;;~ title    "Mark order shipped"
;;~ author   "lacuna"
;;~ version  1
;;~ mode     automation
;;~ flavor   green
;;~ id       btn-ship-receipt
;;~ touches  (etsy-receipts)
;;~ summary  "Mark a receipt as shipped with tracking."

;; Mark a receipt as shipped with tracking.
;;
;; Destructive write cart. Action-wrapper shape with the consent gate:
;;   precondition_fetch (ctx has id + payload + operator-confirmed)
;;     -> guard (consent required) -> perform -> result -> on_error.
;; operator_confirmed rides in args so the driver's destructive-verb
;; gate sees it. Rate-limit retries with backoff; auth-stale escalates.
;; State is `perform` (not `act`) so it never shadows the descriptor
;; constructor of the same name in cartPrelude.

(cart 'btn-ship-receipt
  '((author    . "lacuna")
    (version   . 1)
    (touches   . (etsy-receipts))
    (read-only . #f)))

(define (start ctx)
  (let ((id      (ctx-get 'listing-id ctx))
        (tracking (ctx-get 'tracking ctx))
        (consent (ctx-get 'operator-confirmed ctx)))
    (cond
      ((null? id)        (escalate 'missing-listing-id null))
      ((null? tracking)    (escalate 'missing-tracking null))
      ((not consent)     (escalate 'consent-required null))
      (else              (next 'perform ctx)))))

(define (perform ctx)
  (let ((id (ctx-get 'listing-id ctx))
        (tracking (ctx-get 'tracking ctx)))
    (act 'etsy/mark-shipped
         (list id tracking (list 'operator_confirmed #t))
         'check-result)))

(define (check-result ctx)
  (let ((r (ctx-result ctx)))
    (cond
      ((eq? r 'ok)            (done))
      ((eq? r 'rate-limited)  (after 30 'perform ctx))
      ((eq? r 'auth-stale)    (escalate 'auth-relogin null))
      (else                   (escalate 'write-failed r)))))