@vobs/payment 0.1.0

package/dist/manager.js

@@ -0,0 +1,399 @@
+/** @license MIT
+ * Copyright (c) 2026 vobsjs
+ * @vobs/payment
+ */
+/**
+ * PaymentManager — payment core service layer (framework-agnostic, pure logic).
+ *
+ * Security baseline coverage (design doc §3/§5):
+ *  - Server-side pricing (amount comes from the business's getOrderAmount; the frontend amount is only a consistency check)
+ *  - MAX_AMOUNT per-order limit (over-limit rejected, avoids channel errors/risk control)
+ *  - Order idempotency (idempotencyKey) + duplicate-order guard for the same business order (duplicateOrderStrategy)
+ *  - Callback verification + time window + nonce anti-replay + callback idempotency (persist before responding)
+ *  - Conflict freeze / paid-after-close freeze / large-amount manual review (AUDIT_THRESHOLD + confirm)
+ *  - Operation audit (order/callback-book/freeze/confirm all logged)
+ *  - onVerified business hook (must be idempotent) / onAlert alert hook
+ */
+import { applyClose, applyConfirm, applyPaidCallback } from './state-machine.js';
+import { createMemoryStore } from './store.js';
+import { verifySignedCallback } from './verify.js';
+const DEFAULT_API_KEY = 'dev-secret-0123456789abcdef';
+export function createPaymentManager(options = {}) {
+    const config = options.config ?? {};
+    const store = options.store ?? createMemoryStore();
+    const apiKey = options.apiKey ?? DEFAULT_API_KEY;
+    const getOrderAmount = options.getOrderAmount;
+    const drivers = new Map();
+    const notifyVerified = options.onVerified;
+    const notifyAlert = options.onAlert;
+    const audit = (entry) => {
+        store.appendAudit(entry);
+    };
+    const alert = (alert) => {
+        notifyAlert?.(alert);
+    };
+    function driverOf(name) {
+        const driver = drivers.get(name);
+        if (!driver)
+            throw new Error(`driver_not_found: ${name}`);
+        return driver;
+    }
+    /** Create an order record (zero-amount orders skip the channel and have no init). */
+    function newOrder(input, driver, state) {
+        return {
+            orderId: input.orderId,
+            amount: input.amount,
+            subject: input.subject,
+            scene: input.scene,
+            driver: driver.name,
+            state,
+            createdAt: Date.now(),
+        };
+    }
+    async function createOrder(req) {
+        const orderId = req.orderId;
+        // ① idempotency: same idempotencyKey returns the same order
+        if (req.idempotencyKey) {
+            const existingId = store.getOrderByIdempotencyKey(req.idempotencyKey);
+            if (existingId) {
+                const existing = store.getOrder(existingId);
+                if (existing) {
+                    return {
+                        kind: 'ok',
+                        driver: existing.driver,
+                        orderId: existing.orderId,
+                        state: existing.state,
+                        ...(existing.init ? { init: existing.init } : {}),
+                    };
+                }
+            }
+        }
+        // ② server-side pricing: amount from business (security red line — never trust the client amount)
+        let expected = req.amount;
+        if (getOrderAmount) {
+            expected = await getOrderAmount(orderId);
+            if (expected === undefined) {
+                return { error: 'order_not_found' };
+            }
+            if (req.amount !== expected) {
+                return { error: 'amount_mismatch', expected };
+            }
+        }
+        // ③ per-order limit: reject over-limit (avoids channel errors/risk control)
+        if (config.maxAmount && expected > config.maxAmount) {
+            return { error: 'amount_exceeds_limit', max: config.maxAmount };
+        }
+        // ④ duplicate guard: an unpaid order already exists
+        const existingOrder = store.getOrder(orderId);
+        if (existingOrder && existingOrder.state === 'created') {
+            const strategy = config.duplicateOrderStrategy ?? 'ask';
+            if (strategy === 'ask') {
+                return {
+                    kind: 'duplicate',
+                    existingOrderId: existingOrder.orderId,
+                    existingAmount: existingOrder.amount,
+                };
+            }
+            if (strategy === 'reuse') {
+                return {
+                    kind: 'ok',
+                    driver: existingOrder.driver,
+                    orderId: existingOrder.orderId,
+                    state: existingOrder.state,
+                    ...(existingOrder.init ? { init: existingOrder.init } : {}),
+                };
+            }
+            if (strategy === 'reject') {
+                return { error: 'order_conflict', message: `active order exists for ${orderId}` };
+            }
+            // 'replace': close old and create new
+            existingOrder.state = 'closed';
+            audit({
+                operation: 'close',
+                orderId,
+                from: 'created',
+                to: 'closed',
+                reason: 'duplicate_replace',
+                at: Date.now(),
+            });
+        }
+        // ⑤ zero-amount: skip the channel, mark paid directly
+        if (expected === 0) {
+            const driver = driverOf(req.driver ?? availableDrivers()[0]?.name ?? '');
+            const record = newOrder({ orderId, amount: 0, subject: req.subject, scene: req.scene ?? 'pc', notifyUrl: '' }, driver, 'paid');
+            record.paidAt = new Date().toISOString();
+            store.saveOrder(record);
+            if (req.idempotencyKey)
+                store.setIdempotencyKey(req.idempotencyKey, orderId);
+            audit({ operation: 'create', orderId, to: 'paid', reason: 'zero_amount', at: Date.now() });
+            void notifyVerified?.({ orderId, state: 'paid', paidAt: record.paidAt });
+            return { kind: 'ok', driver: driver.name, orderId, state: 'paid' };
+        }
+        // ⑥ place the order via the channel
+        const driver = driverOf(req.driver ?? availableDrivers()[0]?.name ?? '');
+        let init;
+        try {
+            init = await driver.createOrder({
+                orderId,
+                amount: expected,
+                subject: req.subject,
+                scene: req.scene ?? 'pc',
+                notifyUrl: '',
+            });
+        }
+        catch (error) {
+            alert({ level: 'error', code: 'channel_error', message: String(error), driver: driver.name });
+            return { error: 'channel_unavailable', message: String(error) };
+        }
+        const record = newOrder({ orderId, amount: expected, subject: req.subject, scene: req.scene ?? 'pc', notifyUrl: '' }, driver, 'created');
+        record.init = init;
+        store.saveOrder(record);
+        if (req.idempotencyKey)
+            store.setIdempotencyKey(req.idempotencyKey, orderId);
+        audit({ operation: 'create', orderId, to: 'created', at: Date.now() });
+        return {
+            kind: 'ok',
+            driver: driver.name,
+            orderId,
+            state: 'created',
+            ...(init ? { init } : {}),
+        };
+    }
+    function availableDrivers() {
+        return Array.from(drivers.values()).map((d) => ({ name: d.name, scenes: d.scenes }));
+    }
+    function getStatus(orderId) {
+        const order = store.getOrder(orderId);
+        if (!order)
+            return undefined;
+        return { state: order.state, ...(order.paidAt ? { paidAt: order.paidAt } : {}) };
+    }
+    function close(orderId) {
+        const order = store.getOrder(orderId);
+        if (!order)
+            return undefined;
+        const before = order.state;
+        const { state, ok } = applyClose(order.state);
+        if (ok) {
+            order.state = state;
+            audit({ operation: 'close', orderId, from: before, to: state, at: Date.now() });
+        }
+        return { state: order.state, ...(order.paidAt ? { paidAt: order.paidAt } : {}) };
+    }
+    function confirm(orderId) {
+        const order = store.getOrder(orderId);
+        if (!order)
+            return undefined;
+        const before = order.state;
+        const { state, ok } = applyConfirm(order.state);
+        if (ok) {
+            order.state = state;
+            order.paidAt = new Date().toISOString();
+            audit({ operation: 'confirm', orderId, from: before, to: state, at: Date.now() });
+            void notifyVerified?.({
+                orderId,
+                state: 'paid',
+                paidAt: order.paidAt,
+                ...(order.channelTxnId ? { channelTxnId: order.channelTxnId } : {}),
+            });
+        }
+        return { state: order.state, ...(order.paidAt ? { paidAt: order.paidAt } : {}) };
+    }
+    async function syncOrderStatus(orderId) {
+        const order = store.getOrder(orderId);
+        if (!order)
+            return undefined;
+        const driver = drivers.get(order.driver);
+        if (!driver)
+            return undefined;
+        const status = await driver.queryOrder(orderId);
+        // reconciliation: channel paid & local unpaid → migrate via state machine (amount from order; large-amount audit also applies)
+        if (status.state === 'paid' && order.state === 'created') {
+            const before = order.state;
+            const transition = applyPaidCallback(order.state, order.amount, order.amount, config.auditThreshold);
+            if (transition.state !== before) {
+                order.state = transition.state;
+                if (transition.state === 'paid') {
+                    order.paidAt = new Date().toISOString();
+                }
+                audit({
+                    operation: 'callback',
+                    orderId,
+                    from: before,
+                    to: transition.state,
+                    reason: transition.reason ?? 'sync',
+                    at: Date.now(),
+                });
+                if (transition.state === 'paid') {
+                    void notifyVerified?.({
+                        orderId,
+                        state: 'paid',
+                        ...(order.paidAt ? { paidAt: order.paidAt } : {}),
+                        ...(order.channelTxnId ? { channelTxnId: order.channelTxnId } : {}),
+                    });
+                }
+            }
+        }
+        return { state: order.state, ...(order.paidAt ? { paidAt: order.paidAt } : {}) };
+    }
+    function scanExpiredOrders(ttlMs) {
+        const now = Date.now();
+        const closed = [];
+        for (const order of store.allOrders()) {
+            if (order.state === 'created' && now - order.createdAt >= ttlMs) {
+                const before = order.state;
+                const { state, ok } = applyClose(order.state);
+                if (ok) {
+                    order.state = state;
+                    audit({
+                        operation: 'close',
+                        orderId: order.orderId,
+                        from: before,
+                        to: state,
+                        reason: 'expired',
+                        at: now,
+                    });
+                    closed.push({ orderId: order.orderId, state });
+                }
+            }
+        }
+        return closed;
+    }
+    async function handleCallback(driverName, ctx) {
+        const driver = drivers.get(driverName);
+        if (!driver) {
+            return { ok: false, status: 404, body: { ok: false, error: 'driver_not_found' } };
+        }
+        const timestamp = ctx.headers['x-timestamp'];
+        const nonce = ctx.headers['x-nonce'];
+        const signature = ctx.headers['x-signature'];
+        const isGenericProtocol = Boolean(timestamp && nonce && signature);
+        if (isGenericProtocol) {
+            // generic verification protocol (X-* headers + HMAC-SHA256): for mock/self-built backends
+            const verified = await verifySignedCallback({
+                apiKey,
+                timestamp: timestamp,
+                nonce: nonce,
+                signature: signature,
+                body: ctx.body,
+                ...(config.timeWindowSec !== undefined ? { timeWindowSec: config.timeWindowSec } : {}),
+            });
+            if (!verified.ok) {
+                alert({
+                    level: 'warn',
+                    code: 'verify_failed',
+                    message: verified.reason,
+                    driver: driverName,
+                });
+                return { ok: false, status: 401, body: { ok: false, error: verified.reason } };
+            }
+            // nonce anti-replay (idempotency stops double-booking; nonce stops forged replays)
+            if (!store.addNonce(nonce)) {
+                return { ok: false, status: 401, body: { ok: false, error: 'nonce_reused' } };
+            }
+        }
+        // otherwise: channel self-verification path — real channels (WeChat/Alipay) use their own verification protocol (platform cert/RSA2),
+        // handled internally by driver.verifyCallback (verify/decrypt/anti-replay; the driver holds the store for nonce dedup).
+        // Parse payload:
+        //  - generic protocol path: try JSON.parse (mock path; payload is an object)
+        //  - channel self-verify path: raw body (WeChat callback is outer JSON; Alipay notify is form-encoded),
+        //    parsed + verified (platform cert/RSA2) + anti-replay inside driver.verifyCallback
+        let payload;
+        if (isGenericProtocol) {
+            try {
+                payload = JSON.parse(ctx.body);
+            }
+            catch {
+                payload = ctx.body;
+            }
+        }
+        else {
+            payload = ctx.body;
+        }
+        const callback = driver.verifyCallback(payload, ctx.headers);
+        if (!callback.ok || !callback.orderId || callback.paidAmount === undefined) {
+            return {
+                ok: false,
+                status: 400,
+                body: { ok: false, error: callback.reason ?? 'bad_callback' },
+            };
+        }
+        const order = store.getOrder(callback.orderId);
+        if (!order) {
+            return { ok: false, status: 404, body: { ok: false, error: 'order_not_found' } };
+        }
+        // state machine (amount match / idempotency / closed→frozen / large-amount pending / paid)
+        const before = order.state;
+        const transition = applyPaidCallback(order.state, order.amount, callback.paidAmount, config.auditThreshold);
+        // persist first, then respond (callback response protocol)
+        if (transition.state !== order.state) {
+            order.state = transition.state;
+            if (transition.state === 'paid') {
+                order.paidAt = new Date().toISOString();
+                if (callback.channelTxnId)
+                    order.channelTxnId = callback.channelTxnId;
+            }
+            if (transition.state === 'pending' && transition.reason) {
+                order.auditReason = transition.reason;
+            }
+            audit({
+                operation: transition.state === 'frozen' ? 'freeze' : 'callback',
+                orderId: order.orderId,
+                from: before,
+                to: transition.state,
+                ...(transition.reason ? { reason: transition.reason } : {}),
+                at: Date.now(),
+            });
+        }
+        if (transition.state === 'paid' && !('idempotent' in transition && transition.idempotent)) {
+            void notifyVerified?.({
+                orderId: order.orderId,
+                state: 'paid',
+                ...(order.paidAt ? { paidAt: order.paidAt } : {}),
+                ...(order.channelTxnId ? { channelTxnId: order.channelTxnId } : {}),
+            });
+        }
+        if (transition.state === 'frozen') {
+            alert({
+                level: 'error',
+                code: 'order_frozen',
+                message: transition.reason ?? 'frozen',
+                orderId: order.orderId,
+            });
+        }
+        if (transition.state === 'pending') {
+            alert({
+                level: 'warn',
+                code: 'audit_required',
+                message: 'large amount pending review',
+                orderId: order.orderId,
+            });
+        }
+        const body = { ok: true, orderId: order.orderId, state: order.state };
+        if (transition.reason)
+            body['reason'] = transition.reason;
+        return {
+            ok: true,
+            status: 200,
+            body,
+            orderId: order.orderId,
+            state: order.state,
+            ...(transition.reason ? { reason: transition.reason } : {}),
+            ...(driver.successResponseText ? { text: driver.successResponseText } : {}),
+        };
+    }
+    return {
+        registerDriver(driver) {
+            drivers.set(driver.name, driver);
+        },
+        available: availableDrivers,
+        createOrder,
+        getStatus,
+        close,
+        confirm,
+        syncOrderStatus,
+        scanExpiredOrders,
+        handleCallback,
+        auditLog: () => store.auditLog(),
+    };
+}

package/dist/mock-driver.d.ts

@@ -0,0 +1,22 @@
+/** @license MIT
+ * Copyright (c) 2026 vobsjs
+ * @vobs/payment
+ */
+/**
+ * Mock payment driver — for P0 end-to-end demos and integration.
+ *
+ * - `createOrder`: doesn't call a real channel; returns one-time QR pay params (simulated qrUrl).
+ * - `verifyCallback`: package-level verification is done by PaymentManager (generic HMAC protocol);
+ *   the mock driver's verifyCallback only does **normalization parsing** (body → VerifiedCallback).
+ * - `queryOrder`: reads the store (no real channel state).
+ *
+ * Real channels (wechat_official / alipay_official) are implemented in P1, replacing this with real signing/messages.
+ */
+import type { PaymentDriver } from './types.js';
+import type { PaymentStore } from './store.js';
+export interface MockDriverOptions {
+    readonly name?: string;
+    /** Simulates a channel that always succeeds (default true); set false to demo channel failure. */
+    readonly alwaysSucceed?: boolean;
+}
+export declare function createMockDriver(store: PaymentStore, options?: MockDriverOptions): PaymentDriver;

package/dist/mock-driver.js

@@ -0,0 +1,58 @@
+/** @license MIT
+ * Copyright (c) 2026 vobsjs
+ * @vobs/payment
+ */
+/**
+ * Mock payment driver — for P0 end-to-end demos and integration.
+ *
+ * - `createOrder`: doesn't call a real channel; returns one-time QR pay params (simulated qrUrl).
+ * - `verifyCallback`: package-level verification is done by PaymentManager (generic HMAC protocol);
+ *   the mock driver's verifyCallback only does **normalization parsing** (body → VerifiedCallback).
+ * - `queryOrder`: reads the store (no real channel state).
+ *
+ * Real channels (wechat_official / alipay_official) are implemented in P1, replacing this with real signing/messages.
+ */
+export function createMockDriver(store, options) {
+    const name = options?.name ?? 'mock';
+    const alwaysSucceed = options?.alwaysSucceed ?? true;
+    return {
+        name,
+        scenes: ['pc', 'h5'],
+        createOrder(input) {
+            if (!alwaysSucceed) {
+                return Promise.reject(new Error('channel_unavailable'));
+            }
+            // mock channel: scan scenes return qr; real channels return jsapi/qr/redirect per scene
+            return Promise.resolve({
+                kind: 'qr',
+                qrUrl: `https://pay.example.com/qr/${input.orderId}`,
+                expiresAt: new Date(Date.now() + 5 * 60 * 1000).toISOString(),
+            });
+        },
+        verifyCallback(payload, _headers) {
+            // mock normalization: parse the unified callback body (real channels verify signatures + map fields in their own drivers)
+            const body = payload;
+            const orderId = body['orderId'];
+            const paidAmount = body['paidAmount'];
+            if (typeof orderId !== 'string' || typeof paidAmount !== 'number') {
+                return { ok: false, reason: 'bad_payload' };
+            }
+            return {
+                ok: true,
+                orderId,
+                paidAmount,
+                ...(typeof body['channelTxnId'] === 'string' ? { channelTxnId: body['channelTxnId'] } : {}),
+            };
+        },
+        queryOrder(orderId) {
+            const order = store.getOrder(orderId);
+            if (!order) {
+                return Promise.resolve({ state: 'unknown', raw: { error: 'order_not_found' } });
+            }
+            return Promise.resolve({
+                state: order.state,
+                ...(order.paidAt ? { paidAt: order.paidAt } : {}),
+            });
+        },
+    };
+}

package/dist/state-machine.d.ts

@@ -0,0 +1,41 @@
+/** @license MIT
+ * Copyright (c) 2026 vobsjs
+ * @vobs/payment
+ */
+/**
+ * Order state machine (pure functions, no I/O).
+ *
+ * Transitions (no refund path):
+ *   created ──normal callback──▶ paid            (idempotent: a paid order ignores repeated callbacks)
+ *   created ──close───▶ closed ──callback again──▶ frozen (payment after close = money-losing anomaly, manual review)
+ *   created ──amount mismatch──▶ frozen           (conflict freeze: never auto-book)
+ *   created ──paid ≥ auditThreshold──▶ pending (large amount, manual review)──confirm──▶ paid
+ *   zero-amount orders are paid immediately (no channel)
+ */
+import type { OrderState } from './types.js';
+export type CallbackTransition = {
+    readonly state: OrderState;
+    readonly reason?: string;
+} | {
+    readonly state: 'paid';
+    readonly idempotent: boolean;
+    readonly reason?: string;
+};
+/**
+ * Apply a payment callback to an order.
+ * @param orderState current state
+ * @param orderAmount order amount (fen)
+ * @param paidAmount  channel-paid amount (fen)
+ * @param auditThreshold large-amount audit threshold (fen); absent/0 = no audit
+ */
+export declare function applyPaidCallback(orderState: OrderState, orderAmount: number, paidAmount: number, auditThreshold?: number): CallbackTransition;
+/** Approve a large amount: only pending (audit) → paid. */
+export declare function applyConfirm(orderState: OrderState): {
+    state: OrderState;
+    ok: boolean;
+};
+/** Close on timeout/cancel: only created → closed. */
+export declare function applyClose(orderState: OrderState): {
+    state: OrderState;
+    ok: boolean;
+};

package/dist/state-machine.js

@@ -0,0 +1,60 @@
+/** @license MIT
+ * Copyright (c) 2026 vobsjs
+ * @vobs/payment
+ */
+/**
+ * Order state machine (pure functions, no I/O).
+ *
+ * Transitions (no refund path):
+ *   created ──normal callback──▶ paid            (idempotent: a paid order ignores repeated callbacks)
+ *   created ──close───▶ closed ──callback again──▶ frozen (payment after close = money-losing anomaly, manual review)
+ *   created ──amount mismatch──▶ frozen           (conflict freeze: never auto-book)
+ *   created ──paid ≥ auditThreshold──▶ pending (large amount, manual review)──confirm──▶ paid
+ *   zero-amount orders are paid immediately (no channel)
+ */
+/**
+ * Apply a payment callback to an order.
+ * @param orderState current state
+ * @param orderAmount order amount (fen)
+ * @param paidAmount  channel-paid amount (fen)
+ * @param auditThreshold large-amount audit threshold (fen); absent/0 = no audit
+ */
+export function applyPaidCallback(orderState, orderAmount, paidAmount, auditThreshold) {
+    // freeze on conflict: paid ≠ order amount (security red line, never auto-book; discount net amounts are judged by the channel, differences go through amountTolerance evaluated by the business)
+    if (paidAmount !== orderAmount) {
+        return { state: 'frozen', reason: 'amount_mismatch' };
+    }
+    switch (orderState) {
+        case 'paid':
+            // idempotent: don't book twice (callback retry/redelivery)
+            return { state: 'paid', idempotent: true };
+        case 'closed':
+            // payment after close → anomaly, manual review
+            return { state: 'frozen', reason: 'paid_after_close' };
+        case 'frozen':
+            return { state: 'frozen' };
+        case 'pending':
+            return { state: 'pending' };
+        default: {
+            // created: large amount awaits manual audit (pending = 'unconfirmed': channel delay or audit)
+            if (auditThreshold && auditThreshold > 0 && paidAmount >= auditThreshold) {
+                return { state: 'pending', reason: 'audit' };
+            }
+            return { state: 'paid' };
+        }
+    }
+}
+/** Approve a large amount: only pending (audit) → paid. */
+export function applyConfirm(orderState) {
+    if (orderState === 'pending') {
+        return { state: 'paid', ok: true };
+    }
+    return { state: orderState, ok: false };
+}
+/** Close on timeout/cancel: only created → closed. */
+export function applyClose(orderState) {
+    if (orderState === 'created') {
+        return { state: 'closed', ok: true };
+    }
+    return { state: orderState, ok: false };
+}

package/dist/store.d.ts

@@ -0,0 +1,23 @@
+/** @license MIT
+ * Copyright (c) 2026 vobsjs
+ * @vobs/payment
+ */
+/**
+ * Order storage abstraction (P0 in-memory; for a production DB see the design doc's production checklist:
+ * unique constraints back idempotency, row locks/CAS prevent concurrent double-writes, idempotency records and nonces with TTL).
+ */
+import type { AuditEntry, OrderRecord } from './types.js';
+export interface PaymentStore {
+    getOrder(orderId: string): OrderRecord | undefined;
+    saveOrder(order: OrderRecord): void;
+    /** Iterate all orders (for expiry scans; production implementations should paginate/index). */
+    allOrders(): readonly OrderRecord[];
+    /** nonce dedup (anti-replay): returns true on first use. */
+    addNonce(nonce: string): boolean;
+    getOrderByIdempotencyKey(key: string): string | undefined;
+    setIdempotencyKey(key: string, orderId: string): void;
+    appendAudit(entry: AuditEntry): void;
+    auditLog(): readonly AuditEntry[];
+}
+/** In-memory implementation (single process; use an internal mutex for concurrent safety). */
+export declare function createMemoryStore(): PaymentStore;

package/dist/store.js

@@ -0,0 +1,44 @@
+/** @license MIT
+ * Copyright (c) 2026 vobsjs
+ * @vobs/payment
+ */
+/**
+ * Order storage abstraction (P0 in-memory; for a production DB see the design doc's production checklist:
+ * unique constraints back idempotency, row locks/CAS prevent concurrent double-writes, idempotency records and nonces with TTL).
+ */
+/** In-memory implementation (single process; use an internal mutex for concurrent safety). */
+export function createMemoryStore() {
+    const orders = new Map();
+    const nonces = new Set();
+    const idempotency = new Map();
+    const audit = [];
+    return {
+        getOrder(orderId) {
+            return orders.get(orderId);
+        },
+        saveOrder(order) {
+            orders.set(order.orderId, order);
+        },
+        allOrders() {
+            return Array.from(orders.values());
+        },
+        addNonce(nonce) {
+            if (nonces.has(nonce))
+                return false;
+            nonces.add(nonce);
+            return true;
+        },
+        getOrderByIdempotencyKey(key) {
+            return idempotency.get(key);
+        },
+        setIdempotencyKey(key, orderId) {
+            idempotency.set(key, orderId);
+        },
+        appendAudit(entry) {
+            audit.push(entry);
+        },
+        auditLog() {
+            return audit;
+        },
+    };
+}