# Catalog declaration for the `send_email_notification` operation —
# kind = 'Sidecar. Demonstrates ADR-030 mechanism #6
# (SidecarProcessWithSharedDomainLibrary).
#
# The main ontoref daemon proxies POST /ops/send_email_notification to
# the project's sidecar at the declared endpoint. The sidecar performs
# the actual mail dispatch; the daemon signs the sidecar's response
# envelope as the witness.

let s = import "../../schema-future.ncl" in

(
  {
    id          = "send_email_notification",
    description = "Dispatch a transactional email via the project's mail-sidecar; records the message id in the notification ledger.",
    kind        = 'Sidecar,

    body = {
      endpoint   = "http://127.0.0.1:7902/ops/send_email_notification",
      timeout_ms = 8000,
      # auth_token defaults to "<from .ontoref/config.ncl::ops.sidecar_token>"
    },

    inputs = {
      recipient = "String",
      subject   = "String",
      body      = "String",
      template  = "String",
    },

    constraints = {
      # ondaod-pre REQUIRED for non-Rust kinds per ADR-034 Hard
      # constraint `non-rust-kinds-require-ondaod-pre`. The host runtime
      # invokes evaluate_ondaod BEFORE proxying the dispatch to the
      # sidecar — the sidecar process cannot itself satisfy the
      # ondaod-discipline check.
      pre    = ["evaluate_ondaod", "recipient_is_authorised", "template_exists"],
      inline = [],
      post   = ["delivery_attempt_recorded"],
    },

    validation_sla = 'Synchronous,

    effects = [
      {
        kind       = 'Insert,
        entity     = "NotificationLedgerEntry",
        attrs      = ["message_id", "recipient", "status", "timestamp"],
        dimensions = [],
      },
    ],

    # Witness honesty: payload_kind explicitly names the sidecar
    # boundary so external verifiers know the signature attests
    # the daemon's faithful proxying, NOT the sidecar's internal
    # computation. ADR-034 constraint
    # `witness-shape-attests-only-host-observable-state`.
    witness_shape = {
      payload_kind = "sidecar_response_envelope",
      proof_paths  = ["notification_ledger/<message_id>"],
      signature    = { actor_id = "developer", algorithm = "Ed25519" },
    },

    actor_policy = { roles = ["admin", "service-account"] },

    render_paths = [],
  } | s.OperationDecl | s.OndaodPreRequired
)
