WEBHOOK_URL='https://api.smokesignal.sh/webhooks/v1/notifications/smk_your_channel_secret'

curl "$WEBHOOK_URL" \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: 78cc7a79-2ab8-4a24-a85c-1973c9c846fa' \
  --data '{
    "title": "Deploy complete",
    "body": "Production is running version 1.8.0.",
    "url": "https://example.com/deployments/418",
    "ttl_seconds": 3600
  }'

CHANNEL_API_KEY='smk_your_channel_secret'

curl 'https://api.smokesignal.sh/api/v1/notifications' \
  --request POST \
  --header "Authorization: Bearer $CHANNEL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: 78cc7a79-2ab8-4a24-a85c-1973c9c846fa' \
  --data '{
    "title": "Approval needed",
    "body": "The release agent is waiting for your decision.",
    "url": "https://example.com/runs/982",
    "ttl_seconds": 900
  }'

CHANNEL_API_KEY='smk_your_channel_secret'

curl 'https://api.smokesignal.sh/api/v1/decisions' \
  --request POST \
  --header "Authorization: Bearer $CHANNEL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $(openssl rand -hex 16)" \
  --data '{
    "question": "Promote build 1.8.0 to production?",
    "detail": "acme/web at 4f2c9ab. Staging is green.",
    "ttl_seconds": 900,
    "actions": [
      { "id": "promote", "label": "Promote" },
      { "id": "hold", "label": "Hold" }
    ]
  }'

# Match this deadline to ttl_seconds used when creating the Decision.
deadline=$(( $(date +%s) + 900 ))
code=202

# 200 carries the answer, 202 means keep waiting, 410 means the Decision is over.
while [ "$code" = 202 ] && [ "$(date +%s)" -lt "$deadline" ]; do
  code=$(curl -sS -o reply.json -w '%{http_code}' \
    "https://api.smokesignal.sh/api/v1/decisions/$DECISION_ID/reply/claim?wait=25" \
    --request POST --connect-timeout 5 --max-time 30 \
    --header "Authorization: Bearer $CHANNEL_API_KEY") || {
      cat reply.json 2>/dev/null || true
      exit 1
    }
  if [ "$code" = 202 ]; then sleep 1; fi
done

if [ "$code" != 200 ]; then
  cat reply.json 2>/dev/null || true
  echo "Decision timed out or ended without an answer." >&2
  exit 1
fi
jq -r .action_id reply.json

# Remote pairing codes have the form RXXXX-XXXXX.
# Normalize the app code: uppercase it, remove the hyphen and ASCII whitespace,
# fold O to 0, and fold I or L to 1.
# DERIVED = PBKDF2-HMAC-SHA256(
#   password=NORMALIZED_CODE,
#   salt="smoke-signal-remote-pairing-v2\0PBKDF2-SHA256",
#   iterations=600000,
#   length=48)
# PAIRING_LOCATOR = base64url(DERIVED[0:32])
# PAIRING_SECRET = DERIVED[32:48]
# Never send PAIRING_CODE or PAIRING_SECRET to the relay.
# HOST_KEY_PROOF = base64url(HMAC-SHA256(
#   PAIRING_SECRET, "smoke-signal-remote-pairing-v2\0host\0" + HOST_PUBLIC_KEY))
# Verify the returned Device key before saving it:
# DEVICE_KEY_PROOF = base64url(HMAC-SHA256(PAIRING_SECRET,
#   "smoke-signal-remote-pairing-v2\0device\0" + ACCOUNT_DEVICE_ID + "\0" +
#   KEY_VERSION + "\0" + DEVICE_PUBLIC_KEY))
curl 'https://api.smokesignal.sh/api/v1/remote-pairing/exchange' \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
    "pairing_locator": "BASE64URL_DERIVED_LOCATOR",
    "host_public_key": "BASE64URL_UNCOMPRESSED_P256_PUBLIC_KEY",
    "host_key_proof": "BASE64URL_HMAC_SHA256"
  }'

HOST_KEY='smb_your_host_key'

# One long-poll cycle: claim, run, ack. Repeat with a pause and a shutdown condition.
curl 'https://api.smokesignal.sh/api/v1/remote-host/commands/claim?wait=25' \
  --header "Authorization: Bearer $HOST_KEY" \
  --header 'X-Smoke-Signal-Host-Epoch: 3'

# 200 -> {"command": {"id", "task_id", "kind", "payload", "lease_generation"}}
# 204 -> nothing queued; pause before polling again

curl "https://api.smokesignal.sh/api/v1/remote-host/commands/${COMMAND_ID}/ack" \
  --request POST \
  --header "Authorization: Bearer $HOST_KEY" \
  --header 'X-Smoke-Signal-Host-Epoch: 3' \
  --header 'Content-Type: application/json' \
  --data '{ "outcome": "applied", "lease_generation": 1 }'