import { defineMutation } from '@voltro/protocol'
import { Schema } from 'effect'

export const fulfillOrder = defineMutation({
  name:   'orders.fulfill',
  target: { table: 'orders', op: 'insert' },
  // Open — and unlike a plain insert, this one FANS OUT: on commit it emits
  // `order.completed` to every subscribed target, so an unguarded call makes
  // this server POST to third parties. Two things bound that today and both are
  // checkable: the emit is post-commit (a rollback ships nothing), and the
  // target list is empty until someone calls `ctx.webhooks.subscribe`, which is
  // not reachable from this procedure.
  //
  // No auth strategy and no rbac ship in this template, so a
  // `guards: [{ scope: 'orders:write' }]` would deny every caller instead of
  // the wrong ones. Add an identity, then that guard — before real subscribers
  // exist. (The INCOMING `orders` webhook is a different door with its own
  // control: an HMAC signature over `<unix>.<rawBody>`, not this decision.)
  openAccess:
    'inserts an order from caller-supplied fields into the request\'s tenant, then emits '
    + '`order.completed` post-commit. The emit reaches only targets someone registered via '
    + '`ctx.webhooks.subscribe` — none by default — so guard this before subscribers exist.',
  input:  Schema.Struct({ sku: Schema.NonEmptyString, totalCents: Schema.Number }),
  output: Schema.Struct({
    id:         Schema.String,
    sku:        Schema.String,
    totalCents: Schema.Number,
    status:     Schema.String,
    tenantId:   Schema.String,
  }),
})