// Streaming subscription: every change to `documents` for the caller's tenant
// lands as a delta — including the MERGED `body` after any client's CRDT write.
// The runtime AND-merges tenant scope into the predicate via the `tenant()`
// mixin on the table, so no manual `eq('tenantId', ...)` is needed.
//
// `body` crosses the wire as base64 (`Schema.Uint8ArrayFromBase64` — JSON-safe,
// unlike raw bytes) and the rpc client decodes it back to a `Uint8Array`; the
// web client then folds it into its local CRDT handle to converge.

import { defineQuery } from '@voltro/protocol'
import { Schema } from 'effect'

export const listDocuments = defineQuery({
  name: 'documents.list',
  // Open: `tenant()` confines every delivery to the tenantId on the request, so
  // one tenant's CRDT state never reaches another's subscription — but this
  // template configures no auth strategy, so that tenantId is the caller's own
  // `x-tenant` header. It shapes the feed; it does not authorize the caller.
  // A `guards: [{ scope }]` would be unsatisfiable here (an anonymous Subject
  // holds no scopes) and would deny 100% of traffic instead of some of it.
  openAccess:
    'streams the documents of the request\'s tenant, CRDT body included (`tenant()` scopes '
    + 'every delivery). No auth strategy ships here, so the tenant comes from the caller\'s own '
    + '`x-tenant` header — add a strategy, then a `guards:`.',
  input: Schema.Struct({}),
  output: Schema.Array(
    Schema.Struct({
      id: Schema.String,
      title: Schema.String,
      body: Schema.NullOr(Schema.Uint8ArrayFromBase64),
      tenantId: Schema.String,
      createdAt: Schema.Date,
    }),
  ),
})