@7365admin1/core 3.87.0 → 3.88.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.87.0",
+  "version": "3.88.0",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -13,7 +13,7 @@
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
     "lint": "tsc",
-    "test": "tsup src/config.ts src/utils/building-map.util.ts src/utils/robot-cloud.util.ts src/utils/robot-adapter.util.ts src/utils/png-encoder.util.ts src/services/demo.adapter.ts src/utils/robot-fault.util.ts src/utils/robot-tracking.util.ts src/utils/robot-apps.util.ts src/utils/robot-permission.util.ts src/utils/lift-contract.util.ts src/utils/anpr-revoke.util.ts src/utils/anpr-plate.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/utils/camera-playback.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/occurrence-book-create.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts src/utils/people-create-gate.util.ts src/utils/service-app-type.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
+    "test": "tsup src/config.ts src/utils/building-map.util.ts src/utils/robot-cloud.util.ts src/utils/robot-adapter.util.ts src/utils/png-encoder.util.ts src/services/demo.adapter.ts src/utils/robot-fault.util.ts src/utils/robot-tracking.util.ts src/utils/robot-apps.util.ts src/utils/robot-permission.util.ts src/utils/lift-contract.util.ts src/models/robot-building-map.model.ts src/utils/anpr-revoke.util.ts src/utils/anpr-plate.util.ts src/utils/vehicle-request.util.ts src/utils/camera-view.util.ts src/utils/camera-bulk-import.util.ts src/utils/dashboard-metrics.util.ts src/utils/camera-capability.util.ts src/utils/camera-playback.util.ts src/services/camera-device-http.service.ts src/utils/camera-alert.util.ts src/utils/dahua-protocol.util.ts src/utils/site-name.util.ts src/utils/service-provider-invite.util.ts src/utils/notification-category.util.ts src/utils/hid-card.util.ts src/utils/hid-json.util.ts src/utils/hid-access.util.ts src/models/customer-site.model.ts src/models/site-camera.model.ts src/models/member.model.ts src/models/subscription.model.ts src/utils/session-id.util.ts src/utils/occurrence-query.util.ts src/utils/occurrence-book-create.util.ts src/utils/update-result.util.ts src/utils/hid-amico-authz.util.ts src/utils/promo-code-currency.util.ts src/utils/console-audit.util.ts src/utils/org-suspension.util.ts src/utils/session-revoke.util.ts src/models/hid-amico.model.ts src/models/patrol-email.model.ts src/utils/patrol-email-pdf.util.ts src/utils/visitor-status.util.ts src/utils/self-service-email.util.ts src/utils/hid-secret.util.ts src/models/visitor-invite.model.ts src/models/guard-invite.model.ts src/utils/site-timezone.util.ts src/utils/bulletin-service-apps.util.ts src/models/bulletin-board.model.ts src/utils/vehicle-import.util.ts src/utils/expired-vehicle-sweep.util.ts src/models/vehicle.model.ts src/controllers/chat.controller.ts src/utils/file-owner.util.ts src/utils/console-permission.util.ts src/utils/role-scope.util.ts src/utils/org-default-roles.util.ts src/utils/org-modules.util.ts src/utils/site-modules.util.ts src/utils/resident-app-modules.util.ts src/utils/resident-default-role.util.ts src/utils/invite-role-scope.util.ts src/models/personal-emergency-chain.model.ts src/utils/self-signup-files.util.ts src/models/person.model.ts src/utils/module-gate.util.ts src/utils/member-lookup.util.ts src/utils/notification-access.util.ts src/utils/module-access.util.ts src/services/module-gate.service.ts src/controllers/site.controller.ts src/controllers/organization.controller.ts src/controllers/member.controller.ts src/utils/org-owner-repair.util.ts src/utils/socket-session.util.ts src/utils/people-create-gate.util.ts src/utils/service-app-type.util.ts --format esm --out-dir test/.build --no-dts --silent && node --test test/*.test.mjs",
     "test:camera": "yarn test",
     "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },

package/test/e2e/harness.mjs

@@ -880,6 +880,20 @@ function buildApp(nsu, core) {
     robots.get("/organization/:organization/site/:site", requireAuth, getRobots);
     robots.patch("/:id([0-9a-fA-F]{24})", requireAuth, updateRobot);
     robots.delete("/:id([0-9a-fA-F]{24})", requireAuth, deleteRobot);
+
+    const m = core.useRobotMapController();
+    const MAP = "/building-maps/:mapId([0-9a-fA-F]{24})";
+    const SESSION = "/lift-sessions/:sessionId([0-9a-fA-F]{24})";
+    robots.get("/building-maps", requireAuth, m.listMaps);
+    robots.post("/building-maps", requireAuth, m.createMap);
+    robots.get(MAP, requireAuth, m.getMap);
+    robots.patch(MAP, requireAuth, m.updateMap);
+    robots.delete(MAP, requireAuth, m.deleteMap);
+    robots.get(`${MAP}/lifts`, requireAuth, m.getLiftQueue);
+    robots.post(`${MAP}/lifts/:liftName/sessions`, requireAuth, m.requestLift);
+    robots.post(`${SESSION}/refresh`, requireAuth, m.refreshLiftSession);
+    robots.post(`${SESSION}/release`, requireAuth, m.releaseLiftSession);
+    robots.get("/:id([0-9a-fA-F]{24})/lift-session", requireAuth, m.getRobotLiftSession);
   }
 
   // mirrors iservice365-API-core/src/routes/attendance-settings.route.ts

package/test/e2e/robot-map-lift.e2e.test.mjs

@@ -0,0 +1,297 @@
+// End-to-end proof for building maps and the lift queue.
+//
+// 1. A map belongs to its robot's estate. The estate is copied from the STORED
+//    robot and every later call checks the STORED map - a caller elsewhere gets
+//    404 by id, and cannot send a siteId to aim a map somewhere else.
+// 2. A stale editor cannot overwrite a newer save (version check, 409).
+// 3. The lift queue is the collection: one active holder per lift (enforced by a
+//    unique partial index, so racing promotions cannot both win), one open
+//    request per robot, timeouts that hand the lift on, release that hands it on.
+// 4. Every write leaves a console-audit row.
+//
+// In-process MongoDB replica set, loopback Redis and mail sink only. No staging
+// or production system, robot or lift is touched.
+//
+// Run with: yarn test:e2e
+
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { ObjectId } from "mongodb";
+
+import { startHarness } from "./harness.mjs";
+
+const PASSWORD = "Robot-Passw0rd!";
+const OUTSIDER = "ml-outsider@e2e.example.com"; // org A, site A only
+const MANAGER = "ml-manager@e2e.example.com"; // org B
+
+describe("building maps and the lift queue", { concurrency: 1 }, () => {
+  let h;
+  const id = {};
+  let outsiderSid;
+  let managerSid;
+  let mapId;
+
+  before(async () => {
+    h = await startHarness();
+    Object.assign(id, await seed(h));
+    await h.core.useRobotBuildingMapRepo().createIndex();
+    await h.core.useRobotLiftSessionRepo().createIndex();
+    outsiderSid = await h.login(OUTSIDER, PASSWORD);
+    managerSid = await h.login(MANAGER, PASSWORD);
+  }, { timeout: 300000 });
+
+  after(async () => {
+    if (h) await h.stop();
+  });
+
+  const body = {
+    name: "Tower B",
+    levels: [{ floorNo: 1, elevationM: 0 }, { floorNo: 2, elevationM: 4.2 }, { floorNo: 3 }],
+    doors: [{ name: "Lobby", floorNo: 1, start: { x: 0, y: 0 }, end: { x: 1, y: 0 } }],
+    lifts: [{ name: "Lift A", x: 3, y: 3, floors: [1, 2, 3] }],
+  };
+
+  it("unauthenticated is 401", async () => {
+    const res = await h.api(`/robots/building-maps?robot=${id.demo1}`);
+    assert.equal(res.status, 401);
+  });
+
+  it("the estate cannot be sent in the body", async () => {
+    const res = await h.api("/robots/building-maps", {
+      method: "POST",
+      sid: managerSid,
+      body: { ...body, robotId: String(id.demo1), siteId: String(id.siteA) },
+    });
+    assert.equal(res.status, 400);
+  });
+
+  it("a caller at another estate cannot create a map on this robot", async () => {
+    const res = await h.api("/robots/building-maps", {
+      method: "POST",
+      sid: outsiderSid,
+      body: { ...body, robotId: String(id.demo1) },
+    });
+    assert.equal(res.status, 404);
+    assert.equal(await h.db.collection("robot-building-maps").countDocuments(), 0);
+  });
+
+  it("the estate's own manager saves a map; the estate is the robot's; audited", async () => {
+    const res = await h.api("/robots/building-maps", {
+      method: "POST",
+      sid: managerSid,
+      body: { ...body, robotId: String(id.demo1) },
+    });
+    assert.equal(res.status, 201, JSON.stringify(res.body));
+    mapId = res.body.id;
+    const stored = await h.db.collection("robot-building-maps").findOne({ _id: new ObjectId(mapId) });
+    assert.equal(String(stored.siteId), String(id.siteB));
+    assert.equal(String(stored.orgId), String(id.orgB));
+    assert.equal(stored.version, 1);
+    assert.ok(await findAudit(h, "robot.map-saved"), "audit row written");
+  });
+
+  it("list is paginated and scoped; another estate gets 404 by id", async () => {
+    const list = await h.api(`/robots/building-maps?robot=${id.demo1}&page=1&limit=5`, { sid: managerSid });
+    assert.equal(list.status, 200);
+    assert.equal(list.body.items.length, 1);
+    assert.equal(list.body.items[0].liftCount, 1);
+
+    assert.equal((await h.api(`/robots/building-maps?robot=${id.demo1}`, { sid: outsiderSid })).status, 404);
+    assert.equal((await h.api(`/robots/building-maps/${mapId}`, { sid: outsiderSid })).status, 404);
+    const patch = await h.api(`/robots/building-maps/${mapId}`, {
+      method: "PATCH",
+      sid: outsiderSid,
+      body: { ...body, version: 1 },
+    });
+    assert.equal(patch.status, 404);
+  });
+
+  it("a save against an old version is refused with 409; the current one succeeds", async () => {
+    const ok = await h.api(`/robots/building-maps/${mapId}`, {
+      method: "PATCH",
+      sid: managerSid,
+      body: { ...body, name: "Tower B (edited)", version: 1 },
+    });
+    assert.equal(ok.status, 200, JSON.stringify(ok.body));
+    assert.equal(ok.body.version, 2);
+
+    const stale = await h.api(`/robots/building-maps/${mapId}`, {
+      method: "PATCH",
+      sid: managerSid,
+      body: { ...body, version: 1 },
+    });
+    assert.equal(stale.status, 409);
+  });
+
+  const ask = (robot, over = {}) =>
+    h.api(`/robots/building-maps/${mapId}/lifts/${encodeURIComponent("Lift A")}/sessions`, {
+      method: "POST",
+      sid: managerSid,
+      body: { robotId: String(robot), fromFloor: 1, toFloor: 3, ...over },
+    });
+
+  it("a non-demo robot cannot ride the simulated lift", async () => {
+    const res = await ask(id.ounitech);
+    assert.equal(res.status, 400);
+  });
+
+  it("a floor the lift does not serve is refused", async () => {
+    assert.equal((await ask(id.demo1, { toFloor: 7 })).status, 400);
+  });
+
+  it("first robot holds the lift, second queues, a robot cannot ask twice", async () => {
+    const first = await ask(id.demo1);
+    assert.equal(first.status, 201, JSON.stringify(first.body));
+    assert.equal(first.body.session.status, "active");
+
+    const second = await ask(id.demo2);
+    assert.equal(second.status, 201);
+    assert.equal(second.body.session.status, "queued");
+
+    assert.equal((await ask(id.demo1)).status, 409);
+
+    const queue = await h.api(`/robots/building-maps/${mapId}/lifts`, { sid: managerSid });
+    assert.equal(queue.status, 200);
+    const lift = queue.body.items[0];
+    assert.equal(lift.simulated, true);
+    assert.equal(lift.active.robotName, "Demo 1");
+    assert.equal(lift.queue.length, 1);
+    assert.equal(lift.state.sessionId, String(lift.active._id));
+
+    const mine = await h.api(`/robots/${id.demo2}/lift-session`, { sid: managerSid });
+    assert.equal(mine.body.session.position, 1);
+
+    assert.equal((await h.api(`/robots/building-maps/${mapId}/lifts`, { sid: outsiderSid })).status, 404);
+  });
+
+  it("releasing hands the lift to the next robot; release is audited", async () => {
+    const holder = await h.db.collection("robot-lift-sessions").findOne({ status: "active" });
+    assert.equal((await h.api(`/robots/lift-sessions/${holder._id}/release`, { method: "POST", sid: outsiderSid })).status, 404);
+
+    const rel = await h.api(`/robots/lift-sessions/${holder._id}/release`, { method: "POST", sid: managerSid });
+    assert.equal(rel.status, 200);
+    const now = await h.db.collection("robot-lift-sessions").findOne({ status: "active" });
+    assert.equal(String(now.robotId), String(id.demo2));
+    assert.equal((await h.api(`/robots/lift-sessions/${holder._id}/release`, { method: "POST", sid: managerSid })).status, 409);
+    assert.ok(await findAudit(h, "robot.lift-released"));
+    assert.ok(await findAudit(h, "robot.lift-requested"));
+  });
+
+  it("a holder that stops refreshing loses the lift when its lease runs out", async () => {
+    const holder = await h.db.collection("robot-lift-sessions").findOne({ status: "active" });
+    assert.equal((await h.api(`/robots/lift-sessions/${holder._id}/refresh`, { method: "POST", sid: managerSid })).status, 200);
+
+    await ask(id.demo1); // queues behind demo2
+    await h.db.collection("robot-lift-sessions").updateOne(
+      { _id: holder._id },
+      { $set: { expiresAt: new Date(Date.now() - 1000) } },
+    );
+    const queue = await h.api(`/robots/building-maps/${mapId}/lifts`, { sid: managerSid });
+    assert.equal(queue.body.items[0].active.robotName, "Demo 1");
+    const expired = await h.db.collection("robot-lift-sessions").findOne({ _id: holder._id });
+    assert.equal(expired.status, "expired");
+    assert.equal((await h.api(`/robots/lift-sessions/${holder._id}/refresh`, { method: "POST", sid: managerSid })).status, 409);
+  });
+
+  it("racing promotions on many instances never produce two holders", async () => {
+    const repo = h.core.useRobotLiftSessionRepo();
+    const coll = h.db.collection("robot-lift-sessions");
+    await coll.updateMany({ open: true }, { $set: { status: "cancelled", open: false } });
+    const key = `race:${new ObjectId()}`;
+    const t = Date.now();
+    await coll.insertMany(
+      [0, 1, 2, 3, 4].map((i) => ({
+        liftKey: key,
+        liftName: "race",
+        mapId: new ObjectId(),
+        robotId: new ObjectId(),
+        status: "queued",
+        open: true,
+        requestedAt: new Date(t + i),
+        expiresAt: new Date(t + 600000),
+      })),
+    );
+    await Promise.all(Array.from({ length: 20 }, () => repo.advance(key)));
+    assert.equal(await coll.countDocuments({ liftKey: key, status: "active" }), 1);
+    const active = await coll.findOne({ liftKey: key, status: "active" });
+    assert.equal(active.requestedAt.getTime(), t, "the oldest request wins");
+
+    // And the database itself refuses a second holder, whatever the code does.
+    await assert.rejects(
+      coll.updateOne({ liftKey: key, status: "queued" }, { $set: { status: "active" } }),
+      (e) => e.code === 11000,
+    );
+  });
+
+  it("removing the map closes its lift queue and the map 404s", async () => {
+    await ask(id.demo2);
+    const del = await h.api(`/robots/building-maps/${mapId}`, { method: "DELETE", sid: managerSid });
+    assert.equal(del.status, 200);
+    assert.equal(await h.db.collection("robot-lift-sessions").countDocuments({ mapId: new ObjectId(mapId), open: true }), 0);
+    assert.equal((await h.api(`/robots/building-maps/${mapId}`, { sid: managerSid })).status, 404);
+    assert.ok(await findAudit(h, "robot.map-removed"));
+  });
+});
+
+async function findAudit(h, action) {
+  const names = (await h.db.listCollections().toArray()).map((c) => c.name);
+  for (const name of names.filter((n) => /audit/i.test(n))) {
+    const row = await h.db.collection(name).findOne({ action });
+    if (row) return row;
+  }
+  return null;
+}
+
+async function seed(h) {
+  const now = new Date().toISOString();
+  const orgA = new ObjectId();
+  const orgB = new ObjectId();
+  const siteA = new ObjectId();
+  const siteB = new ObjectId();
+  const roleA = new ObjectId();
+  const roleB = new ObjectId();
+
+  await h.db.collection("organizations").insertMany([
+    { _id: orgA, name: "ML Org A", email: "mla@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+    { _id: orgB, name: "ML Org B", email: "mlb@e2e.example.com", type: "org", nature: "property_management_agency", status: "active", createdAt: now },
+  ]);
+  await h.db.collection("sites").insertMany([
+    { _id: siteA, name: "ML Site A", org: orgA, orgId: orgA, status: "active" },
+    { _id: siteB, name: "ML Site B", org: orgB, orgId: orgB, status: "active" },
+  ]);
+  await h.db.collection("roles").insertMany([
+    { _id: roleA, name: "Manager A", org: orgA, permissions: ["*"], status: "active" },
+    { _id: roleB, name: "Manager B", org: orgB, permissions: ["*"], status: "active" },
+  ]);
+  const emails = [OUTSIDER, MANAGER];
+  const users = await h.db.collection("users").insertMany(
+    emails.map((email) => ({ email, name: email.split("@")[0], status: "active", createdAt: now })),
+  );
+  const hashed = await h.hashPassword(PASSWORD);
+  await h.db.collection("users").updateMany({ email: { $in: emails } }, { $set: { password: hashed } });
+  const [outsider, manager] = [0, 1].map((i) => users.insertedIds[i]);
+  await h.db.collection("members").insertMany([
+    { user: outsider, org: orgA, siteId: siteA, type: "organization", role: roleA, status: "active" },
+    { user: manager, org: orgB, type: "organization", role: roleB, status: "active" },
+  ]);
+
+  const robot = (name, brand) => ({
+    name,
+    brand,
+    type: "cleaning",
+    appKey: "e2e-fake-key",
+    appToken: "e2e-fake-token",
+    createdBy: manager,
+    createdByName: "ml-manager",
+    metadata: { orgId: orgB, siteId: siteB, administratorId: "" },
+    status: "",
+    deletedAt: "",
+    createdAt: new Date(),
+  });
+  const r = await h.db.collection("robots").insertMany([
+    robot("Demo 1", "demo"),
+    robot("Demo 2", "demo"),
+    robot("Real one", "ounitech"),
+  ]);
+  return { orgA, orgB, siteA, siteB, demo1: r.insertedIds[0], demo2: r.insertedIds[1], ounitech: r.insertedIds[2] };
+}

package/test/robot-map-lift.test.mjs

@@ -0,0 +1,141 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  LIFT_DOOR,
+  LIFT_MODE,
+  LIFT_SIM_BOARD_MS,
+  LIFT_SIM_DOOR_DWELL_MS,
+  LIFT_SIM_MS_PER_FLOOR,
+  liftQueueKey,
+  simulatedLiftState,
+} from "./.build/utils/lift-contract.util.mjs";
+import {
+  buildingMapCreateSchema,
+  buildingMapUpdateSchema,
+  liftRequestSchema,
+} from "./.build/models/robot-building-map.model.mjs";
+
+/* The lift broker's car is REPLAYED from the session, so every API instance
+ * must reach the same answer for the same inputs. These pin the phases. */
+
+const FLOORS = ["1", "2", "3", "4"];
+const session = (over = {}) => ({ id: "s1", fromFloor: "1", toFloor: "3", activeAt: 0, ...over });
+const at = (ms, s = session()) => simulatedLiftState({ name: "Lift A", floors: FLOORS, session: s, now: ms });
+
+test("no holder: the car is idle, in human mode, held by nobody", async () => {
+  const { state, phase } = await simulatedLiftState({ name: "Lift A", floors: FLOORS, session: null, now: 5000 });
+  assert.equal(phase, "idle");
+  assert.equal(state.sessionId, "");
+  assert.equal(state.currentMode, LIFT_MODE.HUMAN);
+});
+
+test("a session whose floors the lift does not serve is treated as no session", async () => {
+  const { phase } = await at(1000, session({ toFloor: "9" }));
+  assert.equal(phase, "idle");
+});
+
+test("pickup at the car's own floor boards at once, doors open, AGV mode", async () => {
+  const { state, phase } = await at(0);
+  assert.equal(phase, "boarding");
+  assert.equal(state.doorState, LIFT_DOOR.OPEN);
+  assert.equal(state.currentMode, LIFT_MODE.AGV);
+  assert.equal(state.sessionId, "s1");
+});
+
+test("boarding holds the doors longer than the dwell, then the car leaves", async () => {
+  const mid = await at(LIFT_SIM_BOARD_MS - 500);
+  assert.equal(mid.phase, "boarding");
+  assert.equal(mid.state.doorState, LIFT_DOOR.OPEN);
+
+  const moving = await at(LIFT_SIM_BOARD_MS + 1000);
+  assert.equal(moving.phase, "to-destination");
+  assert.equal(moving.state.doorState, LIFT_DOOR.CLOSED);
+});
+
+test("arrives at the destination and keeps the doors open while held", async () => {
+  const travel = 2 * LIFT_SIM_MS_PER_FLOOR;
+  const arrived = await at(LIFT_SIM_BOARD_MS + travel + 1000);
+  assert.equal(arrived.phase, "arrived");
+  assert.equal(arrived.state.currentFloor, "3");
+  assert.equal(arrived.state.doorState, LIFT_DOOR.OPEN);
+
+  // Long after the door dwell: the hold is still refreshed, so no door closes on the robot.
+  const later = await at(LIFT_SIM_BOARD_MS + travel + LIFT_SIM_DOOR_DWELL_MS * 5);
+  assert.equal(later.state.doorState, LIFT_DOOR.OPEN);
+});
+
+test("a pickup above the car travels there first", async () => {
+  const s = session({ fromFloor: "3", toFloor: "1" });
+  const start = await at(500, s);
+  assert.equal(start.phase, "to-pickup");
+  assert.equal(start.state.doorState, LIFT_DOOR.CLOSED);
+  const there = await at(2 * LIFT_SIM_MS_PER_FLOOR + 500, s);
+  assert.equal(there.phase, "boarding");
+  assert.equal(there.state.currentFloor, "3");
+});
+
+test("replay is deterministic - same inputs, same answer", async () => {
+  const a = await at(12_345);
+  const b = await at(12_345);
+  assert.deepEqual(a, b);
+});
+
+test("queue key separates same-named lifts in different buildings", () => {
+  assert.notEqual(liftQueueKey("a", "Lift A"), liftQueueKey("b", "Lift A"));
+});
+
+/* ---------------------------------------------------------------- schemas */
+
+const robotId = "a".repeat(24);
+const good = {
+  robotId,
+  name: "Tower 1",
+  levels: [{ floorNo: 1, elevationM: 0 }, { floorNo: 2, elevationM: 4.5 }],
+  doors: [{ name: "Lobby door", floorNo: 1, start: { x: 0, y: 0 }, end: { x: 1, y: 0 } }],
+  lifts: [{ name: "Lift A", x: 3, y: 4, floors: [1, 2] }],
+};
+
+test("a sensible map validates and gets defaults", () => {
+  const { error, value } = buildingMapCreateSchema.validate(good);
+  assert.equal(error, undefined);
+  assert.equal(value.doors[0].type, "hinged");
+  assert.equal(value.lifts[0].widthM, 2);
+});
+
+test("two lifts may not share a name - it is the queue's key", () => {
+  const { error } = buildingMapCreateSchema.validate({
+    ...good,
+    lifts: [good.lifts[0], { ...good.lifts[0], x: 9 }],
+  });
+  assert.ok(error);
+});
+
+test("a lift must span at least two floors, and a level may not repeat", () => {
+  assert.ok(buildingMapCreateSchema.validate({ ...good, lifts: [{ ...good.lifts[0], floors: [1] }] }).error);
+  assert.ok(buildingMapCreateSchema.validate({ ...good, levels: [{ floorNo: 1 }, { floorNo: 1 }] }).error);
+});
+
+test("pixel-sized coordinates are refused - the map is in metres", () => {
+  const { error } = buildingMapCreateSchema.validate({
+    ...good,
+    doors: [{ ...good.doors[0], end: { x: 5000, y: 0 } }],
+  });
+  assert.ok(error);
+});
+
+test("the estate cannot be sent - siteId/orgId are not accepted fields", () => {
+  assert.ok(buildingMapCreateSchema.validate({ ...good, siteId: robotId }).error);
+  assert.ok(buildingMapCreateSchema.validate({ ...good, orgId: robotId }).error);
+});
+
+test("a save must say which version it edited", () => {
+  const { robotId: _r, ...body } = good;
+  assert.ok(buildingMapUpdateSchema.validate(body).error);
+  assert.equal(buildingMapUpdateSchema.validate({ ...body, version: 3 }).error, undefined);
+});
+
+test("a lift request needs two different floors", () => {
+  assert.ok(liftRequestSchema.validate({ robotId, fromFloor: 2, toFloor: 2 }).error);
+  assert.equal(liftRequestSchema.validate({ robotId, fromFloor: 1, toFloor: 2 }).error, undefined);
+});