;;~ title    "Disconnect shop"
;;~ author   "lacuna"
;;~ version  1
;;~ mode     automation
;;~ flavor   green
;;~ id       btn-disconnect
;;~ touches  (etsy-shop etsy-listings)
;;~ summary  "Remove the Etsy OAuth grant."

;; Remove the Etsy OAuth grant.
;;
;; Destructive write cart. Action-wrapper shape with the consent gate:
;;   precondition_fetch (ctx has id + payload + operator-confirmed)
;;     -> guard (consent required) -> perform -> result -> on_error.
;; operator_confirmed rides in args so the driver's destructive-verb
;; gate sees it. Rate-limit retries with backoff; auth-stale escalates.
;; State is `perform` (not `act`) so it never shadows the descriptor
;; constructor of the same name in cartPrelude.

(cart 'btn-disconnect
  '((author    . "lacuna")
    (version   . 1)
    (touches   . (etsy-shop etsy-listings))
    (read-only . #f)))

(define (start ctx)
  (let ((consent (ctx-get 'operator-confirmed ctx)))
    (if (not consent)
        (escalate 'consent-required null)
        (next 'perform ctx))))

(define (perform ctx)
  (act 'etsy/disconnect
       (list (list 'operator_confirmed #t))
       'check-result))

(define (check-result ctx)
  (let ((r (ctx-result ctx)))
    (cond
      ((eq? r 'ok)            (done))
      ((eq? r 'rate-limited)  (after 30 'perform ctx))
      ((eq? r 'auth-stale)    (escalate 'auth-relogin null))
      (else                   (escalate 'write-failed r)))))