Agents that never fail.
Policies that never bend.

export const Orders = defineAgent({
  name: 'Orders',
  id: { customerId: z.string() },
  http: http.mount('/orders/{customerId}'),
  config: { systemPrompt: z.string() },
  methods: {
    handle: method({
      input: { request: z.string(), orderId: z.string() },
      returns: z.object({ resolved: z.boolean() }),
    }),
  },
})

export const OrdersImpl = Orders.implement({
  init: () => ({ history: [] as Message[] }),
  methods: {
    async handle({ request, orderId }) {
      // No DB writes — this push survives crashes, deploys, host migrations
      this.history.push({ role: 'user', content: request })

      // LLM sees full conversation; system prompt comes from typed config
      const outcome = await llm.run({
        prompt: this.config.systemPrompt, history: this.history,
        tools: [cancelOrder, changeAddress], context: { orderId },
      })
      this.history.push({ role: 'assistant', content: outcome.message })

      // Refunds aren't in the LLM's toolset — agent code gates them via HITL
      if (outcome.needsRefund) {
        // This await can sit for days at zero cost — no queue, no cron, no state table
        const webhook = createWebhook()
        await notifyApprover(webhook.getUrl(), outcome)
        const { approved } = (await webhook).json()
        if (approved) {
          // Crash, retry, restart — still one charge. No silent double-charges.
          const result = await refundOrder({ orderId, amount: outcome.refundAmount })
          this.history.push({ role: 'tool', content: JSON.stringify(result) })
        }
      }
      return { resolved: true }
    },
  },
})

class OrdersConfig extends defineConfig("Orders.Config", {
  systemPrompt: Schema.String,
}) {}

export const Orders = defineAgent({
  name: "Orders",
  id: { customerId: Schema.String },
  http: Http.mount("/orders/{customerId}"),
  config: OrdersConfig,
  methods: {
    handle: method({
      input: { request: Schema.String, orderId: Schema.String },
      success: Schema.Struct({ resolved: Schema.Boolean }),
    }),
  },
}).implement<Ref.Ref<Message[]>>({
  init: () => Ref.make<Message[]>([]),
  methods: (history) => ({
    handle: ({ request, orderId }) =>
      Effect.gen(function* () {
        // No DB writes — this update survives crashes, deploys, host migrations
        yield* Ref.update(history, (h) => [...h, { role: "user", content: request }])

        // LLM sees full conversation; system prompt comes from typed config
        const config = yield* OrdersConfig
        const outcome = yield* llm.run({
          prompt: yield* config.systemPrompt, history: yield* Ref.get(history),
          tools: [cancelOrder, changeAddress], context: { orderId },
        })
        yield* Ref.update(history, (h) => [...h, { role: "assistant", content: outcome.message }])

        // Refunds aren't in the LLM's toolset — agent code gates them via HITL
        if (outcome.needsRefund) {
          // This await can sit for days at zero cost — no queue, no cron, no state table
          const webhook = yield* Webhook.create
          yield* notifyApprover(webhook.url, outcome)
          const { approved } = yield* (yield* webhook.await).decode(Approval)
          if (approved) {
            // Crash, retry, restart — still one charge. No silent double-charges.
            const result = yield* refundOrder({ orderId, amount: outcome.refundAmount })
            yield* Ref.update(history, (h) => [...h, { role: "tool", content: JSON.stringify(result) }])
          }
        }
        return { resolved: true }
      }),
  }),
})

#[derive(ConfigSchema)]
pub struct OrdersConfig { pub system_prompt: String }

#[agent_definition(mount = "/orders/{customer_id}")]
pub trait Orders {
    fn new(customer_id: String, #[agent_config] config: Config<OrdersConfig>) -> Self;
    async fn handle(&mut self, request: String, order_id: String) -> bool;
}

struct OrdersImpl { config: Config<OrdersConfig>, history: Vec<Message> }

#[agent_implementation]
impl Orders for OrdersImpl {
    fn new(_customer_id: String, #[agent_config] config: Config<OrdersConfig>) -> Self {
        Self { config, history: Vec::new() }
    }

    async fn handle(&mut self, request: String, order_id: String) -> bool {
        // No DB writes — this push survives crashes, deploys, host migrations
        self.history.push(Message::user(request));

        // LLM sees full conversation; system prompt comes from typed config
        let system_prompt = self.config.get().expect("config").system_prompt;
        let outcome = llm::run(
            &system_prompt, &self.history,
            vec![cancel_order(), change_address()], order_id.clone(),
        ).await;
        self.history.push(Message::assistant(outcome.message.clone()));

        // Refunds aren't in the LLM's toolset — agent code gates them via HITL
        if outcome.needs_refund {
            // This await can sit for days at zero cost — no queue, no cron, no state table
            let webhook = create_webhook().expect("webhook");
            notify_approver(webhook.url(), &outcome).await;
            let approval: Approval = webhook.await.json().expect("approval");
            if approval.approved {
                // Crash, retry, restart — still one charge. No silent double-charges.
                let result = refund_order(order_id, outcome.refund_amount).await;
                self.history.push(Message::tool(result.to_string()));
            }
        }
        true
    }
}

type ID struct{ Customer string }
type Config struct{ SystemPrompt string }
type HandleIn struct{ Request, OrderID string }

var Orders = golem.DefineConfiguredAgent[ID, Config](golem.Spec{
	Name: "Orders",
	HTTP: &golem.Mount{Path: "/orders/{customer}"},
})

var Handle = Orders.Method[HandleIn, bool]("handle")

type state struct{ history []Message }

func (s *state) add(role, content string) {
	s.history = append(s.history, Message{role, content})
}

var agent = Orders.Implement(func(ID) *state { return &state{} })

func init() {
	agent.Handle(Handle, func(ctx *golem.Context[state], in HandleIn) bool {
		// No DB writes — this append survives crashes, deploys, host migrations
		ctx.State.add("user", in.Request)

		// LLM sees full conversation; system prompt comes from typed config
		outcome := llm.Run(ctx.Config(Orders).SystemPrompt, ctx.State.history,
			[]Tool{cancelOrder, changeAddress}, in.OrderID)
		ctx.State.add("assistant", outcome.Message)

		// Refunds aren't in the LLM's toolset — agent code gates them via HITL
		if outcome.NeedsRefund {
			// This await can sit for days at zero cost — no queue, no cron, no state table
			webhook := golem.NewWebhook[Approval]()
			notifyApprover(webhook.URL(), outcome)
			if webhook.MustAwait().Approved {
				// Crash, retry, restart — still one charge. No silent double-charges.
				result := refundOrder(in.OrderID, outcome.RefundAmount)
				ctx.State.add("tool", result.String())
			}
		}
		return true
	})
}

final case class OrdersConfig(systemPrompt: String) derives Schema

@agentDefinition(mount = "/orders/{customerId}")
trait Orders extends BaseAgent with AgentConfig[OrdersConfig]:
  class Id(val customerId: String)
  def handle(request: String, orderId: String): Future[Boolean]

@agentImplementation()
final class OrdersImpl(customerId: String, config: Config[OrdersConfig]) extends Orders:
  private var history: Vector[Message] = Vector.empty

  override def handle(request: String, orderId: String): Future[Boolean] =
    // No DB writes — this append survives crashes, deploys, host migrations
    history = history :+ Message("user", request)

    for
      // LLM sees full conversation; system prompt comes from typed config
      outcome <- llm.run(
        prompt = config.value.systemPrompt, history = history,
        tools = Seq(cancelOrder, changeAddress), context = Map("orderId" -> orderId))
      _ = history = history :+ Message("assistant", outcome.message)

      // Refunds aren't in the LLM's toolset — agent code gates them via HITL.
      // This await can sit for days at zero cost — no queue, no cron, no state table
      approved <-
        if outcome.needsRefund then awaitApproval(HostApi.createWebhook(), outcome)
        else Future.successful(false)

      // Crash, retry, restart — still one charge. No silent double-charges.
      _ <-
        if approved then refundOrder(orderId, outcome.refundAmount)
          .map(result => history = history :+ Message("tool", result.toString))
        else Future.unit
    yield true

#derive.config
pub(all) struct OrdersConfig { system_prompt : String }

#derive.agent
#derive.mount("/orders/{customer_id}")
struct Orders {
  config : @config.Config[OrdersConfig]
  mut history : Array[Message]
}

fn Orders::new(customer_id : String, config : @config.Config[OrdersConfig]) -> Orders {
  let _ = customer_id
  { config, history: [] }
}

pub async fn Orders::handle(self : Self, request : String, order_id : String) -> Bool {
  // No DB writes — this push survives crashes, deploys, host migrations
  self.history.push({ role: "user", content: request })

  // LLM sees full conversation; system prompt comes from typed config
  let outcome = @llm.run(
    prompt = self.config.value.system_prompt, history = self.history,
    tools = [cancel_order(), change_address()], context = { "order_id": order_id },
  )
  self.history.push({ role: "assistant", content: outcome.message })

  // Refunds aren't in the LLM's toolset — agent code gates them via HITL
  if outcome.needs_refund {
    // This await can sit for days at zero cost — no queue, no cron, no state table
    let webhook = @webhook.create()
    notify_approver(webhook.url(), outcome)
    if webhook.wait().text() == "approved" {
      // Crash, retry, restart — still one charge. No silent double-charges.
      let result = refund_order(order_id, outcome.refund_amount)
      self.history.push({ role: "tool", content: result.to_json().stringify() })
    }
  }
  true
}