#!/usr/bin/env bash
# REST API v1 with curl and jq: who am I, open a tab, read it, take a screenshot, close it.
#   WEBPILOT_URL=http://localhost:8931 WEBPILOT_TOKEN=cbu_... bash examples/curl/rest.sh [url]
# Every response carries X-Request-Id; errors are {"error": {"code", "message", "hint"?, "details"?, "request_id"}}.
# The contract: api/openapi.yaml (OpenAPI 3.1).
set -euo pipefail
: "${WEBPILOT_URL:=http://localhost:8931}"
: "${WEBPILOT_TOKEN:?set WEBPILOT_TOKEN to your cbu_ token}"
URL=${1:-https://example.com}
api() { curl -sS --fail-with-body -H "Authorization: Bearer $WEBPILOT_TOKEN" "$@"; }

echo "--- me"
api "$WEBPILOT_URL/v1/me" | jq '{user_id, server_version, browser: .browser.state}'

echo "--- open a read tab (it can look, never write)"
TAB=$(api -X POST "$WEBPILOT_URL/v1/tabs" -H "content-type: application/json" \
  -d "{\"url\": \"$URL\", \"mode\": \"read\"}" | jq -r .id)
echo "tab $TAB"

echo "--- snapshot: interactive elements with refs (e1, e2…) to act on"
api "$WEBPILOT_URL/v1/tabs/$TAB/snapshot" | jq -r '.title, (.elements[:8][] | "  \(.ref) \(.role) \(.name)")'

echo "--- rendered text (untrusted page content)"
api "$WEBPILOT_URL/v1/tabs/$TAB/text" | jq -r .text | head -c 600; echo

echo "--- screenshot"
api "$WEBPILOT_URL/v1/tabs/$TAB/screenshot?format=png" -o page.png && echo "saved page.png"

echo "--- close the tab (tabs outlive the request: close the ones you open)"
api -X DELETE "$WEBPILOT_URL/v1/tabs/$TAB" -o /dev/null -w "HTTP %{http_code}\n"