fix(courier): parse XFX form-urlencoded track callbacks and raw ACK

Enable urlencoded body parser, return XFX {code,message} without API envelope, and harden callback payload parsing.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/callbacks/delivery-callback.service.ts

@@ -47,12 +47,14 @@ export class DeliveryCallbackService {
 
     const payload = this.xiaofeixiaProvider.parseTrackCallback(body);
     if (!payload) {
+      const response = this.courier.buildTrackCallbackResponse(false);
       await logCourierCall(this.prisma, {
         ...baseLog,
+        responseBody: response,
         status: 'FAILED',
         errorMessage: '回调体解析失败',
       });
-      return this.courier.buildTrackCallbackResponse(false);
+      return response;
     }
 
     const order = payload.outNumber
@@ -64,13 +66,15 @@ export class DeliveryCallbackService {
         : null;
 
     if (!order) {
+      const response = this.courier.buildTrackCallbackResponse(false);
       await logCourierCall(this.prisma, {
         ...baseLog,
+        responseBody: response,
         status: 'FAILED',
         errorMessage: '订单不存在',
         externalNo: payload.outNumber || payload.trackingNumber,
       });
-      return this.courier.buildTrackCallbackResponse(false);
+      return response;
     }
 
     const targetStatus = this.xiaofeixiaProvider.mapTrackStatus(

server/dukang-api/src/callbacks/delivery-track.controller.ts

@@ -1,4 +1,5 @@
-import { Body, Controller, Param, Post } from '@nestjs/common';
+import { Body, Controller, Param, Post, Res } from '@nestjs/common';
+import type { Response } from 'express';
 import { DeliveryCallbackService } from './delivery-callback.service';
 
 @Controller('callbacks')
@@ -7,21 +8,28 @@ export class DeliveryCallbackController {
 
   /** 小飞侠/物流路由变化回调（适配器入口） */
   @Post('courier/:provider/track')
-  trackByProvider(@Param('provider') provider: string, @Body() body: unknown) {
-    return this.deliveryCallbackService.handleTrackCallback(
+  async trackByProvider(
+    @Param('provider') provider: string,
+    @Body() body: unknown,
+    @Res() res: Response,
+  ) {
+    const result = await this.deliveryCallbackService.handleTrackCallback(
       provider,
       body,
       `/api/v1/callbacks/courier/${provider}/track`,
     );
+    // 直出承运商约定结构，避免被全局 { code:0, data } 包装
+    return res.status(200).json(result);
   }
 
   /** 兼容旧路径，默认按小飞侠解析 */
   @Post('delivery/track')
-  trackLegacy(@Body() body: unknown) {
-    return this.deliveryCallbackService.handleTrackCallback(
+  async trackLegacy(@Body() body: unknown, @Res() res: Response) {
+    const result = await this.deliveryCallbackService.handleTrackCallback(
       'xfx',
       body,
       '/api/v1/callbacks/delivery/track',
     );
+    return res.status(200).json(result);
   }
 }