LWLT-AI/api_inventory.md

# LTJT Business Module API Inventory

Date: 2026-07-07

## Scope
Authorized browser session for the `业务操作` module on `https://ltjt.yunzhi.run/`.

This inventory records endpoint shapes and parameter names only. It intentionally avoids storing business data rows, cookie values, passwords, CAPTCHA values, or other secrets.

## Integration Model Observed
- The app is a classic ASP/IIS back office.
- Business screens are HTML pages under `/System/Business/*.asp`.
- List data is usually loaded by jQuery XHR from `/System/dat/*.asp` with `POST` form encoding.
- Most list endpoints return `text/html; Charset=UTF-8`, not JSON.
- Common pagination keys: `Act`, `Tpage`, `P_Size`, then the page's `SearchForm.serialize()` fields.
- The UI opens modules as extra iframes/tabs inside `System/Mainlt.asp`, not as a single replaced iframe.
- A direct unauthenticated or expired call returns JavaScript such as `alert('登陆失效，请重新登陆！')`.

## Core List Endpoints

| Module | Page | List endpoint | Act | Notes |
|---|---|---|---|---|
| 产品管理 | `/System/Business/Product.asp` | `POST /System/dat/product.asp` | `PrintGridList` | Confirmed by real menu click. |
| 独立团计划表 | `/System/Business/orders.asp` | `POST /System/dat/orders.asp` | `JH_OrderList` | Confirmed by real menu click. |
| 散拼团计划表 | `/System/Business/plan.asp` | `POST /System/dat/plan.asp` | `SP_OrderList` | Confirmed by real menu click. |
| 团队安排 | `/System/Business/teams.asp` | `POST /System/dat/team.asp` | `PrintGridLists` | Confirmed by real menu click. |
| 航班控位表 | `/System/Business/tickets.asp` | `POST /System/dat/tickets.asp` | `PrintGridListh` | Confirmed from page JS; initial load also calls `AjaxPublicFun.asp?Act=Probaowei`. |
| 团队备案表 | `/System/Business/teams_beians.asp` | `POST /System/dat/team.asp` | `PrintGridListb` | Confirmed by real menu click. |
| 退货管理 | `/System/Business/teams_return.asp` | `POST /System/dat/team_return.asp` | `PrintGridLists` | Confirmed by real menu click. |
| 客服回访 | `/System/Business/kefu.asp` | `POST /System/dat/team.asp` | `PrintGridListk` | Confirmed by real menu click. |
| 酒店用房表 | `/System/Business/Hotels.asp` | `POST /System/dat/hotels.asp` | TBD | Page references confirmed; exact `Act` still needs a stable-login script capture. |

## Parameter Shapes

### 产品管理
Endpoint: `POST /System/dat/product.asp`

Observed body keys:
`Act=PrintGridList`, `Tpage`, `P_Size`, `S_fabudanwei`, `S_chanpinming`, `S_tianshu`, `S_kehu`, `S_caozuoren`, `S_zhuanxianming`, `S_zhuangtai`.

Related endpoints:
- `POST /System/dat/AjaxPublicFun.asp?Act=ProGetTableZD&tb=Product&zd=chanpinming&s_fabudanwei=...`
- `GET /System/Business/product_list.asp?ID=...`
- `GET /System/Business/product_add.asp?cp=...`
- `POST ../DAT/product.asp` and `POST ../dat/product.asp` are referenced for product actions.

### 独立团计划表
Endpoint: `POST /System/dat/orders.asp`

Observed list body keys:
`Act=JH_OrderList`, `Tpage`, `P_Size`, `riqi`, `S_chufariqi`, `S_chufarizhi`, `S_fabudanwei`, `S_tuanxuhao`, `S_kehuming`, `S_chanpinming`, `S_gendanren`, `S_youkexinxi`, `S_daoyou`, `S_lingdui`, `S_querenshu`, `S_zhuanxianming`, `S_zhuangtai`.

Other actions referenced:
- `Act=JH_OrderList_one`
- `Act=DelRecord`
- `Act=JH_Ordercopy`
- `Act=JH_set_quxiao`

Related pages:
- `/System/Business/orders_list.asp?did=...`
- `/System/Business/orders_add.asp?fabudanwei=...`
- `/System/Business/orders_adds.asp?fabudanwei=...`
- `/System/Business/cash_shou_add.asp?...`
- `/System/Business/teams_shoudaoyou.asp?tdid=...`
- `orders_excel.asp`

#### 独立团下单 / 新增订单
Full extracted field schema:
- Machine-readable JSON: [schemas/orders_add_form_schema.json](/Users/inmanx/Documents/lwltAPI/schemas/orders_add_form_schema.json)
- Human-readable summary: [schemas/orders_add_form_schema.md](/Users/inmanx/Documents/lwltAPI/schemas/orders_add_form_schema.md)

Entry point:
- The `下单` button on `/System/Business/orders.asp` has `onclick=OPEN_update(0,0,0)`.
- It opens a dialog iframe:
  `/system/Business/orders_add.asp?fabudanwei=<分公司>&copy=0&ddid=0&_=<timestamp>`
- The page title is `计划下单/修改`.

Save endpoint:
- Form id/name: `ListForm`
- Form action: `/System/DAT/orders.asp?Act=DoInfoJH`
- JavaScript submit call:
  `POST /System/DAT/orders.asp`
- Submit payload:
  `Act=DoInfoJH&` + `$("#ListForm").serialize()`
- Response type: JavaScript (`dataType: "script"`), so success/failure is probably returned as executable script/alerts rather than JSON.

Submit behavior observed:
- `SubmitInfoForm()` first checks that the total large/small passenger counts are not both zero.
- It then calls `Vidy.CheckMastInput("ListForm")` to enforce required fields and basic input filtering.
- Only after those checks does it call `$.ajax({ type: "POST", url: "/System/DAT/orders.asp", dataType: "script", data: "Act=DoInfoJH&" + $("#ListForm").serialize() })`.
- The loaded add form contained about 825 `input/select/textarea` fields, because it includes repeated itinerary, receivable, flight, restaurant, hotel, attraction, attachment, and hidden metadata rows.

Primary required fields observed on the add form:
- `chufa_ri` - 出发日期
- `zhuanxianming` - 专线名称
- `TianShu` - 行程天数
- `zutuanshe` plus hidden `zutuansheid`, `zutuanshegzr`, `bizhong` - 预订客户/customer metadata
- `chanpinming` plus hidden `baojia` - 产品名称/pricing metadata
- `gendanren` - 跟单人
- `tuanxuhao1`, `tuanxuhao2` - 团号 parts
- `darenshu`, `xiaorenshu`, `ertrenshu`, `yingrenshu`, `quanrenshu` - adult/child/infant/leader counts
- `xiaoshouren` - 销售人

Other form field groups observed:
- `lianxiren`, `keyuandi`, `xiadanbeizhu`, `yaobeian`, `danzhuangtai`
- `frenshu*` traveler-count breakdown fields
- `Text*_N` and `shuomingN` itinerary/explanation blocks
- `PicFile0`, `PicFile1` upload attachment references
- `ys_*` receivable/charge rows, including unit, item, currency, quantity, unit price, amount, payment-state metadata, remarks, operator/reviewer fields
- `ban*` flight rows, up to 4 observed row groups
- `zao*`, `zhong*`, `wan*`, `zhusu*`, `jingdian*` itinerary/service arrangement rows, up to 15 day rows and repeated attraction slots
- hidden operational fields including `ddid`, `tdid`, `quanxian`, `fabudanwei`, `caozuoren`, `ys_shenhe`, `yingfu_jing`, `yingfu_can`, `zhusuanpai`, `daoyoujiesuan`, `youyingshoukuan`, `session_id`

Lookup/support endpoints loaded by the add page:
- `POST /system/dat/AjaxPublicFun.asp?Act=GetInformation&fl=1&fabudanwei=...`
- `POST /system/dat/AjaxPublicFun.asp?Act=ProTravel&fabudanwei=...`
- `POST /system/dat/AjaxPublicFun.asp?Act=GetSFXiangMu&sf=0`
- `POST /system/dat/AjaxPublicFun.asp?Act=Probaowei&fabudanwei=...`
- `POST /system/dat/AjaxPublicFun.asp?Act=GetProucttextes&fabudanwei=...`
- `POST /system/dat/AjaxPublicFun.asp?Act=ProDanweiZCxm&leibie=3&fabudanwei=...`
- `POST /system/dat/AjaxPublicFun.asp?Act=ProDanweiZCxm&leibie=4&fabudanwei=...`
- `POST /system/dat/AjaxPublicFun.asp?Act=ProDanweiZCxm&leibie=1&fabudanwei=...`
- `POST /system/dat/AjaxPublicFun.asp?Act=GetInformation&fl=3&fls=1&fabudanwei=...`
- `POST /system/dat/AjaxPublicFun.asp?Act=ProGetProductname&fls=1&fabudanwei=...`
- `POST ../dat/AjaxPublicFun.asp?Act=Find_danweixinxi&...`
- `POST ../DAT/AjaxPublicFun.asp?Act=Find_qiankuan&...`
- `POST ../dat/AjaxPublicFun.asp?Act=GetProduct&cpm=...`

Attachment helper pages:
- `/Inc/UpLoadImg.asp?InputID=PicFile0&Exe=jpg|jpeg|bmp|png|gif|tif|doc|xls|xlsx|docx|pdf&oldval=...`
- `/Inc/UpLoadImg.asp?InputID=PicFile1&Exe=jpg|jpeg|bmp|png|gif|tif|doc|xls|xlsx|docx|pdf&oldval=...`

Feasibility note:
- The down-order operation is technically addressable through `Act=DoInfoJH`, but it is a large browser-form contract rather than a small API call.
- Building a reliable adapter requires reproducing the page's client-side construction of `ListForm`: lookup fills, hidden IDs, currency/unit metadata, itinerary rows, receivable rows, uploaded attachment references, and validation.
- It should be developed first as a dry-run serializer that opens `orders_add.asp`, fills fields in a controlled browser/page context, serializes `ListForm`, and compares the payload without pressing submit.
- Actual `Act=DoInfoJH` submission should wait for explicit owner approval and a test/sandbox order or rollback policy.

### 散拼团计划表
Endpoint: `POST /System/dat/plan.asp`

Observed list body keys:
`Act=SP_OrderList`, `Tpage`, `P_Size`, `riqi`, `S_chufariqi`, `S_chufarizhi`, `S_fabudanwei`, `S_tuanxuhao`, `S_kehuming`, `S_chanpinming`, `S_gendanren`, `S_youkexinxi`, `S_daoyou`, `S_querenshu`, `S_zhuanxianming`, `S_zhuangtai`.

Other actions referenced:
- `Act=SP_OrderList_one`
- `Act=SP_Plancopy`
- `Act=DelRecord`
- `Act=JH_set_quxiao`

Related pages:
- `/System/Business/plan_List.asp?tid=...`
- `/System/Business/plan_order.asp?tdid=...`
- `/System/Business/plan_add.asp?fabudanwei=...`
- `/System/Business/plan_update.asp?tid=...`

### 团队安排
Endpoint: `POST /System/dat/team.asp`

Observed body keys:
`Act=PrintGridLists`, `Tpage`, `P_Size`, `riqi`, `S_chufariqi`, `S_chufarizhi`, `S_fabudanwei`, `S_chanpinming`, `S_fatuanren`, `S_daoyou`, `S_kehu`, `S_jiudian`, `S_chedui`, `S_tuanxuhao`, `S_Guide`, `S_Car`, `S_Hotel`, `S_Train`, `S_Other`, `S_youke`, `S_tuanbao`, `S_zhuanxianming`, `S_zhuanxianlei`, `S_zhuangtai`.

Related pages:
- `/System/Business/plan_List.asp?tid=...`
- `/System/Business/orders_list.asp?tid=...`
- `/System/Business/teams_daoyou.asp?tdid=...`
- `/System/Business/teams_cheliang.asp?tdid=...`
- `/System/Business/teams_jiudian.asp?tdid=...`
- `/System/Business/teams_piao.asp?tdid=...`
- `/System/Business/teams_qita.asp?tdid=...`
- `teams_excel.asp`

### 航班控位表
Endpoint: `POST /System/dat/tickets.asp`

Observed list body keys:
`Act=PrintGridListh`, `Tpage`, `P_Size`, `S_chufariqi`, `S_chufarizhi`, `S_fabudanwei`, `S_picihao`, `S_kehu`, `S_danweiid`, `S_danwei`, `S_zhuanxianlei`.

Related endpoints/pages:
- `POST /System/dat/AjaxPublicFun.asp?Act=Probaowei&fabudanwei=...`
- `/System/Business/tickets_add.asp?...`
- `/System/Business/tickets_one.asp?hangbanhao=...`
- `tickets_excel.asp`

### 团队备案表
Endpoint: `POST /System/dat/team.asp`

Observed body keys:
`Act=PrintGridListb`, `Tpage`, `P_Size`, `riqi`, `S_chufariqi`, `S_chufarizhi`, `S_fabudanwei`, `S_chanpinming`, `S_jidiaoren`, `S_daoyou`, `S_kehu`, `S_beianhao`, `S_tuanxuhao`, `S_Other`, `S_youke`, `S_zhuanxianming`, `S_zhuanxianlei`, `S_zhuangtai`.

Related page:
- `/System/Business/teams_qita.asp?tdid=...`

### 退货管理
Endpoint: `POST /System/dat/team_return.asp`

Observed body keys:
`Act=PrintGridLists`, `Tpage`, `P_Size`, `riqilei`, `S_chufariqi`, `S_chufarizhi`, `S_fabudanwei`, `S_tuanxuhao`, `S_chanpinming`, `S_gouwudian`, `S_daoyou`, `S_kehu`, `S_youke`, `S_fatuanren`, `S_zhuanxianming`, `S_zhuangtai`.

Related pages:
- `/System/Business/teams_return_add.asp?fabudanwei=...`
- `teams_return_excel.asp`

### 客服回访
Endpoint: `POST /System/dat/team.asp`

Observed body keys:
`Act=PrintGridListk`, `Tpage`, `P_Size`, `riqi`, `S_chufariqi`, `S_chufarizhi`, `S_fabudanwei`, `S_tuanxuhao`, `S_chanpinming`, `S_fatuanren`, `S_daoyou`, `S_zhuanxianlei`, `S_zhuanxianming`, `S_zhuangtai`.

Related actions/pages:
- `/System/Business/kefu_add.asp?tdid=...`
- `Act=del_kefu` on `POST /System/DAT/team.asp`

## Permission or Session-Sensitive Pages

The following business-menu items showed permission alerts, empty frames, or session invalidation during capture and should be rechecked after a fresh login if they are needed:
- `/System/Business/Cash_fu.asp` - 我的付款单
- `/System/Business/Cash_shou.asp` - 我的收款单
- `/System/Business/Cash_zhi.asp` - 我的费用报销单
- `/System/Business/Invoice.asp` - 我的发票申请
- `/System/Business/Bill_out.asp` - 我发放的签单
- `/System/Business/Arrears.asp` - 我的客户欠款

## Practical Feasibility

Direct integration appears feasible, but not as a clean public API. The practical path is to build an adapter that:
- Logs in through an approved account/session strategy.
- Replays the same `application/x-www-form-urlencoded` XHR calls used by each page.
- Parses HTML fragments, not JSON.
- Handles session expiry scripts and permission-alert scripts as first-class errors.
- Keeps writes disabled until each write endpoint is separately reviewed and authorized.

Runtime must not depend on AI/LLM decisions. AI is only acceptable for discovery and mapping drafts. The production adapter should be deterministic: standard data object -> explicit field mapping -> lookup resolution -> dry-run serialization -> validated submit.

See [adapter_design.md](/Users/inmanx/Documents/lwltAPI/adapter_design.md) for the recommended non-AI runtime architecture.

Open items before production:
- Confirm stable login/session renewal with the system owner.
- Capture response-body structure for successful list calls after a fresh login.
- Confirm whether dat endpoints require a page-opened iframe context, Referer, or additional cookies.
- Define allowed read/write operations for the integration account.