netstack 0.1.1 → 0.2.0

data/lib/netstack/deployment/plan.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+
+module Netstack
+  module Deployment
+    # 可持久化的单目标有序意图；规范序列化产生稳定摘要供恢复核验。
+    # 配置正文应放在私有工件中，参数与元数据只保留引用和安全摘要。
+    class Plan < Data.define(:target, :steps, :preconditions, :metadata)
+      SCHEMA_VERSION = 1
+
+      def initialize(target:, steps:, preconditions: {}, metadata: {})
+        raise InputError, "plan target must be a Target" unless target.is_a?(Target)
+        unless steps.is_a?(Array) && steps.all? { |step| step.is_a?(Step) } && steps.map(&:id).uniq.size == steps.size
+          raise InputError, "plan steps must have unique identities"
+        end
+        raise InputError, "plan metadata must be hashes" unless preconditions.is_a?(Hash) && metadata.is_a?(Hash)
+
+        super(target: target, steps: steps.dup.freeze, preconditions: Values.copy(preconditions), metadata: Values.copy(metadata))
+        # 适配器执行预检读取或写入之前，先验证序列化契约。
+        payload
+      end
+
+      def payload
+        canonical({ schema_version: SCHEMA_VERSION, target: target.to_h, steps: steps.map(&:to_h), preconditions: preconditions, metadata: metadata })
+      end
+
+      def digest = Digest::SHA256.hexdigest(JSON.generate(payload))
+
+      def self.from_h(value)
+        raise InputError, "plan must be an object" unless value.is_a?(Hash)
+
+        validate_serialized_keys!(value)
+        data = JSON.parse(JSON.generate(value), symbolize_names: true)
+        raise InputError, "unsupported plan schema" unless data.fetch(:schema_version) == SCHEMA_VERSION
+
+        new(target: Target.new(**data.fetch(:target)), steps: data.fetch(:steps).map { |step| Step.new(**step) },
+          preconditions: data.fetch(:preconditions), metadata: data.fetch(:metadata))
+      rescue KeyError, TypeError, NoMethodError, JSON::GeneratorError, JSON::ParserError, ArgumentError
+        raise InputError, "invalid plan payload"
+      end
+
+      def self.validate_serialized_keys!(value)
+        case value
+        when Hash
+          raise InputError, "plan keys must be strings or symbols" unless value.keys.all? { |key| key.is_a?(String) || key.is_a?(Symbol) }
+
+          keys = value.keys.map(&:to_s)
+          raise InputError, "duplicate serialized plan keys" unless keys.uniq.size == keys.size
+
+          value.each_value { |item| validate_serialized_keys!(item) }
+        when Array then value.each { |item| validate_serialized_keys!(item) }
+        end
+      end
+      private_class_method :validate_serialized_keys!
+
+      private
+
+      def canonical(value)
+        case value
+        when Hash
+          raise InputError, "plan keys must be strings or symbols" unless value.keys.all? { |key| key.is_a?(String) || key.is_a?(Symbol) }
+
+          keys = value.keys.map(&:to_s)
+          raise InputError, "duplicate serialized plan keys" unless keys.uniq.size == keys.size
+
+          value.to_h { |key, item| [key.to_s, canonical(item)] }.sort.to_h
+        when Array then value.map { |item| canonical(item) }
+        when Time then value.getutc.iso8601(6)
+        when Symbol then value.to_s
+        when Float
+          raise InputError, "plan numbers must be finite" unless value.finite?
+
+          value
+        when String, Integer, TrueClass, FalseClass, NilClass then value
+        else raise InputError, "plan contains a non-serializable value"
+        end
+      end
+    end
+  end
+end

data/lib/netstack/deployment/receipt.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Netstack
+  module Deployment
+    # 不可变的执行前缀；证据只应包含安全的身份与摘要，
+    # 不能包含凭据、配置正文或传输原文。
+    class Receipt < Data.define(:execution_id, :plan_digest, :target_key, :steps, :planned_step_ids)
+      STATES = %i[started applied accepted verified failed unknown not_applied].freeze
+      SCHEMA_VERSION = 1
+      STEP_FIELDS = %i[step_id status idempotency_key remote_id error_code evidence].freeze
+
+      def initialize(execution_id:, plan_digest:, target_key:, planned_step_ids:, steps: [])
+        raise InputError, "receipt steps must be an Array" unless steps.is_a?(Array)
+        unless planned_step_ids.is_a?(Array) && planned_step_ids.all? { |id| id.is_a?(String) && !id.empty? } && planned_step_ids.uniq == planned_step_ids
+          raise InputError, "planned step identities must be unique strings"
+        end
+
+        records = steps.map do |step|
+          raise InputError, "receipt step must be a Hash" unless step.is_a?(Hash)
+
+          self.class.send(:validate_serialized_keys!, step)
+          item = step.transform_keys(&:to_sym)
+          raise InputError, "unknown receipt step fields" unless (item.keys - STEP_FIELDS).empty?
+          item[:step_id] = Values.text(item.fetch(:step_id), name: "receipt step id")
+          item[:idempotency_key] = Values.text(item[:idempotency_key], name: "idempotency key") if item.key?(:idempotency_key)
+          item[:remote_id] = Values.text(item[:remote_id], name: "remote id") if item.key?(:remote_id)
+          state = item.fetch(:status).to_sym
+          raise InputError, "invalid receipt status" unless STATES.include?(state)
+          item[:error_code] = item[:error_code].to_sym if item[:error_code]
+
+          Values.copy(item.merge(status: state))
+        end
+        raise InputError, "duplicate receipt steps" unless records.map { |step| step[:step_id] }.uniq.size == records.size
+        unless records.map { |step| step[:step_id] } == planned_step_ids.first(records.size)
+          raise InputError, "receipt steps must follow plan order"
+        end
+
+        super(execution_id: Values.text(execution_id, name: "execution id"), plan_digest: Values.text(plan_digest, name: "plan digest"),
+          target_key: Values.text(target_key, name: "target key"), steps: records.freeze, planned_step_ids: Values.copy(planned_step_ids))
+      rescue KeyError, NoMethodError
+        raise InputError, "invalid receipt step"
+      end
+
+      def verified? = !steps.empty? && steps.size == planned_step_ids.size && steps.all? { |step| step[:status] == :verified }
+      def no_changes? = planned_step_ids.empty?
+      def unknown? = steps.any? { |step| %i[started unknown applied accepted].include?(step[:status]) }
+      def failed? = steps.any? { |step| %i[failed not_applied].include?(step[:status]) }
+
+      def payload = { schema_version: SCHEMA_VERSION, **to_h }
+
+      def self.from_h(value)
+        raise InputError, "receipt must be an object" unless value.is_a?(Hash)
+
+        validate_serialized_keys!(value)
+        data = JSON.parse(JSON.generate(value), symbolize_names: true)
+        raise InputError, "unsupported receipt schema" unless data.delete(:schema_version) == SCHEMA_VERSION
+
+        new(**data)
+      rescue JSON::GeneratorError, JSON::ParserError, ArgumentError, TypeError
+        raise InputError, "invalid receipt payload"
+      end
+
+      def self.validate_serialized_keys!(value)
+        case value
+        when Hash
+          unless value.keys.all? { |key| key.is_a?(String) || key.is_a?(Symbol) } && value.keys.map(&:to_s).uniq.size == value.size
+            raise InputError, "ambiguous receipt keys"
+          end
+          value.each_value { |item| validate_serialized_keys!(item) }
+        when Array then value.each { |item| validate_serialized_keys!(item) }
+        end
+      end
+      private_class_method :validate_serialized_keys!
+    end
+  end
+end

data/lib/netstack/deployment/recovery.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Deployment
+    # 根据收据建议宿主的下一步动作；不调度，也不执行动作。
+    # 未知结果包括已经开始、应用或接受但尚未确认效果的步骤。
+    class Recovery
+      def decision(receipt:)
+        raise InputError, "receipt required" unless receipt.is_a?(Receipt)
+        return :no_changes if receipt.no_changes?
+        return :verify if receipt.unknown?
+        return :review if receipt.failed?
+        return :complete if receipt.verified?
+
+        :resume
+      end
+    end
+  end
+end

data/lib/netstack/deployment/step.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Deployment
+    # 步骤身份、动作参数和预期状态；具体动作的业务校验由领域适配器负责。
+    # 身份参与幂等键计算；此对象本身不代表已经提交或已经执行。
+    class Step < Data.define(:id, :action, :parameters, :expected)
+      def initialize(id:, action:, parameters: {}, expected: {})
+        raise InputError, "step parameters and expected state must be hashes" unless parameters.is_a?(Hash) && expected.is_a?(Hash)
+
+        super(id: Values.text(id, name: "step id"), action: Values.text(action, name: "step action"),
+          parameters: Values.copy(parameters), expected: Values.copy(expected))
+      end
+    end
+  end
+end

data/lib/netstack/dimension.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Netstack
+  # A collection result for one explicitly requested scope; empty data is not a success signal.
+  class Dimension < Data.define(:name, :status, :records, :started_at, :completed_at, :evidence, :diagnostics)
+    STATUSES = %i[complete partial unsupported failed not_requested].freeze
+
+    def initialize(name:, status:, records: [], started_at: nil, completed_at: nil, evidence: [], diagnostics: [])
+      name = Values.text(name.is_a?(Symbol) ? name.to_s : name, name: "dimension name").to_sym
+      status = status.to_sym if status.is_a?(String)
+      raise InputError, "invalid dimension status" unless STATUSES.include?(status)
+      raise InputError, "dimension records must be an Array" unless records.is_a?(Array)
+      if %i[unsupported failed not_requested].include?(status) && !records.empty?
+        raise InputError, "unavailable dimensions cannot contain records"
+      end
+      started_at = Values.time(started_at, name: "collection start", optional: true)
+      completed_at = Values.time(completed_at, name: "collection end", optional: true)
+      if (!started_at.nil? ^ !completed_at.nil?) || (started_at && completed_at < started_at)
+        raise InputError, "invalid collection time window"
+      end
+
+      super(name: name, status: status, records: Values.copy(records), started_at: started_at, completed_at: completed_at,
+        evidence: Values.copy(evidence), diagnostics: Values.copy(diagnostics))
+    end
+
+    def complete? = status == :complete
+    def partial? = status == :partial
+    def unavailable? = %i[unsupported failed not_requested].include?(status)
+  end
+end

data/lib/netstack/error.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Netstack
+  class Error < StandardError
+    attr_reader :code, :stage, :details
+
+    def initialize(message = "network operation failed", code: :operation_failed, stage: nil, details: {})
+      @code = code.to_sym
+      @stage = stage&.to_sym
+      @details = Values.copy(details)
+      super(message)
+    end
+  end
+end

data/lib/netstack/input_error.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Netstack
+  class InputError < Error
+    def initialize(message = "invalid input", code: :invalid_input, stage: :validate, details: {})
+      super
+    end
+  end
+end

data/lib/netstack/integrations/bluecat/client.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Integrations
+    module Bluecat
+      # BlueCat REST v1 协议边界；分页必须正常结束后才能向调用者
+      # 返回集合；耗尽页数预算不会将部分数据作为成功结果返回。
+      class Client
+        BASE_PATH = "Services/REST/v1"
+
+        def initialize(base_url: nil, username:, password:, http: nil, **http_options)
+          @username = Values.text(username, name: "BlueCat username")
+          raise InputError, "BlueCat password must be nonempty text" unless password.is_a?(String) && password.present?
+
+          # 密码是凭据字节，不能像普通名称一样去除前后空格。
+          @password = password.dup.freeze
+          @http = http || Http::Client.new(base_url: base_url, **http_options)
+        end
+
+        def inspect = "#<#{self.class.name}>"
+
+        def json(endpoint, **query)
+          request(:get, endpoint, query).json
+        end
+
+        def entity(endpoint, **query)
+          validate_entity(json(endpoint, **query), allow_missing: true)
+        end
+
+        def entities(parent_id:, type:, page_size: 100, max_pages: 100)
+          page_size = Values.integer(page_size, name: "page_size", min: 1, max: 1000)
+          max_pages = Values.integer(max_pages, name: "max_pages", min: 1)
+          all = []
+          max_pages.times do |page|
+            rows = json("getEntities", parentId: parent_id, type: type, start: page * page_size, count: page_size)
+            invalid! unless rows.is_a?(Array) && rows.size <= page_size
+            rows = rows.map { |row| validate_entity(row) }
+            invalid! unless (all + rows).map { |row| row["id"] }.uniq.size == all.size + rows.size
+            all.concat(rows)
+            return Values.copy(all) if rows.size < page_size
+          end
+          raise Netstack::Error.new("BlueCat entity list is incomplete", code: :incomplete_snapshot)
+        end
+
+        def write(method, endpoint, query:, returns_id: false)
+          response = request(method, endpoint, query)
+          if returns_id
+            id = response.json
+            invalid! unless id.is_a?(Integer) && id.positive?
+            id
+          else
+            invalid! unless ["", "null", "true"].include?(response.body.strip)
+            true
+          end
+        end
+
+        def validate_entity(value, allow_missing: false)
+          invalid! unless value.is_a?(Hash) && value["id"].is_a?(Integer) && value["id"] >= 0
+          return nil if allow_missing && value["id"].zero?
+          invalid! unless value["id"].positive? && value["name"].is_a?(String) && value["type"].is_a?(String) && value["properties"].is_a?(String)
+          Values.copy(value)
+        end
+
+        private
+
+        def request(method, endpoint, query)
+          raise InputError, "Invalid BlueCat endpoint" unless endpoint.is_a?(String) && endpoint.match?(/\A[a-zA-Z][a-zA-Z0-9]+\z/)
+          authenticate! unless @token
+          @http.request(method, "#{BASE_PATH}/#{endpoint}", query: query, headers: { "Authorization" => "BAMAuthToken: #{@token}" })
+        end
+
+        def authenticate!
+          response = @http.request(:get, "#{BASE_PATH}/login", query: { username: @username, password: @password })
+          @token = response.body[/BAMAuthToken:\s+([^\s"<>]+)/, 1]
+          raise Netstack::Error.new("BlueCat authentication failed", code: :authentication_failed) unless @token
+        end
+
+        def invalid!
+          raise Netstack::Error.new("Invalid BlueCat response", code: :invalid_response, stage: :response)
+        end
+      end
+    end
+  end
+end

data/lib/netstack/integrations/http/client.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+require "json"
+require "openssl"
+require "timeout"
+
+module Netstack
+  # 显式调用的外部协议客户端；构造和加载常量不会建立连接。
+  module Integrations
+    module Http
+      # One request, no redirects or implicit retries. Transport receives keyword
+      # arguments and returns Response, which also makes protocol tests offline.
+      class Client
+        METHODS = %w[get post put patch delete head].freeze
+        FORBIDDEN_HEADERS = %w[host content-length connection transfer-encoding proxy-authorization].freeze
+
+        def initialize(base_url:, headers: {}, open_timeout: 5, read_timeout: 30,
+                       write_timeout: 30, request_timeout: 60, max_response_bytes: 2_097_152, verify_tls: true, transport: nil)
+          @base_uri = parse_uri(base_url)
+          @headers = validate_headers(headers)
+          @timeouts = { open_timeout: open_timeout, read_timeout: read_timeout, write_timeout: write_timeout }
+          invalid!("HTTP timeouts must be positive numbers") unless @timeouts.values.all? { |value| value.is_a?(Numeric) && value.finite? && value.positive? }
+          invalid!("HTTP request timeout must be positive") unless request_timeout.is_a?(Numeric) && request_timeout.finite? && request_timeout.positive?
+          @request_timeout = request_timeout
+          invalid!("Response byte limit must be a positive integer") unless max_response_bytes.is_a?(Integer) && max_response_bytes.positive?
+          invalid!("verify_tls must be boolean") unless [true, false].include?(verify_tls)
+          @max_response_bytes = max_response_bytes
+          @verify_tls = verify_tls
+          @transport = transport
+        end
+
+        def inspect = "#<#{self.class.name}>"
+
+        def request(method, path = "", query: {}, headers: {}, json: nil, body: nil)
+          method = method.to_s.downcase
+          invalid!("Unsupported HTTP method") unless METHODS.include?(method)
+          invalid!("Supply json or body, not both") if !json.nil? && !body.nil?
+          uri = request_uri(path, query)
+          request_headers = @headers.merge(validate_headers(headers))
+          unless json.nil?
+            request_headers["Content-Type"] ||= "application/json"
+            body = JSON.generate(json, allow_nan: false)
+          end
+          invalid!("HTTP body must be text") unless body.nil? || body.is_a?(String)
+          options = { method: method, url: uri.to_s, headers: request_headers, body: body,
+                      **@timeouts, max_response_bytes: @max_response_bytes, verify_tls: @verify_tls }
+          deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @request_timeout
+          response = Timeout.timeout(@request_timeout) do
+            @transport ? @transport.call(**options) : transmit(**options, deadline: deadline)
+          end
+          raise Timeout::Error if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+          raise Error.new("Invalid HTTP transport response", code: "invalid_response", stage: "response") unless response.is_a?(Response)
+
+          check_size!(response.body.bytesize)
+          unless (200..299).cover?(response.status)
+            raise Error.new("HTTP request was not successful", code: "http_status", stage: "response",
+                                                               details: { "status" => response.status })
+          end
+          response
+        rescue Timeout::Error
+          raise Error.new("HTTP request timed out", code: "http_timeout", stage: "transport"), cause: nil
+        rescue SocketError, IOError, SystemCallError, OpenSSL::SSL::SSLError, Net::HTTPBadResponse, Net::ProtocolError
+          raise Error.new("HTTP connection failed", code: "http_connection_failed", stage: "transport"), cause: nil
+        rescue JSON::GeneratorError
+          invalid!("Request is not valid JSON")
+        end
+
+        private
+
+        def transmit(method:, url:, headers:, body:, open_timeout:, read_timeout:, write_timeout:, max_response_bytes:, verify_tls:, deadline:)
+          uri = URI.parse(url)
+          http = Net::HTTP.new(uri.host, uri.port, nil)
+          http.use_ssl = uri.scheme == "https"
+          http.verify_mode = verify_tls ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
+          http.open_timeout = open_timeout
+          http.read_timeout = read_timeout
+          http.write_timeout = write_timeout
+          http.max_retries = 0
+          request = Net::HTTPGenericRequest.new(method.upcase, !body.nil?, method != "head", uri.request_uri, headers)
+          request.body = body if body
+          http.start do
+            http.request(request) do |response|
+              bytes = +""
+              response.read_body do |chunk|
+                raise Timeout::Error if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+                check_size!(bytes.bytesize + chunk.bytesize, max_response_bytes)
+                bytes << chunk
+              end
+              return Response.new(status: response.code.to_i, headers: response.to_hash.transform_values { |values| values.join(", ") }, body: bytes)
+            end
+          end
+        end
+
+        def parse_uri(value)
+          invalid!("HTTP base URL must be text") unless value.is_a?(String)
+          uri = URI.parse(value)
+          unless %w[http https].include?(uri.scheme) && uri.host && !uri.userinfo && !uri.fragment
+            invalid!("HTTP base URL must identify an HTTP origin without credentials or fragment")
+          end
+          uri
+        rescue URI::InvalidURIError
+          invalid!("Invalid HTTP URL")
+        end
+
+        def request_uri(path, query)
+          invalid!("HTTP path must be text") unless path.is_a?(String)
+          invalid!("HTTP query must be a hash") unless query.is_a?(Hash)
+          uri = path.empty? ? @base_uri.dup : URI.join(@base_uri.to_s.sub(%r{/\z}, "") + "/", path)
+          unless [uri.scheme, uri.host, uri.port] == [@base_uri.scheme, @base_uri.host, @base_uri.port] && !uri.userinfo && !uri.fragment
+            invalid!("Request path must stay within the configured origin")
+          end
+          unless query.empty?
+            encoded = URI.encode_www_form(query)
+            uri.query = [uri.query, encoded].compact.reject(&:empty?).join("&")
+          end
+          uri
+        rescue URI::InvalidURIError
+          invalid!("Invalid HTTP path")
+        end
+
+        def validate_headers(headers)
+          invalid!("HTTP headers must be a hash") unless headers.is_a?(Hash)
+          headers.to_h do |key, value|
+            name = key.to_s
+            unless name.match?(/\A[!#$%&'*+.^_`|~0-9a-z-]+\z/i) && value.is_a?(String) && !value.match?(/[\r\n\x00]/) && !FORBIDDEN_HEADERS.include?(name.downcase)
+              invalid!("Invalid HTTP header")
+            end
+            [name.dup.freeze, value.dup.freeze]
+          end
+        end
+
+        def check_size!(bytes, maximum = @max_response_bytes)
+          return if bytes <= maximum
+
+          raise Error.new("HTTP response exceeds the byte limit", code: "response_too_large", stage: "response")
+        end
+
+        def invalid!(message)
+          raise Netstack::InputError.new(message, code: "invalid_http_input", stage: "input")
+        end
+      end
+    end
+  end
+end

data/lib/netstack/integrations/http/error.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Integrations
+    module Http
+      class Error < Netstack::Error
+      end
+    end
+  end
+end

data/lib/netstack/integrations/http/response.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Netstack
+  module Integrations
+    module Http
+      class Response
+        attr_reader :status, :headers, :body
+
+        def initialize(status:, headers: {}, body: "")
+          @status = Integer(status)
+          @headers = headers.to_h.transform_keys { |key| key.to_s.downcase }.transform_values { |value| value.to_s.dup.freeze }.freeze
+          @body = String(body).dup.freeze
+          freeze
+        end
+
+        def json
+          JSON.parse(body)
+        rescue JSON::ParserError, EncodingError
+          raise Error.new("HTTP response is not valid JSON", code: "invalid_json", stage: "response"), cause: nil
+        end
+
+        def inspect = "#<#{self.class.name} status=#{status} bytes=#{body.bytesize}>"
+      end
+    end
+  end
+end

data/lib/netstack/integrations/http_delivery/adapter.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Integrations
+    module HttpDelivery
+      # 将工件引用接入 Deployment 的提交与回读协议。
+      # 每次新提交都重新解析工件并核对摘要；恢复按操作身份查询。
+      class Adapter
+        def initialize(client:, artifact_resolver:)
+          @client = client
+          @artifacts = Configuration::ArtifactResolver.new(resolver: artifact_resolver)
+        end
+
+        def preflight(plan:, previous:, credentials:) # rubocop:disable Naming/PredicateMethod -- Deployment adapter protocol.
+          @client.validate_credentials!(credentials)
+          previous_ids = previous ? previous.steps.map { |step| step.fetch(:step_id) } : []
+          plan.steps.each { |step| @artifacts.resolve(step).validate_target!(plan.target) unless previous_ids.include?(step.id) }
+          true
+        end
+
+        def apply(step:, target:, credentials:, idempotency_key:)
+          artifact = @artifacts.resolve(step)
+          result = @client.submit(target: target, artifact: artifact, credentials: credentials, idempotency_key: idempotency_key,
+            request_no: step.parameters[:request_no], target_id: step.parameters[:target_id])
+          response(result, submitting: true)
+        end
+
+        def verify(step:, target:, credentials:, receipt:) # rubocop:disable Lint/UnusedMethodArgument -- Deployment adapter protocol; lookup needs no device credentials.
+          # Even a previous POST terminal reply is reconciled using the same identity.
+          result = @client.status(remote_id: receipt[:remote_id], idempotency_key: receipt.fetch(:idempotency_key))
+          response(result, submitting: false)
+        end
+
+        private
+
+        def response(result, submitting:)
+          status = case result.status
+          when :succeeded then submitting ? :applied : :verified
+          when :running then submitting ? :accepted : :unknown
+          when :failed then :failed
+          else :unknown
+          end
+          value = { status: status, evidence: { remote_status: result.status } }
+          value[:remote_id] = result.remote_id if result.remote_id
+          value[:error_code] = :remote_rejected if result.failed?
+          value
+        end
+      end
+    end
+  end
+end