// Reads are guarded too. A write-only authorization model is the quiet half
// of a leak: the data still goes out, just without anyone writing it.
//
// `guards:` on a QUERY is enforced when the subscription opens AND re-checked
// on every delivery — so a caller whose role is revoked mid-subscription stops
// receiving rows rather than keeping a live feed open on an expired grant.

import { defineQuery } from '@voltro/protocol'
import { Schema } from 'effect'

export const listNotes = defineQuery({
  name:   'notes.list',
  source: 'notes',
  // Declarative — the framework enforces it, and `voltro check` can SEE it.
  // No `error: ScopeError` needed: declaring `guards:` merges `ScopeError`
  // into the descriptor's error union automatically.
  guards: [{ scope: 'notes:read' }],
  input:  Schema.Struct({}),
  output: Schema.Array(Schema.Struct({
    id:       Schema.String,
    title:    Schema.String,
    body:     Schema.String,
    archived: Schema.Boolean,
    tenantId: Schema.String,
  })),
})