/**
 * {{titleCase name}} — External-Service Pattern Application
 *
 * Declares a third-party vendor as a first-class ExternalService: the
 * platform owns the credential SHELL (Secrets Manager path + schema + Hub
 * registration + health probe); real values are set out-of-band with
 * `mesh secrets set external/vendorpay` (or the Hub UI) and the app resolves
 * them at RUNTIME — credentials never touch code, config files, or Pulumi
 * state.
 *
 * Dev mode:  mesh dev --externals   (starts mocks/vendorpay and points the
 *                                    credential secret at it — same runtime path)
 * Deploy:    mesh deploy up
 */

import * as pulumi from "@pulumi/pulumi";
import * as path from "node:path";
import { fileURLToPath } from "node:url";
import { mesh } from "@mesh-tech/app-kit/infra";

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const { tenant, platform, stack, deploy } = mesh.apps.getConfig(pulumi);

// --- Environment ---

const env = new mesh.apps.AppEnvironment("env", {
  tenant,
  platform,
  stack,
  deploy,
  appName: "{{name}}",
  namespace: true,
  rootDir: __dirname,
});

// --- External service (the vendor) ---
// Registers in the Hub's external-services view, creates the credential
// shell at mesh/{tenant}/{stage}/external/vendorpay, and (deployed) probes
// the vendor's health endpoint.

const vendorpay = new mesh.apps.ExternalService("vendorpay", {
  env,
  type: "payment",
  kind: "connection",
  description: "Example payments vendor (quotes API) — the external-service pattern",
  credentials: {
    fields: {
      baseUrl: { name: "Base URL", description: "Vendor API endpoint" },
      apiKey: { name: "API Key", description: "Vendor API key", secret: true },
    },
  },
  healthCheck: {
    // Replace with the vendor's real health/status URL.
    url: "https://status.vendorpay.example.com/health",
    intervalSeconds: 300,
  },
});

// --- Services ---

const api = new mesh.apps.Service("api", {
  env,
  runtime: "node",
  src: "./api",
  port: 3000,
  // link() injects VENDORPAY_SECRET_PREFIX + the IAM permission to read the
  // credential secret; the api calls resolveCredentials("vendorpay") at
  // runtime.
  link: [vendorpay.link()],
  ingress: env.buildIngress({
    subdomain: "{{name}}-api",
    healthCheckPath: "/health",
  }),
  replicas: 1,
  resources: { cpu: "100m", memory: "128Mi" },
});

// --- Outputs ---

export const app = env.register({
  description: "{{titleCase name}} — external-service (vendor credentials) pattern",
});