fix(order): enforce versioned platform commands and submissions

scripts/prod-release-acceptance.mjs

@@ -88,7 +88,7 @@ export function client(settings, fetcher = fetch, policy = allowedRequest) {
   return {
     get requests() { return requests },
     async request(region, method, path, token, body, idempotencyKey) {
-      if (!policy(method, path, region)) throw new Error('请求不在生产前置检查白名单内')
+      if (!policy(method, path, region, body, idempotencyKey)) throw new Error('请求不在生产前置检查白名单内')
       if (++requests > 100) throw new Error('超过单次前置检查请求上限')
       let response
       try {
@@ -185,7 +185,7 @@ export async function executeOrder(settings, input, journalPath, resume, fetcher
     await preflight(settings, base, value => { context = value })
     if (context.warehouses['CN-YIWU-01'] !== bound.origin.id) throw new Error('下单始发仓与义乌主档不符')
     const root = '/merchant/v1/orders/first-leg'
-    const policy = (method, path, region) => region === 'cn' && (
+    const policy = (method, path, region, body, idempotencyKey) => region === 'cn' && (
       method === 'GET' && (path === `${root}/inbound-code-policy`
         || state.orderId && path === `${root}/${state.orderId}`
         || path === `/merchant/v1/warehouses/${bound.destination.id}`
@@ -193,6 +193,8 @@ export async function executeOrder(settings, input, journalPath, resume, fetcher
       || method === 'POST' && (path === '/merchant/v1/first-leg/pricing/estimate'
         || path === root && state.phase === 'CREATE_INTENT'
         || state.orderId && path === `${root}/${state.orderId}/submit` && state.phase === 'SUBMIT_INTENT'
+          && Number.isSafeInteger(state.submitCommand?.body?.expectedVersion)
+          && JSON.stringify(body) === JSON.stringify(state.submitCommand.body) && idempotencyKey === state.submitCommand.idempotencyKey
         || state.orderId && path === `/platform/v1/orders/first-leg/${state.orderId}/approve?tenantId=${settings.customer.id}` && state.phase === 'APPROVE_INTENT'))
     const http = client(settings, fetcher, policy)
     const merchant = context.logins.MERCHANT.accessToken