;;~ title    "Update a listing"
;;~ author   "lacuna"
;;~ version  1
;;~ mode     automation
;;~ flavor   green
;;~ id       btn-update
;;~ touches  (etsy-listings)
;;~ summary  "Edit fields on an existing listing."

;; Edit fields on an existing listing.
;;
;; Destructive write cart. Action-wrapper shape with the consent gate:
;;   precondition_fetch (ctx has id + payload + operator-confirmed)
;;     -> guard (consent required) -> perform -> result -> on_error.
;; operator_confirmed rides in args so the driver's destructive-verb
;; gate sees it. Rate-limit retries with backoff; auth-stale escalates.
;; State is `perform` (not `act`) so it never shadows the descriptor
;; constructor of the same name in cartPrelude.

(cart 'btn-update
  '((author    . "lacuna")
    (version   . 1)
    (touches   . (etsy-listings))
    (read-only . #f)))

(define (start ctx)
  (let ((id      (ctx-get 'listing-id ctx))
        (fields (ctx-get 'fields ctx))
        (consent (ctx-get 'operator-confirmed ctx)))
    (cond
      ((null? id)        (escalate 'missing-listing-id null))
      ((null? fields)    (escalate 'missing-fields null))
      ((not consent)     (escalate 'consent-required null))
      (else              (next 'perform ctx)))))

(define (perform ctx)
  (let ((id (ctx-get 'listing-id ctx))
        (fields (ctx-get 'fields ctx)))
    (act 'etsy/update-listing
         (list id fields (list 'operator_confirmed #t))
         'check-result)))

(define (check-result ctx)
  (let ((r (ctx-result ctx)))
    (cond
      ((eq? r 'ok)            (done))
      ((eq? r 'rate-limited)  (after 30 'perform ctx))
      ((eq? r 'auth-stale)    (escalate 'auth-relogin null))
      (else                   (escalate 'write-failed r)))))