"><div class="empty-icon">📦</div><p>商品不存在</p></div>';
+    });
+}
+
+// ============================================================
+// 视图: 支付 (扫码)
+// ============================================================
+function renderPay(order) {
+  state.view = 'pay';
+  state.currentOrder = order;
+  app.innerHTML = `
+    <div style="padding:12px 0">
+      <button class="btn btn-secondary" style="width:auto;padding:8px 16px;font-size:14px" onclick="location.hash='#product/${order.product_id}'">← 返回商品</button>
+    </div>
+    <div class="qr-container">
+      <div style="font-size:17px;font-weight:600;margin-bottom:20px">微信扫码支付</div>
+      <div class="qr-box"><canvas id="qr-canvas"></canvas></div>
+      <div class="qr-hint">¥${fmt(order.amount)} · 请使用微信扫一扫</div>
+      <div id="pay-code-url" style="font-size:11px;color:var(--muted);margin-top:8px;word-break:break-all;max-width:260px"></div>
+      <div style="margin-top:24px;font-size:13px;color:var(--muted)">
+        订单号: ${esc(order.id.slice(0, 12))}…<br>
+        <span id="pay-status">等待支付中…</span>
+      </div>
+    </div>
+  `;
+
+  // 二维码: 改由后端渲染 (2026-10-03 kimi)
+  // 原因: 包内 qrcode.min.js (kazuhiko arase qrcode-generator) 的 UMD 只处理 AMD/CommonJS,
+  //       浏览器里既没有 toCanvas, window.qrcode 也不可靠 → 支付页二维码长期空白。
+  // 后端 GET /api/qr?text=<urlencoded> 返回 SVG (只认 weixin://wxpay/ 前缀)。
+  if (order.code_url) {
+    const box = document.getElementById('qr-canvas');
+    if (box) {
+      const img = document.createElement('img');
+      img.src = '/api/qr?text=' + encodeURIComponent(order.code_url);
+      img.alt = '微信支付二维码';
+      img.width = 220;
+      img.height = 220;
+      img.style.display = 'block';
+      img.style.margin = '0 auto';
+      img.onerror = function () {
+        const d = document.createElement('div');
+        d.style.cssText = 'padding:24px;color:var(--muted);font-size:13px;word-break:break-all';
+        d.innerHTML = '二维码加载失败<br>可在微信里直接打开下面的支付链接';
+        img.replaceWith(d);
+      };
+      // 注意: #qr-canvas 是 <canvas>, 其子元素不渲染 —— 必须整体替换, 不能 append 进去
+      box.replaceWith(img);
+    }
+    // 兜底: 支付链接原文 (二维码不可用时可复制到微信打开)
+    const hint = document.getElementById('pay-code-url');
+    if (hint) hint.textContent = order.code_url;
+  }
+
+  // 轮询订单状态
+  startPayPolling(order.id);
+}
+
+function startPayPolling(orderId) {
+  stopPayPolling();
+  let pollCount = 0;
+  state.payTimer = setInterval(() => {
+    pollCount++;
+    if (pollCount > 300) { stopPayPolling(); return; }
+    fetchOrder(orderId)
+      .then(order => {
+        if (order.status === 'paid' || order.status === 'completed') {
+          stopPayPolling();
+          location.hash = `#order/${orderId}`;
+        }
+      })
+      .catch(() => {}); // 静默重试
+  }, 3000);
+}
+
+function stopPayPolling() {
+  if (state.payTimer) {
+    clearInterval(state.payTimer);
+    state.payTimer = null;
+  }
+}
+
+// ============================================================
+// 视图: 订单状态
+// ============================================================
+function renderOrder(orderId) {
+  state.view = 'order';
+  app.innerHTML = '<div class="loading">加载中…</div>';
+  fetchOrder(orderId)
+    .then(order => {
+      const statusMap = {
+        'pending': ['待支付', 'status-pending'],
+        'paid': ['已支付', 'status-paid'],
+        'shipped': ['已发货', 'status-paid'],
+        'completed': ['已完成', 'status-done'],
+      };
+      const [statusText, statusClass] = statusMap[order.status] || ['处理中', 'status-pending'];
+      app.innerHTML = `
+        <div style="padding:24px 0">
+          <span class="status-badge ${statusClass}">${statusText}</span>
+          ${order.status === 'pending' ? '<button class="btn" style="margin-top:16px" onclick="handlePay(\'' + order.id + '\')">继续支付</button>' : ''}
+          ${order.status === 'paid' || order.status === 'completed' ? '<div style="margin-top:16px;font-size:14px;color:var(--ok)">✓ 交易已存证</div>' : ''}
+        </div>
+        <div class="product-card" style="cursor:default">
+          <div class="product-info">
+            <div class="product-name">${esc(order.product_name || '商品')}</div>
+            <div class="product-price">¥${fmt(order.amount)}</div>
+            <div style="font-size:12px;color:var(--muted);margin-top:8px">
+              订单号: ${esc(order.id)}<br>
+              数量: ${order.quantity || 1}<br>
+              ${order.tx_hash ? '凭证: ' + esc(order.tx_hash.slice(0, 16)) + '…' : ''}
+            </div>
+          </div>
+        </div>
+        <button class="btn btn-secondary" style="margin-top:24px" onclick="location.hash=''">返回首页</button>
+      `;
+    })
+    .catch(() => {
+      app.innerHTML = '<div class="empty"><div class="empty-icon">📋</div><p>订单不存在</p></div>';
+    });
+}
+
+
+function loadQrLib(cb) {
+  if (window.qrcode) return cb();
+  var script = document.createElement('script');
+  script.src = '/qrcode.min.js';
+  script.onload = cb;
+  script.onerror = cb;
+  document.head.appendChild(script);
+}
+
+// kazuhiko qrcode-generator API 直绘 canvas (typeNumber 0 = 自动, 'M' 纠错)
+function drawQrToCanvas(canvas, text, size) {
+  const qr = window.qrcode(0, 'M');
+  qr.addData(text);
+  qr.make();
+  const count = qr.getModuleCount();
+  canvas.width = size;
+  canvas.height = size;
+  const ctx = canvas.getContext('2d');
+  ctx.fillStyle = '#FFFFFF';
+  ctx.fillRect(0, 0, size, size);
+  ctx.fillStyle = '#000000';
+  const quiet = 2; // 白边 (模块数)
+  const cell = size / (count + quiet);
+  for (let r = 0; r < count; r++) {
+    for (let c = 0; c < count; c++) {
+      if (qr.isDark(r, c)) {
+        ctx.fillRect(
+          Math.floor((c + quiet / 2) * cell),
+          Math.floor((r + quiet / 2) * cell),
+          Math.ceil(cell), Math.ceil(cell)
+        );
+      }
+    }
+  }
+}
+
+// ============================================================
+// 事件处理
+// ============================================================
+window.handleBuy = function(productId) {
+  // A1: physical 商品前端先拦收货地址 (后端 buyer-shop.js:387 也拦, 双重保证)
+  const p = state.currentProduct;
+  let shippingAddress = '';
+  if (p && (p.product_type || 'physical') === 'physical') {
+    const ta = document.getElementById('shipping-addr');
+    shippingAddress = ta ? ta.value.trim() : '';
+    if (!shippingAddress) {
+      alert('请填写收货地址（实物商品必需）');
+      if (ta) ta.focus();
+      return;
+    }
+  }
+  app.innerHTML = '<div class="loading">正在下单…</div>';
+  createOrder(productId, 1, shippingAddress)
+    .then(order => {
+      if (order.code_url) {
+        renderPay(order);
+      } else {
+        location.hash = `#order/${order.id}`;
+      }
+    })
+    .catch(err => {
+      app.innerHTML = `<div class="empty"><div class="empty-icon">⚠️</div><p>${esc(err.message)}</p><button class="btn btn-secondary" style="margin-top:16px" onclick="location.hash='#product/${productId}'">返回</button></div>`;
+    });
+};
+
+window.handlePay = function(orderId) {
+  app.innerHTML = '<div class="loading">正在获取支付信息…</div>';
+  fetchOrder(orderId).then(order => {
+    if (order.code_url) {
+      renderPay(order);
+    } else {
+      renderOrder(orderId);
+    }
+  });
+};
+
+// ============================================================
+// 路由 (hash-based)
+// ============================================================
+function route() {
+  // 注意: location.hash 自带 '#', slice(1) 后已无 '#', 比较时不能再带 '#'
+  // (2026-10-02 kimi 修: 原实现 startsWith('#product/') 恒为假 → 详情/下单/支付页全部不可达, 买家流程整条断在这)
+  const hash = location.hash.slice(1);
+  stopPayPolling();
+
+  if (hash.startsWith('product/')) {
+    renderDetail(hash.replace('product/', ''));
+  } else if (hash.startsWith('order/')) {
+    renderOrder(hash.replace('order/', ''));
+  } else {
+    renderList();
+  }
+}
+
+window.addEventListener('hashchange', route);
+
+// ============================================================
+// 离线检测
+// ============================================================
+window.addEventListener('online', () => { offlineBar.style.display = 'none'; });
+window.addEventListener('offline', () => { offlineBar.style.display = 'block'; });
+
+// ============================================================
+// 工具函数
+// ============================================================
+function esc(s) {
+  return String(s || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+
+function fmt(n) {
+  return Number(n || 0).toFixed(2);
+}
+
+// ============================================================
+// 启动
+// ============================================================
+getCardId(); // 确保安全卡存在
+
+// SW 注册 (安全上下文先判: https 或 localhost 才可用)
+if ('serviceWorker' in navigator) {
+  navigator.serviceWorker.register('/sw.js', { scope: '/' })
+    .then(function(reg) { console.log('[PWA] SW registered, scope:', reg.scope); })
+    .catch(function(err) { console.warn('[PWA] SW not available:', err.message); });
+} else {
+  console.warn('[PWA] ServiceWorker not supported or insecure context');
+}
+
+route();

package/web/dist/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="14" fill="#F7F3EB"/>
+  <path d="M20 24 L28 16 L36 16 L44 24 L44 48 L20 48 Z" fill="#D4753E"/>
+  <rect x="24" y="34" width="16" height="14" fill="#F7F3EB"/>
+  <rect x="26" y="20" width="4" height="8" fill="#F7F3EB" opacity="0.6"/>
+  <rect x="34" y="20" width="4" height="8" fill="#F7F3EB" opacity="0.6"/>
+</svg>

package/web/dist/index.html

@@ -0,0 +1,126 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+  <meta name="theme-color" content="#F7F3EB">
+  <link rel="manifest" href="/manifest.json">
+  <link rel="icon" href="/icon.svg" type="image/svg+xml">
+  <title>店铺</title>
+  <style>
+    :root {
+      --bg: #F7F3EB;
+      --card: #FFFFFF;
+      --ink: #1a1a2e;
+      --muted: #8a8a9a;
+      --accent: #D4753E;
+      --accent-hover: #C4682F;
+      --ok: #5B8C5A;
+      --radius: 12px;
+    }
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'PingFang SC', 'Noto Sans SC', sans-serif;
+      background: var(--bg);
+      color: var(--ink);
+      min-height: 100vh;
+      padding-bottom: env(safe-area-inset-bottom);
+    }
+    .container { max-width: 640px; margin: 0 auto; padding: 16px; }
+
+    /* 商品列表 */
+    .product-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(280px, 1fr)); gap: 16px; }
+    .product-card {
+      background: var(--card);
+      border-radius: var(--radius);
+      overflow: hidden;
+      cursor: pointer;
+      transition: transform 0.15s ease, box-shadow 0.15s ease;
+    }
+    .product-card:active { transform: scale(0.98); }
+    .product-img { width: 100%; aspect-ratio: 4/3; object-fit: cover; background: #eee; }
+    .product-info { padding: 14px; }
+    .product-name { font-size: 15px; font-weight: 600; line-height: 1.4; margin-bottom: 6px; }
+    .product-price { font-size: 18px; font-weight: 700; color: var(--accent); }
+    .product-stock { font-size: 12px; color: var(--muted); margin-top: 4px; }
+
+    /* 商品详情 */
+    .detail-img { width: 100%; aspect-ratio: 4/3; object-fit: cover; border-radius: var(--radius); }
+    .detail-name { font-size: 22px; font-weight: 700; margin: 16px 0 8px; }
+    .detail-desc { font-size: 14px; color: var(--muted); line-height: 1.6; margin-bottom: 16px; white-space: pre-wrap; }
+    .detail-price { font-size: 28px; font-weight: 700; color: var(--accent); margin-bottom: 24px; }
+
+    /* 按钮 */
+    .btn {
+      display: block;
+      width: 100%;
+      padding: 16px;
+      border: none;
+      border-radius: var(--radius);
+      background: var(--accent);
+      color: #fff;
+      font-size: 17px;
+      font-weight: 600;
+      cursor: pointer;
+      text-align: center;
+      transition: background 0.15s;
+    }
+    .btn:hover { background: var(--accent-hover); }
+    .btn:disabled { opacity: 0.5; cursor: not-allowed; }
+    .btn-secondary { background: transparent; color: var(--accent); border: 1px solid var(--accent); }
+
+    /* 支付二维码 */
+    .qr-container { text-align: center; padding: 32px 16px; }
+    .qr-box {
+      display: inline-block;
+      background: #fff;
+      padding: 24px;
+      border-radius: var(--radius);
+      box-shadow: 0 4px 24px rgba(0,0,0,0.08);
+    }
+    .qr-box canvas { display: block; }
+    .qr-hint { font-size: 14px; color: var(--muted); margin-top: 16px; }
+
+    /* 订单状态 */
+    .status-badge {
+      display: inline-block;
+      padding: 6px 16px;
+      border-radius: 20px;
+      font-size: 13px;
+      font-weight: 600;
+      margin-bottom: 16px;
+    }
+    .status-pending { background: #FFF3CD; color: #856404; }
+    .status-paid { background: #D4EDDA; color: #155724; }
+    .status-done { background: #CCE5FF; color: #004085; }
+
+    /* 空状态 */
+    .empty { text-align: center; padding: 60px 16px; color: var(--muted); }
+    .empty-icon { font-size: 48px; margin-bottom: 12px; }
+
+    /* 离线提示 */
+    .offline-bar {
+      background: #ff9800;
+      color: #fff;
+      text-align: center;
+      padding: 6px;
+      font-size: 12px;
+      display: none;
+    }
+
+    /* 加载 */
+    .loading { text-align: center; padding: 60px; color: var(--muted); }
+
+    @media (max-width: 480px) {
+      .product-grid { grid-template-columns: 1fr; }
+      .container { padding: 12px; }
+    }
+  </style>
+</head>
+<body>
+  <div class="offline-bar" id="offline-bar">⚠ 网络已断开，显示缓存内容</div>
+  <div class="container" id="app"></div>
+
+  <script type="module" src="/app.js?v=20261017a"></script>
+</body>
+</html>

package/web/dist/manifest.json

@@ -0,0 +1,13 @@
+{
+  "name": "TrustBase 示例店铺",
+  "short_name": "店铺",
+  "description": "TrustBase 极简示例店铺 — 商品·下单·扫码支付",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#F7F3EB",
+  "theme_color": "#F7F3EB",
+  "icons": [
+    { "src": "/icon.svg", "sizes": "any", "type": "image/svg+xml" }
+  ]
+}