The restrictions
are the point.

// `@order.placed` carries data for two different subjects: the customer and the shop.
// Per-field subjects (rather than scoping the whole event to one) let each be erased
// independently: shredding the customer leaves the shop's order record intact, and
// shredding the shop never touches the customer's personal fields.
//
// The customer's two fields are optional, and that is load-bearing rather than
// incidental. An erased subject's column reads back absent, so the type has to admit
// absence for erasure to be observable through a read model at all.

event @order.placed {
  order_id: Uuid,
  // Subject ids stay plaintext: they are how the runtime finds the key.
  customer_id: Int,
  shop_id: Int,
  // Personal, scoped to the customer.
  email: String? @subject(customer_id) @max(200),
  shipping_address: String? @subject(customer_id) @max(200),
  // The shop's commercial figure, scoped to the shop.
  order_total: Money(2) @subject(shop_id),
  // Free text nobody queries: opt out of tagging, and of being a huge tag.
  notes: String @no_index @max(500),
}

refusal SoldOut "this shop's launch allocation is gone"

command PlaceOrder(
  order_id: Uuid,
  customer_id: Int,
  shop_id: Int,
  email: String?,
  shipping_address: String?,
  order_total: Money(2),
  notes: String,
) {
  // Narrow: this one order. A caller retrying the same `order_id` is a no-op rather
  // than a second order.
  fold placed: Bool = false
    on @order.placed(order_id) => true

  // Wide on purpose: an allocation is a rule about every order in the shop, so every
  // order in a shop conflicts with every other. That is what a hard cap costs, and the
  // retry loop is what absorbs it.
  fold sold: Int = 0
    on @order.placed(shop_id) => sold + 1

  if placed {
    return
  }
  if sold >= LAUNCH_ALLOCATION {
    return reject SoldOut
  }

  emit @order.placed {
    order_id,
    customer_id,
    shop_id,
    email,
    shipping_address,
    order_total,
    notes,
  }
}

// Orders by id. The customer's personal columns receive sealed content, so the seal
// propagates onto them and the projector stores ciphertext without ever handling
// plaintext; the read API decrypts on the way out.
//
// `GET /read/CustomerOrders/Order/{order_id}` returns one order with the personal
// fields decrypted. After `hekla erase customer_id <id>` those two columns read back
// absent while the row and its plaintext `customer_id` remain, which is what a
// per-field subject buys: the shop's `order_total` is scoped to a different key and is
// untouched, though this read model does not carry it.

projector CustomerOrders {
  entity Order {
    order_id: Uuid @key,
    customer_id: Int @index,
    email: String? @max(200),
    shipping_address: String? @max(200),
  }

  on @order.placed { order_id, customer_id, email, shipping_address } {
    put Order { order_id, customer_id, email, shipping_address }
  }
}

effect NotifyCustomer {
  on @order.placed as e { order_id, @key customer_id, email } {
    // Inclusive of the triggering event, so a customer's first order leaves this at 1.
    fold orders: Int = 0
      on @order.placed(customer_id) => orders + 1

    if email.is_none() {
      log("order {order_id} has no address to confirm to")
      return
    }

    let response = http.post(
      "https://mail.example/confirm",
      {
        "to": reveal(email),
        "order_id": order_id,
        "first_order": orders == 1,
      },
    )
    if response.status >= 400 {
      log("confirmation rejected with status {response.status}")
    }
  }
}

// The narrow slice. A caller retrying the same order writes nothing rather than a
// second order, and says so by succeeding.
test "a repeat of the same order writes nothing" {
  given @order.placed {
    order_id: "11111111-1111-1111-1111-111111111111",
    customer_id: 7,
    shop_id: 1,
    email: "ada@example.com",
    shipping_address: "1 High St",
    order_total: 25.99,
    notes: "",
  }
  run PlaceOrder {
    order_id: "11111111-1111-1111-1111-111111111111",
    customer_id: 7,
    shop_id: 1,
    email: "ada@example.com",
    shipping_address: "1 High St",
    order_total: 25.99,
    notes: "",
  }
  expect nothing
}