校园系统接口评审：开柜超时后如何保留原动作与执行观察

'use strict';
// Local, sequential model only. It never sends a device command.
const assert=require('node:assert/strict');
const {createHash}=require('node:crypto');
const rows=new Map();let checks=0;
const clone=x=>structuredClone(x);
function fail(code){throw Object.assign(new Error(code),{code});}
function authorize(ctx,provider){
 if(!ctx||typeof ctx.tenant!=='string'||ctx.role!=='operator'||!ctx.providers?.includes(provider))fail('FORBIDDEN');
}
const key=(tenant,provider,ref)=>JSON.stringify([tenant,provider,ref]);
function register(ctx,{provider,ref,order,kind,slot}){
 authorize(ctx,provider);
 if(![provider,ref,order,slot].every(x=>typeof x==='string'&&x.trim())||!['STORE','OPEN'].includes(kind))fail('INVALID');
 // Fixed flat field list; do not hash raw JSON with arbitrary key order.
 const sha=createHash('sha256').update(JSON.stringify([order,kind,slot])).digest('hex');
 const k=key(ctx.tenant,provider,ref),old=rows.get(k);
 if(old){if(old.sha!==sha)fail('KEY_CONFLICT');return clone(old);}
 const row={tenant:ctx.tenant,provider,ref,order,kind,slot,sha,state:'PREPARED',revision:0,evidence:null};
 rows.set(k,row);return clone(row);
}
function observe(ctx,provider,ref,next,evidence){
 authorize(ctx,provider);const row=rows.get(key(ctx.tenant,provider,ref));if(!row)fail('NOT_FOUND');
 const allowed={PREPARED:['SENT'],SENT:['UNKNOWN','ACCEPTED','EXECUTED','REJECTED'],UNKNOWN:['ACCEPTED','EXECUTED','REJECTED'],ACCEPTED:['EXECUTED'],EXECUTED:[],REJECTED:[]};
 if(!Object.hasOwn(allowed,next))fail('INVALID_STATE');
 // A production adapter must authenticate and bind external evidence first.
 if(['ACCEPTED','EXECUTED','REJECTED'].includes(next)&&!(typeof evidence==='string'&&evidence.trim()))fail('EVIDENCE_REQUIRED');
 if(row.state===next||row.state==='EXECUTED'&&next==='ACCEPTED')return clone(row);
 if(!allowed[row.state].includes(next))fail('STATE_CONFLICT');
 row.state=next;row.revision++;row.evidence=evidence??row.evidence;return clone(row);
}
function eq(actual,expected){assert.deepEqual(actual,expected);checks++;}
function throws(fn,code){assert.throws(fn,e=>e.code===code);checks++;}
const ctx={tenant:'T1',role:'operator',providers:['P1']};
const input={provider:'P1',ref:'K1',order:'O1',kind:'OPEN',slot:'A1'};
const first=register(ctx,input);eq(first.state,'PREPARED');eq(first.revision,0);
eq(register(ctx,input),first);eq(rows.size,1);
throws(()=>register(ctx,{...input,order:'O2'}),'KEY_CONFLICT');
throws(()=>register(ctx,{...input,slot:'A2'}),'KEY_CONFLICT');
throws(()=>register(ctx,{...input,kind:'OTHER'}),'INVALID');
throws(()=>register({...ctx,role:'viewer'},input),'FORBIDDEN');
throws(()=>register(ctx,{...input,provider:'P2'}),'FORBIDDEN');
eq(observe(ctx,'P1','K1','SENT').revision,1);
eq(observe(ctx,'P1','K1','UNKNOWN').revision,2);
throws(()=>observe(ctx,'P1','K1','PREPARED'),'STATE_CONFLICT');
throws(()=>observe(ctx,'P1','K1','EXECUTED'),'EVIDENCE_REQUIRED');
const executed=observe(ctx,'P1','K1','EXECUTED','provider-query:E1');eq(executed.revision,3);
eq(observe(ctx,'P1','K1','ACCEPTED','old-ack:E0'),executed);
throws(()=>observe(ctx,'P1','K1','REJECTED','contradiction:E2'),'STATE_CONFLICT');
const returned=register(ctx,input);returned.state='PREPARED';eq(register(ctx,input).state,'EXECUTED');
throws(()=>observe({...ctx,tenant:'T2'},'P1','K1','EXECUTED','E1'),'NOT_FOUND');
eq(register({...ctx,tenant:'T2'},input).state,'PREPARED');eq(rows.size,2);
console.log(JSON.stringify({passed:checks,originalState:register(ctx,input).state,originalRevision:register(ctx,input).revision,rows:rows.size,scope:'sequential in-memory model; no database, HTTP, device, cloud or product test'}));