fix(order): enforce versioned platform commands and submissions

scripts/create-pending-review-orders.mjs

@@ -31,6 +31,13 @@ export const PRODUCT_CATALOG = [
 
 const DEFAULT_COUNT = 50
 
+export function pendingSubmitCommand(detail, orderId, idempotencyKey) {
+  if (String(detail?.order?.id) !== String(orderId) || !Number.isSafeInteger(detail?.order?.version)
+      || detail.order.version < 0 || !idempotencyKey) throw new Error('Missing original order identity/version/key for submit')
+  return Object.freeze({ body: Object.freeze({ expectedVersion: detail.order.version }),
+    headers: Object.freeze({ 'Idempotency-Key': idempotencyKey }) })
+}
+
 export function parseArguments(values) {
   const options = {}
   const booleanOptions = new Set(['help', 'same-channel'])
@@ -428,10 +435,13 @@ export async function main(argv = process.argv.slice(2)) {
     const orderId = String(requireSuccess(createResponse, `Create order ${index}`) ?? '')
     if (!orderId) throw new Error(`Create order ${index} did not return orderId`)
 
+    const submitDetail = requireSuccess(await request(gateway, timeoutMs, 'GET',
+      `/api/merchant/v1/orders/first-leg/${encodeURIComponent(orderId)}`, { token }), `Freeze submit version ${index}`)
+    const submitCommand = pendingSubmitCommand(submitDetail, orderId, `${marker}-submit-${index}`.slice(0, 128))
     const submitResponse = await request(gateway, timeoutMs, 'POST',
       `/api/merchant/v1/orders/first-leg/${encodeURIComponent(orderId)}/submit`, {
         token,
-        headers: { 'Idempotency-Key': `${marker}-submit-${index}`.slice(0, 128) },
+        ...submitCommand,
       })
     requireSuccess(submitResponse, `Submit order ${index}`)
 
@@ -451,6 +461,7 @@ export async function main(argv = process.argv.slice(2)) {
     }
     const result = {
       index,
+      submitCommand,
       orderId,
       orderNo,
       clientStatus: detail.order.status,