#!/usr/bin/env sh
# Site report with curl: free discovery, refusals before payment, the 402 terms, one paid call, polling.
# Runs against a local dev shop by default (dry mode, mock facilitator: no real money moves).
# For the real shop: SHOP=https://shop.lordevo.com and a funded BUYER_PRIVATE_KEY (USDC on Base), only once the service
# is on sale. Needs: curl, and Node 20+ with @x402/fetch, @x402/evm and viem for the signing step (node/sign-payment.mjs).
# Windows: run it in Git Bash or WSL (the quoting is POSIX shell).
SHOP="${SHOP:-http://127.0.0.1:4999}"
TARGET="${TARGET:-https://lordevo.com}"
BODY='{"url":"'"$TARGET"'","scope":{"max_pages":3,"audience":"agency","brand":{"name":"Your Agency"},"format":"all"},"authorization":{"attested":true,"statement":"I own this website or have written permission from its owner to assess it."}}'

# 1. Free: is it on sale, what does it cost (price_status says whether the price is confirmed), what does it need.
curl -s "$SHOP/services.json"

# 2. Refused BEFORE any payment request, never charged: no authorization statement -> 403 authorization_required.
curl -s -i -X POST "$SHOP/api/svc/site-report/standard" -H 'content-type: application/json' -d '{"url":"'"$TARGET"'"}'

# 3. Invalid input: unknown area -> 402 with input_hint (error bad_areas, field areas). Paid, it would answer 400, not charged.
curl -s -i -X POST "$SHOP/api/svc/site-report/standard" -H 'content-type: application/json' -d '{"url":"'"$TARGET"'","scope":{"areas":["pentest"]},"authorization":{"attested":true,"statement":"I own this website."}}'

# 4. A valid request without payment -> 402 with the x402 terms in the PAYMENT-REQUIRED header (base64 JSON).
curl -s -i -X POST "$SHOP/api/svc/site-report/standard" -H 'content-type: application/json' -d "$BODY"

# 5. Sign the payment for exactly those terms (the helper reads the 402 itself and prints the PAYMENT-SIGNATURE value).
PAYMENT=$(node node/sign-payment.mjs "$SHOP/api/svc/site-report/standard" "$BODY")

# 6. Same request again with the payment. 200 = done (report inline). 202 = running: copy result_url from the JSON.
curl -s -X POST "$SHOP/api/svc/site-report/standard" -H 'content-type: application/json' -H "PAYMENT-SIGNATURE: $PAYMENT" -d "$BODY"

# 7. Poll (free) every 15-30 s until "status" is "done" or "error". RESULT_URL = result_url from step 6.
curl -s "$RESULT_URL"

# 8. The client-ready documents (private links, 30 days): report_html_url and report_markdown_url from the done JSON.
curl -s -o "${OUT_DIR:-.}/report.html" "$REPORT_HTML_URL"
curl -s -o "${OUT_DIR:-.}/report.md" "$REPORT_MARKDOWN_URL"